@rynfar/meridian 1.64.0 → 1.65.0

package/dist/{cli-pbvm9kc2.js → cli-n8t34zmq.js}

@@ -1,5 +1,6 @@
 import {
   __commonJS,
+  __esm,
   __require,
   __toESM
 } from "./cli-p9swy5t3.js";
@@ -460,11 +461,185 @@ var require_cross_spawn = __commonJS((exports, module) => {
   module.exports._enoent = enoent;
 });
 
+// src/proxy/priorityAttestation.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+function configDirectory() {
+  return process.env.MERIDIAN_CONFIG_DIR ?? join(homedir(), ".config", "meridian");
+}
+function priorityAttestationKeyPath() {
+  return join(configDirectory(), PRIORITY_ATTESTATION_KEY_FILE);
+}
+function decodeCanonicalBase64Url(raw) {
+  if (!/^[A-Za-z0-9_-]+$/.test(raw))
+    return;
+  const decoded = Buffer.from(raw, "base64url");
+  return decoded.toString("base64url") === raw ? decoded : undefined;
+}
+function decodePriorityAttestationKey(raw) {
+  if (raw === undefined)
+    return;
+  const decoded = decodeCanonicalBase64Url(raw.trim());
+  return decoded?.length === 32 ? decoded : undefined;
+}
+function loadPriorityAttestationKey() {
+  const fromEnv = process.env[PRIORITY_ATTESTATION_KEY_ENV];
+  if (fromEnv !== undefined)
+    return decodePriorityAttestationKey(fromEnv);
+  try {
+    return decodePriorityAttestationKey(readFileSync(priorityAttestationKeyPath(), "utf8"));
+  } catch {
+    return;
+  }
+}
+function readRequiredFileKey(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    throw new InvalidPriorityAttestationKeyError(path);
+  }
+  const key = decodePriorityAttestationKey(raw);
+  if (!key)
+    throw new InvalidPriorityAttestationKeyError(path);
+  return key;
+}
+function ensurePriorityAttestationKey() {
+  const fromEnv = process.env[PRIORITY_ATTESTATION_KEY_ENV];
+  if (fromEnv !== undefined) {
+    const key2 = decodePriorityAttestationKey(fromEnv);
+    if (!key2)
+      throw new InvalidPriorityAttestationKeyError(PRIORITY_ATTESTATION_KEY_ENV);
+    return { key: key2 };
+  }
+  const path = priorityAttestationKeyPath();
+  try {
+    const key2 = readRequiredFileKey(path);
+    if (platform() !== "win32")
+      chmodSync(path, 384);
+    return { key: key2, path };
+  } catch (error) {
+    if (!(error instanceof InvalidPriorityAttestationKeyError))
+      throw error;
+    try {
+      readFileSync(path);
+      throw error;
+    } catch (readError) {
+      if (readError === error)
+        throw error;
+    }
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  const encoded = randomBytes(32).toString("base64url");
+  try {
+    writeFileSync(path, `${encoded}
+`, { encoding: "utf8", flag: "wx", mode: 384 });
+  } catch (error) {
+    const code = typeof error === "object" && error !== null ? Reflect.get(error, "code") : undefined;
+    if (code !== "EEXIST")
+      throw error;
+  }
+  const key = readRequiredFileKey(path);
+  if (platform() !== "win32")
+    chmodSync(path, 384);
+  return { key, path };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeAgentId(value) {
+  return value.length >= 1 && value.length <= 64 && value.trim() === value && /^[\x20-\x7E]+$/.test(value);
+}
+function parseCanonicalPayload(raw) {
+  if (Buffer.byteLength(raw) > MAX_PAYLOAD_BYTES)
+    return;
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  if (!isRecord(value))
+    return;
+  if (Object.keys(value).join(",") !== "v,g,s,a,t,iat")
+    return;
+  if (value.v !== 1)
+    return;
+  if (value.g !== "oc1" && value.g !== "oc2b18314")
+    return;
+  if (typeof value.s !== "string" || !SAFE_ID_PATTERN.test(value.s))
+    return;
+  if (typeof value.a !== "string" || !isSafeAgentId(value.a))
+    return;
+  if (typeof value.t !== "string" || !TURN_DIGEST_PATTERN.test(value.t))
+    return;
+  if (typeof value.iat !== "number" || !Number.isSafeInteger(value.iat) || value.iat < 0)
+    return;
+  const canonical = JSON.stringify({
+    v: 1,
+    g: value.g,
+    s: value.s,
+    a: value.a,
+    t: value.t,
+    iat: value.iat
+  });
+  if (canonical !== raw)
+    return;
+  return {
+    generation: value.g,
+    sessionId: value.s,
+    agentId: value.a,
+    turnId: value.t,
+    issuedAt: value.iat
+  };
+}
+function verifyPriorityAttestation(token, key = loadPriorityAttestationKey() ?? Buffer.alloc(0), nowSeconds = Math.floor(Date.now() / 1000)) {
+  if (!token || key.length !== 32 || Buffer.byteLength(token) > MAX_HEADER_BYTES)
+    return;
+  const match = TOKEN_PATTERN.exec(token);
+  if (!match?.[1] || !match[2])
+    return;
+  const payloadBytes = decodeCanonicalBase64Url(match[1]);
+  const suppliedMac = decodeCanonicalBase64Url(match[2]);
+  if (!payloadBytes || !suppliedMac || suppliedMac.length !== 32)
+    return;
+  const payloadRaw = payloadBytes.toString("utf8");
+  if (Buffer.from(payloadRaw, "utf8").compare(payloadBytes) !== 0)
+    return;
+  const payload = parseCanonicalPayload(payloadRaw);
+  if (!payload)
+    return;
+  if (payload.issuedAt < nowSeconds - MAX_PAST_AGE_SECONDS)
+    return;
+  if (payload.issuedAt > nowSeconds + MAX_FUTURE_SKEW_SECONDS)
+    return;
+  const expectedMac = createHmac("sha256", key).update(MAC_DOMAIN).update(payloadRaw).digest();
+  if (!timingSafeEqual(expectedMac, suppliedMac))
+    return;
+  return payload;
+}
+var PRIORITY_ATTESTATION_HEADER = "x-meridian-opencode-turn", PRIORITY_ATTESTATION_KEY_ENV = "MERIDIAN_OPENCODE_ATTESTATION_KEY", PRIORITY_ATTESTATION_KEY_FILE = "opencode-turn.key", TOKEN_PATTERN, MAC_DOMAIN = "meridian.opencode.turn.v1\x00", MAX_HEADER_BYTES = 768, MAX_PAYLOAD_BYTES = 384, MAX_PAST_AGE_SECONDS = 120, MAX_FUTURE_SKEW_SECONDS = 30, SAFE_ID_PATTERN, TURN_DIGEST_PATTERN, InvalidPriorityAttestationKeyError;
+var init_priorityAttestation = __esm(() => {
+  TOKEN_PATTERN = /^v1\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/;
+  SAFE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+  TURN_DIGEST_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+  InvalidPriorityAttestationKeyError = class InvalidPriorityAttestationKeyError extends Error {
+    keyPath;
+    constructor(keyPath) {
+      super(`OpenCode routing attestation key is invalid at ${keyPath}`);
+      this.keyPath = keyPath;
+      this.name = "InvalidPriorityAttestationKeyError";
+    }
+  };
+});
+
 // src/proxy/setup.ts
 var import_cross_spawn = __toESM(require_cross_spawn(), 1);
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir, platform } from "os";
-import { basename, dirname, join } from "path";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2, platform as platform2 } from "os";
+import { basename, dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
 import { applyEdits, modify, parse as parseJsonc } from "jsonc-parser";
 
@@ -534,6 +709,8 @@ class LRUMap {
 }
 
 // src/proxy/setup.ts
+init_priorityAttestation();
+
 class UnparseableConfigError extends Error {
   configPath;
   constructor(configPath) {
@@ -574,40 +751,40 @@ function opencodeConfigDirectory() {
   if (process.env.OPENCODE_CONFIG_DIR)
     return process.env.OPENCODE_CONFIG_DIR;
   if (process.env.XDG_CONFIG_HOME)
-    return join(process.env.XDG_CONFIG_HOME, "opencode");
-  if (platform() === "win32" && process.env.APPDATA)
-    return join(process.env.APPDATA, "opencode");
-  return join(homedir(), ".config", "opencode");
+    return join2(process.env.XDG_CONFIG_HOME, "opencode");
+  if (platform2() === "win32" && process.env.APPDATA)
+    return join2(process.env.APPDATA, "opencode");
+  return join2(homedir2(), ".config", "opencode");
 }
 function findOpencodeConfigPath() {
   const dir = opencodeConfigDirectory();
-  const jsonPath = join(dir, "opencode.json");
-  const jsoncPath = join(dir, "opencode.jsonc");
+  const jsonPath = join2(dir, "opencode.json");
+  const jsoncPath = join2(dir, "opencode.jsonc");
   return !existsSync(jsonPath) && existsSync(jsoncPath) ? jsoncPath : jsonPath;
 }
 function siblingOpencodeConfigPath(configPath) {
   const name = basename(configPath);
   if (name === "opencode.json")
-    return join(dirname(configPath), "opencode.jsonc");
+    return join2(dirname2(configPath), "opencode.jsonc");
   if (name === "opencode.jsonc")
-    return join(dirname(configPath), "opencode.json");
+    return join2(dirname2(configPath), "opencode.json");
   return;
 }
 function findPluginPath(fromUrl) {
-  const dir = dirname(fileURLToPath(fromUrl));
-  return join(dir, "..", "plugin", "meridian.ts");
+  const dir = dirname2(fileURLToPath(fromUrl));
+  return join2(dir, "..", "plugin", "meridian.ts");
 }
 var SUPPORTED_OPENCODE_V2_VERSION = "0.0.0-beta-18314";
 function findV2PluginPath(fromUrl) {
   const entryPath = fileURLToPath(fromUrl);
-  const dir = dirname(entryPath);
+  const dir = dirname2(entryPath);
   if (entryPath.endsWith(".ts")) {
-    const sourcePlugin = join(dir, "..", "plugin", "meridian-v2.ts");
+    const sourcePlugin = join2(dir, "..", "plugin", "meridian-v2.ts");
     if (existsSync(sourcePlugin))
       return sourcePlugin;
     throw new MissingV2PluginError(sourcePlugin);
   }
-  const bundledPlugin = join(dir, "meridian-v2.js");
+  const bundledPlugin = join2(dir, "meridian-v2.js");
   if (existsSync(bundledPlugin))
     return bundledPlugin;
   throw new MissingV2PluginError(bundledPlugin);
@@ -672,7 +849,7 @@ function checkPluginConfigured(configPath, expectedPluginPath) {
   return paths.some((path) => {
     if (!existsSync(path))
       return false;
-    const config = parseOpencodeConfig(readFileSync(path, "utf-8"));
+    const config = parseOpencodeConfig(readFileSync2(path, "utf-8"));
     if (config === null)
       return false;
     const plugins = [
@@ -702,12 +879,12 @@ function notePluginlessOpenCodeRequest(input) {
 }
 function runSetup(pluginPath, configPath, generation = "v1") {
   const path = configPath ?? findOpencodeConfigPath();
-  const dir = dirname(path);
+  const dir = dirname2(path);
   const targetField = generation === "v2" ? "plugins" : "plugin";
   const otherField = generation === "v2" ? "plugin" : "plugins";
   const siblingPath = siblingOpencodeConfigPath(path);
   if (siblingPath && existsSync(siblingPath)) {
-    const siblingConfig = parseOpencodeConfig(readFileSync(siblingPath, "utf-8"));
+    const siblingConfig = parseOpencodeConfig(readFileSync2(siblingPath, "utf-8"));
     if (siblingConfig === null)
       throw new UnparseableConfigError(siblingPath);
     const siblingPlugins = [
@@ -719,13 +896,14 @@ function runSetup(pluginPath, configPath, generation = "v1") {
     }
   }
   if (!existsSync(path)) {
+    ensurePriorityAttestationKey();
     if (!existsSync(dir))
-      mkdirSync(dir, { recursive: true });
-    writeFileSync(path, `${JSON.stringify({ [targetField]: [pluginPath] }, null, 2)}
+      mkdirSync2(dir, { recursive: true });
+    writeFileSync2(path, `${JSON.stringify({ [targetField]: [pluginPath] }, null, 2)}
 `, "utf-8");
     return { configPath: path, pluginPath, alreadyConfigured: false, removedStale: [], created: true };
   }
-  const text = readFileSync(path, "utf-8");
+  const text = readFileSync2(path, "utf-8");
   const config = parseOpencodeConfig(text);
   if (config === null) {
     throw new UnparseableConfigError(path);
@@ -753,8 +931,9 @@ function runSetup(pluginPath, configPath, generation = "v1") {
   if (Array.isArray(config[otherField]) && otherMeridian.length > 0) {
     updated = applyEdits(updated, modify(updated, [otherField], otherPlugins, { formattingOptions }));
   }
-  writeFileSync(path, updated, "utf-8");
+  ensurePriorityAttestationKey();
+  writeFileSync2(path, updated, "utf-8");
   return { configPath: path, pluginPath, alreadyConfigured, removedStale, created: false };
 }
 
-export { LRUMap, UnparseableConfigError, MissingV2PluginError, DuplicateMeridianConfigError, findOpencodeConfigPath, findPluginPath, SUPPORTED_OPENCODE_V2_VERSION, findV2PluginPath, classifyOpenCodeVersion, detectOpenCodeGeneration, pluginPathForGeneration, checkPluginConfigured, clearPluginlessWarnings, notePluginlessOpenCodeRequest, runSetup };
+export { LRUMap, PRIORITY_ATTESTATION_HEADER, verifyPriorityAttestation, init_priorityAttestation, UnparseableConfigError, MissingV2PluginError, DuplicateMeridianConfigError, findOpencodeConfigPath, findPluginPath, SUPPORTED_OPENCODE_V2_VERSION, findV2PluginPath, classifyOpenCodeVersion, detectOpenCodeGeneration, pluginPathForGeneration, checkPluginConfigured, clearPluginlessWarnings, notePluginlessOpenCodeRequest, runSetup };

package/dist/{cli-m0p2bc8v.js → cli-pdpry6q0.js}

@@ -18,6 +18,12 @@ function getRoutingMode(raw) {
     return "priority";
   return "active";
 }
+function getPriorityFailbackPolicy(raw) {
+  return raw?.toLowerCase() === "next-user-turn" ? "next-user-turn" : "new-conversation";
+}
+function shouldPromotePriorityAssignment(input) {
+  return input.policy === "next-user-turn" && input.requestKind === "human" && input.requestId !== undefined && input.requestId !== input.assignment.requestId;
+}
 function rendezvousScore(sessionKey, profileId) {
   const digest = createHash("sha256").update(`${sessionKey}\x00${profileId}`).digest();
   return digest.readBigUInt64BE(0);
@@ -54,13 +60,14 @@ function resolvePriorityOrder(configuredIds, orderSetting) {
   return { order, unknown };
 }
 function choosePriorityProfile(order, isExhausted) {
-  if (order.length === 0)
+  const preferred = order[0];
+  if (preferred === undefined)
     return;
   for (const id of order) {
     if (!isExhausted(id))
       return { id, allExhausted: false };
   }
-  return { id: order[0], allExhausted: true };
+  return { id: preferred, allExhausted: true };
 }
 
 class ProfileExhaustion {
@@ -121,6 +128,12 @@ class AssignmentStore {
         this.entries.delete(oldest);
     }
   }
+  compareAndSet(key, expected, value) {
+    if (this.entries.get(key) !== expected)
+      return false;
+    this.set(key, value);
+    return true;
+  }
   get size() {
     return this.entries.size;
   }
@@ -258,4 +271,4 @@ function listProfiles(profiles, defaultProfile) {
   }));
 }
 
-export { getRoutingMode, resolvePriorityOrder, choosePriorityProfile, ProfileExhaustion, AssignmentStore, resolveCooldownUntil, loadProfilesFromDisk, setActiveProfile, getActiveProfileId, resetActiveProfile, restoreActiveProfile, enableDiskProfileDiscovery, getEffectiveProfiles, hasProfiles, resolveProfile, listProfiles };
+export { getRoutingMode, getPriorityFailbackPolicy, shouldPromotePriorityAssignment, resolvePriorityOrder, choosePriorityProfile, ProfileExhaustion, AssignmentStore, resolveCooldownUntil, loadProfilesFromDisk, setActiveProfile, getActiveProfileId, resetActiveProfile, restoreActiveProfile, enableDiskProfileDiscovery, getEffectiveProfiles, hasProfiles, resolveProfile, listProfiles };

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startProxyServer
-} from "./cli-4ghkaajs.js";
-import"./cli-m0p2bc8v.js";
+} from "./cli-7cts44b5.js";
+import"./cli-pdpry6q0.js";
 import"./cli-sry5aqdj.js";
 import"./cli-8yp89fan.js";
 import {
@@ -10,7 +10,7 @@ import {
 } from "./cli-0ed6j0vk.js";
 import"./cli-khhjyk04.js";
 import"./cli-vj9cv18n.js";
-import"./cli-pbvm9kc2.js";
+import"./cli-n8t34zmq.js";
 import {
   __require
 } from "./cli-p9swy5t3.js";
@@ -93,7 +93,7 @@ if (args[0] === "setup") {
     runSetup,
     SUPPORTED_OPENCODE_V2_VERSION,
     UnparseableConfigError
-  } = await import("./setup-4v3zg3c0.js");
+  } = await import("./setup-8fwgwhqh.js");
   const forceV1 = args.includes("--v1");
   const forceV2 = args.includes("--v2");
   if (forceV1 && forceV2) {
@@ -205,7 +205,7 @@ async function runCli(start = startProxyServer, runAuthCheck = async () => {
   return execFile(claudePath, ["auth", "status"], { timeout: 5000 });
 }) {
   try {
-    const { findOpencodeConfigPath, checkPluginConfigured, findPluginPath } = await import("./setup-4v3zg3c0.js");
+    const { findOpencodeConfigPath, checkPluginConfigured, findPluginPath } = await import("./setup-8fwgwhqh.js");
     const configPath = findOpencodeConfigPath();
     const { existsSync } = await import("fs");
     if (existsSync(configPath) && !checkPluginConfigured(configPath)) {
@@ -230,7 +230,7 @@ async function runCli(start = startProxyServer, runAuthCheck = async () => {
     console.error("\x1B[33m⚠ Could not verify Claude auth status. If requests fail, run: claude login\x1B[0m");
   }
   if (!profiles) {
-    const { enableDiskProfileDiscovery } = await import("./profiles-0pyeqayw.js");
+    const { enableDiskProfileDiscovery } = await import("./profiles-4ajzjqhm.js");
     enableDiskProfileDiscovery();
   }
   const proxy = await start({ port, host, idleTimeoutSeconds, pluginDir, pluginConfigPath, profiles, defaultProfile, version, installProcessErrorHandlers: true });