@schoolai/shipyard 3.34.1-rc.20260927.1 → 3.34.1

package/dist/electron-utility.js

@@ -71,7 +71,7 @@ async function main() {
   await loadAuthFromConfig(env);
   crumb("post-auth-load");
   crumb("pre-serve-import");
-  const { serve } = await import("./serve-OP4JVMPM.js");
+  const { serve } = await import("./serve-LJYQF75A.js");
   crumb("post-serve-import");
   const portQueue = [];
   let acceptor = null;

package/dist/index.js

@@ -137,7 +137,7 @@ async function handleSubcommand() {
     return true;
   }
   if (subcommand === "start") {
-    const { startCommand } = await import("./start-MOBEORLT.js");
+    const { startCommand } = await import("./start-E2YHOYBP.js");
     await startCommand();
     return true;
   }
@@ -159,7 +159,7 @@ async function main() {
   const args = parseCliArgs();
   if (args.serve) {
     await loadAuthFromConfig(env);
-    const { serve } = await import("./serve-OP4JVMPM.js");
+    const { serve } = await import("./serve-LJYQF75A.js");
     return serve({ isDev: env.SHIPYARD_DEV });
   }
   logger.error("Use `shipyard start` to run the daemon. Use --help for usage.");

package/dist/{serve-OP4JVMPM.js → serve-LJYQF75A.js}

@@ -25629,6 +25629,30 @@ function resolveUsageLimitResetsAtMs(rateLimitStore, capabilities, profileForSpa
   if (record2.info.isUsingOverage === true) return null;
   return pickSoonestSaturatedReset(record2.info, nowMs);
 }
+var USAGE_LIMIT_TRUST_WINDOW_MS = 10 * 6e4;
+var USAGE_LIMIT_PROBE_TIMEOUT_MS = 9e4;
+function resolveUsageLimitGate(rateLimitStore, capabilities, profileForSpawn = null, nowMs = Date.now(), mode = "claim") {
+  const resetsAt = resolveUsageLimitResetsAtMs(
+    rateLimitStore,
+    capabilities,
+    profileForSpawn,
+    nowMs
+  );
+  const accountKey = resolveRateLimitAccountKey(capabilities, profileForSpawn);
+  if (resetsAt === null || rateLimitStore === null || accountKey === null) {
+    return { resetsAtMs: resetsAt, probe: null, accountKey };
+  }
+  if (rateLimitStore.isRecordTrusted(accountKey, nowMs, USAGE_LIMIT_TRUST_WINDOW_MS)) {
+    return { resetsAtMs: resetsAt, probe: null, accountKey };
+  }
+  if (mode === "observe") {
+    return { resetsAtMs: null, probe: null, accountKey };
+  }
+  if (rateLimitStore.claimUsageLimitProbe(accountKey, nowMs, USAGE_LIMIT_PROBE_TIMEOUT_MS)) {
+    return { resetsAtMs: null, probe: "claimed", accountKey };
+  }
+  return { resetsAtMs: resetsAt, probe: "blocked", accountKey };
+}
 var SYNTHETIC_REJECTED_WINDOW_MS = 15e3;
 function pickSoonestSaturatedReset(info, nowMs) {
   let candidate = null;
@@ -82440,6 +82464,20 @@ function createClaudeAccountTracker(onSwitched) {
     if (plan.switched !== null) onSwitched(plan.switched);
   };
 }
+function createAccountKeySwitchTracker(onSwitched) {
+  const lastKeys = /* @__PURE__ */ new Map();
+  return (next) => {
+    for (const profile of AGENT_IDS) {
+      const key = resolveRateLimitAccountKey(next, profile);
+      if (key === null) continue;
+      const last = lastKeys.get(profile);
+      lastKeys.set(profile, key);
+      if (last !== void 0 && last !== key) {
+        onSwitched({ profile, from: last, to: key });
+      }
+    }
+  };
+}
 function applyClaudeAccountSwitch(deps, switched) {
   const clearedTaskIds = [...deps.lastUsageLimitBroadcastByTask.keys()];
   deps.lastUsageLimitBroadcastByTask.clear();
@@ -91221,6 +91259,8 @@ async function buildRateLimitStore(dataDir, opts) {
   const initial = await loadStoreFile(filePath, opts.logger);
   const records = { ...initial.records };
   const observed = /* @__PURE__ */ new Set();
+  const switchedInUntrusted = /* @__PURE__ */ new Set();
+  const probeInFlight = /* @__PURE__ */ new Map();
   let writeQueue = Promise.resolve();
   function enqueueWrite(accountKey) {
     const attempt = () => withFileLock(lockPath2, async () => {
@@ -91245,8 +91285,25 @@ async function buildRateLimitStore(dataDir, opts) {
     observedSinceLoad(accountKey) {
       return observed.has(accountKey);
     },
+    isRecordTrusted(accountKey, nowMs, trustWindowMs) {
+      const record2 = records[accountKey];
+      if (!record2) return false;
+      if (switchedInUntrusted.has(accountKey)) return false;
+      return nowMs - record2.updatedAt < trustWindowMs;
+    },
+    markAccountSwitchedIn(accountKey) {
+      switchedInUntrusted.add(accountKey);
+    },
+    claimUsageLimitProbe(accountKey, nowMs, probeTimeoutMs) {
+      const started = probeInFlight.get(accountKey);
+      if (started !== void 0 && nowMs - started < probeTimeoutMs) return false;
+      probeInFlight.set(accountKey, nowMs);
+      return true;
+    },
     set(accountKey, info) {
       observed.add(accountKey);
+      switchedInUntrusted.delete(accountKey);
+      probeInFlight.delete(accountKey);
       const record2 = {
         info: normalizeRateLimitResetsToMs(info),
         updatedAt: Date.now()
@@ -91257,6 +91314,8 @@ async function buildRateLimitStore(dataDir, opts) {
     },
     applyEvent(accountKey, info, eventTime) {
       observed.add(accountKey);
+      switchedInUntrusted.delete(accountKey);
+      probeInFlight.delete(accountKey);
       const prev = records[accountKey]?.info;
       const nextInfo = mergeEvent(prev, normalizeRateLimitResetsToMs(info), eventTime);
       const record2 = { info: nextInfo, updatedAt: eventTime };
@@ -91284,6 +91343,8 @@ async function buildRateLimitStore(dataDir, opts) {
     clearForAccount(accountKey) {
       if (!(accountKey in records)) return false;
       observed.delete(accountKey);
+      switchedInUntrusted.delete(accountKey);
+      probeInFlight.delete(accountKey);
       delete records[accountKey];
       enqueueWrite(accountKey);
       return true;
@@ -91293,6 +91354,8 @@ async function buildRateLimitStore(dataDir, opts) {
         delete records[key];
       }
       observed.clear();
+      switchedInUntrusted.clear();
+      probeInFlight.clear();
       enqueueWrite();
     }
   };
@@ -116934,14 +116997,23 @@ async function createDaemon(deps) {
     current: (reason) => deps.log({ event: "claude_auth_recheck_before_wiring", reason })
   };
   let lastClaudeAccountSwitchAtMs = null;
-  const commitCapabilities = createCapabilityWriter(
-    capabilitiesRef,
-    createClaudeAccountTracker((switched) => {
-      lastClaudeAccountSwitchAtMs = Date.now();
-      claudeAccountSwitchRef.current(switched);
-    })
-  );
   const rateLimitStoreRef = { current: null };
+  const claudeTracker = createClaudeAccountTracker((switched) => {
+    lastClaudeAccountSwitchAtMs = Date.now();
+    claudeAccountSwitchRef.current(switched);
+  });
+  const accountKeySwitchTracker = createAccountKeySwitchTracker((switched) => {
+    rateLimitStoreRef.current?.markAccountSwitchedIn(switched.to);
+    deps.log({
+      event: "rate_limit_record_untrusted_on_switch_in",
+      profile: switched.profile,
+      accountKey: switched.to
+    });
+  });
+  const commitCapabilities = createCapabilityWriter(capabilitiesRef, (next) => {
+    claudeTracker(next);
+    accountKeySwitchTracker(next);
+  });
   const gitCheckpoint = createGitCheckpointService();
   const skillResolution = buildSkillResolutionService({
     shipyardHome: deps.shipyardHome,
@@ -117658,6 +117730,32 @@ async function createDaemon(deps) {
     return subprocess;
   }
   const lastUsageLimitBroadcastByTask = /* @__PURE__ */ new Map();
+  const usageLimitGateForSpawn = (taskId, profileId) => {
+    const gate = resolveUsageLimitGate(
+      rateLimitStoreRef.current,
+      capabilitiesRef.current,
+      profileId
+    );
+    if (gate.probe === "claimed") {
+      const record2 = gate.accountKey === null ? void 0 : rateLimitStoreRef.current?.get(gate.accountKey);
+      deps.log({
+        event: "usage_limit_probe_spawn",
+        taskId,
+        accountKey: gate.accountKey,
+        profile: profileId,
+        recordAgeMs: record2 ? Date.now() - record2.updatedAt : null
+      });
+    } else if (gate.probe === "blocked") {
+      deps.log({
+        event: "usage_limit_probe_blocked",
+        taskId,
+        accountKey: gate.accountKey,
+        profile: profileId,
+        resetsAtMs: gate.resetsAtMs
+      });
+    }
+    return gate.resetsAtMs;
+  };
   const spawnSubprocessFn = (reason, initialContent, unattributedOnEvent, canUseTool, settings, cwd, taskId, additionalSystemPrompt, disallowedTools, mode, onCwdChanged, initialMessageKind) => {
     const resolvedTaskId = taskId ?? "unknown";
     const resolvedCwd = cwd ?? deps.workspaceRoot;
@@ -117716,11 +117814,7 @@ async function createDaemon(deps) {
         profileForModel?.id ?? null,
         capabilitiesRef.current
       ),
-      usageLimitResetsAtMs: resolveUsageLimitResetsAtMs(
-        rateLimitStoreRef.current,
-        capabilitiesRef.current,
-        profileForModel?.id ?? null
-      ),
+      usageLimitResetsAtMs: usageLimitGateForSpawn(resolvedTaskId, profileForModel?.id ?? null),
       resolvedCwd,
       /** Sync: `SpawnSubprocessFn` contract requires synchronous check; policy details live on `isPathPresentSync`. */
       cwdExists: isPathPresentSync(resolvedCwd)
@@ -118406,10 +118500,23 @@ async function createDaemon(deps) {
      * no-op (returns null), which matches the legacy behavior of "spawn
      * unconditionally during early boot."
      */
-    checkUsageLimit: () => resolveUsageLimitResetsAtMs(
-      rateLimitStoreRef.current,
-      capabilitiesRef.current,
-      "claude-code"
+    checkUsageLimit: () => (
+      /**
+       * 'observe' — a warm lane is idle until adopted (`initialContent: []`,
+       * no API call), so it can never produce probe evidence; claiming would
+       * only starve real task spawns behind USAGE_LIMIT_PROBE_TIMEOUT_MS.
+       * The task spawn that claims the probe adopts this warm lane, and the
+       * adopting turn's first `rate_limit` event IS the evidence (#5469).
+       * This call also runs in the failure-backoff path — a bookkeeping read
+       * that must not have side effects.
+       */
+      resolveUsageLimitGate(
+        rateLimitStoreRef.current,
+        capabilitiesRef.current,
+        "claude-code",
+        Date.now(),
+        "observe"
+      ).resetsAtMs
     ),
     /** Block the spawn only on an explicit `unauthenticated` flip (unknown/authenticated still spawn). */
     checkIsAuthenticated: () => capabilitiesRef.current?.anthropicAuth?.status !== "unauthenticated"
@@ -122647,4 +122754,4 @@ export {
   decideWorkspaceScope,
   serve
 };
-//# sourceMappingURL=serve-OP4JVMPM.js.map
+//# sourceMappingURL=serve-LJYQF75A.js.map