@skrr-ai/cli 0.1.8

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/managed-inference-broker.js

@@ -0,0 +1,1054 @@
+/**
+ * First-party managed-inference broker for skrr Code.
+ *
+ * A LiteLLM virtual key is still a bearer capability.  Delivering it through
+ * an ACP child's environment would make it available to the harness, its
+ * descendants, crash dumps, and the default wrapper's serialized request.
+ * For the first-party runtime the server retains that key behind an
+ * authenticated public relay. The daemon exposes a per-session Unix loopback
+ * endpoint, and the child receives only a random secret usable against that
+ * endpoint while it is alive.
+ */
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { chmodSync, mkdtempSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { ModelProxyLoopbackServer } from './loopback-server.js';
+import { MODEL_PROXY_ERROR, ModelProxyError } from './contract.js';
+import { startRenewalLoop, } from './managed-inference-renewal.js';
+// A synthetic origin is required by URL-oriented provider SDKs. skrr Code pairs
+// it with OVERSKY_INFERENCE_BROKER_SOCKET and Bun's `fetch({ unix })`; it is
+// never resolved through DNS or connected over TCP.
+/**
+ * OSK-3893 — reserved local path the engine reads for its managed-session readout.
+ *
+ * Deliberately outside the provider dialects (`/v1/...`) the broker forwards, so it
+ * can never collide with a real upstream route, and deliberately prefixed
+ * `/oversky/` so a reader of a request log can tell platform traffic from provider
+ * traffic at a glance.
+ */
+export const MANAGED_STATUS_PATH = '/oversky/managed-status';
+export const INFERENCE_BROKER_ORIGIN = 'http://oversky-inference-broker.invalid';
+export const INFERENCE_BROKER_SOCKET_ENV = 'OVERSKY_INFERENCE_BROKER_SOCKET';
+export const MANAGED_SESSION_ENV = 'OVERSKY_MANAGED_SESSION';
+export const MANAGED_PROMPT_CACHING_ENV = 'OVERSKY_MANAGED_PROMPT_CACHING';
+const ALLOWED_PATHS = new Set([
+    '/v1/messages',
+    '/messages',
+    '/v1/chat/completions',
+    '/chat/completions',
+    '/v1/responses',
+    '/responses',
+]);
+const ANTHROPIC_ALLOWED_PATHS = new Set([
+    '/v1/messages',
+    '/messages',
+    '/v1/chat/completions',
+    '/chat/completions',
+]);
+const OPENAI_COMPATIBLE_CHAT_PATHS = new Set(['/v1/chat/completions', '/chat/completions']);
+const FORWARDED_HEADERS = new Set([
+    'accept',
+    'content-type',
+    'anthropic-version',
+    'anthropic-beta',
+    'user-agent',
+]);
+function nonEmpty(value) {
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;
+}
+export function managedClientModelId(scope) {
+    // skrr Code deliberately exposes managed Bedrock as a synthetic `bedrock`
+    // provider so the child cannot instantiate the native AWS SDK or discover
+    // ambient AWS credentials. The API-facing selector remains the canonical
+    // `amazon-bedrock/<inference-profile>` id for admission and accounting, but
+    // the ACP model handshake must use the exact synthetic alias that the
+    // validated lease already binds to.
+    if (scope.upstreamProvider === 'bedrock' && scope.gatewayModelAlias.startsWith('bedrock/')) {
+        return scope.gatewayModelAlias;
+    }
+    return scope.harnessModelId;
+}
+/** True only for a concrete gateway descriptor; raw provider keys never enter this broker. */
+export function isGatewayCredential(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const credential = value;
+    return Boolean(nonEmpty(credential.baseUrl) && nonEmpty(credential.authToken));
+}
+export function isManagedInferenceModelScope(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const scope = value;
+    return Boolean(scope.version === 1 &&
+        nonEmpty(scope.harnessModelId) &&
+        nonEmpty(scope.upstreamProvider) &&
+        nonEmpty(scope.gatewayModelAlias) &&
+        nonEmpty(scope.wireModel) === nonEmpty(scope.gatewayModelAlias) &&
+        nonEmpty(scope.policyVersion) &&
+        nonEmpty(scope.reservationId) &&
+        isManagedRequestEnvelope(scope.requestEnvelope) &&
+        isManagedInputTokenAccounting(scope.inputTokenAccounting) &&
+        managedAccountingMatchesProvider(scope.upstreamProvider, scope.inputTokenAccounting));
+}
+function isManagedInputTokenAccounting(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const accounting = value;
+    return Boolean(accounting.version === 1 &&
+        accounting.mode === 'server_authoritative' &&
+        ['openai_o200k_json_v1', 'utf8_bytes_json_v1'].includes(String(accounting.algorithm)));
+}
+function managedAccountingMatchesProvider(upstreamProvider, accounting) {
+    return ((upstreamProvider === 'openai' && accounting.algorithm === 'openai_o200k_json_v1') ||
+        (['anthropic', 'openrouter', 'bedrock'].includes(String(upstreamProvider)) &&
+            accounting.algorithm === 'utf8_bytes_json_v1'));
+}
+/**
+ * Build the public, session-scoped OverSky relay from a non-secret server
+ * model contract. Current servers never deliver a LiteLLM virtual key to the
+ * daemon. The explicit return shape also discards any legacy `authToken` that
+ * an older server might include, while the public relay authenticates the
+ * already-issued `agst_` claim and retrieves the virtual key server-side.
+ */
+export function buildManagedInferenceRelayCredential(credential, options) {
+    const sessionId = nonEmpty(options.sessionId);
+    const sessionToken = nonEmpty(options.sessionToken);
+    if (!sessionId || !sessionToken?.startsWith('agst_')) {
+        throw new Error('managed inference relay requires a session-scoped capability');
+    }
+    let base;
+    try {
+        base = new URL(options.serverUrl);
+    }
+    catch {
+        throw new Error('managed inference relay requires a valid OverSky server URL');
+    }
+    if (base.protocol !== 'https:' || base.username || base.password || base.search || base.hash) {
+        throw new Error('managed inference relay requires an authenticated HTTPS OverSky server');
+    }
+    base.pathname = `/api/agentic/sessions/${encodeURIComponent(sessionId)}/inference`;
+    return {
+        source: 'gateway-relay',
+        ...(credential.modelScope ? { modelScope: credential.modelScope } : {}),
+        baseUrl: base.toString().replace(/\/$/, ''),
+        authToken: sessionToken,
+    };
+}
+/**
+ * Start the daemon-local, request-envelope-constrained proxy.
+ *
+ * skrr Code is a multi-provider ACP runtime, so the child receives each dialect
+ * it may select: OpenAI/OpenRouter and Anthropic. Every credential variable
+ * contains the same daemon-local relay secret, never the LiteLLM virtual key.
+ * The first-party engine must use one of these supplied base URLs for managed
+ * execution; a failure to do so becomes an auth failure rather than a
+ * direct-provider fallback.
+ */
+export async function startManagedInferenceBroker(options) {
+    const gatewayBase = nonEmpty(options.credential.baseUrl);
+    const gatewayKey = nonEmpty(options.credential.authToken);
+    const modelScope = isManagedInferenceModelScope(options.modelScope) ? options.modelScope : null;
+    const legacyModel = nonEmpty(options.model);
+    if (!gatewayBase || !gatewayKey || (!modelScope && !legacyModel)) {
+        throw new Error('managed inference broker requires gateway base URL, virtual key, and resolved model');
+    }
+    let origin;
+    try {
+        origin = new URL(gatewayBase).origin;
+    }
+    catch {
+        throw new Error('managed inference broker received an invalid gateway base URL');
+    }
+    // 256-bit random, local-only bearer. It is meaningful solely to the
+    // loopback server and dies with this object; it is not accepted by LiteLLM.
+    let relayToken = randomBytes(32).toString('base64url');
+    let upstreamKey = gatewayKey;
+    /**
+     * OSK-3901 — the lease renewal heartbeat, armed below once the session is up.
+     *
+     * Declared here so `stop()` can cancel it. Assigned rather than constructed
+     * inline because a lease with no renewal policy must produce NO loop at all
+     * (see `renewalWindowMs`), and an always-armed timer that immediately gives up
+     * is harder to reason about than an absent one.
+     */
+    let renewal = null;
+    /**
+     * OSK-3893 — the readout state, updated only from renewal responses.
+     *
+     * `expiresAtMs` is stored as an ABSOLUTE instant rather than a remaining
+     * duration: a duration recorded once and read later is wrong by however long the
+     * gap was, and a countdown that lies about the time left is worse than no
+     * countdown.
+     */
+    const status = {
+        expiresAtMs: options.leaseExpiresInMs && options.leaseExpiresInMs > 0
+            ? Date.now() + options.leaseExpiresInMs
+            : null,
+        spendUsd: null,
+        authorizedUsd: null,
+        renewals: 0,
+    };
+    const statusResponse = () => {
+        const payload = {
+            managed: true,
+            expiresInMs: status.expiresAtMs == null ? null : Math.max(0, status.expiresAtMs - Date.now()),
+            spendUsd: status.spendUsd,
+            authorizedUsd: status.authorizedUsd,
+            ...(status.budgetState ? { budgetState: status.budgetState } : {}),
+            renewals: status.renewals,
+            ...(status.stopped ? { stopped: status.stopped } : {}),
+        };
+        const encoded = new TextEncoder().encode(JSON.stringify(payload));
+        return {
+            status: 200,
+            headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+            body: (async function* () {
+                yield encoded;
+            })(),
+        };
+    };
+    const fetchImpl = options.fetchImpl ?? ((url, init) => fetch(url, init));
+    const envelope = modelScope?.requestEnvelope ?? null;
+    let activeRequests = 0;
+    let totalRequests = 0;
+    const requestStarts = [];
+    const acquireRequestSlot = () => {
+        if (!envelope)
+            return () => { };
+        const now = Date.now();
+        while (requestStarts.length > 0 && requestStarts[0] <= now - 60_000)
+            requestStarts.shift();
+        if (activeRequests >= envelope.maxConcurrentRequests ||
+            totalRequests >= envelope.maxTotalRequests ||
+            requestStarts.length >= envelope.maxRequestsPerMinute) {
+            rejectManagedRequest('managed inference broker request rate or concurrency envelope exceeded');
+        }
+        activeRequests += 1;
+        totalRequests += 1;
+        requestStarts.push(now);
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            activeRequests -= 1;
+        };
+    };
+    /**
+     * Copy the server's money figures off a relayed response into the status this
+     * broker serves.
+     *
+     * Absent headers change nothing. An older API sends none, and a status that
+     * kept its last known figures is strictly better than one that resets them to
+     * null every time a request comes back from a server that does not speak this.
+     */
+    const readBudgetHeaders = (headers) => {
+        const verdict = headers.get('x-oversky-budget-state');
+        if (verdict === 'ok' || verdict === 'warn' || verdict === 'exhausted') {
+            status.budgetState = verdict;
+        }
+        // Parsed through a helper because `Number(null)` is 0 and 0 is finite — so a
+        // MISSING header read as "the session has spent nothing", which is the one
+        // wrong answer that looks reassuring. It also silently overwrote a real
+        // figure with zero on every response from a server that does not send these.
+        const usd = (name) => {
+            const raw = headers.get(name);
+            if (raw === null || raw.trim() === '')
+                return null;
+            const value = Number(raw);
+            return Number.isFinite(value) ? value : null;
+        };
+        const settled = usd('x-oversky-session-settled-usd');
+        if (settled !== null)
+            status.spendUsd = settled;
+        const authorized = usd('x-oversky-session-authorized-usd');
+        if (authorized !== null && authorized > 0)
+            status.authorizedUsd = authorized;
+    };
+    const forwarder = {
+        forward: async (request, { signal }) => {
+            // OSK-3893 (I5) — the supervised-session readout, answered LOCALLY.
+            //
+            // Intercepted here rather than added to the loopback server, so the
+            // transport keeps exactly one job (authenticate, read, forward) and the
+            // reserved path cannot be reached without the relay token that already
+            // guards every inference call.
+            //
+            // It consumes no request slot and never leaves the machine: the numbers were
+            // already fetched by the renewal heartbeat, which is a round-trip on the
+            // cadence a human readout wants anyway. A second polling surface would have
+            // been a second thing to authorize and revoke.
+            if (request.path === MANAGED_STATUS_PATH) {
+                return statusResponse();
+            }
+            const releaseSlot = acquireRequestSlot();
+            const url = resolveGatewayUrl(gatewayBase, origin, request.path);
+            try {
+                const body = assertApprovedEnvelope(request.method, request.path, request.body, modelScope, legacyModel);
+                const headers = new Headers();
+                for (const [name, value] of Object.entries(request.headers)) {
+                    if (FORWARDED_HEADERS.has(name.toLowerCase()))
+                        headers.set(name, value);
+                }
+                headers.set('authorization', `Bearer ${upstreamKey}`);
+                const response = await fetchImpl(url.toString(), {
+                    method: request.method,
+                    headers,
+                    body: body ? body : undefined,
+                    signal,
+                    duplex: 'half',
+                    redirect: 'error',
+                });
+                // OSK-3932 — learn the money from the response the session just made.
+                //
+                // The readout used to arrive only on the renewal heartbeat, and a read of
+                // dev found `renewalCount: 0` on every interactive reservation: sessions
+                // end in ~44-60s while the first heartbeat is armed at 72s. So the status
+                // this broker serves was, in practice, never populated with a figure at
+                // all. Every inference call carries one now, which is the one channel a
+                // session cannot be too short to use.
+                readBudgetHeaders(response.headers);
+                return {
+                    status: response.status,
+                    headers: responseHeaders(response.headers),
+                    body: responseBody(response, envelope?.maxResponseBytes, releaseSlot),
+                };
+            }
+            catch (error) {
+                releaseSlot();
+                throw error;
+            }
+        },
+    };
+    if (process.platform === 'win32') {
+        throw new Error('managed inference broker requires a verified local IPC transport on Windows');
+    }
+    // Keep below Unix-domain socket path limits even on macOS where os.tmpdir()
+    // can be deeply nested. The random mkdtemp directory is private to this
+    // daemon process; the socket itself is chmod 0600 by the listener.
+    const socketDirectory = mkdtempSync('/tmp/oversky-inference-');
+    chmodSync(socketDirectory, 0o700);
+    const socketPath = join(socketDirectory, 'broker.sock');
+    const server = new ModelProxyLoopbackServer({
+        relayToken,
+        forwarder,
+        socketPath,
+        advertisedBaseUrl: INFERENCE_BROKER_ORIGIN,
+        ...(envelope ? { maxBodyBytes: envelope.maxInputBytes } : {}),
+    });
+    try {
+        await server.start();
+    }
+    catch (error) {
+        rmSync(socketDirectory, { recursive: true, force: true });
+        throw error;
+    }
+    let stopped = false;
+    // OSK-3901 — arm the renewal heartbeat once the socket is live.
+    //
+    // Armed here rather than before `server.start()`: a renewal that extended a
+    // lease for a broker that then failed to start would hold a reservation and its
+    // concurrency slot for a session that never ran.
+    //
+    // The renewal reaches the API with the SAME session-scoped capability the relay
+    // uses (`upstreamKey`, an `agst_` token) against `<relay base>/renew` — so no
+    // second credential and no new daemon-to-worker message are involved.
+    if (options.leaseExpiresInMs && options.leaseExpiresInMs > 0) {
+        const renewUrl = `${gatewayBase.replace(/\/+$/, '')}/renew`;
+        const renewModel = modelScope?.gatewayModelAlias ?? legacyModel;
+        const refreshCapability = options.refreshCapability;
+        renewal = startRenewalLoop({
+            initialExpiresInMs: options.leaseExpiresInMs,
+            ...(options.capabilityExpiresAtMs && refreshCapability
+                ? {
+                    capabilityExpiresAtMs: options.capabilityExpiresAtMs,
+                    refreshCapability: async () => {
+                        const outcome = await refreshCapability();
+                        if (!outcome.ok)
+                            return outcome;
+                        const token = nonEmpty(outcome.token);
+                        if (!token) {
+                            // A success that carries nothing to install has refreshed nothing.
+                            // Reported as transient rather than accepted, because accepting it
+                            // would re-arm the schedule against a token we never swapped in and
+                            // hide the real expiry until the relay 401s.
+                            return { ok: false, reason: 'capability refresh returned no token' };
+                        }
+                        // THE SWAP, and the only statement in this block that matters.
+                        // `upstreamKey` is read at CALL time — once per forwarded request
+                        // (`headers.set('authorization', …)`) and once per lease renewal — so
+                        // one assignment re-points every later use. Nothing captured it by
+                        // value, no Headers object outlives a request, and the relay's own
+                        // base URL never embedded it.
+                        //
+                        // Safe mid-flight: the server's renewal is ADDITIVE, so a request
+                        // already carrying the previous token keeps working while the new one
+                        // takes over.
+                        //
+                        // But never after teardown: `stop()` drops this reference on purpose,
+                        // and a refresh that was already in flight would otherwise re-arm a
+                        // credential for a session that has ended. Nothing could use it — the
+                        // socket and the loop are both gone — which is exactly why writing it
+                        // back would be pure hygiene loss.
+                        if (stopped)
+                            return { ok: false, reason: 'managed session stopped' };
+                        upstreamKey = token;
+                        return outcome;
+                    },
+                }
+                : {}),
+            onStop: (reason, detail) => {
+                // Recorded before the caller's handler runs, so a readout polled during
+                // teardown reports the stop rather than a stale countdown that keeps
+                // ticking toward a lease nobody will renew.
+                status.stopped = { reason, ...(detail ? { detail } : {}) };
+                options.onLeaseRenewalStopped?.(reason, detail);
+            },
+            renew: async ({ renewalId }) => {
+                const response = await fetchImpl(renewUrl, {
+                    method: 'POST',
+                    headers: {
+                        Authorization: `Bearer ${upstreamKey}`,
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({ model: renewModel, renewalId }),
+                });
+                if (response.ok) {
+                    const payload = (await response.json().catch(() => ({})));
+                    // Absolute instant, and only from fields the server actually sent —
+                    // `?? null` rather than `?? 0`, because "not reported" must stay
+                    // distinguishable from "zero spent" all the way to the screen.
+                    if (typeof payload.expiresInMs === 'number') {
+                        status.expiresAtMs = Date.now() + payload.expiresInMs;
+                    }
+                    if (payload.budgetState === 'ok' ||
+                        payload.budgetState === 'warn' ||
+                        payload.budgetState === 'exhausted') {
+                        status.budgetState = payload.budgetState;
+                    }
+                    if (typeof payload.spendUsd === 'number')
+                        status.spendUsd = payload.spendUsd;
+                    if (typeof payload.authorizedUsd === 'number') {
+                        status.authorizedUsd = payload.authorizedUsd;
+                    }
+                    status.renewals =
+                        typeof payload.renewalCount === 'number' ? payload.renewalCount : status.renewals + 1;
+                    return { ok: true, expiresInMs: payload.expiresInMs };
+                }
+                return classifyLeaseRenewalRefusal(response);
+            },
+        });
+    }
+    return {
+        env: {
+            OPENAI_BASE_URL: INFERENCE_BROKER_ORIGIN,
+            OPENAI_API_KEY: relayToken,
+            // skrr Code's existing multi-provider adapter uses the OpenRouter key
+            // name. Pointing both dialect variables at the loopback avoids falling
+            // back to an inherited operator credential.
+            OPENROUTER_BASE_URL: INFERENCE_BROKER_ORIGIN,
+            OPENROUTER_API_KEY: relayToken,
+            // Bedrock is reached only through LiteLLM's reviewed OpenAI-compatible
+            // alias. These are daemon-local relay values, never AWS credentials.
+            BEDROCK_BASE_URL: INFERENCE_BROKER_ORIGIN,
+            BEDROCK_API_KEY: relayToken,
+            // Claude's native Messages adapter does not consult either OpenAI
+            // variable. ANTHROPIC_AUTH_TOKEN makes it send the same short-lived
+            // Bearer capability that ModelProxyLoopbackServer validates.
+            ANTHROPIC_BASE_URL: INFERENCE_BROKER_ORIGIN,
+            ANTHROPIC_AUTH_TOKEN: relayToken,
+            [INFERENCE_BROKER_SOCKET_ENV]: socketPath,
+            [MANAGED_SESSION_ENV]: '1',
+            ...(modelScope?.requestEnvelope.allowPromptCaching && supportsManagedPromptCaching(modelScope)
+                ? { [MANAGED_PROMPT_CACHING_ENV]: '1' }
+                : {}),
+        },
+        socketPath,
+        ...(modelScope ? { clientModelId: managedClientModelId(modelScope) } : {}),
+        ...(envelope
+            ? {
+                reasoningPolicy: {
+                    allowedEfforts: [...envelope.allowedReasoningEfforts],
+                    defaultEffort: envelope.defaultReasoningEffort ?? envelope.allowedReasoningEfforts[0],
+                    ...(envelope.selectedReasoningEffort
+                        ? { requestedEffort: envelope.selectedReasoningEffort }
+                        : {}),
+                    ...(envelope.reasoningSelectionSource
+                        ? { selectionSource: envelope.reasoningSelectionSource }
+                        : {}),
+                },
+            }
+            : {}),
+        async stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            // Before the socket: a renewal in flight against a session that is ending
+            // would extend a lease nobody will use, and its timer would otherwise keep
+            // firing against a dead broker.
+            renewal?.stop();
+            await server.stop();
+            rmSync(socketDirectory, { recursive: true, force: true });
+            // Drop our own references promptly. JS cannot promise physical memory
+            // zeroization, but no subsequent request can authenticate upstream.
+            relayToken = '';
+            upstreamKey = '';
+        },
+    };
+}
+/**
+ * The renewal refusal that means the lease reached its IMMUTABLE ceiling.
+ *
+ * `POST <relay>/renew` answers this BEFORE it extends the gateway key, which is
+ * what makes it distinguishable at all: every other refusal that route can produce
+ * arrives as `lease-denied`, and that code covers revoked, reaped and spent
+ * identically. Matched exactly rather than by prefix — an unrecognised 4xx still
+ * stops the loop, just with the more cautious sentence.
+ */
+const LEASE_CEILING_CODE = 'lease-ceiling-reached';
+/**
+ * The two money refusals (OSK-3932). Separate constants rather than a prefix
+ * match, for the same reason the ceiling is matched exactly: an unrecognised
+ * code must still stop the loop, just with the more cautious sentence.
+ *
+ * They differ in ONE respect that reaches the user — whether a `resetAt`
+ * accompanies them — so the classifier treats them alike and the message layer
+ * does not.
+ */
+const SESSION_BUDGET_CODE = 'session-budget-exhausted';
+/**
+ * RESERVED, not currently emitted. The server deleted this refusal in
+ * `77d3b26187` because the quantity behind it — `hardUsd - spentUsd -
+ * reservedUsd` — is the NEW-ADMISSION question, and asking it of a live session
+ * would have terminated one admitted at an exact fit, on a bucket
+ * (`provider_model`) whose scope key carries no tenant and is therefore shared
+ * fleet-wide.
+ *
+ * Kept because the classifier must not regress if renewal ever claims new money
+ * (S3), and because a client that meets an unknown 402 falls through to the
+ * generic `denied` sentence, which is the wrong one for a budget. Costs one
+ * comparison; removing it would be a wire regression waiting to happen.
+ */
+const ACCOUNT_BUDGET_CODE = 'account-budget-exhausted';
+/**
+ * Classify a NON-OK lease renewal response.
+ *
+ * Exported (though not re-exported from the package index) so a test can drive
+ * the loop's schedule against the server's ACTUAL wire shapes rather than against
+ * an injected outcome — which is the only way the interaction between the two
+ * schedules is testable at all, and a test that injects the outcome would have
+ * been green through the defect this exists to close.
+ *
+ * The status CLASS still decides everything else, deliberately: 4xx is a decision
+ * and 5xx is the dependency, and parsing server prose to tell them apart is a job
+ * the daemon should not have. The one exception is the ceiling, which is the
+ * refusal a supervised session is EXPECTED to end on and therefore the one whose
+ * sentence has to differ.
+ */
+export async function classifyLeaseRenewalRefusal(response) {
+    const refusal = await readRenewalRefusal(response);
+    if (refusal.code === LEASE_CEILING_CODE) {
+        return {
+            ok: false,
+            ceiling: true,
+            // The INSTANT rather than the code, and only here: the user knows which
+            // rule fired — they want to know when their window ended.
+            reason: refusal.maxExpiresAt
+                ? `authorized through ${refusal.maxExpiresAt}`
+                : LEASE_CEILING_CODE,
+        };
+    }
+    // The MONEY, matched before the generic 4xx fallthrough for exactly the reason
+    // the ceiling is: both would otherwise arrive as `denied`, which covers
+    // revoked, reaped and spent identically and would tell a user whose budget ran
+    // out to go looking for a fault in their access.
+    if (refusal.code === SESSION_BUDGET_CODE || refusal.code === ACCOUNT_BUDGET_CODE) {
+        return {
+            ok: false,
+            exhausted: true,
+            // Carried only when the server sent one. A session's own authorization
+            // never comes back, so inventing a time here would be the one wrong
+            // answer that sounds reassuring.
+            ...(refusal.resetAt ? { resetAt: refusal.resetAt } : {}),
+            reason: refusal.code,
+        };
+    }
+    const denied = response.status >= 400 && response.status < 500;
+    return {
+        ok: false,
+        denied,
+        reason: refusal.code ?? `renewal HTTP ${response.status}`,
+    };
+}
+/**
+ * Read `{error: {code}, maxExpiresAt}` without letting a hostile or huge body
+ * matter, and without letting a malformed one throw on a teardown-adjacent path.
+ */
+async function readRenewalRefusal(response) {
+    try {
+        const raw = (await response.text()).slice(0, 2048);
+        const parsed = JSON.parse(raw);
+        const code = parsed?.error?.code;
+        const maxExpiresAt = parsed?.maxExpiresAt;
+        // Present only when waiting can actually help — a spent account window
+        // refills, a spent session authorization does not. Absent is meaningful.
+        const resetAt = parsed?.resetAt;
+        return {
+            ...(typeof code === 'string' && code ? { code } : {}),
+            ...(typeof maxExpiresAt === 'string' && maxExpiresAt ? { maxExpiresAt } : {}),
+            ...(typeof resetAt === 'string' && resetAt ? { resetAt } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+function resolveGatewayUrl(base, allowedOrigin, path) {
+    let url;
+    try {
+        const parsedBase = new URL(base);
+        const canonicalPath = path.startsWith('/v1/') ? path : `/v1${path}`;
+        const basePath = parsedBase.pathname.replace(/\/$/, '');
+        const suffix = basePath.endsWith('/v1') ? canonicalPath.slice(3) : canonicalPath;
+        parsedBase.pathname = `${basePath}${suffix}`;
+        parsedBase.search = '';
+        parsedBase.hash = '';
+        url = parsedBase;
+    }
+    catch {
+        rejectManagedRequest('managed inference broker received an invalid request path');
+    }
+    if (url.origin !== allowedOrigin ||
+        !ALLOWED_PATHS.has(path) ||
+        (!url.pathname.endsWith('/v1/messages') &&
+            !url.pathname.endsWith('/v1/chat/completions') &&
+            !url.pathname.endsWith('/v1/responses'))) {
+        rejectManagedRequest('managed inference broker denied an unapproved upstream route');
+    }
+    return url;
+}
+function assertApprovedEnvelope(method, path, body, modelScope, legacyModel) {
+    if (method.toUpperCase() !== 'POST' || !ALLOWED_PATHS.has(path)) {
+        rejectManagedRequest('managed inference broker denied an unapproved request method or route');
+    }
+    if (!body)
+        rejectManagedRequest('managed inference broker requires a model request body');
+    if (modelScope && body.byteLength > modelScope.requestEnvelope.maxInputBytes) {
+        rejectManagedRequest('managed inference broker input byte envelope exceeded');
+    }
+    // The daemon enforces the independent byte/body boundary. Token accounting
+    // is intentionally repeated by the authenticated public relay using the
+    // reviewed server-side algorithm named in this immutable scope; the child
+    // cannot provide or influence a token estimate. Requiring the descriptor in
+    // isManagedInferenceModelScope keeps older servers fail-closed.
+    let payload;
+    try {
+        payload = JSON.parse(new TextDecoder().decode(body));
+    }
+    catch {
+        rejectManagedRequest('managed inference broker requires a JSON model request');
+    }
+    if (!payload || typeof payload !== 'object') {
+        rejectManagedRequest('managed inference broker denied a model outside the approved lease');
+    }
+    const requestedModel = payload.model;
+    if (modelScope) {
+        // The currently published binary may use compatible chat while the target
+        // binary uses native Messages. Neither dialect authorizes Responses.
+        if ((modelScope.upstreamProvider === 'anthropic' && !ANTHROPIC_ALLOWED_PATHS.has(path)) ||
+            (modelScope.upstreamProvider === 'bedrock' && !OPENAI_COMPATIBLE_CHAT_PATHS.has(path)) ||
+            (!['anthropic', 'bedrock'].includes(modelScope.upstreamProvider) &&
+                path.endsWith('/messages'))) {
+            rejectManagedRequest('managed inference broker denied a route outside the provider dialect');
+        }
+        // ACP selectors are provider-qualified (`openrouter/anthropic/...` and
+        // `amazon-bedrock/us.anthropic...`), while OpenAI-compatible adapters send
+        // the exact provider-local suffix in the JSON body. Accept that one
+        // deterministically derived spelling as the same selector, then translate
+        // it to the immutable gateway alias below. This is still an exact match;
+        // it does not authorize another provider or model.
+        const clientModelId = providerLocalModelId(modelScope.harnessModelId);
+        const approved = constantTimeStringEqual(requestedModel, modelScope.harnessModelId) ||
+            constantTimeStringEqual(requestedModel, modelScope.gatewayModelAlias) ||
+            (clientModelId !== null && constantTimeStringEqual(requestedModel, clientModelId));
+        if (!approved) {
+            rejectManagedRequest('managed inference broker denied a model outside the approved lease');
+        }
+        // The child speaks in its harness namespace. The virtual key and LiteLLM
+        // route are scoped in the gateway namespace, so make that translation in
+        // the trusted daemon and guarantee the upstream always sees the alias the
+        // key was actually minted for.
+        payload.model = modelScope.wireModel;
+        enforceRequestEnvelope(payload, path, modelScope.requestEnvelope, modelScope);
+        const sanitized = new TextEncoder().encode(JSON.stringify(payload));
+        if (sanitized.byteLength > modelScope.requestEnvelope.maxInputBytes) {
+            rejectManagedRequest('managed inference broker input byte envelope exceeded');
+        }
+        return sanitized;
+    }
+    if (!legacyModel || !constantTimeStringEqual(requestedModel, legacyModel)) {
+        rejectManagedRequest('managed inference broker denied a model outside the approved lease');
+    }
+    return body;
+}
+function enforceRequestEnvelope(payload, path, envelope, modelScope) {
+    // LiteLLM merges `extra_body` after provider transformation. The child must
+    // never use it to override model, spend, output, or cache fields already
+    // checked by this broker and the authenticated API.
+    if (payload.extra_body != null) {
+        rejectManagedRequest('managed inference broker denied a caller-supplied extra body');
+    }
+    const outputFields = ['max_tokens', 'max_completion_tokens', 'max_output_tokens'];
+    let sawOutputLimit = false;
+    for (const field of outputFields) {
+        if (payload[field] == null)
+            continue;
+        const value = Number(payload[field]);
+        if (!Number.isSafeInteger(value) || value < 1) {
+            rejectManagedRequest(`managed inference broker denied invalid ${field}`);
+        }
+        payload[field] = Math.min(value, envelope.maxOutputTokens);
+        sawOutputLimit = true;
+    }
+    if (!sawOutputLimit) {
+        payload[path.endsWith('/responses')
+            ? 'max_output_tokens'
+            : path.endsWith('/messages')
+                ? 'max_tokens'
+                : 'max_completion_tokens'] = envelope.maxOutputTokens;
+    }
+    if (payload.stream != null && typeof payload.stream !== 'boolean') {
+        rejectManagedRequest('managed inference broker denied invalid streaming mode');
+    }
+    if (payload.stream === true && !envelope.allowStreaming) {
+        rejectManagedRequest('managed inference broker denied streaming outside the lease envelope');
+    }
+    const reasoning = payload.reasoning;
+    if (reasoning != null) {
+        if (!reasoning || typeof reasoning !== 'object' || Array.isArray(reasoning)) {
+            rejectManagedRequest('managed inference broker denied invalid reasoning envelope');
+        }
+        const record = reasoning;
+        if (record.effort != null &&
+            (typeof record.effort !== 'string' ||
+                !envelope.allowedReasoningEfforts.includes(record.effort))) {
+            rejectManagedRequest('managed inference broker denied reasoning effort outside the lease envelope');
+        }
+        if (record.max_tokens != null) {
+            const value = Number(record.max_tokens);
+            if (!Number.isSafeInteger(value) || value < 1) {
+                rejectManagedRequest('managed inference broker denied invalid reasoning token limit');
+            }
+            record.max_tokens = Math.min(value, envelope.maxReasoningTokens);
+        }
+    }
+    if (payload.reasoning_effort != null &&
+        (typeof payload.reasoning_effort !== 'string' ||
+            !envelope.allowedReasoningEfforts.includes(payload.reasoning_effort))) {
+        rejectManagedRequest('managed inference broker denied reasoning effort outside the lease envelope');
+    }
+    const selectedEffort = envelope.selectedReasoningEffort;
+    if (selectedEffort) {
+        const responseEffort = reasoning && typeof reasoning === 'object' && !Array.isArray(reasoning)
+            ? reasoning.effort
+            : undefined;
+        const anthropicOutputConfig = isPlainObject(payload.output_config)
+            ? payload.output_config
+            : null;
+        const anthropicEffort = anthropicOutputConfig?.effort;
+        // Whether the pin is AUTHORITY or merely a DEFAULT, and the difference is the
+        // whole reason managed `sky code` could not complete a single turn.
+        //
+        // `selectedReasoningEffort` has two provenances and the envelope has always
+        // recorded which (`reasoningSelectionSource`) — it was read for reporting and
+        // ignored here. When the caller ASKED for an effort, admission priced that
+        // request and the reservation is authority: a later request naming a
+        // different one is trying to change what was authorized, and is refused.
+        //
+        // When it came from `policy_default`, nobody asked for anything. The server
+        // filled a blank, and refusing the engine's own choice enforces a preference
+        // the platform invented. That is what happened: the interactive admit sends
+        // no effort at all, so every supervised reservation pinned dev's
+        // `defaultReasoningEffort: 'low'`, and every request the engine made carried
+        // its own model default and was denied. Deterministic, not a race — no retry
+        // could help, and the CLI had no way to declare an effort in the first place.
+        //
+        // Cost is still bounded, and not by this check: `allowedReasoningEfforts`
+        // gates the value just above, `maxReasoningTokens` hard-caps the tokens
+        // reasoning may actually consume, and both apply to whatever wins here. So
+        // adopting the caller's explicit effort widens no envelope.
+        //
+        // Not solved by silently rewriting to the default either. The engine asked
+        // for something specific; answering with a quieter model and saying nothing
+        // is the same class of defect as a badge reporting a healthy lease over a
+        // dead one.
+        const declared = [responseEffort, payload.reasoning_effort, anthropicEffort].filter((value) => value != null);
+        let effectiveEffort = selectedEffort;
+        if (declared.length > 0) {
+            // The dialects must agree with EACH OTHER before either can be honoured.
+            // Two conflicting efforts in one payload is malformed, and picking one
+            // would make the winner depend on field order.
+            if (declared.some((value) => value !== declared[0])) {
+                rejectManagedRequest('managed inference broker denied conflicting reasoning efforts in one request');
+            }
+            const callerEffort = declared[0];
+            if (envelope.reasoningSelectionSource === 'request') {
+                if (callerEffort !== selectedEffort) {
+                    rejectManagedRequest('managed inference broker denied reasoning effort different from the immutable reservation');
+                }
+            }
+            else if (callerEffort !== selectedEffort) {
+                // Re-validated rather than trusted. The allow-list check above covers the
+                // OpenAI dialects; `output_config.effort` reaches here unchecked, and this
+                // is the branch that would let it through.
+                if (typeof callerEffort !== 'string' ||
+                    !envelope.allowedReasoningEfforts.includes(callerEffort)) {
+                    rejectManagedRequest('managed inference broker denied reasoning effort outside the lease envelope');
+                }
+                effectiveEffort = callerEffort;
+            }
+        }
+        if (path.endsWith('/responses')) {
+            payload.reasoning = {
+                ...(reasoning && typeof reasoning === 'object' && !Array.isArray(reasoning)
+                    ? reasoning
+                    : {}),
+                effort: effectiveEffort,
+            };
+        }
+        else if (path.endsWith('/messages')) {
+            if (!['low', 'medium', 'high', 'max'].includes(effectiveEffort)) {
+                rejectManagedRequest('managed inference broker denied reasoning effort unsupported by the Anthropic dialect');
+            }
+            payload.output_config = { ...(anthropicOutputConfig ?? {}), effort: effectiveEffort };
+        }
+        else if (modelScope.upstreamProvider === 'openrouter') {
+            // OpenRouter accepts either reasoning.effort or reasoning.max_tokens,
+            // never both. skrr Code's compatible adapter may send a token budget even
+            // though the managed reservation selected an immutable effort. The
+            // reservation wins: replace the caller budget with that exact effort in
+            // OpenRouter's native envelope and leave LiteLLM nothing to merge twice.
+            const openRouterReasoning = reasoning && typeof reasoning === 'object' && !Array.isArray(reasoning)
+                ? { ...reasoning }
+                : {};
+            delete openRouterReasoning.max_tokens;
+            payload.reasoning = { ...openRouterReasoning, effort: effectiveEffort };
+            delete payload.reasoning_effort;
+        }
+        else {
+            payload.reasoning_effort = effectiveEffort;
+        }
+    }
+    if (payload.max_reasoning_tokens != null) {
+        const value = Number(payload.max_reasoning_tokens);
+        if (!Number.isSafeInteger(value) || value < 1) {
+            rejectManagedRequest('managed inference broker denied invalid reasoning token limit');
+        }
+        payload.max_reasoning_tokens = Math.min(value, envelope.maxReasoningTokens);
+    }
+    enforcePromptCacheEnvelope(payload, envelope, modelScope);
+}
+function rejectManagedRequest(message) {
+    throw new ModelProxyError(MODEL_PROXY_ERROR.REQUEST_REJECTED, message);
+}
+function containsObjectKey(value, target) {
+    if (Array.isArray(value))
+        return value.some((item) => containsObjectKey(item, target));
+    if (!value || typeof value !== 'object')
+        return false;
+    const record = value;
+    return (Object.prototype.hasOwnProperty.call(record, target) ||
+        Object.values(record).some((item) => containsObjectKey(item, target)));
+}
+function objectKeyValues(value, target, found = []) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            objectKeyValues(item, target, found);
+        return found;
+    }
+    if (!value || typeof value !== 'object')
+        return found;
+    const record = value;
+    if (Object.prototype.hasOwnProperty.call(record, target))
+        found.push(record[target]);
+    for (const item of Object.values(record))
+        objectKeyValues(item, target, found);
+    return found;
+}
+function isPlainObject(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+const MAX_OPENAI_CACHE_BREAKPOINTS = 50;
+function supportsManagedPromptCaching(modelScope) {
+    const model = nonEmpty(modelScope.wireModel)
+        ?.replace(/^openai\//, '')
+        .toLowerCase();
+    return modelScope.upstreamProvider === 'openai' && Boolean(model?.startsWith('gpt-5.6'));
+}
+/**
+ * OpenAI GPT-5.6 caching is implicit by default; removing the SDK's routing
+ * key does not disable it. A disabled lease is normalized to the provider's
+ * explicit/no-breakpoint contract before the request reaches the public relay.
+ * The authenticated API repeats this enforcement for direct capability calls.
+ *
+ * Source: https://developers.openai.com/api/docs/guides/prompt-caching
+ */
+function enforcePromptCacheEnvelope(payload, envelope, modelScope) {
+    const model = nonEmpty(modelScope.wireModel)
+        ?.replace(/^openai\//, '')
+        .toLowerCase();
+    const claudeCacheControlFamily = ['anthropic', 'openrouter', 'bedrock'].includes(modelScope.upstreamProvider) &&
+        model?.includes('claude');
+    if (claudeCacheControlFamily) {
+        if (envelope.allowPromptCaching) {
+            rejectManagedRequest('managed inference broker has no prompt cache policy for the leased model');
+        }
+        if (containsObjectKey(payload, 'cache_control') ||
+            containsObjectKey(payload, 'prompt_cache_breakpoint') ||
+            payload.prompt_cache_key != null ||
+            payload.prompt_cache_options != null ||
+            payload.prompt_cache_retention != null) {
+            rejectManagedRequest('managed inference broker denied prompt caching outside the lease envelope');
+        }
+        return;
+    }
+    if (!supportsManagedPromptCaching(modelScope)) {
+        rejectManagedRequest('managed inference broker has no prompt cache policy for the leased model');
+    }
+    const breakpoints = objectKeyValues(payload, 'prompt_cache_breakpoint');
+    if (!envelope.allowPromptCaching) {
+        if (containsObjectKey(payload, 'cache_control') || breakpoints.length > 0) {
+            rejectManagedRequest('managed inference broker denied prompt caching outside the lease envelope');
+        }
+        delete payload.prompt_cache_key;
+        delete payload.prompt_cache_retention;
+        payload.prompt_cache_options = { mode: 'explicit' };
+        return;
+    }
+    if (payload.prompt_cache_key != null && !nonEmpty(payload.prompt_cache_key)) {
+        rejectManagedRequest('managed inference broker denied invalid prompt cache key');
+    }
+    if (payload.prompt_cache_retention != null) {
+        rejectManagedRequest('managed inference broker denied deprecated GPT-5.6 cache retention');
+    }
+    if (payload.prompt_cache_options != null) {
+        const options = payload.prompt_cache_options;
+        const keys = isPlainObject(options) ? Object.keys(options) : [];
+        if (!isPlainObject(options) ||
+            keys.some((key) => !['mode', 'ttl'].includes(key)) ||
+            (options.mode != null &&
+                (typeof options.mode !== 'string' || !['implicit', 'explicit'].includes(options.mode))) ||
+            (options.ttl != null && (typeof options.ttl !== 'string' || options.ttl !== '30m'))) {
+            rejectManagedRequest('managed inference broker denied invalid prompt cache options');
+        }
+    }
+    if (breakpoints.length > MAX_OPENAI_CACHE_BREAKPOINTS ||
+        breakpoints.some((breakpoint) => !isPlainObject(breakpoint) ||
+            Object.keys(breakpoint).length !== 1 ||
+            breakpoint.mode !== 'explicit')) {
+        rejectManagedRequest('managed inference broker denied invalid prompt cache breakpoint');
+    }
+}
+function isManagedRequestEnvelope(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const envelope = value;
+    const boundedPositiveInteger = (candidate, max) => Number.isSafeInteger(candidate) && Number(candidate) > 0 && Number(candidate) <= max;
+    const allowedEfforts = new Set(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
+    return Boolean(boundedPositiveInteger(envelope.maxInputBytes, 8 * 1024 * 1024) &&
+        boundedPositiveInteger(envelope.maxInputTokens, 1_000_000) &&
+        boundedPositiveInteger(envelope.maxOutputTokens, 1_000_000) &&
+        boundedPositiveInteger(envelope.maxReasoningTokens, 1_000_000) &&
+        boundedPositiveInteger(envelope.maxConcurrentRequests, 64) &&
+        boundedPositiveInteger(envelope.maxRequestsPerMinute, 10_000) &&
+        boundedPositiveInteger(envelope.maxTotalRequests, 100_000) &&
+        boundedPositiveInteger(envelope.maxResponseBytes, 128 * 1024 * 1024) &&
+        typeof envelope.allowStreaming === 'boolean' &&
+        typeof envelope.allowPromptCaching === 'boolean' &&
+        Array.isArray(envelope.allowedReasoningEfforts) &&
+        envelope.allowedReasoningEfforts.length > 0 &&
+        envelope.allowedReasoningEfforts.every((effort) => allowedEfforts.has(effort)) &&
+        (envelope.defaultReasoningEffort == null ||
+            (allowedEfforts.has(envelope.defaultReasoningEffort) &&
+                envelope.allowedReasoningEfforts.includes(envelope.defaultReasoningEffort))) &&
+        (envelope.selectedReasoningEffort == null
+            ? envelope.requestedReasoningEffort == null && envelope.reasoningSelectionSource == null
+            : allowedEfforts.has(envelope.selectedReasoningEffort) &&
+                envelope.allowedReasoningEfforts.includes(envelope.selectedReasoningEffort) &&
+                (envelope.reasoningSelectionSource === 'request' ||
+                    envelope.reasoningSelectionSource === 'policy_default')) &&
+        (envelope.reasoningSelectionSource !== 'request' ||
+            envelope.requestedReasoningEffort === envelope.selectedReasoningEffort) &&
+        (envelope.reasoningSelectionSource !== 'policy_default' ||
+            envelope.defaultReasoningEffort === envelope.selectedReasoningEffort));
+}
+function constantTimeStringEqual(value, expected) {
+    if (typeof value !== 'string')
+        return false;
+    const left = Buffer.from(value);
+    const right = Buffer.from(expected);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function providerLocalModelId(harnessModelId) {
+    const separator = harnessModelId.indexOf('/');
+    if (separator <= 0 || separator === harnessModelId.length - 1)
+        return null;
+    return harnessModelId.slice(separator + 1);
+}
+function responseHeaders(headers) {
+    const out = {};
+    // Fetch implementations expose the decoded response body while retaining
+    // the origin response's representation metadata. Replaying those headers
+    // through the daemon-local HTTP hop makes the child decode the body a second
+    // time (and makes the encoded Content-Length describe the wrong bytes).
+    // Preserve identity responses byte-for-byte, but when a content coding was
+    // applied, describe the decoded representation that responseBody delivers.
+    const contentEncoding = headers.get('content-encoding')?.trim().toLowerCase();
+    const bodyWasDecoded = Boolean(contentEncoding && contentEncoding !== 'identity');
+    headers.forEach((value, name) => {
+        if (name === 'connection' || name === 'transfer-encoding')
+            return;
+        if (bodyWasDecoded && (name === 'content-encoding' || name === 'content-length'))
+            return;
+        out[name] = value;
+    });
+    return out;
+}
+async function* responseBody(response, maxBytes, onComplete = () => { }) {
+    if (!response.body) {
+        onComplete();
+        return;
+    }
+    let totalBytes = 0;
+    const bounded = (value) => {
+        totalBytes += value.byteLength;
+        if (maxBytes != null && totalBytes > maxBytes) {
+            throw new Error('managed inference broker response byte envelope exceeded');
+        }
+        return value;
+    };
+    const stream = response.body;
+    try {
+        if (typeof stream[Symbol.asyncIterator] === 'function') {
+            for await (const value of stream)
+                yield bounded(value);
+            return;
+        }
+        const reader = response.body.getReader();
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                if (value)
+                    yield bounded(value);
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    finally {
+        onComplete();
+    }
+}