@tokenfactory/acc-runner 0.42.0 → 0.43.0

package/dist/engines/account-probe.d.ts

@@ -24,6 +24,15 @@
  * Wiring this scheduler onto the companion's identity broadcaster is a follow-up
  * (companion.ts is outside this track's file scope); this module is the engine
  * primitive that follow-up drives.
+ *
+ * AX-H1 (MACHINE-CAPABILITIES) rides this cadence rather than adding a second
+ * one. `onCapabilityTick` is an OPTIONAL hook called once per probe, after the
+ * identity is emitted, with the trigger that fired and the account key the probe
+ * resolved. That ordering is deliberate: the account key is what tells the
+ * capability reporter its engine rows just went stale, so the identity has to be
+ * resolved first. The hook is best-effort and awaited on the same serial chain —
+ * a slow or throwing hook delays the next probe rather than racing it, and can
+ * never fail an identity broadcast.
  */
 import type { EngineAccountIdentity } from "./types.js";
 /** Which cadence trigger fired a given probe. */
@@ -69,6 +78,21 @@ export interface AccountProbeSchedulerDeps {
     timer?: ProbeTimer;
     /** Best-effort audit/log sink for detected swaps + probe errors. */
     onLog?: (line: string) => void;
+    /**
+     * AX-H1 (MACHINE-CAPABILITIES): optional per-probe hook, called once after each
+     * identity emit with the same trigger and the account key that probe resolved.
+     * It exists so the host-capability probe REUSES this cadence instead of running
+     * a loop of its own — there is exactly one probe loop per host, and it is this
+     * one. Awaited on the serial chain, and a rejection is logged and swallowed: a
+     * capability report is telemetry and must never break identity broadcasting.
+     */
+    onCapabilityTick?: (args: {
+        trigger: AccountProbeTrigger;
+        accountKey: string;
+        identity: EngineAccountIdentity;
+        seq: number;
+        at: number;
+    }) => void | Promise<void>;
 }
 /**
  * Drives the four-trigger account-probe cadence. Probes are SERIALIZED onto one

package/dist/engines/account-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-probe.d.ts","sourceRoot":"","sources":["../../src/engines/account-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGxD,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,CAAC;AAE1F,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iDAAiD;IACjD,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,iCAAiC;IACjC,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAOD,MAAM,WAAW,yBAAyB;IACxC,2GAA2G;IAC3G,KAAK,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5C,4FAA4F;IAC5F,IAAI,EAAE,CAAC,SAAS,EAAE,qBAAqB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,oEAAoE;IACpE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAiBpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,IAAI,CAAsC;IAClD,OAAO,CAAC,iBAAiB,CAA4B;IACrD,mFAAmF;IACnF,OAAO,CAAC,IAAI,CAAoC;gBAEnB,IAAI,EAAE,yBAAyB;IAQ5D,iEAAiE;IACjE,YAAY,IAAI,qBAAqB,GAAG,IAAI;IAI5C,8EAA8E;IAC9E,KAAK,IAAI,IAAI;IAOb;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAMhC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAQrB,iEAAiE;IACjE,IAAI,IAAI,IAAI;IAQZ,+DAA+D;IACzD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,eAAe;IAQvB,0EAA0E;IAC1E,OAAO,CAAC,OAAO;YAID,QAAQ;CA2BvB"}
+{"version":3,"file":"account-probe.d.ts","sourceRoot":"","sources":["../../src/engines/account-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGxD,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,CAAC;AAE1F,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iDAAiD;IACjD,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,iCAAiC;IACjC,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAOD,MAAM,WAAW,yBAAyB;IACxC,2GAA2G;IAC3G,KAAK,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5C,4FAA4F;IAC5F,IAAI,EAAE,CAAC,SAAS,EAAE,qBAAqB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,oEAAoE;IACpE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,OAAO,EAAE,mBAAmB,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,qBAAqB,CAAC;QAChC,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;KACZ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAiBpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,IAAI,CAAsC;IAClD,OAAO,CAAC,iBAAiB,CAA4B;IACrD,mFAAmF;IACnF,OAAO,CAAC,IAAI,CAAoC;gBAEnB,IAAI,EAAE,yBAAyB;IAQ5D,iEAAiE;IACjE,YAAY,IAAI,qBAAqB,GAAG,IAAI;IAI5C,8EAA8E;IAC9E,KAAK,IAAI,IAAI;IAOb;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAMhC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAQrB,iEAAiE;IACjE,IAAI,IAAI,IAAI;IAQZ,+DAA+D;IACzD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,eAAe;IAQvB,0EAA0E;IAC1E,OAAO,CAAC,OAAO;YAID,QAAQ;CA6CvB"}

package/dist/engines/account-probe.js

@@ -1,4 +1,4 @@
-import { accountChanged } from "./account-identity.js";
+import { accountChanged, accountKey } from "./account-identity.js";
 const DEFAULT_TIMER = {
     setTimer: (fn, ms) => setTimeout(fn, ms),
     clearTimer: (h) => clearTimeout(h),
@@ -129,6 +129,23 @@ export class AccountProbeScheduler {
             this.deps.onLog?.(`[acc-runner] account identity emit failed (${trigger}): ${err?.message ?? String(err)}`);
         }
         this.last = identity;
+        // AX-H1: the host-capability probe rides THIS tick. Runs after the emit so a
+        // slow capability probe can never delay a login-swap broadcast, and inside
+        // the same serial chain so it cannot overlap itself.
+        if (this.deps.onCapabilityTick) {
+            try {
+                await this.deps.onCapabilityTick({
+                    trigger,
+                    accountKey: accountKey(identity),
+                    identity,
+                    seq,
+                    at,
+                });
+            }
+            catch (err) {
+                this.deps.onLog?.(`[acc-runner] machine-capability tick failed (${trigger}): ${err?.message ?? String(err)}`);
+            }
+        }
     }
 }
 //# sourceMappingURL=account-probe.js.map

package/dist/engines/account-probe.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-probe.js","sourceRoot":"","sources":["../../src/engines/account-probe.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA+BvD,MAAM,aAAa,GAAe;IAChC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAkC,CAAC;CACpE,CAAC;AAqBF;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAiBH;IAhBZ,WAAW,CAAS;IACpB,WAAW,CAAS;IACpB,qBAAqB,CAAS;IAC9B,GAAG,CAAe;IAClB,KAAK,CAAa;IAE3B,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAChB,MAAM,GAAG,KAAK,CAAC;IACf,eAAe,GAAY,IAAI,CAAC;IAChC,GAAG,GAAG,CAAC,CAAC;IACR,IAAI,GAAiC,IAAI,CAAC;IAC1C,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACrD,mFAAmF;IAC3E,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,qBAAqB,IAAI,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,YAAY;QACV,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAe;QACvB,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,qBAAqB;YAAE,OAAO;QACpE,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,0EAA0E;IAClE,OAAO,CAAC,OAA4B;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAA4B;QACjD,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,+BAA+B,OAAO,aAAc,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,uCAAuC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAClH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,8CAA8C,OAAO,MAAO,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"account-probe.js","sourceRoot":"","sources":["../../src/engines/account-probe.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AA+BnE,MAAM,aAAa,GAAe;IAChC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAkC,CAAC;CACpE,CAAC;AAoCF;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAiBH;IAhBZ,WAAW,CAAS;IACpB,WAAW,CAAS;IACpB,qBAAqB,CAAS;IAC9B,GAAG,CAAe;IAClB,KAAK,CAAa;IAE3B,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAChB,MAAM,GAAG,KAAK,CAAC;IACf,eAAe,GAAY,IAAI,CAAC;IAChC,GAAG,GAAG,CAAC,CAAC;IACR,IAAI,GAAiC,IAAI,CAAC;IAC1C,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACrD,mFAAmF;IAC3E,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,qBAAqB,IAAI,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,YAAY;QACV,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAe;QACvB,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,qBAAqB;YAAE,OAAO;QACpE,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,0EAA0E;IAClE,OAAO,CAAC,OAA4B;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAA4B;QACjD,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,+BAA+B,OAAO,aAAc,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,uCAAuC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAClH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,8CAA8C,OAAO,MAAO,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;QACrB,6EAA6E;QAC7E,2EAA2E;QAC3E,qDAAqD;QACrD,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;oBAC/B,OAAO;oBACP,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;oBAChC,QAAQ;oBACR,GAAG;oBACH,EAAE;iBACH,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,gDAAgD,OAAO,MAAO,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACtG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/machine-capabilities/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * AX-H1 (MACHINE-CAPABILITIES): probe and record what a machine can actually do.
+ * AUTH_APPROVAL_BRIEF.md §7, Phase H, gap G-17.
+ *
+ * Three modules, one rule (brief §7.1 — no credential ever transits ACC; presence
+ * and identity only):
+ *
+ *   types.ts   the CLOSED field set. Presence, identity, provenance. Nothing else.
+ *   redact.ts  the boundary: rebuild + mask every record before it leaves the host.
+ *   probe.ts   the host probe (gh / git / engine logins), read-only and bounded.
+ *   report.ts  the gate + the write, driven by somebody ELSE's cadence.
+ *
+ * The cadence is the AS-1 account probe (engines/account-probe.ts), reused rather
+ * than duplicated: `AccountProbeScheduler` calls the reporter on each of its four
+ * triggers, so this package still has exactly one probe loop on a host.
+ */
+export { HOST_TOOLS, type EngineCapability, type HostTool, type MachineCapabilityReport, type MachineCapabilitySnapshot, type ToolCapability, } from "./types.js";
+export { CREDENTIAL_SHAPES, looksLikeCredential, safeScopes, safeText, sanitizeEngine, sanitizeSnapshot, sanitizeTool, } from "./redact.js";
+export { PROBE_TIMEOUT_MS, parseGhAuthStatus, parseVersion, probeMachineCapabilities, type MachineCapabilityProbeDeps, type ProbeExec, type ProbeExecResult, } from "./probe.js";
+export { DEFAULT_PROBE_MIN_INTERVAL_MS, DEFAULT_REFRESH_MIN_INTERVAL_MS, MachineCapabilityReporter, recordMachineCapabilities, snapshotFingerprint, type MachineCapabilityReporterDeps, type MachineCapabilityTickOutcome, type MachineCapabilityTransport, } from "./report.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/machine-capabilities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/machine-capabilities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC"}

package/dist/machine-capabilities/index.js

@@ -0,0 +1,21 @@
+/**
+ * AX-H1 (MACHINE-CAPABILITIES): probe and record what a machine can actually do.
+ * AUTH_APPROVAL_BRIEF.md §7, Phase H, gap G-17.
+ *
+ * Three modules, one rule (brief §7.1 — no credential ever transits ACC; presence
+ * and identity only):
+ *
+ *   types.ts   the CLOSED field set. Presence, identity, provenance. Nothing else.
+ *   redact.ts  the boundary: rebuild + mask every record before it leaves the host.
+ *   probe.ts   the host probe (gh / git / engine logins), read-only and bounded.
+ *   report.ts  the gate + the write, driven by somebody ELSE's cadence.
+ *
+ * The cadence is the AS-1 account probe (engines/account-probe.ts), reused rather
+ * than duplicated: `AccountProbeScheduler` calls the reporter on each of its four
+ * triggers, so this package still has exactly one probe loop on a host.
+ */
+export { HOST_TOOLS, } from "./types.js";
+export { CREDENTIAL_SHAPES, looksLikeCredential, safeScopes, safeText, sanitizeEngine, sanitizeSnapshot, sanitizeTool, } from "./redact.js";
+export { PROBE_TIMEOUT_MS, parseGhAuthStatus, parseVersion, probeMachineCapabilities, } from "./probe.js";
+export { DEFAULT_PROBE_MIN_INTERVAL_MS, DEFAULT_REFRESH_MIN_INTERVAL_MS, MachineCapabilityReporter, recordMachineCapabilities, snapshotFingerprint, } from "./report.js";
+//# sourceMappingURL=index.js.map

package/dist/machine-capabilities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/machine-capabilities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,GAIzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,aAAa,CAAC"}

package/dist/machine-capabilities/probe.d.ts

@@ -0,0 +1,61 @@
+import { type MachineCapabilitySnapshot } from "./types.js";
+/** One command invocation captured without throwing. */
+export interface ProbeExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+}
+/** The single I/O seam: run `bin args` and report what happened. Never throws. */
+export type ProbeExec = (bin: string, args: string[]) => Promise<ProbeExecResult>;
+/** Per-probe timeout. A capability probe must never hold up a cadence tick. */
+export declare const PROBE_TIMEOUT_MS = 5000;
+export interface MachineCapabilityProbeDeps {
+    /** Command runner (test seam). Defaults to a bounded, non-throwing execa. */
+    exec?: ProbeExec;
+    /** Host name (test seam). Defaults to os.hostname(). */
+    hostname?: () => string;
+    /** Engine ids to probe (test seam). Defaults to the chat-engine registry. */
+    engineIds?: () => string[];
+    /** Reported runner version (test seam). Defaults to the package version. */
+    runnerVersion?: string;
+    /** platform/arch (test seam). Default to process values. */
+    platform?: string;
+    arch?: string;
+}
+/**
+ * Extract the first dotted version triple from a `--version` line. Tolerant on
+ * purpose: `gh version 2.62.0 (2024-11-08)`, `git version 2.46.0`,
+ * `1.0.30 (Claude Code)` and a bare `2.4` all resolve; anything else is null
+ * rather than a guess (an invented version would make an "is this old enough?"
+ * question answerable and wrong).
+ */
+export declare function parseVersion(output: string): string | null;
+/**
+ * Parse `gh auth status` output. gh prints a human block per host:
+ *
+ *   github.com
+ *     ✓ Logged in to github.com account gaurav (keyring)
+ *     - Active account: true
+ *     - Git operations protocol: https
+ *     - Token: gho_************************************
+ *     - Token scopes: 'gist', 'read:org', 'repo'
+ *
+ * The `Token:` line is already elided by gh, and we do not read it either way —
+ * only the account, the host, and the scope labels. Tolerant of the older
+ * `Logged in to github.com as gaurav (…)` spelling, and of `--json`-less GHES
+ * output where the host is the bare first line.
+ */
+export declare function parseGhAuthStatus(output: string): {
+    account: string | null;
+    host: string | null;
+    scopes: string[];
+};
+/**
+ * Probe the whole host. Never throws and never rejects: a probe that fails is
+ * reported as an absent tool, because "we could not tell" and "it is not there"
+ * are both answers a user can act on, whereas an exception on a cadence tick is
+ * not. The result is passed through `sanitizeSnapshot` before it is returned, so
+ * a caller cannot obtain an unredacted snapshot from this module at all.
+ */
+export declare function probeMachineCapabilities(deps?: MachineCapabilityProbeDeps): Promise<MachineCapabilitySnapshot>;
+//# sourceMappingURL=probe.d.ts.map

package/dist/machine-capabilities/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/machine-capabilities/probe.ts"],"names":[],"mappings":"AAsCA,OAAO,EAGL,KAAK,yBAAyB,EAE/B,MAAM,YAAY,CAAC;AAEpB,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,kFAAkF;AAClF,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAElF,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,OAAQ,CAAC;AAqBtC,MAAM,WAAW,0BAA0B;IACzC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IACjD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAaA;AAkID;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,yBAAyB,CAAC,CAiBpC"}

package/dist/machine-capabilities/probe.js

@@ -0,0 +1,243 @@
+/**
+ * AX-H1 (MACHINE-CAPABILITIES): the host probe. Answers "what does THIS machine
+ * actually offer?" — gh, git, and each registered engine's login — so ACC can
+ * tell a user what their own machine can do instead of leaving that in the
+ * operator's head.
+ *
+ * WHAT IT READS, AND WHAT IT REFUSES TO READ. Every probe here is a read-only,
+ * short-timeout, local invocation of a tool's own status command:
+ *
+ *   gh    `gh --version`, `gh auth status`  — presence, version, whether the
+ *         credential works, the account login, the host, and the token's SCOPE
+ *         LABELS. `--show-token` is NEVER passed: the scopes are the authority,
+ *         and the authority is the answerable question ("can this machine open a
+ *         PR?"). The token is not read, so it cannot be sent. The unit suite
+ *         asserts no argv in this package contains `--show-token`.
+ *   git   `git --version`, `git config --get user.email` — presence, version and
+ *         the committing identity. Git has no host-level login of its own, so
+ *         `authenticated` is false and the credential-health question is answered
+ *         by the separate GIT-AUTH-ALERT `ls-remote` probe (git-auth/probe.ts),
+ *         which is where a remote round-trip belongs.
+ *   engines  the AS-1 `accountIdentity()` surface plus a `--version` presence
+ *         check. NOT a second credential probe: the identity is exactly what the
+ *         AS-1 cadence already computes, so the engine rows are a projection of
+ *         a fact this process already has.
+ *
+ * Nothing here reads a keychain, a token file, or an environment variable's
+ * VALUE. Every free-text field goes through redact.ts before it leaves the host.
+ *
+ * FULLY injectable (exec / hostname / engines / version) so the whole probe is
+ * exercised with zero real subprocesses.
+ */
+import { execa } from "execa";
+import os from "node:os";
+import { buildEnv } from "../bin-resolve.js";
+import { chatEngineIds, getChatEngine } from "../engines/registry.js";
+import { unknownAccountIdentity } from "../engines/account-identity.js";
+import { PACKAGE_VERSION } from "../pkg-version.js";
+import { sanitizeSnapshot } from "./redact.js";
+import { HOST_TOOLS, } from "./types.js";
+/** Per-probe timeout. A capability probe must never hold up a cadence tick. */
+export const PROBE_TIMEOUT_MS = 5_000;
+const defaultExec = async (bin, args) => {
+    try {
+        const res = await execa(bin, args, {
+            env: buildEnv(),
+            timeout: PROBE_TIMEOUT_MS,
+            reject: false,
+        });
+        return {
+            stdout: res.stdout ?? "",
+            stderr: res.stderr ?? "",
+            exitCode: res.exitCode ?? null,
+        };
+    }
+    catch (err) {
+        // A missing binary throws ENOENT rather than exiting non-zero. That is
+        // "absent", not "broken", and it is reported as such.
+        return { stdout: "", stderr: err?.message ?? "spawn failed", exitCode: null };
+    }
+};
+/**
+ * Extract the first dotted version triple from a `--version` line. Tolerant on
+ * purpose: `gh version 2.62.0 (2024-11-08)`, `git version 2.46.0`,
+ * `1.0.30 (Claude Code)` and a bare `2.4` all resolve; anything else is null
+ * rather than a guess (an invented version would make an "is this old enough?"
+ * question answerable and wrong).
+ */
+export function parseVersion(output) {
+    const m = /\b(\d+(?:\.\d+){1,3})\b/.exec(output ?? "");
+    return m ? m[1] : null;
+}
+/**
+ * Parse `gh auth status` output. gh prints a human block per host:
+ *
+ *   github.com
+ *     ✓ Logged in to github.com account gaurav (keyring)
+ *     - Active account: true
+ *     - Git operations protocol: https
+ *     - Token: gho_************************************
+ *     - Token scopes: 'gist', 'read:org', 'repo'
+ *
+ * The `Token:` line is already elided by gh, and we do not read it either way —
+ * only the account, the host, and the scope labels. Tolerant of the older
+ * `Logged in to github.com as gaurav (…)` spelling, and of `--json`-less GHES
+ * output where the host is the bare first line.
+ */
+export function parseGhAuthStatus(output) {
+    const text = output ?? "";
+    const account = /Logged in to \S+ account ([A-Za-z0-9._-]+)/.exec(text)?.[1] ??
+        /Logged in to \S+ as ([A-Za-z0-9._-]+)/.exec(text)?.[1] ??
+        null;
+    const host = /Logged in to (\S+?)(?: account| as)\b/.exec(text)?.[1] ?? null;
+    const scopeLine = /Token scopes:\s*(.+)/.exec(text)?.[1] ?? "";
+    const scopes = scopeLine
+        .split(",")
+        .map((s) => s.trim().replace(/^['"]|['"]$/g, ""))
+        .filter((s) => s.length > 0 && s !== "none");
+    return { account, host, scopes };
+}
+/** Probe `gh`: presence, version, whether it authenticates, and as whom. */
+async function probeGh(exec) {
+    const ver = await exec("gh", ["--version"]);
+    const present = ver.exitCode === 0;
+    const version = present ? parseVersion(ver.stdout) : null;
+    if (!present) {
+        return {
+            tool: "gh",
+            present: false,
+            version: null,
+            authenticated: false,
+            identity: null,
+            host: null,
+            scopes: [],
+            detail: "gh not installed (or not on PATH)",
+        };
+    }
+    // `gh auth status` is a LOCAL token check, not a GitHub API call (see gh.ts),
+    // so it is unbudgeted and safe to run on every capability probe.
+    const status = await exec("gh", ["auth", "status"]);
+    const authenticated = status.exitCode === 0;
+    // gh has printed the status block on stdout since 2.x and on stderr before
+    // that; read both so an older install still resolves an identity.
+    const { account, host, scopes } = parseGhAuthStatus(`${status.stdout}\n${status.stderr}`);
+    return {
+        tool: "gh",
+        present: true,
+        version,
+        authenticated,
+        identity: authenticated ? account : null,
+        host: authenticated ? host : null,
+        scopes: authenticated ? scopes : [],
+        detail: authenticated
+            ? `gh ${version ?? "?"} authenticated${account ? ` as ${account}` : ""}${host ? ` on ${host}` : ""}`
+            : `gh ${version ?? "?"} installed but not authenticated (run \`gh auth login\`)`,
+    };
+}
+/** Probe `git`: presence, version and the committing identity. */
+async function probeGit(exec) {
+    const ver = await exec("git", ["--version"]);
+    const present = ver.exitCode === 0;
+    if (!present) {
+        return {
+            tool: "git",
+            present: false,
+            version: null,
+            authenticated: false,
+            identity: null,
+            host: null,
+            scopes: [],
+            detail: "git not installed (or not on PATH)",
+        };
+    }
+    const version = parseVersion(ver.stdout);
+    const email = await exec("git", ["config", "--get", "user.email"]);
+    const identity = email.exitCode === 0 ? email.stdout.trim() || null : null;
+    return {
+        tool: "git",
+        present: true,
+        version,
+        // git holds no host login of its own; remote credential health is the
+        // GIT-AUTH-ALERT ls-remote probe's job, and duplicating it here would mean
+        // a second remote round trip on every cadence tick.
+        authenticated: false,
+        identity,
+        host: null,
+        scopes: [],
+        detail: identity
+            ? `git ${version ?? "?"} committing as ${identity}`
+            : `git ${version ?? "?"} (no user.email configured)`,
+    };
+}
+/**
+ * Probe one engine: is the binary there, and who is it logged in as? The identity
+ * comes from the AS-1 `accountIdentity()` surface — this is a PROJECTION of the
+ * probe the cadence already runs, not a second credential probe. An engine that
+ * predates AS-1 degrades to the honest unknown-account identity rather than being
+ * reported as logged out.
+ */
+async function probeEngine(engineId, exec) {
+    let binary = engineId;
+    let channel = "none";
+    let identity = unknownAccountIdentity({
+        engineId,
+        channel: "none",
+        detail: `engine ${engineId} is not registered in this runner build`,
+    });
+    try {
+        const engine = getChatEngine(engineId);
+        binary = engine.binary;
+        channel = engine.authMode;
+        identity = engine.accountIdentity
+            ? await engine.accountIdentity()
+            : unknownAccountIdentity({
+                engineId: engine.id,
+                channel: engine.authMode,
+                detail: "no account-identity probe on this engine build",
+            });
+    }
+    catch {
+        // An unknown / unresolvable engine id is reported as absent, never thrown:
+        // one bad engine must not cost the whole snapshot.
+    }
+    const ver = await exec(binary, ["--version"]);
+    const present = ver.exitCode === 0;
+    return {
+        engine_id: engineId,
+        present,
+        version: present ? parseVersion(ver.stdout) : null,
+        // "Logged in" means a REAL named account resolved. The AS-1 honest-unknown
+        // identity always carries a synthetic account, so presence of that id is not
+        // evidence of a login — the email is.
+        logged_in: identity.account_email !== null,
+        channel: identity.channel ?? channel,
+        account_email: identity.account_email,
+        plan_hint: identity.plan_hint,
+        synthetic_account: identity.synthetic_account,
+        detail: present
+            ? identity.detail
+            : `${engineId} not installed (or not on PATH); ${identity.detail}`,
+    };
+}
+/**
+ * Probe the whole host. Never throws and never rejects: a probe that fails is
+ * reported as an absent tool, because "we could not tell" and "it is not there"
+ * are both answers a user can act on, whereas an exception on a cadence tick is
+ * not. The result is passed through `sanitizeSnapshot` before it is returned, so
+ * a caller cannot obtain an unredacted snapshot from this module at all.
+ */
+export async function probeMachineCapabilities(deps = {}) {
+    const exec = deps.exec ?? defaultExec;
+    const engineIds = (deps.engineIds ?? chatEngineIds)();
+    const tools = await Promise.all(HOST_TOOLS.map((tool) => (tool === "gh" ? probeGh(exec) : probeGit(exec))));
+    const engines = await Promise.all(engineIds.map((id) => probeEngine(id, exec)));
+    return sanitizeSnapshot({
+        machine: (deps.hostname ?? (() => os.hostname()))() || "unknown-host",
+        platform: deps.platform ?? process.platform,
+        arch: deps.arch ?? process.arch,
+        runner_version: deps.runnerVersion ?? PACKAGE_VERSION,
+        tools,
+        engines,
+    });
+}
+//# sourceMappingURL=probe.js.map

package/dist/machine-capabilities/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/machine-capabilities/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,UAAU,GAIX,MAAM,YAAY,CAAC;AAYpB,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,MAAM,WAAW,GAAc,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YACjC,GAAG,EAAE,QAAQ,EAAE;YACf,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,sDAAsD;QACtD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAG,GAAa,EAAE,OAAO,IAAI,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3F,CAAC;AACH,CAAC,CAAC;AAgBF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAK9C,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,MAAM,OAAO,GACX,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;IACP,MAAM,IAAI,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7E,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,SAAS;SACrB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,OAAO,CAAC,IAAe;IACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,mCAAmC;SAC5C,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC5C,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,CACjD,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CACrC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,OAAO;QACP,aAAa;QACb,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACxC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACjC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACnC,MAAM,EAAE,aAAa;YACnB,CAAC,CAAC,MAAM,OAAO,IAAI,GAAG,iBAAiB,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAClE,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EACzB,EAAE;YACJ,CAAC,CAAC,MAAM,OAAO,IAAI,GAAG,0DAA0D;KACnF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,QAAQ,CAAC,IAAe;IACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,oCAAoC;SAC7C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,IAAI;QACb,OAAO;QACP,sEAAsE;QACtE,2EAA2E;QAC3E,oDAAoD;QACpD,aAAa,EAAE,KAAK;QACpB,QAAQ;QACR,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,OAAO,OAAO,IAAI,GAAG,kBAAkB,QAAQ,EAAE;YACnD,CAAC,CAAC,OAAO,OAAO,IAAI,GAAG,6BAA6B;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAe;IAC1D,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,OAAO,GAAgC,MAAM,CAAC;IAClD,IAAI,QAAQ,GAAG,sBAAsB,CAAC;QACpC,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,UAAU,QAAQ,yCAAyC;KACpE,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1B,QAAQ,GAAG,MAAM,CAAC,eAAe;YAC/B,CAAC,CAAC,MAAM,MAAM,CAAC,eAAe,EAAE;YAChC,CAAC,CAAC,sBAAsB,CAAC;gBACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,OAAO,EAAE,MAAM,CAAC,QAAQ;gBACxB,MAAM,EAAE,gDAAgD;aACzD,CAAC,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,mDAAmD;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;IACnC,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QAClD,2EAA2E;QAC3E,6EAA6E;QAC7E,sCAAsC;QACtC,SAAS,EAAE,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC1C,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,OAAO;QACpC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,GAAG,QAAQ,oCAAoC,QAAQ,CAAC,MAAM,EAAE;KACrE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAmC,EAAE;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,EAAE,CAAC;IAEtD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAC3E,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAEhF,OAAO,gBAAgB,CAAC;QACtB,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,cAAc;QACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;QAC/B,cAAc,EAAE,IAAI,CAAC,aAAa,IAAI,eAAe;QACrD,KAAK;QACL,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/machine-capabilities/redact.d.ts

@@ -0,0 +1,42 @@
+import { type EngineCapability, type MachineCapabilitySnapshot, type ToolCapability } from "./types.js";
+/**
+ * Credential SHAPES a developer machine actually holds, plus the two generic
+ * carriers. Mirrors the regexes in `acc.machine_capability_material_free`
+ * (0310 §2); `tests/unit/t1785160000000035-machine-capabilities.test.ts` asserts
+ * the mirror by running the same vectors through both spellings.
+ */
+export declare const CREDENTIAL_SHAPES: readonly RegExp[];
+/** True when `value` contains anything shaped like a credential. */
+export declare function looksLikeCredential(value: string | null | undefined): boolean;
+/**
+ * Mask + bound one free-text field. Applies `maskGitCredentials` first (the
+ * GIT-AUTH-ALERT masker, so URL userinfo and bare gh tokens are rewritten rather
+ * than dropped), then DROPS the value entirely if a credential shape survived —
+ * an unmaskable value is not worth a field. Length-bounded so a whitelisted
+ * field cannot become the smuggling channel.
+ */
+export declare function safeText(value: string | null | undefined, maxLength: number): string | null;
+/**
+ * Bound, dedupe and sort gh scope labels. Sorted so two snapshots of the same
+ * machine compare equal regardless of the order gh printed them, which is what
+ * makes the "did anything change?" fingerprint in report.ts stable. A label that
+ * looks like a credential is dropped rather than masked — a scope label is a
+ * short well-known word, so an unmaskable one is not a scope.
+ */
+export declare function safeScopes(scopes: readonly string[] | null | undefined): string[];
+/** Rebuild one tool row from the closed field set. */
+export declare function sanitizeTool(tool: ToolCapability): ToolCapability;
+/** Rebuild one engine row from the closed field set. */
+export declare function sanitizeEngine(engine: EngineCapability): EngineCapability;
+/**
+ * Rebuild a whole snapshot. The ONLY function the reporter is allowed to send
+ * the output of — `recordMachineCapabilities` calls it unconditionally, even on a
+ * snapshot this package built itself, because the point is that no future probe
+ * can add a field that bypasses it.
+ *
+ * Rows for tools outside `HOST_TOOLS` and engines with a blank id are dropped:
+ * the server-side whitelist would drop them anyway, and sending them would make
+ * the local snapshot disagree with the recorded one.
+ */
+export declare function sanitizeSnapshot(snapshot: MachineCapabilitySnapshot): MachineCapabilitySnapshot;
+//# sourceMappingURL=redact.d.ts.map

package/dist/machine-capabilities/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/machine-capabilities/redact.ts"],"names":[],"mappings":"AA6BA,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAkB9C,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAG7E;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAMf;AAOD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAWjF;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAWjE;AAED,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAYzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,CAgB3B"}