@velum-labs/routekit-daemon 1.2.0 → 1.3.0

package/README.md

@@ -17,3 +17,11 @@ primary and `runRouteKitDaemonWorker` in cluster workers.
 Applications normally use it through `@velum-labs/routekit`. Tests and specialized
 hosts can acquire a scoped gateway generation from `@velum-labs/routekit-daemon/effect`
 without claiming the singleton service record.
+
+`launcher.prepare` discovers a named manifest upward from the requested launch
+working directory and returns a memory-only gateway credential bound to that
+repository/profile pair. The singleton proxy projects that trusted context to
+the read-only compositional policy reader per request; it never derives a
+repository from the daemon-global router config or accepts an untrusted path
+header. Selecting one never writes the repository, durable token store,
+daemon-global config, or daemon-global activation store.

package/dist/effect/daemon-live.js

@@ -31,6 +31,7 @@ import { DaemonState } from "../daemon-state-context.js";
 import { DataPlane } from "../data-plane-context.js";
 import { EvalSessions } from "../services/eval-session/service.js";
 import { Generations } from "../services/generations/service.js";
+import { LauncherSessions } from "../services/launcher-session/service.js";
 import { Leaderboard } from "../leaderboard-context.js";
 import { Sidecar } from "../sidecar-context.js";
 import { Telemetry } from "../services/telemetry/service.js";
@@ -42,9 +43,7 @@ class DaemonFoundation extends Context.Service()("@velum-labs/routekit-daemon/Da
 const prepareFoundation = (options) => Effect.acquireRelease(Effect.tryPromise({
     try: async () => {
         const preflight = await prepareDaemonBootstrap(options);
-        const previous = preflight.hosted === undefined
-            ? preflight.store.read(ROUTEKIT_DAEMON_KIND)
-            : undefined;
+        const previous = preflight.hosted === undefined ? preflight.store.read(ROUTEKIT_DAEMON_KIND) : undefined;
         if (preflight.hosted === undefined &&
             previous !== undefined &&
             previous.pid !== process.pid &&
@@ -112,6 +111,7 @@ const acquireRunningDaemon = Effect.fn("Daemon.acquireRunning")(function* (optio
     const generations = yield* Generations;
     const gateway = yield* ActiveGateway;
     const evalSessions = yield* EvalSessions;
+    const launcherSessions = yield* LauncherSessions;
     const tokens = yield* Tokens;
     const telemetry = yield* Telemetry;
     const auth = yield* AccountAuth;
@@ -134,6 +134,9 @@ const acquireRunningDaemon = Effect.fn("Daemon.acquireRunning")(function* (optio
         port: options.port ?? 8080,
         authToken: tokens.dataAuth.token,
         resolveDataPrincipal: (presented) => {
+            const launcherPrincipal = launcherSessions.resolve(presented);
+            if (launcherPrincipal !== undefined)
+                return launcherPrincipal;
             const evalPrincipal = evalSessions.resolve(presented);
             if (evalPrincipal !== undefined)
                 return evalPrincipal;
@@ -146,7 +149,11 @@ const acquireRunningDaemon = Effect.fn("Daemon.acquireRunning")(function* (optio
     yield* Effect.addFinalizer(() => proxy.drain(foundation.drainGraceMs).pipe(Effect.ignore));
     const portless = foundation.hosted === undefined
         ? yield* Effect.acquireRelease(Effect.tryPromise({
-            try: () => createPortlessSession(options.portless ?? foundation.env.ROUTEKIT_PORTLESS !== "0", { project: ROUTEKIT_PRODUCT, ownerLabel: "routekit-daemon", bareNames: [] }),
+            try: () => createPortlessSession(options.portless ?? foundation.env.ROUTEKIT_PORTLESS !== "0", {
+                project: ROUTEKIT_PRODUCT,
+                ownerLabel: "routekit-daemon",
+                bareNames: []
+            }),
             catch: toRouteKitFailure
         }), (session) => Effect.sync(() => {
             if (session.enabled)
@@ -265,7 +272,10 @@ const acquireRunningDaemon = Effect.fn("Daemon.acquireRunning")(function* (optio
     });
     const reload = Effect.gen(function* () {
         const document = canonicalConfigDocument(foundation.configPath);
-        yield* generations.replace(foundation.runtimeState.config, document, { write: false, configRevision: true });
+        yield* generations.replace(foundation.runtimeState.config, document, {
+            write: false,
+            configRevision: true
+        });
     });
     return DaemonRuntime.of({
         record,
@@ -292,9 +302,7 @@ export function daemonLive(options) {
         : createHostedCliproxySidecar(value.hosted.sidecarRequest)), (sidecar) => sidecar.close.pipe(Effect.ignore)))), Layer.unwrap(Effect.map(DaemonFoundation, (value) => Tokens.layer({
         home: value.home,
         ...(options.authToken === undefined ? {} : { authToken: options.authToken }),
-        ...(options.authTokenFile === undefined
-            ? {}
-            : { authTokenFile: options.authTokenFile })
+        ...(options.authTokenFile === undefined ? {} : { authTokenFile: options.authTokenFile })
     }))), Layer.unwrap(Effect.map(DaemonFoundation, (value) => Telemetry.layer({
         home: value.home,
         env: value.env,
@@ -319,7 +327,7 @@ export function daemonLive(options) {
                 });
             }
         });
-    }), (leaderboard) => Effect.sync(() => leaderboard.rollups.flush())))), EvalSessions.layer()).pipe(Layer.provideMerge(platform));
+    }), (leaderboard) => Effect.sync(() => leaderboard.rollups.flush())))), EvalSessions.layer(), LauncherSessions.layer()).pipe(Layer.provideMerge(platform));
     const staticServices = Layer.mergeAll(Layer.effect(DaemonEnv, Effect.map(DaemonFoundation, (value) => DaemonEnv.of({
         home: value.home,
         configPath: value.configPath,

package/dist/effect-api.d.ts

@@ -18,6 +18,7 @@ export { DaemonState } from "./daemon-state-context.js";
 export type { DataPlaneValue } from "./data-plane-context.js";
 export { DataPlane } from "./data-plane-context.js";
 export { EvalSessions } from "./services/eval-session/service.js";
+export { LauncherSessions } from "./services/launcher-session/service.js";
 export type { GatewayGenerationOptions, GatewayGenerationRedeemResetOptions, GatewayGenerationRedeemResetResponse, RunningGatewayGeneration } from "./services/gateway-generation/service.js";
 export { startGatewayGenerationEffect } from "./services/gateway-generation/service.js";
 export type { DaemonGenerationHooks } from "./services/generations/service.js";

package/dist/effect-api.js

@@ -10,6 +10,7 @@ export { DaemonPolicy } from "./daemon-policy-context.js";
 export { DaemonState } from "./daemon-state-context.js";
 export { DataPlane } from "./data-plane-context.js";
 export { EvalSessions } from "./services/eval-session/service.js";
+export { LauncherSessions } from "./services/launcher-session/service.js";
 export { startGatewayGenerationEffect } from "./services/gateway-generation/service.js";
 export { Generations } from "./services/generations/service.js";
 export { Leaderboard } from "./leaderboard-context.js";

package/dist/eval-routing-policy.d.ts

@@ -2,4 +2,4 @@ import { type CompositionalRoutingPolicyReader } from "@velum-labs/routekit-gate
 /** Daemon-owned location for the compact policy artifact consumed online. */
 export declare function evalRoutingSnapshotDirectory(routekitHome: string): string;
 /** Read the authoritative routing activation without restarting router generations. */
-export declare function makeCompositionalRoutingPolicyReader(routekitHome: string): CompositionalRoutingPolicyReader;
+export declare function makeCompositionalRoutingPolicyReader(routekitHome: string, defaultRepositoryRoot?: string): CompositionalRoutingPolicyReader;

package/dist/eval-routing-policy.js

@@ -1,21 +1,101 @@
 import { join } from "node:path";
+import { loadRepositoryRoutingProfile, ROUTING_PROFILE_DIRECTORY } from "@velum-labs/routekit-config";
+import { AnyPublishedRoutingActivation, assertPublishedRoutingActivation, assertPublishedRoutingActivationV3 } from "@velum-labs/routekit-eval-contracts";
 import { makeRoutingActivationStore } from "@velum-labs/routekit-eval-store/effect";
 import { RoutingPolicyReadError } from "@velum-labs/routekit-gateway";
-import { Effect } from "effect";
+import { Effect, FileSystem, Schema } from "effect";
 /** Daemon-owned location for the compact policy artifact consumed online. */
 export function evalRoutingSnapshotDirectory(routekitHome) {
     return join(routekitHome, "eval");
 }
 /** Read the authoritative routing activation without restarting router generations. */
-export function makeCompositionalRoutingPolicyReader(routekitHome) {
+export function makeCompositionalRoutingPolicyReader(routekitHome, defaultRepositoryRoot) {
     const snapshots = makeRoutingActivationStore(evalRoutingSnapshotDirectory(routekitHome));
     return {
-        getActivation: () => snapshots.readDeployment().pipe(Effect.map((deployment) => deployment.authoritative?.activation), Effect.catch((currentCause) => snapshots
-            .readPrevious()
-            .pipe(Effect.flatMap((previous) => previous === undefined ? Effect.fail(currentCause) : Effect.succeed(previous)))), Effect.mapError((cause) => new RoutingPolicyReadError({
-            profileId: "*",
-            message: "failed to read the authoritative routing activation",
-            cause
-        })))
+        getActivation: (profileName, requestRepositoryRoot) => {
+            const repositoryRoot = requestRepositoryRoot ?? defaultRepositoryRoot;
+            return profileName === undefined
+                ? Effect.gen(function* () {
+                    if (repositoryRoot !== undefined) {
+                        const fs = yield* FileSystem.FileSystem;
+                        if (yield* fs.exists(join(repositoryRoot, ROUTING_PROFILE_DIRECTORY))) {
+                            return yield* new RoutingPolicyReadError({
+                                profileId: "*",
+                                message: "repository routing profiles require an explicit profile selector"
+                            });
+                        }
+                    }
+                    return yield* snapshots.readDeployment().pipe(Effect.map((deployment) => deployment.authoritative?.activation), Effect.catch((currentCause) => snapshots
+                        .readPrevious()
+                        .pipe(Effect.flatMap((previous) => previous === undefined ? Effect.fail(currentCause) : Effect.succeed(previous)))), Effect.mapError((cause) => new RoutingPolicyReadError({
+                        profileId: "*",
+                        message: "failed to read the authoritative routing activation",
+                        cause
+                    })));
+                }).pipe(Effect.mapError((cause) => cause instanceof RoutingPolicyReadError
+                    ? cause
+                    : new RoutingPolicyReadError({
+                        profileId: "*",
+                        message: "failed to inspect repository routing profiles",
+                        cause
+                    })))
+                : Effect.gen(function* () {
+                    if (repositoryRoot === undefined) {
+                        return yield* new RoutingPolicyReadError({
+                            profileId: profileName,
+                            message: "named routing profiles require trusted repository context from launcher preparation or the host policy reader"
+                        });
+                    }
+                    const loaded = yield* Effect.try({
+                        try: () => loadRepositoryRoutingProfile({
+                            repositoryRoot,
+                            name: profileName
+                        }),
+                        catch: (cause) => new RoutingPolicyReadError({
+                            profileId: profileName,
+                            message: `failed to resolve repository routing profile ${JSON.stringify(profileName)}`,
+                            cause
+                        })
+                    });
+                    const fs = yield* FileSystem.FileSystem;
+                    const raw = yield* fs.readFileString(loaded.activationPath).pipe(Effect.mapError((cause) => new RoutingPolicyReadError({
+                        profileId: profileName,
+                        message: `failed to read repository routing profile activation ${JSON.stringify(loaded.activationPath)}`,
+                        cause
+                    })));
+                    const json = yield* Effect.try({
+                        try: () => JSON.parse(raw),
+                        catch: (cause) => new RoutingPolicyReadError({
+                            profileId: profileName,
+                            message: `repository routing profile activation is not valid JSON`,
+                            cause
+                        })
+                    });
+                    const activation = yield* Schema.decodeUnknownEffect(AnyPublishedRoutingActivation)(json).pipe(Effect.mapError((cause) => new RoutingPolicyReadError({
+                        profileId: profileName,
+                        message: "repository routing profile activation has the wrong shape",
+                        cause
+                    })));
+                    yield* Effect.try({
+                        try: () => {
+                            if (activation.version === 2) {
+                                assertPublishedRoutingActivation(activation);
+                            }
+                            else {
+                                assertPublishedRoutingActivationV3(activation);
+                            }
+                            if (JSON.stringify(activation.objective) !== JSON.stringify(loaded.profile.objective)) {
+                                throw new Error("routing profile objective does not match its activation objective");
+                            }
+                        },
+                        catch: (cause) => new RoutingPolicyReadError({
+                            profileId: profileName,
+                            message: "repository routing profile activation is invalid",
+                            cause
+                        })
+                    });
+                    return activation;
+                });
+        }
     };
 }

package/dist/eval-routing-service.js

@@ -109,10 +109,12 @@ export class EvalRoutingApplicationService {
             })),
             "evalRouting.installAuthoritative": (params) => Effect.gen(function* () {
                 const env = yield* DaemonEnv;
-                const activation = yield* decodeAnyActivation(params.activation);
+                const activation = yield* makeRoutingActivationStore(evalRoutingSnapshotDirectory(env.home))
+                    .readActivation(params.activationPath)
+                    .pipe(Effect.mapError(mapStoreError("read authoritative routing policy")));
                 yield* validateRuntimeCompatibility(activation);
                 const deployment = yield* makeRoutingActivationStore(evalRoutingSnapshotDirectory(env.home))
-                    .installAuthoritative(activation, params.expectedAuthoritativeRevisionDigest, params.expectedPreviousAuthoritativeRevisionDigest)
+                    .installAuthoritative(activation, params.activationPath, params.expectedAuthoritativeRevisionDigest, params.expectedPreviousAuthoritativeRevisionDigest)
                     .pipe(Effect.mapError(mapStoreError("install authoritative routing policy")));
                 return {
                     installed: true,

package/dist/launcher-service.js

@@ -1,7 +1,10 @@
+import { resolve } from "node:path";
+import { findRepositoryRoutingProfileRoot, loadRepositoryRoutingProfile } from "@velum-labs/routekit-config";
 import { resolveCodexStartupModel } from "@velum-labs/routekit-gateway";
 import { ControlError } from "@velum-labs/routekit-runtime/control";
 import { Effect } from "effect";
 import { ActiveGateway } from "./services/active-gateway/service.js";
+import { LauncherSessions } from "./services/launcher-session/service.js";
 import { Tokens } from "./services/tokens/service.js";
 /** Owns coding-tool launch preparation against the live catalog. */
 export class LauncherApplicationService {
@@ -18,9 +21,60 @@ export class LauncherApplicationService {
                     requestId: "internal"
                 });
                 return yield* Effect.gen(function* () {
-                    let model = params.model ?? listed.defaultModel ?? listed.models[0]?.id;
+                    const requestedModel = params.model?.trim();
+                    const modelProfile = requestedModel?.toLowerCase().startsWith("auto:")
+                        ? requestedModel.slice("auto:".length)
+                        : undefined;
+                    const routingProfile = params.routingProfile ?? modelProfile;
+                    if (params.routingProfile !== undefined && modelProfile !== undefined) {
+                        if (params.routingProfile !== modelProfile) {
+                            return yield* Effect.fail(new ControlError({
+                                code: "bad_request",
+                                message: "routingProfile conflicts with the model profile selector"
+                            }));
+                        }
+                    }
+                    else if (params.routingProfile !== undefined &&
+                        requestedModel !== undefined &&
+                        requestedModel.toLowerCase() !== "auto") {
+                        return yield* Effect.fail(new ControlError({
+                            code: "bad_request",
+                            message: "routingProfile may be used only with model auto or an omitted model"
+                        }));
+                    }
+                    let launcherAuthToken;
+                    if (routingProfile !== undefined) {
+                        const cwd = resolve(params.cwd ?? ".");
+                        const repositoryRoot = yield* Effect.try({
+                            try: () => {
+                                const root = findRepositoryRoutingProfileRoot(cwd, routingProfile);
+                                if (root === undefined) {
+                                    throw new Error(`routing profile ${JSON.stringify(routingProfile)} was not found from ${cwd}`);
+                                }
+                                loadRepositoryRoutingProfile({ repositoryRoot: root, name: routingProfile });
+                                return root;
+                            },
+                            catch: (cause) => new ControlError({
+                                code: "not_found",
+                                message: cause instanceof Error
+                                    ? cause.message
+                                    : `routing profile ${JSON.stringify(routingProfile)} was not found`
+                            })
+                        });
+                        const launcherSessions = yield* LauncherSessions;
+                        launcherAuthToken = launcherSessions.open({
+                            repositoryRoot,
+                            profileName: routingProfile,
+                            role: context.principal === undefined || context.principal.role === "ephemeral"
+                                ? "owner"
+                                : context.principal.role
+                        });
+                    }
+                    let model = routingProfile === undefined
+                        ? (params.model ?? listed.defaultModel ?? listed.models[0]?.id)
+                        : `auto:${routingProfile}`;
                     let codexSelection;
-                    if (params.tool === "codex") {
+                    if (params.tool === "codex" && routingProfile === undefined) {
                         const gateway = yield* ActiveGateway;
                         const candidates = listed.models.flatMap((entry) => {
                             const info = gateway.router().modelInfo(entry.id);
@@ -68,7 +122,8 @@ export class LauncherApplicationService {
                             models: [...selected.models]
                         };
                     }
-                    if (model === undefined || !listed.models.some((entry) => entry.id === model)) {
+                    if (model === undefined ||
+                        (routingProfile === undefined && !listed.models.some((entry) => entry.id === model))) {
                         return yield* Effect.fail(new ControlError({
                             code: "not_found",
                             message: params.model === undefined
@@ -78,7 +133,7 @@ export class LauncherApplicationService {
                     }
                     const gateway = yield* ActiveGateway;
                     const tokens = yield* Tokens;
-                    const authToken = yield* tokens.dataTokenForPrincipal(context.principal);
+                    const authToken = launcherAuthToken ?? (yield* tokens.dataTokenForPrincipal(context.principal));
                     return {
                         tool: params.tool,
                         model,

package/dist/services/launcher-session/service.d.ts

@@ -0,0 +1,23 @@
+import type { GatewayPrincipal } from "@velum-labs/routekit-gateway";
+import { Context, Layer } from "effect";
+export type OpenLauncherSessionInput = {
+    repositoryRoot: string;
+    profileName: string;
+    role: "owner" | "admin";
+};
+export type LauncherSessionManagerOptions = {
+    random?: (bytes: number) => Buffer;
+};
+/** Daemon-owned, memory-only credentials that bind one launcher to one repository profile. */
+export declare class LauncherSessionManager {
+    #private;
+    constructor(options?: LauncherSessionManagerOptions);
+    open(input: OpenLauncherSessionInput): string;
+    resolve(presented: string): GatewayPrincipal | undefined;
+    closeAll(): void;
+}
+declare const LauncherSessions_base: Context.ServiceClass<LauncherSessions, "@velum-labs/routekit-daemon/LauncherSessions", LauncherSessionManager>;
+export declare class LauncherSessions extends LauncherSessions_base {
+    static layer(options?: LauncherSessionManagerOptions): Layer.Layer<LauncherSessions, never, never>;
+}
+export {};

package/dist/services/launcher-session/service.js

@@ -0,0 +1,48 @@
+import { createHash, randomBytes } from "node:crypto";
+import { Context, Effect, Layer } from "effect";
+function digest(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+/** Daemon-owned, memory-only credentials that bind one launcher to one repository profile. */
+export class LauncherSessionManager {
+    #sessionsByTokenDigest = new Map();
+    #random;
+    constructor(options = {}) {
+        this.#random = options.random ?? randomBytes;
+    }
+    open(input) {
+        const credential = this.#random(32).toString("base64url");
+        const tokenDigest = digest(credential);
+        const session = {
+            id: `launcher_${this.#random(16).toString("base64url")}`,
+            tokenDigest,
+            repositoryRoot: input.repositoryRoot,
+            profileName: input.profileName,
+            role: input.role
+        };
+        this.#sessionsByTokenDigest.set(tokenDigest, session);
+        return credential;
+    }
+    resolve(presented) {
+        const session = this.#sessionsByTokenDigest.get(digest(presented));
+        if (session === undefined)
+            return undefined;
+        return {
+            id: session.id,
+            label: `launcher:${session.profileName}`,
+            role: session.role,
+            routing: {
+                repositoryRoot: session.repositoryRoot,
+                profileName: session.profileName
+            }
+        };
+    }
+    closeAll() {
+        this.#sessionsByTokenDigest.clear();
+    }
+}
+export class LauncherSessions extends Context.Service()("@velum-labs/routekit-daemon/LauncherSessions") {
+    static layer(options = {}) {
+        return Layer.effect(LauncherSessions, Effect.acquireRelease(Effect.sync(() => new LauncherSessionManager(options)), (sessions) => Effect.sync(() => sessions.closeAll())));
+    }
+}

package/dist/test/application-services.test.js

@@ -9,6 +9,7 @@ import { DaemonLifecycleService } from "../daemon-lifecycle-service.js";
 import { DoctorApplicationService } from "../doctor-service.js";
 import { EvalRoutingApplicationService } from "../eval-routing-service.js";
 import { EvalSessionApplicationService } from "../services/eval-session/service.js";
+import { LauncherSessionManager } from "../services/launcher-session/service.js";
 import { LauncherApplicationService } from "../launcher-service.js";
 import { ProviderQueryService } from "../provider-query-service.js";
 import { RouterGenerationService } from "../router-generation-service.js";
@@ -109,3 +110,26 @@ test("application services expose concrete bounded handler groups", () => {
         "telemetry.set"
     ]);
 });
+test("launcher sessions bind repository profile context without durable token state", () => {
+    let byte = 0;
+    const sessions = new LauncherSessionManager({
+        random: (length) => Buffer.alloc(length, byte++)
+    });
+    const token = sessions.open({
+        repositoryRoot: "/workspace/repository",
+        profileName: "quality",
+        role: "owner"
+    });
+    assert.deepEqual(sessions.resolve(token), {
+        id: `launcher_${Buffer.alloc(16, 1).toString("base64url")}`,
+        label: "launcher:quality",
+        role: "owner",
+        routing: {
+            repositoryRoot: "/workspace/repository",
+            profileName: "quality"
+        }
+    });
+    assert.equal(sessions.resolve("wrong"), undefined);
+    sessions.closeAll();
+    assert.equal(sessions.resolve(token), undefined);
+});

package/dist/test/daemon-data-plane.test.js

@@ -1,15 +1,17 @@
 import assert from "node:assert/strict";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { request as httpRequest } from "node:http";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 import { RouteKitControlClient } from "@velum-labs/routekit-control";
 import { ControlClient, ControlError } from "@velum-labs/routekit-runtime/control";
 import { createServiceRecordStore } from "@velum-labs/routekit-runtime/service";
 import { runRouteKitEffect, runRouteKitEffectExit, throwRouteKitExit } from "@velum-labs/routekit-runtime/effect";
 import { startRouteKitDaemon } from "../index.js";
 import { mockProvider, nativeCredential, withMockNativeDiscovery } from "./daemon-fixtures.js";
+const REPOSITORY_PROFILE_FIXTURE = join(dirname(fileURLToPath(import.meta.url)), "../../../../test/fixtures/repository-routing-profiles");
 test("broken optional subscription credentials do not block a healthy API provider", async () => {
     const root = mkdtempSync(join(tmpdir(), "routekit-daemon-broken-subscription-"));
     const stateHome = join(root, "state");
@@ -17,13 +19,7 @@ test("broken optional subscription credentials do not block a healthy API provid
     const accountsDirectory = join(stateHome, "subscriptions", "codex");
     mkdirSync(accountsDirectory, { recursive: true, mode: 0o700 });
     writeFileSync(join(accountsDirectory, "broken.json"), "{not-json", { mode: 0o600 });
-    writeFileSync(configPath, [
-        "providers:",
-        "  openai: {}",
-        "  codex: {}",
-        "defaultModel: openai/mock-model",
-        ""
-    ].join("\n"));
+    writeFileSync(configPath, ["providers:", "  openai: {}", "  codex: {}", "defaultModel: openai/mock-model", ""].join("\n"));
     const upstream = await mockProvider();
     let daemon;
     try {
@@ -739,3 +735,112 @@ test("cleared persisted cooldown remains absent and eligible after daemon reload
         rmSync(root, { recursive: true, force: true });
     }
 });
+test("singleton launcher targets repository profiles without clobbering sibling or global state", async () => {
+    const root = mkdtempSync(join(tmpdir(), "routekit-daemon-launcher-profiles-"));
+    const stateHome = join(root, "state");
+    const repository = join(root, "repository");
+    const cwd = join(repository, "packages", "app");
+    const configPath = join(root, ".config", "routekit", "router.yaml");
+    const globalActivation = join(stateHome, "eval", "published-routing.json");
+    cpSync(REPOSITORY_PROFILE_FIXTURE, repository, { recursive: true });
+    const classifierDimensions = ["code", "navigation", "debugging", "architecture", "explanation"];
+    for (const profile of ["quality", "cost"]) {
+        const path = join(repository, ".routekit", "routing", "activations", `${profile}.json`);
+        const current = JSON.parse(readFileSync(path, "utf8"));
+        current.dimensions = classifierDimensions.map((id) => ({
+            id,
+            description: `Tasks centered on ${id}`,
+            includes: [`Includes ${id}`],
+            excludes: [`Excludes work outside ${id}`]
+        }));
+        current.evidence = current.evidence.map((entry, index) => ({
+            ...entry,
+            dimensionId: classifierDimensions[index % classifierDimensions.length]
+        }));
+        writeFileSync(path, `${JSON.stringify(current, null, 2)}\n`);
+    }
+    mkdirSync(cwd, { recursive: true });
+    mkdirSync(dirname(configPath), { recursive: true });
+    mkdirSync(dirname(globalActivation), { recursive: true });
+    writeFileSync(configPath, "providers:\n  openai: {}\ndefaultModel: openai/quality-model\nclassifierModel: openai/gpt-5.6-luna\n");
+    writeFileSync(globalActivation, '{"global":"unchanged"}\n');
+    const upstream = await mockProvider([
+        { id: "quality-model", object: "model" },
+        { id: "cost-model", object: "model" },
+        { id: "gpt-5.6-luna", object: "model" }
+    ]);
+    let daemon;
+    try {
+        daemon = await startRouteKitDaemon({
+            packageVersion: "1.2.3",
+            stateHome,
+            configPath,
+            port: 0,
+            portless: false,
+            env: {
+                HOME: root,
+                ROUTEKIT_HOME: stateHome,
+                OPENAI_API_KEY: "test-key",
+                OPENAI_BASE_URL: upstream.url,
+                ROUTEKIT_PORTLESS: "0"
+            }
+        });
+        const client = new RouteKitControlClient({
+            url: daemon.record.url,
+            token: daemon.record.controlToken
+        });
+        const qualityProfile = join(repository, ".routekit", "routing", "profiles", "quality.yaml");
+        const costProfile = join(repository, ".routekit", "routing", "profiles", "cost.yaml");
+        const qualityActivation = join(repository, ".routekit", "routing", "activations", "quality.json");
+        const costActivation = join(repository, ".routekit", "routing", "activations", "cost.json");
+        const tracked = [
+            qualityProfile,
+            costProfile,
+            qualityActivation,
+            costActivation,
+            configPath,
+            globalActivation,
+            join(stateHome, "secrets", "tokens.json")
+        ];
+        const before = new Map(tracked.map((path) => [path, readFileSync(path, "utf8")]));
+        const target = async (name, expectedModel, selector) => {
+            const prepared = await runRouteKitEffect(client.call("launcher.prepare", {
+                tool: "codex",
+                ...(selector === "model"
+                    ? { model: `auto:${name}` }
+                    : { model: "auto", routingProfile: name }),
+                cwd
+            }));
+            assert.equal(prepared.model, `auto:${name}`);
+            const response = await fetch(`${prepared.gatewayUrl}/v1/chat/completions`, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${prepared.authToken}`,
+                    "content-type": "application/json",
+                    ...(selector === "profile" ? { "x-routekit-routing-profile": name } : {})
+                },
+                body: JSON.stringify({
+                    model: selector === "model" ? `auto:${name}` : "auto",
+                    messages: [{ role: "user", content: "Implement this code change" }]
+                })
+            });
+            const body = await response.text();
+            assert.equal(response.status, 200, body);
+            assert.match(body, new RegExp(expectedModel));
+        };
+        await target("quality", "quality-model", "model");
+        for (const path of [costProfile, costActivation, configPath, globalActivation]) {
+            assert.equal(readFileSync(path, "utf8"), before.get(path), `${path} changed`);
+        }
+        await target("cost", "cost-model", "profile");
+        for (const path of tracked) {
+            assert.equal(readFileSync(path, "utf8"), before.get(path), `${path} changed`);
+        }
+    }
+    finally {
+        if (daemon !== undefined)
+            await daemon.close();
+        await upstream.close();
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/test/daemon-fixtures.js

@@ -46,6 +46,15 @@ async function mockProvider(models = [
             const send = () => {
                 res.setHeader("content-type", "application/json");
                 res.end(JSON.stringify({
+                    model: (() => {
+                        try {
+                            const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                            return typeof body.model === "string" ? body.model : undefined;
+                        }
+                        catch {
+                            return undefined;
+                        }
+                    })(),
                     choices: [
                         {
                             index: 0,

package/dist/test/eval-routing-application-service.test.js

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -83,6 +83,7 @@ test("legacy V2 publication is rejected because V2 is rollback-only", async () =
 });
 test("V3 authority installs when its pinned models match the running gateway", async () => {
     const home = mkdtempSync(join(tmpdir(), "routekit-routing-v3-authority-"));
+    const repositoryRoot = mkdtempSync(join(tmpdir(), "routekit-routing-v3-repository-"));
     const activationV3 = JSON.parse(readFileSync(new URL("../../../../test/fixtures/routing-v3/examples/published-routing-activation-v3.example.json", import.meta.url), "utf8"));
     const daemonEnv = Layer.succeed(DaemonEnv, DaemonEnv.of({
         home,
@@ -124,17 +125,27 @@ test("V3 authority installs when its pinned models match the running gateway", a
     const services = Layer.mergeAll(daemonEnv, DaemonState.layer(runtimeState), activeGateway);
     const handler = new EvalRoutingApplicationService().handlers()["evalRouting.installAuthoritative"];
     const run = (effect) => runRouteKitEffect(effect.pipe(Effect.provide(services)));
+    const activationPath = join(repositoryRoot, ".routekit", "routing", "activations", `${activationV3.activationDigest}.json`);
+    mkdirSync(join(repositoryRoot, ".routekit", "routing", "activations"), {
+        recursive: true
+    });
+    writeFileSync(activationPath, `${JSON.stringify(activationV3, null, 2)}\n`);
     const params = {
         expectedAuthoritativeRevisionDigest: null,
         expectedPreviousAuthoritativeRevisionDigest: null,
-        activation: activationV3
+        activationPath
     };
     try {
         const installed = await run(handler(params, undefined));
         assert.equal(installed.installed, true);
         assert.equal(installed.authoritative.version, 3);
+        const pointer = readFileSync(join(home, "eval", "routing-deployment.v2.json"), "utf8");
+        assert.match(pointer, /"activationPath"/u);
+        assert.equal(pointer.includes('"activation":'), false);
+        assert.equal(pointer.includes('"basis":'), false);
     }
     finally {
         rmSync(home, { recursive: true, force: true });
+        rmSync(repositoryRoot, { recursive: true, force: true });
     }
 });

package/dist/test/eval-routing-policy.test.js

@@ -1,11 +1,13 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 import { makeRoutingActivationStore } from "@velum-labs/routekit-eval-store/effect";
 import { runRouteKitEffect } from "@velum-labs/routekit-runtime/effect";
 import { evalRoutingSnapshotDirectory, makeCompositionalRoutingPolicyReader } from "../eval-routing-policy.js";
+const REPOSITORY_PROFILE_FIXTURE = resolve(dirname(fileURLToPath(import.meta.url)), "../../../../test/fixtures/repository-routing-profiles");
 test("daemon compositional reader projects authority and falls back to previous V2", async () => {
     const home = mkdtempSync(join(tmpdir(), "routekit-daemon-compositional-policy-"));
     const dimensions = [
@@ -53,3 +55,53 @@ test("daemon compositional reader projects authority and falls back to previous
         rmSync(home, { recursive: true, force: true });
     }
 });
+test("two repository routing profiles can be targeted without clobbering each other or daemon-global state", async () => {
+    const root = mkdtempSync(join(tmpdir(), "routekit-daemon-repository-profiles-"));
+    const repository = join(root, "repository");
+    const home = join(root, "state");
+    const globalConfig = join(root, "home", ".config", "routekit", "router.yaml");
+    try {
+        cpSync(REPOSITORY_PROFILE_FIXTURE, repository, { recursive: true });
+        mkdirSync(dirname(globalConfig), { recursive: true });
+        writeFileSync(globalConfig, "providers:\n  openai: {}\ndefaultModel: openai/global-model\n");
+        const globalActivation = join(evalRoutingSnapshotDirectory(home), "published-routing.json");
+        mkdirSync(dirname(globalActivation), { recursive: true });
+        writeFileSync(globalActivation, '{"global":"unchanged"}\n');
+        const qualityProfile = join(repository, ".routekit", "routing", "profiles", "quality.yaml");
+        const costProfile = join(repository, ".routekit", "routing", "profiles", "cost.yaml");
+        const qualityActivation = join(repository, ".routekit", "routing", "activations", "quality.json");
+        const costActivation = join(repository, ".routekit", "routing", "activations", "cost.json");
+        const paths = [
+            qualityProfile,
+            costProfile,
+            qualityActivation,
+            costActivation,
+            globalConfig,
+            globalActivation
+        ];
+        const before = new Map(paths.map((path) => [path, readFileSync(path, "utf8")]));
+        const reader = makeCompositionalRoutingPolicyReader(home, repository);
+        const quality = await runRouteKitEffect(reader.getActivation("quality"));
+        assert.deepEqual(quality?.objective, { kind: "highest-quality" });
+        assert.equal(quality?.evidenceDigest, "quality-evidence-v2");
+        for (const path of [costProfile, costActivation, globalConfig, globalActivation]) {
+            assert.equal(readFileSync(path, "utf8"), before.get(path), `${path} changed`);
+        }
+        const cost = await runRouteKitEffect(reader.getActivation("cost"));
+        assert.deepEqual(cost?.objective, {
+            kind: "lowest-cost",
+            minimumQuality: 0.7
+        });
+        assert.equal(cost?.evidenceDigest, "cost-evidence-v2");
+        for (const path of [qualityProfile, qualityActivation, globalConfig, globalActivation]) {
+            assert.equal(readFileSync(path, "utf8"), before.get(path), `${path} changed`);
+        }
+        for (const path of paths) {
+            assert.equal(readFileSync(path, "utf8"), before.get(path), `${path} changed`);
+        }
+        await assert.rejects(runRouteKitEffect(reader.getActivation()), /require an explicit profile selector/);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@velum-labs/routekit-daemon",
   "private": false,
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Singleton RouteKit control daemon and stable model gateway.",
   "repository": {
     "type": "git",
@@ -44,15 +44,15 @@
     "effect": "4.0.0-rc.108",
     "posthog-node": "5.46.1",
     "yaml": "2.9.0",
-    "@velum-labs/routekit-accounts": "1.2.0",
-    "@velum-labs/routekit-config": "1.2.0",
-    "@velum-labs/routekit-control": "1.2.0",
-    "@velum-labs/routekit-eval-contracts": "1.2.0",
-    "@velum-labs/routekit-eval-store": "1.2.0",
-    "@velum-labs/routekit-gateway": "1.2.0",
-    "@velum-labs/routekit-registry": "1.2.0",
-    "@velum-labs/routekit-runtime": "1.2.0",
-    "@velum-labs/routekit-telemetry-core": "1.2.0"
+    "@velum-labs/routekit-accounts": "1.3.0",
+    "@velum-labs/routekit-config": "1.3.0",
+    "@velum-labs/routekit-control": "1.3.0",
+    "@velum-labs/routekit-eval-contracts": "1.3.0",
+    "@velum-labs/routekit-eval-store": "1.3.0",
+    "@velum-labs/routekit-gateway": "1.3.0",
+    "@velum-labs/routekit-registry": "1.3.0",
+    "@velum-labs/routekit-runtime": "1.3.0",
+    "@velum-labs/routekit-telemetry-core": "1.3.0"
   },
   "scripts": {
     "build": "tsc -b",