@vigil-guard/vge-cc-guard 0.9.0-beta.1

package/dist/daemon/vge-connectivity.js

@@ -0,0 +1,214 @@
+import { validateVgeApiUrlFromEnv } from '../shared/vge-url.js';
+export const VGE_CONNECTIVITY_TIMEOUT_MS = 10_000;
+const CANDIDATE_STRING_MAX = 1024;
+const PROBE_SESSION_ID = 'daemon-vge-health';
+export async function checkVgeConnectivity(config, opts = {}) {
+    const now = opts.now ?? (() => new Date());
+    const checkedAt = now().toISOString();
+    const effective = effectiveProbeConfig(config, opts.candidates);
+    if (!effective.ok) {
+        return degradedReport({
+            apiUrl: effective.apiUrl,
+            checkedAt,
+            inputKey: 'failed',
+            outputKey: 'not_configured',
+            reason: 'config_missing',
+            detail: effective.detail,
+        });
+    }
+    const fetchProbe = opts.fetch ?? fetch;
+    const timeoutMs = opts.timeoutMs ?? VGE_CONNECTIVITY_TIMEOUT_MS;
+    const inputProbe = await checkSingleVgeKey({
+        apiUrl: effective.config.apiUrl,
+        apiKey: effective.config.inputKey,
+        role: 'input',
+        fetchProbe,
+        timeoutMs,
+        now,
+    });
+    if (!inputProbe.ok) {
+        return degradedReport({
+            apiUrl: effective.config.apiUrl,
+            checkedAt,
+            inputKey: 'failed',
+            outputKey: 'not_configured',
+            reason: inputProbe.reason,
+            detail: inputProbe.detail,
+            latencyMs: inputProbe.latencyMs,
+        });
+    }
+    if (!effective.config.outputKey) {
+        return {
+            ok: true,
+            apiUrl: effective.config.apiUrl,
+            inputKey: 'ok',
+            outputKey: 'uses_input_key',
+            latencyMs: inputProbe.latencyMs,
+            checkedAt,
+        };
+    }
+    const outputProbe = await checkSingleVgeKey({
+        apiUrl: effective.config.apiUrl,
+        apiKey: effective.config.outputKey,
+        role: 'output',
+        fetchProbe,
+        timeoutMs,
+        now,
+    });
+    if (!outputProbe.ok) {
+        return degradedReport({
+            apiUrl: effective.config.apiUrl,
+            checkedAt,
+            inputKey: 'ok',
+            outputKey: 'failed',
+            reason: outputProbe.reason,
+            detail: outputProbe.detail,
+            latencyMs: outputProbe.latencyMs,
+        });
+    }
+    return {
+        ok: true,
+        apiUrl: effective.config.apiUrl,
+        inputKey: 'ok',
+        outputKey: 'ok',
+        latencyMs: inputProbe.latencyMs + outputProbe.latencyMs,
+        checkedAt,
+    };
+}
+function effectiveProbeConfig(config, candidates) {
+    const apiUrl = candidates?.apiUrl ?? config.vge.api_url;
+    const inputKey = candidates?.apiKeyInput ?? config.vge.api_key_input;
+    const outputKey = candidates && 'apiKeyOutput' in candidates
+        ? candidates.apiKeyOutput ?? null
+        : config.vge.api_key_output;
+    if (isTooLong(apiUrl) ||
+        isTooLong(inputKey) ||
+        isTooLong(outputKey)) {
+        return { ok: false, apiUrl: boundedApiUrl(apiUrl), detail: 'candidate_too_long' };
+    }
+    const validation = validateVgeApiUrlFromEnv(apiUrl);
+    if (!validation.ok || inputKey.trim().length === 0) {
+        return { ok: false, apiUrl: validation.ok ? validation.url : boundedApiUrl(apiUrl), detail: 'invalid_config' };
+    }
+    return {
+        ok: true,
+        config: {
+            apiUrl: validation.url,
+            inputKey,
+            outputKey: outputKey && outputKey.trim().length > 0 ? outputKey : null,
+        },
+    };
+}
+function isTooLong(value) {
+    return typeof value === 'string' && value.length > CANDIDATE_STRING_MAX;
+}
+function boundedApiUrl(value) {
+    return value.length > CANDIDATE_STRING_MAX ? null : value;
+}
+async function checkSingleVgeKey(input) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), input.timeoutMs);
+    const startedAt = input.now().getTime();
+    try {
+        const response = await input.fetchProbe(`${input.apiUrl}${probePath(input.role)}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${input.apiKey}`,
+            },
+            body: JSON.stringify(input.role === 'input' ? buildInputHealthProbeBody() : buildOutputHealthProbeBody()),
+            signal: ctrl.signal,
+        });
+        const latencyMs = Math.max(0, input.now().getTime() - startedAt);
+        if (response.ok)
+            return { ok: true, latencyMs };
+        return {
+            ok: false,
+            ...classifyConnectivityFailure(response.status),
+            latencyMs,
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            ...classifyConnectivityException(err, ctrl.signal.aborted, input.timeoutMs),
+            latencyMs: null,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function probePath(role) {
+    return role === 'input' ? '/v1/guard/input' : '/v1/guard/analyze';
+}
+function buildInputHealthProbeBody() {
+    return {
+        prompt: 'ping',
+        agent: { sessionId: PROBE_SESSION_ID, traceId: PROBE_SESSION_ID },
+        metadata: { platform: 'claude-code', source: PROBE_SESSION_ID },
+    };
+}
+function buildOutputHealthProbeBody() {
+    return {
+        text: 'ping',
+        source: 'tool_output',
+        metadata: { platform: 'claude-code', source: PROBE_SESSION_ID },
+        agent: { sessionId: PROBE_SESSION_ID, traceId: PROBE_SESSION_ID },
+        tool: { name: 'VgeHealthProbe', vendor: 'vge-cc-guard' },
+    };
+}
+function classifyConnectivityFailure(status) {
+    if (status === 401 || status === 403)
+        return { reason: 'auth_failed', detail: 'invalid_api_key' };
+    if (status === 429)
+        return { reason: 'vge_error', detail: 'rate_limited' };
+    return { reason: 'vge_error', detail: `vge_http_${status}` };
+}
+function classifyConnectivityException(err, aborted, timeoutMs) {
+    if (aborted || errorName(err) === 'AbortError') {
+        return { reason: 'timeout', detail: `request timeout after ${timeoutMs}ms` };
+    }
+    if (isTlsError(err)) {
+        return { reason: 'tls_error', detail: 'tls_certificate_error' };
+    }
+    return { reason: 'network_error', detail: 'network_error' };
+}
+function isTlsError(err) {
+    const code = errorCode(err);
+    if (code === 'DEPTH_ZERO_SELF_SIGNED_CERT' ||
+        code === 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' ||
+        code === 'ERR_TLS_CERT_ALTNAME_INVALID') {
+        return true;
+    }
+    const message = err instanceof Error ? err.message.toLowerCase() : '';
+    return message.includes('certificate') && (message.includes('verify') ||
+        message.includes('self-signed') ||
+        message.includes('hostname') ||
+        message.includes('altname'));
+}
+function errorName(err) {
+    if (typeof err !== 'object' || err === null)
+        return null;
+    const value = err['name'];
+    return typeof value === 'string' ? value : null;
+}
+function errorCode(err) {
+    if (typeof err !== 'object' || err === null)
+        return null;
+    const value = err['code'];
+    return typeof value === 'string' ? value : null;
+}
+function degradedReport(input) {
+    return {
+        ok: false,
+        apiUrl: input.apiUrl,
+        inputKey: input.inputKey,
+        outputKey: input.outputKey,
+        latencyMs: input.latencyMs ?? null,
+        checkedAt: input.checkedAt,
+        failureReason: input.reason,
+        detail: input.detail,
+    };
+}
+//# sourceMappingURL=vge-connectivity.js.map

package/dist/daemon/vge-connectivity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vge-connectivity.js","sourceRoot":"","sources":["../../src/daemon/vge-connectivity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AA8C7C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,cAAc,CAAC;YACpB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS;YACT,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,gBAAgB;YAC3B,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,2BAA2B,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;QACzC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;QAC/B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ;QACjC,IAAI,EAAE,OAAO;QACb,UAAU;QACV,SAAS;QACT,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;YACpB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;YAC/B,SAAS;YACT,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,gBAAgB;YAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;QAC1C,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;QAC/B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS;QAClC,IAAI,EAAE,QAAQ;QACd,UAAU;QACV,SAAS;QACT,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,cAAc,CAAC;YACpB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;YAC/B,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;QAC/B,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,UAAU,CAAC,SAAS,GAAG,WAAW,CAAC,SAAS;QACvD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAc,EACd,UAAiD;IAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;IACxD,MAAM,QAAQ,GAAG,UAAU,EAAE,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;IACrE,MAAM,SAAS,GAAG,UAAU,IAAI,cAAc,IAAI,UAAU;QAC1D,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,IAAI;QACjC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;IAE9B,IACE,SAAS,CAAC,MAAM,CAAC;QACjB,SAAS,CAAC,QAAQ,CAAC;QACnB,SAAS,CAAC,SAAS,CAAC,EACpB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,GAAG;YACtB,QAAQ;YACR,SAAS,EAAE,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SACvE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAoB;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAOhC;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE;YACjF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC;YACzG,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/C,SAAS;SACV,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG,6BAA6B,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;YAC3E,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACpE,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACjE,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE;QAC/D,KAAK,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE;QACjE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAc;IACjD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,MAAM,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,6BAA6B,CACpC,GAAY,EACZ,OAAgB,EAChB,SAAiB;IAEjB,IAAI,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,YAAY,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,SAAS,IAAI,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IACE,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,iCAAiC;QAC1C,IAAI,KAAK,8BAA8B,EACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,KAAK,GAAI,GAA+B,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,KAAK,GAAI,GAA+B,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,KAQvB;IACC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,MAAM;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC"}

package/dist/daemon/vge-health-route.d.ts

@@ -0,0 +1,4 @@
+import type express from 'express';
+import type { Config } from '../shared/config-schema.js';
+export declare function registerVgeHealthRoute(app: express.Express, requireDaemonToken: express.RequestHandler, parseProtectedJson: express.RequestHandler, getConfig: () => Config): void;
+//# sourceMappingURL=vge-health-route.d.ts.map

package/dist/daemon/vge-health-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vge-health-route.d.ts","sourceRoot":"","sources":["../../src/daemon/vge-health-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAazD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAC1C,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAC1C,SAAS,EAAE,MAAM,MAAM,GACtB,IAAI,CAIN"}

package/dist/daemon/vge-health-route.js

@@ -0,0 +1,107 @@
+import { appendEvent } from '../shared/audit-writer.js';
+import { vgeKeyFingerprint } from '../shared/vge-verification.js';
+import { checkVgeConnectivity, } from './vge-connectivity.js';
+const CANDIDATE_STRING_MAX = 1024;
+const MAX_IN_FLIGHT_CHECKS = 32;
+const inFlightChecks = new Map();
+export function registerVgeHealthRoute(app, requireDaemonToken, parseProtectedJson, getConfig) {
+    app.post('/v1/control/vge-health', requireDaemonToken, parseProtectedJson, (req, res) => {
+        void handleVgeHealth(req, res, getConfig);
+    });
+}
+async function handleVgeHealth(req, res, getConfig) {
+    const candidates = parseVgeHealthCandidates(req.body);
+    if (!candidates.ok) {
+        res.status(400).json({ ok: false, error: 'invalid_vge_health_payload' });
+        return;
+    }
+    const config = getConfig();
+    const key = inFlightKey(config, candidates.value);
+    const existing = inFlightChecks.get(key);
+    if (existing) {
+        // Coalesced callers share the lead probe response; only the lead request emits audit.
+        res.json(await existing);
+        return;
+    }
+    const pending = checkVgeConnectivity(config, { candidates: candidates.value });
+    trimInFlightChecks();
+    inFlightChecks.set(key, pending);
+    try {
+        const report = await pending;
+        logVgeConnectivityChecked(report);
+        res.json(report);
+    }
+    finally {
+        inFlightChecks.delete(key);
+    }
+}
+function trimInFlightChecks() {
+    if (inFlightChecks.size < MAX_IN_FLIGHT_CHECKS)
+        return;
+    const oldest = inFlightChecks.keys().next().value;
+    if (oldest)
+        inFlightChecks.delete(oldest);
+}
+function logVgeConnectivityChecked(report) {
+    appendEvent({
+        event_type: 'vge_connectivity_checked',
+        ok: report.ok,
+        api_host: report.apiUrl ? safeHost(report.apiUrl) : null,
+        input_key: report.inputKey,
+        output_key: report.outputKey,
+        failure_reason: report.failureReason ?? null,
+        latency_ms: report.latencyMs,
+    });
+}
+function safeHost(apiUrl) {
+    try {
+        return new URL(apiUrl).hostname;
+    }
+    catch {
+        return null;
+    }
+}
+function parseVgeHealthCandidates(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body))
+        return { ok: false };
+    const record = body;
+    const value = {};
+    if (!copyOptionalString(record, value, 'apiUrl', 'apiUrl'))
+        return { ok: false };
+    if (!copyOptionalString(record, value, 'apiKeyInput', 'apiKeyInput'))
+        return { ok: false };
+    if (!copyOptionalStringOrNull(record, value, 'apiKeyOutput', 'apiKeyOutput'))
+        return { ok: false };
+    return { ok: true, value };
+}
+function copyOptionalString(source, target, sourceKey, targetKey) {
+    if (!(sourceKey in source))
+        return true;
+    const value = source[sourceKey];
+    if (typeof value !== 'string' || value.length > CANDIDATE_STRING_MAX)
+        return false;
+    target[targetKey] = value;
+    return true;
+}
+function copyOptionalStringOrNull(source, target, sourceKey, targetKey) {
+    if (!(sourceKey in source))
+        return true;
+    const value = source[sourceKey];
+    if (value !== null && (typeof value !== 'string' || value.length > CANDIDATE_STRING_MAX))
+        return false;
+    target[targetKey] = value;
+    return true;
+}
+function inFlightKey(config, candidates) {
+    const apiUrl = candidates.apiUrl ?? config.vge.api_url;
+    const inputKey = candidates.apiKeyInput ?? config.vge.api_key_input;
+    const outputKey = 'apiKeyOutput' in candidates
+        ? candidates.apiKeyOutput ?? null
+        : config.vge.api_key_output;
+    return JSON.stringify({
+        apiUrl,
+        inputKey: vgeKeyFingerprint(inputKey),
+        outputKey: vgeKeyFingerprint(outputKey),
+    });
+}
+//# sourceMappingURL=vge-health-route.js.map

package/dist/daemon/vge-health-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vge-health-route.js","sourceRoot":"","sources":["../../src/daemon/vge-health-route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0C,CAAC;AAEzE,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,kBAA0C,EAC1C,kBAA0C,EAC1C,SAAuB;IAEvB,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtF,KAAK,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,GAAoB,EACpB,GAAqB,EACrB,SAAuB;IAEvB,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,sFAAsF;QACtF,GAAG,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/E,kBAAkB,EAAE,CAAC;IACrB,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC7B,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,cAAc,CAAC,IAAI,GAAG,oBAAoB;QAAE,OAAO;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;IACxE,IAAI,MAAM;QAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA6B;IAC9D,WAAW,CAAC;QACV,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QACxD,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,cAAc,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC5C,UAAU,EAAE,MAAM,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAa;IAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjF,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC3F,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACnG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA+B,EAC/B,MAAiC,EACjC,SAAiB,EACjB,SAAmC;IAEnC,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACnF,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAA+B,EAC/B,MAAiC,EACjC,SAAiB,EACjB,SAAyB;IAEzB,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC;IACvG,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,UAAqC;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;IACpE,MAAM,SAAS,GAAG,cAAc,IAAI,UAAU;QAC5C,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,IAAI;QACjC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;IAE9B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM;QACN,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/daemon/vge-overload-backpressure.d.ts

@@ -0,0 +1,51 @@
+export type VgeOverloadStage = 'posttool_output';
+export interface VgeOverloadBackpressureConfig {
+    enabled: boolean;
+    base_cooldown_ms: number;
+    max_cooldown_ms: number;
+    half_open_jitter_min_ms: number;
+    half_open_jitter_max_ms: number;
+}
+export type BackpressureDecision = {
+    kind: 'allow';
+} | {
+    kind: 'skip';
+    reason: 'vge_overload_cooldown';
+    cooldownRemainingMs: number;
+    triggerFailureReason: string;
+    triggerHttpStatus?: number;
+} | {
+    kind: 'probe';
+    probeId: string;
+    halfOpenJitterMs: number;
+};
+export interface VgeOverloadFailure {
+    failureReason: string;
+    httpStatus?: number;
+    retryAfterMs?: number;
+}
+export type CooldownUpdate = {
+    cooldownStarted: false;
+} | {
+    cooldownStarted: true;
+    cooldownMs: number;
+    cooldownUntilMs: number;
+};
+export declare function isResearchTool(toolName: string): boolean;
+export declare function getPostToolBackpressureDecision(params: {
+    stage: VgeOverloadStage;
+    toolName: string;
+    config: VgeOverloadBackpressureConfig;
+    nowMs?: number;
+    random?: () => number;
+}): BackpressureDecision;
+export declare function recordVgeOverloadFailure(params: {
+    stage: VgeOverloadStage;
+    failure: VgeOverloadFailure;
+    config: VgeOverloadBackpressureConfig;
+    nowMs?: number;
+}): CooldownUpdate;
+export declare function recordVgeOverloadSuccess(stage: VgeOverloadStage): void;
+export declare function releaseHalfOpenProbe(stage: VgeOverloadStage, probeId: string): void;
+export declare function resetVgeOverloadBackpressureForTests(): void;
+//# sourceMappingURL=vge-overload-backpressure.d.ts.map

package/dist/daemon/vge-overload-backpressure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vge-overload-backpressure.d.ts","sourceRoot":"","sources":["../../src/daemon/vge-overload-backpressure.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAEjD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IACE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,uBAAuB,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,eAAe,EAAE,KAAK,CAAA;CAAE,GAC1B;IACE,eAAe,EAAE,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAWN,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB,GAAG,oBAAoB,CAsBvB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,cAAc,CAejB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKnF;AAED,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D"}

package/dist/daemon/vge-overload-backpressure.js

@@ -0,0 +1,79 @@
+import * as crypto from 'crypto';
+const stageStates = new Map();
+export function isResearchTool(toolName) {
+    return toolName === 'WebSearch' || toolName === 'WebFetch';
+}
+export function getPostToolBackpressureDecision(params) {
+    if (!params.config.enabled || !isResearchTool(params.toolName))
+        return { kind: 'allow' };
+    const nowMs = params.nowMs ?? Date.now();
+    const state = stageStates.get(params.stage);
+    if (!state)
+        return { kind: 'allow' };
+    if (state.probeId) {
+        return skipDecision(state, Math.max(state.cooldownUntilMs - nowMs, 0));
+    }
+    if (nowMs < state.cooldownUntilMs) {
+        return skipDecision(state, state.cooldownUntilMs - nowMs);
+    }
+    const probeId = `probe_${crypto.randomUUID()}`;
+    state.probeId = probeId;
+    return {
+        kind: 'probe',
+        probeId,
+        halfOpenJitterMs: halfOpenJitterMs(params.config, params.random ?? Math.random),
+    };
+}
+export function recordVgeOverloadFailure(params) {
+    if (!params.config.enabled || !isOverloadFailure(params.failure)) {
+        return { cooldownStarted: false };
+    }
+    const nowMs = params.nowMs ?? Date.now();
+    const cooldownMs = cooldownDurationMs(params.failure.retryAfterMs, params.config);
+    const cooldownUntilMs = nowMs + cooldownMs;
+    stageStates.set(params.stage, {
+        cooldownUntilMs,
+        triggerFailureReason: params.failure.failureReason,
+        ...(typeof params.failure.httpStatus === 'number' ? { triggerHttpStatus: params.failure.httpStatus } : {}),
+    });
+    return { cooldownStarted: true, cooldownMs, cooldownUntilMs };
+}
+export function recordVgeOverloadSuccess(stage) {
+    stageStates.delete(stage);
+}
+export function releaseHalfOpenProbe(stage, probeId) {
+    const state = stageStates.get(stage);
+    if (state?.probeId === probeId) {
+        delete state.probeId;
+    }
+}
+export function resetVgeOverloadBackpressureForTests() {
+    stageStates.clear();
+}
+function skipDecision(state, cooldownRemainingMs) {
+    return {
+        kind: 'skip',
+        reason: 'vge_overload_cooldown',
+        cooldownRemainingMs,
+        triggerFailureReason: state.triggerFailureReason,
+        ...(typeof state.triggerHttpStatus === 'number' ? { triggerHttpStatus: state.triggerHttpStatus } : {}),
+    };
+}
+function isOverloadFailure(failure) {
+    if (failure.failureReason !== 'vge_error')
+        return false;
+    if (failure.httpStatus === 429)
+        return true;
+    return typeof failure.httpStatus === 'number' && failure.httpStatus >= 500 && failure.httpStatus < 600;
+}
+function cooldownDurationMs(retryAfterMs, config) {
+    const requested = typeof retryAfterMs === 'number' && retryAfterMs > 0
+        ? retryAfterMs
+        : config.base_cooldown_ms;
+    return Math.min(requested, config.max_cooldown_ms);
+}
+function halfOpenJitterMs(config, random) {
+    const span = config.half_open_jitter_max_ms - config.half_open_jitter_min_ms;
+    return Math.round(config.half_open_jitter_min_ms + (span * random()));
+}
+//# sourceMappingURL=vge-overload-backpressure.js.map

package/dist/daemon/vge-overload-backpressure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vge-overload-backpressure.js","sourceRoot":"","sources":["../../src/daemon/vge-overload-backpressure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAgDjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAM/C;IACC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAEzF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAErC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO;QACP,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAKxC;IACC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,KAAK,GAAG,UAAU,CAAC;IAC3C,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;QAC5B,eAAe;QACf,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;QAClD,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3G,CAAC,CAAC;IAEH,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAuB;IAC9D,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAuB,EAAE,OAAe;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oCAAoC;IAClD,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB,EAAE,mBAA2B;IAClE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,uBAAuB;QAC/B,mBAAmB;QACnB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,GAAG,CAAC,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA2B;IACpD,IAAI,OAAO,CAAC,aAAa,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,IAAI,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;AACzG,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAgC,EAAE,MAAqC;IACjG,MAAM,SAAS,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,GAAG,CAAC;QACpE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAqC,EAAE,MAAoB;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,GAAG,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/daemon/vge-scan-failure-policy.d.ts

@@ -0,0 +1,8 @@
+export type VgeScanFailureAction = 'fail_closed' | 'fail_open' | 'fail_open_skipped';
+export type VgeScanFailureStage = 'prompt_text' | 'prompt_attachment' | 'posttool_output';
+export interface VgeScanFailureDetails {
+    failureReason: string;
+    httpStatus?: number;
+}
+export declare function isFailOpenEligibleVgeFailure(failure: VgeScanFailureDetails): boolean;
+//# sourceMappingURL=vge-scan-failure-policy.d.ts.map

package/dist/daemon/vge-scan-failure-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vge-scan-failure-policy.d.ts","sourceRoot":"","sources":["../../src/daemon/vge-scan-failure-policy.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,WAAW,GAAG,mBAAmB,CAAC;AACrF,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;AAE1F,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAMpF"}

package/dist/daemon/vge-scan-failure-policy.js

@@ -0,0 +1,12 @@
+export function isFailOpenEligibleVgeFailure(failure) {
+    if (failure.failureReason === 'timeout')
+        return true;
+    if (failure.failureReason === 'network_error')
+        return true;
+    if (failure.failureReason !== 'vge_error')
+        return false;
+    if (failure.httpStatus === 429)
+        return true;
+    return typeof failure.httpStatus === 'number' && failure.httpStatus >= 500 && failure.httpStatus < 600;
+}
+//# sourceMappingURL=vge-scan-failure-policy.js.map

package/dist/daemon/vge-scan-failure-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vge-scan-failure-policy.js","sourceRoot":"","sources":["../../src/daemon/vge-scan-failure-policy.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,4BAA4B,CAAC,OAA8B;IACzE,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,CAAC,aAAa,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,OAAO,CAAC,aAAa,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,IAAI,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;AACzG,CAAC"}

package/dist/shared/audit-writer.d.ts

@@ -0,0 +1,9 @@
+export type AuditWriteOutcome = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function appendEvent(event: Record<string, unknown>): AuditWriteOutcome;
+export declare function cleanupOldLogs(): void;
+//# sourceMappingURL=audit-writer.d.ts.map

package/dist/shared/audit-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-writer.d.ts","sourceRoot":"","sources":["../../src/shared/audit-writer.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA6BlC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,CA4B7E;AAED,wBAAgB,cAAc,IAAI,IAAI,CAUrC"}

package/dist/shared/audit-writer.js

@@ -0,0 +1,72 @@
+import fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { appendPrivateFileSync, chmodPrivateSync } from './private-file.js';
+function getLogDir() {
+    return process.env['VGE_CC_GUARD_CONFIG_DIR'] ?? path.join(os.homedir(), '.vge-cc-guard');
+}
+function getLogPath() {
+    return path.join(getLogDir(), 'audit.log');
+}
+let lastWriteDate = '';
+function bootstrapLastWriteDate(logPath) {
+    if (lastWriteDate)
+        return;
+    try {
+        const mtime = fs.statSync(logPath).mtime;
+        lastWriteDate = mtime.toISOString().slice(0, 10);
+    }
+    catch {
+        // file does not exist yet
+    }
+}
+function auditFailure(error) {
+    return {
+        ok: false,
+        reason: error instanceof Error ? error.message : 'audit write failed',
+    };
+}
+export function appendEvent(event) {
+    try {
+        const dir = getLogDir();
+        fs.mkdirSync(dir, { recursive: true });
+        const today = new Date().toISOString().slice(0, 10);
+        const logPath = getLogPath();
+        bootstrapLastWriteDate(logPath);
+        if (lastWriteDate && lastWriteDate !== today && fs.existsSync(logPath)) {
+            try {
+                const rotatedPath = path.join(dir, `audit.log.${lastWriteDate}`);
+                fs.renameSync(logPath, rotatedPath);
+                chmodPrivateSync(rotatedPath);
+                lastWriteDate = today;
+            }
+            catch (error) {
+                return auditFailure(error);
+            }
+        }
+        else {
+            lastWriteDate = today;
+        }
+        const line = JSON.stringify({ ...event, timestamp: new Date().toISOString() }) + '\n';
+        appendPrivateFileSync(logPath, line);
+        return { ok: true };
+    }
+    catch (error) {
+        return auditFailure(error);
+    }
+}
+export function cleanupOldLogs() {
+    const dir = getLogDir();
+    if (!fs.existsSync(dir))
+        return;
+    const cutoff = Date.now() - 90 * 24 * 3600 * 1000;
+    for (const entry of fs.readdirSync(dir)) {
+        const match = entry.match(/^audit\.log\.(\d{4}-\d{2}-\d{2})$/);
+        if (!match)
+            continue;
+        const fileDate = new Date(match[1]).getTime();
+        if (fileDate < cutoff)
+            fs.unlinkSync(path.join(dir, entry));
+    }
+}
+//# sourceMappingURL=audit-writer.js.map

package/dist/shared/audit-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-writer.js","sourceRoot":"","sources":["../../src/shared/audit-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAM5E,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,IAAI,aAAa,GAAG,EAAE,CAAC;AAEvB,SAAS,sBAAsB,CAAC,OAAe;IAC7C,IAAI,aAAa;QAAE,OAAO;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;QACzC,aAAa,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAA8B;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEhC,IAAI,aAAa,IAAI,aAAa,KAAK,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,aAAa,EAAE,CAAC,CAAC;gBACjE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBAC9B,aAAa,GAAG,KAAK,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QACtF,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,IAAI,QAAQ,GAAG,MAAM;YAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/shared/blocking-decision-choices.d.ts

@@ -0,0 +1,13 @@
+import type { BlockingDecisionChoice } from './types.js';
+export interface BlockingDecisionChoiceOption {
+    key: '1' | '2' | '3';
+    choice: BlockingDecisionChoice;
+    label: string;
+    shortLabel: string;
+    description: string;
+}
+export declare const BLOCKING_DECISION_CHOICES: readonly BlockingDecisionChoiceOption[];
+export declare function choiceFromDecisionKey(input: string): BlockingDecisionChoice | null;
+export declare function decisionKeyForChoice(choice: BlockingDecisionChoice): '1' | '2' | '3';
+export declare function labelForDecisionChoice(choice: BlockingDecisionChoice): string;
+//# sourceMappingURL=blocking-decision-choices.d.ts.map

package/dist/shared/blocking-decision-choices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocking-decision-choices.d.ts","sourceRoot":"","sources":["../../src/shared/blocking-decision-choices.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,WAAW,4BAA4B;IAC3C,GAAG,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACrB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,yBAAyB,EAAE,SAAS,4BAA4B,EAsB5E,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAGlF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAIpF;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAI7E"}