@wardby/cli 0.2.1 → 0.4.0

package/dist/providers/jobs/kubernetes.js

@@ -29,20 +29,27 @@ import { finished } from "node:stream/promises";
 import { createHash } from "node:crypto";
 import { isIP } from "node:net";
 import { logger } from "../../core/logger.js";
-import { MAX_CODING_ARTIFACT_BYTES, parseCodingAgentOutputJson } from "../../coding/protocol.js";
+import { MAX_CODING_ARTIFACT_BYTES, MAX_DEBUG_TRACE_LINE_BYTES, parseCodingAgentOutputJson, } from "../../coding/protocol.js";
 import { CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "./docker-isolation.js";
 import { parseWorkerDiagnosticLine } from "./docker.js";
 import { KubernetesAlreadyExistsError, KubernetesConflictError } from "./kubernetes-api.js";
-import { ENFORCEMENT_PROBE_DENY_REACHABLE, ENFORCEMENT_PROBE_PROVEN, ENFORCEMENT_PROBE_DENY_REFUSED, ENFORCEMENT_PROBE_PROXY_UNREACHABLE, KEEPER_CONTAINER, KEEPER_SEEDED_MARKER, KUBERNETES_ISOLATION_ERROR, STORAGE_ROOT, WORKER_CONTAINER, assertRunNetworkPolicyMatches, assertRunPodMatches, buildCapabilitySecret, buildRunNetworkPolicy, buildRunPod, enforcementProbeScript, kubernetesRunNames, kubernetesRunNamesForToken, runLabels, validateKubernetesSpec, } from "./kubernetes-isolation.js";
+import { ENFORCEMENT_PROBE_DENY_REACHABLE, ENFORCEMENT_PROBE_PROVEN, ENFORCEMENT_PROBE_DENY_REFUSED, ENFORCEMENT_PROBE_PROXY_UNREACHABLE, KEEPER_CONTAINER, KEEPER_SEEDED_MARKER, KUBERNETES_ISOLATION_ERROR, STORAGE_ROOT, TOOL_RUNNER_CONTAINER, WORKER_CONTAINER, assertRunNetworkPolicyMatches, assertRunPodMatches, buildCapabilitySecret, buildRunNetworkPolicy, buildRunPod, enforcementProbeScript, kubernetesRunNames, kubernetesRunNamesForToken, runLabels, serviceContainerName, validateKubernetesSpec, } from "./kubernetes-isolation.js";
+import { claudeToolSetup } from "./claude-tool-setup.js";
 import { readProxyWitness } from "./kubernetes-witness.js";
 import { safeExtract } from "./safe-extract.js";
+import { reportServiceState, } from "./service-state.js";
+import { serviceUnreadyError } from "../../coding/services/wording.js";
 import { replaceDirectoryFromStaging } from "./workspace-swap.js";
+import { collectExclusions, normalizeCollectExclusions, tarExcludeArgs, } from "../../coding/collect-exclude.js";
 const BACKEND = "kubernetes";
 const RECORD_SCHEMA_VERSION = 1;
 const RECORD_KEY = "record.json";
 const STOP_GRACE_SECONDS = 10;
 const DIAGNOSTIC_TAIL_LINES = 8;
-const DIAGNOSTIC_LIMIT_BYTES = 4096;
+// The API cuts the tail from its FRONT at limitBytes, so this must hold every
+// tail line at full size: a debug-traced run writes lines of up to
+// MAX_DEBUG_TRACE_LINE_BYTES just before its diagnostic line.
+const DIAGNOSTIC_LIMIT_BYTES = DIAGNOSTIC_TAIL_LINES * MAX_DEBUG_TRACE_LINE_BYTES;
 const MAX_WORKSPACE_ENTRIES = 100_000;
 const MAX_RECORD_ATTEMPTS = 5;
 const READY_POLL_MS = 250;
@@ -51,8 +58,17 @@ const DEFAULT_ENFORCEMENT_TIMEOUT_MS = 30_000;
 const ENFORCEMENT_POLL_MS = 500;
 /** Consecutive proven probes required (8787 reachable, 8788 blocked): one dropped SYN must not open the gate. */
 const ENFORCEMENT_BLOCKED_STREAK = 3;
-/** Bound for one enforcement probe exec (the probe makes two sequential connects, so it gives up after at most 6 s). */
-const ENFORCEMENT_EXEC_TIMEOUT_MS = 10_000;
+/**
+ * Default bound for one enforcement probe exec (the probe makes two sequential connects, so it
+ * gives up after at most 6 s of its own connect timeouts). Overridable per KubernetesJobConfig's
+ * `enforcementExecTimeoutMs` (KUBERNETES_ENFORCEMENT_EXEC_TIMEOUT_MS) — a resource-constrained
+ * keeper (e.g. a laptop `kind` cluster's default 250m CPU / 128Mi limit) can take noticeably
+ * longer than this to run even a healthy probe to completion. DEFAULT_ENFORCEMENT_TIMEOUT_MS
+ * above is exactly this default times ENFORCEMENT_BLOCKED_STREAK, which is not a coincidence: see
+ * the constructor, which derives the effective overall bound the same way from whichever exec
+ * timeout is actually configured, so the two never drift apart.
+ */
+const DEFAULT_ENFORCEMENT_EXEC_TIMEOUT_MS = 10_000;
 /**
  * What the gate reports at its bound, by the last probe's exit code. Each names a different place
  * to look, and each carries the reason in its own message rather than in the documentation: an
@@ -141,6 +157,29 @@ const FATAL_WAITING_REASONS = new Set([
     "CreateContainerError",
     "CrashLoopBackOff",
 ]);
+const IMAGE_WAITING_REASONS = new Set(["ErrImagePull", "ImagePullBackOff", "InvalidImageName"]);
+/**
+ * A service sidecar's start-up state as the pod status shows it. The kubelet runs the startup
+ * probe, so attempt counts are unknown here; checks mirror waitForKeeper's own failure rules.
+ */
+function observedServiceState(status) {
+    if (status === undefined)
+        return { state: "pending" };
+    if ((status.restartCount ?? 0) > 0)
+        return { state: "failed", reason: "probe_failed" };
+    const waiting = status.state?.waiting?.reason ?? "";
+    if (IMAGE_WAITING_REASONS.has(waiting))
+        return { state: "failed", reason: "image_unavailable" };
+    if (FATAL_WAITING_REASONS.has(waiting))
+        return { state: "failed", reason: "start_failed" };
+    if (status.state?.terminated !== undefined)
+        return { state: "failed", reason: "exited" };
+    if (status.started === true)
+        return { state: "ready" };
+    if (status.state?.running !== undefined)
+        return { state: "probing" };
+    return { state: "pending" };
+}
 const CAPABILITY = /^rrp_[A-Za-z0-9_-]{16,512}$/;
 const TOKEN = /^[a-f0-9]{20}$/;
 const WORKSPACE_STORAGE = `${STORAGE_ROOT}/workspace`;
@@ -224,6 +263,11 @@ function exitedCleanlyInTime(pod, finishedAt, deadlineAt) {
     const finished = new Date(finishedAt).getTime();
     return Number.isFinite(finished) && finished <= deadlineAt + FINISHED_AT_SKEW_MS;
 }
+/** A Claude run's tool runner that restarted or exited: its socket (and any in-flight command) is gone. */
+function toolRunnerFailed(statuses) {
+    const tool = statuses?.find((status) => status.name === TOOL_RUNNER_CONTAINER);
+    return tool !== undefined && ((tool.restartCount ?? 0) > 0 || tool.state?.terminated !== undefined);
+}
 /** Maps a pod read-back onto the next record state; `undefined` means "no change". Never called for terminal records. */
 function observePod(pod, record, now, readyTimeoutMs) {
     if (!pod) {
@@ -242,6 +286,16 @@ function observePod(pod, record, now, readyTimeoutMs) {
     if (now >= record.deadlineAt || pod.status?.reason === "DeadlineExceeded") {
         return { phase: "failed", result: { exitCode: 124, reason: "timed_out" }, deleteGraceSeconds: STOP_GRACE_SECONDS };
     }
+    // Docker's worker_tool_runner_failed, for the same reason: without its tool runner a Claude worker
+    // can only stall until the deadline. Checked only while the worker still runs, so a clean finish
+    // (checked above) or the pod's own teardown never reads as a tool-runner failure.
+    if (!terminated && toolRunnerFailed(pod.status?.initContainerStatuses)) {
+        return {
+            phase: "failed",
+            result: { exitCode: 1, reason: "failed", diagnostic: "worker_tool_runner_failed" },
+            deleteGraceSeconds: STOP_GRACE_SECONDS,
+        };
+    }
     if (terminated) {
         // An exit 0 that failed the guard above (pod being deleted, no usable finish time) is not a success.
         if (terminated.exitCode === 0)
@@ -328,6 +382,7 @@ export class KubernetesJobLauncher {
     createArchive;
     warn;
     enforcementTimeoutMs;
+    enforcementExecTimeoutMs;
     preflightResult;
     constructor(options) {
         this.options = options;
@@ -339,10 +394,24 @@ export class KubernetesJobLauncher {
         this.now = options.now ?? Date.now;
         this.sleep = options.sleep ?? ((ms) => new Promise((resolvePromise) => setTimeout(resolvePromise, ms)));
         this.readyTimeoutMs = options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
-        this.enforcementTimeoutMs = options.enforcementTimeoutMs ?? DEFAULT_ENFORCEMENT_TIMEOUT_MS;
+        this.enforcementExecTimeoutMs = options.enforcementExecTimeoutMs ?? DEFAULT_ENFORCEMENT_EXEC_TIMEOUT_MS;
+        // Never less than a full blocked-streak's worth of worst-case probes: a longer configured exec
+        // timeout that left this unchanged could make the wall-clock bound expire before the loop ever
+        // has a chance to observe ENFORCEMENT_BLOCKED_STREAK consecutive probes, which would turn "the
+        // keeper is just slow" into an indistinguishable "the policy is not enforced" false negative.
+        // DEFAULT_ENFORCEMENT_TIMEOUT_MS (30_000) already equals the default exec timeout times the
+        // streak (10_000 * 3), so this is a no-op unless a longer exec timeout is actually configured.
+        this.enforcementTimeoutMs = Math.max(options.enforcementTimeoutMs ?? DEFAULT_ENFORCEMENT_TIMEOUT_MS, this.enforcementExecTimeoutMs * ENFORCEMENT_BLOCKED_STREAK);
         this.createArchive = options.createArchive ?? hostTarArchive;
         this.warn = options.onWarning ?? ((message) => kubernetesLog.warn(message));
     }
+    /**
+     * Services run as native sidecars in the run pod (kubernetes-isolation.ts), for either provider:
+     * Claude Code's tool runner is a sidecar in the same pod, so it reaches them on 127.0.0.1 too.
+     */
+    supportsServicesFor(provider) {
+        return provider === "codex" || provider === "claude-code";
+    }
     /**
      * Every per-run object name derives from the run id, so the handle is known before any cluster call.
      * The executor persists it first; a crash mid-launch then still has a handle to clean up with (the
@@ -359,7 +428,19 @@ export class KubernetesJobLauncher {
         }
     }
     async launch(spec) {
-        validateKubernetesSpec(spec);
+        try {
+            validateKubernetesSpec(spec);
+        }
+        catch (error) {
+            // The thrown error already carries the real reason (e.g.
+            // "kubernetes_isolation_unsupported:image-not-registry-digest") and is rethrown unchanged;
+            // this only makes that reason visible to an operator watching logs before the caller (which
+            // may only surface the top-level error code) does anything with it. Nothing here is derived
+            // from spec content beyond that fixed reason tag — no image reference, no limit value.
+            if (error instanceof Error)
+                this.warn(`kubernetes_spec_rejected: ${error.message}`);
+            throw error;
+        }
         await this.runPreflight();
         const names = kubernetesRunNames(spec.runId);
         const handle = { backend: BACKEND, id: `${this.namespace}/${names.token}` };
@@ -376,6 +457,7 @@ export class KubernetesJobLauncher {
             createdAt,
             deadlineAt: createdAt + spec.timeoutSec * 1000,
             phase: "provisioning",
+            collectExclude: spec.collectExclude ?? collectExclusions([]),
         };
         try {
             // The record is the idempotency fence before any other cluster side effect.
@@ -454,7 +536,9 @@ export class KubernetesJobLauncher {
             throw new Error("kubernetes_workspace_destination_invalid");
         }
         const maxBytes = record.diskMb * 1024 * 1024;
-        await replaceDirectoryFromStaging(expected, maxBytes, "kubernetes_workspace_destination_invalid", (staging) => this.extractWorkspace(names, staging, maxBytes, this.transferBudgetMs(record)));
+        await replaceDirectoryFromStaging(expected, maxBytes, "kubernetes_workspace_destination_invalid", (staging) => this.extractWorkspace(names, staging, maxBytes, this.transferBudgetMs(record), 
+        // Names are always the current built-in list; only the paths come from the record.
+        normalizeCollectExclusions(record.collectExclude?.paths)));
     }
     async stop(handle, _reason) {
         const names = this.namesFor(handle);
@@ -532,7 +616,7 @@ export class KubernetesJobLauncher {
             // `exitCode` is this iteration's probe, and the bound below is only ever reached from here —
             // so the verdict is always the *last* probe's, never a remembered earlier one.
             const exitCode = await this.api.exec(this.namespace, names.pod, KEEPER_CONTAINER, command, {
-                timeoutMs: ENFORCEMENT_EXEC_TIMEOUT_MS,
+                timeoutMs: this.enforcementExecTimeoutMs,
             });
             blocked = exitCode === 0 ? blocked + 1 : 0;
             if (blocked >= ENFORCEMENT_BLOCKED_STREAK)
@@ -552,7 +636,7 @@ export class KubernetesJobLauncher {
         return structuredClone(handle);
     }
     async provision(spec, names, record) {
-        const { runtimeClassName, proxyService, platform } = this.options.config;
+        const { runtimeClassName, priorityClassName, proxyService, platform } = this.options.config;
         if (!runtimeClassName) {
             this.warn("kubernetes_runtime_class_unset: no runtime class configured; coding pods run without gVisor (development clusters only)");
         }
@@ -563,12 +647,19 @@ export class KubernetesJobLauncher {
         // which is only meaningful against a Service that actually exposes it with a ready backend.
         const witness = await readProxyWitness(this.api, this.namespace, proxyService);
         const proxyIp = witness.clusterIp;
-        const pod = buildRunPod(spec, { namespace: this.namespace, proxyIp, runtimeClassName, platform });
+        const pod = buildRunPod(spec, {
+            namespace: this.namespace,
+            proxyIp,
+            runtimeClassName,
+            priorityClassName,
+            platform,
+        });
         const policy = buildRunNetworkPolicy(spec, this.namespace);
-        await this.createIfMissing(() => this.api.createSecret(this.namespace, buildCapabilitySecret(spec, this.namespace, capability)));
+        const toolSetup = spec.provider === "claude-code" ? claudeToolSetup(spec, capability) : undefined;
+        await this.createIfMissing(() => this.api.createSecret(this.namespace, buildCapabilitySecret(spec, this.namespace, capability, toolSetup)));
         await this.createIfMissing(() => this.api.createNetworkPolicy(this.namespace, policy));
         await this.createIfMissing(() => this.api.createPod(this.namespace, pod));
-        await this.waitForKeeper(names);
+        await this.waitForKeeper(names, spec.runId, (spec.services ?? []).map((service) => service.name), spec.provider === "claude-code");
         const [actualPod, actualPolicy] = await Promise.all([
             this.api.readPod(this.namespace, names.pod),
             this.api.readNetworkPolicy(this.namespace, names.policy),
@@ -612,14 +703,41 @@ export class KubernetesJobLauncher {
                 throw error;
         }
     }
-    async waitForKeeper(names) {
+    async waitForKeeper(names, runId, serviceNames, toolRunner = false) {
         const started = this.now();
+        const reported = new Map();
+        const report = async (name, observed) => {
+            const key = `${observed.state}:${observed.reason ?? ""}`;
+            if (reported.get(name) === key)
+                return;
+            reported.set(name, key);
+            await reportServiceState(this.options.onServiceState, { runId, name, ...observed });
+        };
         for (;;) {
             const pod = await this.api.readPod(this.namespace, names.pod);
             if (!pod || pod.status?.phase === "Failed")
                 throw new Error("kubernetes_pod_start_failed");
             const statuses = pod.status?.containerStatuses ?? [];
             const initStatuses = pod.status?.initContainerStatuses ?? [];
+            const sidecar = (name) => initStatuses.find((status) => status.name === serviceContainerName(name));
+            for (const name of serviceNames)
+                await report(name, observedServiceState(sidecar(name)));
+            // A service sidecar that restarted (its startup probe gave up), can't be pulled or created, or
+            // exited will never let the keeper start. Name the service rather than a generic start failure.
+            const failedService = serviceNames.find((name) => {
+                const status = sidecar(name);
+                return (status !== undefined &&
+                    ((status.restartCount ?? 0) > 0 ||
+                        FATAL_WAITING_REASONS.has(status.state?.waiting?.reason ?? "") ||
+                        status.state?.terminated !== undefined));
+            });
+            if (failedService !== undefined)
+                throw serviceUnreadyError(failedService);
+            const toolStatus = initStatuses.find((status) => status.name === TOOL_RUNNER_CONTAINER);
+            if (toolRunner &&
+                (toolRunnerFailed(initStatuses) || FATAL_WAITING_REASONS.has(toolStatus?.state?.waiting?.reason ?? ""))) {
+                throw new Error("kubernetes_tool_runner_failed");
+            }
             const keeper = statuses.find((status) => status.name === KEEPER_CONTAINER);
             if ([...initStatuses, ...statuses].some((status) => FATAL_WAITING_REASONS.has(status.state?.waiting?.reason ?? "")) ||
                 // A failed init container (kubectl's Init:Error) or a keeper that already exited can never become ready.
@@ -627,10 +745,25 @@ export class KubernetesJobLauncher {
                 keeper?.state?.terminated !== undefined) {
                 throw new Error("kubernetes_pod_start_failed");
             }
-            if (keeper?.ready === true)
+            if (keeper?.ready === true) {
+                // Native sidecars start in order before the keeper, so a ready keeper means every service started.
+                for (const name of serviceNames)
+                    await report(name, { state: "ready" });
                 return;
-            if (this.now() - started >= this.readyTimeoutMs)
+            }
+            if (this.now() - started >= this.readyTimeoutMs) {
+                if (toolRunner && toolStatus?.started !== true) {
+                    throw new Error("kubernetes_tool_runner_unready");
+                }
+                // At the bound, a service that never passed its startup probe (still pulling, still starting)
+                // is why the keeper never started.
+                const waiting = serviceNames.find((name) => sidecar(name)?.started !== true);
+                if (waiting !== undefined) {
+                    await report(waiting, { state: "failed", reason: "timed_out" });
+                    throw serviceUnreadyError(waiting);
+                }
                 throw new Error("kubernetes_pod_start_timeout");
+            }
             await this.sleep(READY_POLL_MS);
         }
     }
@@ -754,9 +887,10 @@ export class KubernetesJobLauncher {
      * Streams the keeper's workspace through the strict extractor into `staging`.
      * The transfer is bounded by `timeoutMs` (see transferBudgetMs): on expiry the
      * extraction is aborted. On any failure the output stream this method created
-     * is destroyed, since the exec's own timeout does not end it.
+     * is destroyed, since the exec's own timeout does not end it. Excluded dependency
+     * and cache paths never leave the pod (see src/coding/collect-exclude.ts).
      */
-    async extractWorkspace(names, staging, maxBytes, timeoutMs) {
+    async extractWorkspace(names, staging, maxBytes, timeoutMs, exclusions) {
         const output = new PassThrough();
         // Errors are surfaced through the exec/extraction promises; never let a late destroy() crash the process.
         output.on("error", () => undefined);
@@ -767,10 +901,7 @@ export class KubernetesJobLauncher {
             signal: controller.signal,
         });
         const execution = this.api
-            .exec(this.namespace, names.pod, KEEPER_CONTAINER, ["tar", "-C", WORKSPACE_STORAGE, "-cf", "-", "."], {
-            stdout: output,
-            timeoutMs,
-        })
+            .exec(this.namespace, names.pod, KEEPER_CONTAINER, ["tar", "-C", WORKSPACE_STORAGE, ...tarExcludeArgs(exclusions), "-cf", "-", "."], { stdout: output, timeoutMs })
             .then((exitCode) => {
             if (exitCode !== 0)
                 throw new Error("kubernetes_workspace_archive_failed");

package/dist/providers/jobs/service-state.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Display-only observation of coding-run service start-up (docs/coding-services.md): launchers
+ * report each service's state as they see it, for the viewer. Never part of the launch's own
+ * control flow: a reporter error is swallowed. The launcher does await each report inline,
+ * though, so a reporter must be fast.
+ */
+export type ServiceState = "pending" | "probing" | "ready" | "failed";
+/** Fixed identifiers only: never probe output, container logs, or anything from the repository. */
+export type ServiceFailureReason = "image_unavailable" | "start_failed" | "exited" | "probe_failed" | "timed_out";
+export interface ServiceStateUpdate {
+    runId: string;
+    /** The catalog service name (CodingService.name). */
+    name: string;
+    state: ServiceState;
+    /** Readiness probes completed so far; only launchers that run the probe themselves (Docker) know it. */
+    attempts?: number;
+    /** Set only with state "failed". */
+    reason?: ServiceFailureReason;
+}
+export type ServiceStateReporter = (update: ServiceStateUpdate) => Promise<void>;
+/** Calls `reporter` if there is one; any error it throws is dropped (status is display-only). */
+export declare function reportServiceState(reporter: ServiceStateReporter | undefined, update: ServiceStateUpdate): Promise<void>;

package/dist/providers/jobs/service-state.js

@@ -0,0 +1,17 @@
+/**
+ * Display-only observation of coding-run service start-up (docs/coding-services.md): launchers
+ * report each service's state as they see it, for the viewer. Never part of the launch's own
+ * control flow: a reporter error is swallowed. The launcher does await each report inline,
+ * though, so a reporter must be fast.
+ */
+/** Calls `reporter` if there is one; any error it throws is dropped (status is display-only). */
+export async function reportServiceState(reporter, update) {
+    if (!reporter)
+        return;
+    try {
+        await reporter(update);
+    }
+    catch {
+        // Display-only: a lost update must never fail or slow a launch.
+    }
+}

package/dist/providers/jobs/types.d.ts

@@ -3,12 +3,15 @@
  * values are carried in a versioned input artifact, never expanded into an
  * arbitrary environment map or shell command.
  */
+import type { CodingProvider } from "../../coding/provider.js";
 export interface JobResourceLimits {
     cpus: number;
     memoryMb: number;
     pids: number;
     diskMb: number;
 }
+import type { CollectExclusions } from "../../coding/collect-exclude.js";
+import type { ResolvedCodingService } from "../../coding/services/catalog.js";
 export interface JobSpec {
     kind: "coding-agent";
     runId: string;
@@ -21,6 +24,16 @@ export interface JobSpec {
     timeoutSec: number;
     limits: JobResourceLimits;
     labels: Record<string, string>;
+    /** Workspace paths never collected; absent on legacy specs, which get the built-in names. */
+    collectExclude?: CollectExclusions;
+    /**
+     * Coding-run services (docs/coding-services.md): catalog snapshots resolved
+     * at dispatch, started next to the worker. Their images and environments come
+     * from the admin-managed catalog, never from repository content. Absent for
+     * a run without services (never an empty list), so such a spec, and its hash,
+     * is unchanged.
+     */
+    services?: ResolvedCodingService[];
 }
 /** Opaque provider reference. Callers persist both fields exactly as given. */
 export interface JobHandle {
@@ -77,4 +90,9 @@ export interface JobLauncher {
 /** A launcher that can safely copy a terminal worker workspace back to trusted storage. */
 export interface WorkspaceJobLauncher extends JobLauncher {
     materializeWorkspace: (handle: JobHandle, destination: string) => Promise<void>;
+    /**
+     * Whether this launcher starts JobSpec.services for a run of `provider`: Kubernetes and Docker, for
+     * Codex and Claude Code. Absent means no services at all.
+     */
+    supportsServicesFor?(provider: CodingProvider): boolean;
 }

package/dist/providers/llm/anthropic.d.ts

@@ -2,12 +2,12 @@
  * Direct Anthropic (Claude) adapter for the LlmProvider seam. `@anthropic-ai/sdk`
  * is imported only here; all protocol/pricing-dispatch logic lives in the
  * shared ClaudeLlmProvider base class (claude-provider.ts) — this file's only
- * job is constructing the right client and pricing module.
+ * job is constructing the right client.
  */
 import Anthropic from "@anthropic-ai/sdk";
 import { ClaudeLlmProvider } from "./claude-provider.js";
-export { anthropicSupportedModels } from "./pricing-anthropic.js";
+import type { CatalogLookup } from "./catalog-lookup.js";
 export declare function anthropicCredentialsPresent(env?: NodeJS.ProcessEnv): boolean;
 export declare class AnthropicLlmProvider extends ClaudeLlmProvider {
-    constructor(apiKey?: string, client?: Anthropic);
+    constructor(apiKey?: string, client?: Anthropic, lookup?: CatalogLookup);
 }

package/dist/providers/llm/anthropic.js

@@ -2,20 +2,18 @@
  * Direct Anthropic (Claude) adapter for the LlmProvider seam. `@anthropic-ai/sdk`
  * is imported only here; all protocol/pricing-dispatch logic lives in the
  * shared ClaudeLlmProvider base class (claude-provider.ts) — this file's only
- * job is constructing the right client and pricing module.
+ * job is constructing the right client.
  */
 import Anthropic from "@anthropic-ai/sdk";
 import { ClaudeLlmProvider } from "./claude-provider.js";
-import { anthropicPriceUsd, getAnthropicPricing } from "./pricing-anthropic.js";
-export { anthropicSupportedModels } from "./pricing-anthropic.js";
 export function anthropicCredentialsPresent(env = process.env) {
     return Boolean(env.ANTHROPIC_API_KEY);
 }
 export class AnthropicLlmProvider extends ClaudeLlmProvider {
-    constructor(apiKey = process.env.ANTHROPIC_API_KEY ?? "", client) {
+    constructor(apiKey = process.env.ANTHROPIC_API_KEY ?? "", client, lookup) {
         if (!client && !apiKey) {
             throw new Error("ANTHROPIC_API_KEY is not set — required by the Anthropic LlmProvider adapter.");
         }
-        super(client ?? new Anthropic({ apiKey }), { getPricing: getAnthropicPricing, priceUsd: anthropicPriceUsd });
+        super(client ?? new Anthropic({ apiKey }), lookup);
     }
 }

package/dist/providers/llm/bedrock.d.ts

@@ -3,7 +3,7 @@
  * is imported only here; all protocol/pricing-dispatch logic lives in the
  * shared ClaudeLlmProvider base class (claude-provider.ts) — AnthropicBedrock
  * exposes the identical .messages.stream() surface as @anthropic-ai/sdk, so
- * this file's only job is constructing the right client and pricing module.
+ * this file's only job is constructing the right client.
  *
  * Named BedrockClaudeLlmProvider, not BedrockLlmProvider: Bedrock hosts
  * multiple model vendors, and this adapter only ever speaks the
@@ -12,8 +12,8 @@
  */
 import { AnthropicBedrock } from "@anthropic-ai/bedrock-sdk";
 import { ClaudeLlmProvider } from "./claude-provider.js";
-export { bedrockClaudeSupportedModels } from "./pricing-bedrock-claude.js";
+import type { CatalogLookup } from "./catalog-lookup.js";
 export declare function bedrockCredentialsPresent(env?: NodeJS.ProcessEnv): boolean;
 export declare class BedrockClaudeLlmProvider extends ClaudeLlmProvider {
-    constructor(region?: string, client?: AnthropicBedrock);
+    constructor(region?: string, client?: AnthropicBedrock, lookup?: CatalogLookup);
 }

package/dist/providers/llm/bedrock.js

@@ -3,7 +3,7 @@
  * is imported only here; all protocol/pricing-dispatch logic lives in the
  * shared ClaudeLlmProvider base class (claude-provider.ts) — AnthropicBedrock
  * exposes the identical .messages.stream() surface as @anthropic-ai/sdk, so
- * this file's only job is constructing the right client and pricing module.
+ * this file's only job is constructing the right client.
  *
  * Named BedrockClaudeLlmProvider, not BedrockLlmProvider: Bedrock hosts
  * multiple model vendors, and this adapter only ever speaks the
@@ -12,8 +12,6 @@
  */
 import { AnthropicBedrock } from "@anthropic-ai/bedrock-sdk";
 import { ClaudeLlmProvider } from "./claude-provider.js";
-import { bedrockClaudePriceUsd, getBedrockClaudePricing } from "./pricing-bedrock-claude.js";
-export { bedrockClaudeSupportedModels } from "./pricing-bedrock-claude.js";
 export function bedrockCredentialsPresent(env = process.env) {
     // A region is the one thing Bedrock always needs; AWS resolves actual
     // credentials from the standard default chain (env keys, shared config,
@@ -21,13 +19,10 @@ export function bedrockCredentialsPresent(env = process.env) {
     return Boolean(env.BEDROCK_REGION ?? env.AWS_REGION);
 }
 export class BedrockClaudeLlmProvider extends ClaudeLlmProvider {
-    constructor(region = process.env.BEDROCK_REGION ?? process.env.AWS_REGION ?? "", client) {
+    constructor(region = process.env.BEDROCK_REGION ?? process.env.AWS_REGION ?? "", client, lookup) {
         if (!client && !region) {
             throw new Error("BEDROCK_REGION (or AWS_REGION) is required by the Bedrock Claude LlmProvider adapter.");
         }
-        super(client ?? new AnthropicBedrock({ awsRegion: region }), {
-            getPricing: getBedrockClaudePricing,
-            priceUsd: bedrockClaudePriceUsd,
-        });
+        super(client ?? new AnthropicBedrock({ awsRegion: region }), lookup);
     }
 }

package/dist/providers/llm/catalog-lookup.d.ts

@@ -0,0 +1,10 @@
+/**
+ * How an adapter finds the catalog entry for a model. The default reads the
+ * process's current catalog; pinnedLookup binds an adapter to one run's
+ * stored entry. Kept apart from the store so adapters depend only on this.
+ */
+import { type CatalogEntry } from "./catalog-types.js";
+/** Throws ModelUnavailableError for a model it does not serve. */
+export type CatalogLookup = (model: string) => CatalogEntry;
+export declare const currentLookup: CatalogLookup;
+export declare function pinnedLookup(entry: CatalogEntry): CatalogLookup;

package/dist/providers/llm/catalog-lookup.js

@@ -0,0 +1,15 @@
+/**
+ * How an adapter finds the catalog entry for a model. The default reads the
+ * process's current catalog; pinnedLookup binds an adapter to one run's
+ * stored entry. Kept apart from the store so adapters depend only on this.
+ */
+import { ModelUnavailableError } from "./catalog-types.js";
+import { currentModelCatalog } from "./catalog-store.js";
+export const currentLookup = (model) => currentModelCatalog().require(model);
+export function pinnedLookup(entry) {
+    return (model) => {
+        if (model !== entry.modelId)
+            throw new ModelUnavailableError(model, "not_in_catalog");
+        return entry;
+    };
+}

package/dist/providers/llm/catalog-shipped.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The model catalog wardby ships. Every entry is fully literal: rates are the
+ * provider's own published numbers for that exact model, never derived from
+ * another field (CLAUDE.md "LLM pricing tables — STRICT"). A deployment's
+ * admins override or extend this with ModelCatalogEntry rows (set_model);
+ * this file changes only with a wardby release, and SHIPPED_CATALOG_VERSION
+ * must be bumped whenever any value here changes.
+ *
+ * Anthropic and Bedrock rates are the 5-minute cache-TTL numbers
+ * (platform.claude.com/docs/en/about-claude/pricing): wardby only emits the
+ * default 5-minute cache_control breakpoint. OpenAI's pre-GPT-5.6 models have
+ * no distinct cache-write tier (a first-time prefix bills at the standard
+ * input rate), so their cacheWritePerMTok is their own input rate, stated
+ * literally.
+ */
+import type { CatalogEntry } from "./catalog-types.js";
+export declare const SHIPPED_CATALOG_VERSION = "2026-10-03";
+export declare const SHIPPED_CATALOG: readonly CatalogEntry[];