@wardby/cli 0.5.2 → 0.5.3

package/dist/mcp/auth/ownership.d.ts

@@ -72,9 +72,9 @@ export declare function assertStrictlyOwnedTool(tool: Tool | null, id: string, p
  * triggered them. No canRead/null=public path exists here on purpose.
  */
 export declare function requireOwnedTask(db: PrismaClient, taskId: string, principalId: string): Promise<{
+    error: import("@prisma/client/runtime/client").JsonValue | null;
     status: import("#prisma").TaskStatus;
     runId: string | null;
-    error: import("@prisma/client/runtime/client").JsonValue | null;
     createdAt: Date;
     updatedAt: Date;
     kind: import("#prisma").TaskKind;

package/dist/mcp/tools/agents.js

@@ -225,7 +225,7 @@ const profileJsonSchema = {
         },
         packageAllowlist: {
             type: "object",
-            description: "Approved top-level packages per ecosystem (npm, pypi). Needs packages:approve or agents:admin.",
+            description: "Approved top-level packages per ecosystem (npm, pypi). A PyPI entry may name extras, e.g. psycopg[binary]. Needs packages:approve or agents:admin.",
             additionalProperties: { type: "array", maxItems: 256, items: { type: "string" } },
         },
         packagePolicy: {

package/dist/providers/coding-proxy/mock-upstream.d.ts

@@ -0,0 +1,33 @@
+/**
+ * A fake model upstream for load tests: a `fetch` that never opens a socket.
+ * It answers an OpenAI Responses streaming request with one assistant message
+ * whose text is the coding worker's final JSON (`outcome: "no_changes"`), so a
+ * run finishes without tool calls, changes or a pull request. Enabled only by
+ * `mockUpstreamFromEnv` (see its guard). Never use outside a load test.
+ *
+ * Codex/OpenAI Responses only (ruling R1): any other host, including the
+ * Anthropic Messages endpoint, gets a 501 rather than a fabricated reply.
+ */
+export interface MockUpstreamConfig {
+    latencyMs: number;
+    jitterMs: number;
+    inputTokens: number;
+    outputTokens: number;
+}
+export declare const DEFAULT_MOCK_UPSTREAM: MockUpstreamConfig;
+/** The runId the coding worker's prompt names, or null when the request carries none. */
+export declare function extractRunId(body: string): string | null;
+/**
+ * Builds a `fetch` that simulates the OpenAI Responses streaming endpoint for
+ * load tests: no socket, no credential forwarding, deterministic latency and
+ * token counts. `sleep` is injectable so tests can assert on the delay without
+ * waiting it out.
+ */
+export declare function createMockUpstream(overrides?: Partial<MockUpstreamConfig>, sleep?: (ms: number) => Promise<void>): typeof globalThis.fetch;
+/**
+ * The mock model upstream is a load-test seam inside a production binary, so
+ * it needs two deliberate switches: WARDBY_LOAD_TEST=1 and
+ * WARDBY_CODING_PROXY_MOCK_UPSTREAM=1. One without the other, or any other
+ * value, refuses to start the proxy rather than silently picking a side.
+ */
+export declare function mockUpstreamFromEnv(env: NodeJS.ProcessEnv): MockUpstreamConfig | null;

package/dist/providers/coding-proxy/mock-upstream.js

@@ -0,0 +1,116 @@
+export const DEFAULT_MOCK_UPSTREAM = {
+    latencyMs: 5000,
+    jitterMs: 0,
+    inputTokens: 1200,
+    outputTokens: 80,
+};
+const RUN_ID = /The final JSON runId must be ([A-Za-z0-9][A-Za-z0-9_-]*)\./;
+/** The runId the coding worker's prompt names, or null when the request carries none. */
+export function extractRunId(body) {
+    return RUN_ID.exec(body)?.[1] ?? null;
+}
+const sse = (event, data) => `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+async function bodyText(input, init) {
+    const raw = init?.body;
+    if (typeof raw === "string")
+        return raw;
+    if (raw instanceof Uint8Array)
+        return Buffer.from(raw).toString("utf8");
+    if (input instanceof Request)
+        return input.text();
+    return "";
+}
+/**
+ * Builds a `fetch` that simulates the OpenAI Responses streaming endpoint for
+ * load tests: no socket, no credential forwarding, deterministic latency and
+ * token counts. `sleep` is injectable so tests can assert on the delay without
+ * waiting it out.
+ */
+export function createMockUpstream(overrides = {}, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    const config = { ...DEFAULT_MOCK_UPSTREAM, ...overrides };
+    return async (input, init) => {
+        const url = new URL(typeof input === "string" || input instanceof URL ? input : input.url);
+        if (url.hostname !== "api.openai.com") {
+            return Response.json({ error: { code: "mock_upstream_protocol_unsupported" } }, { status: 501 });
+        }
+        const runId = extractRunId(await bodyText(input, init));
+        if (!runId)
+            return Response.json({ error: { code: "mock_upstream_no_run_id" } }, { status: 400 });
+        await sleep(config.latencyMs + Math.floor(Math.random() * (config.jitterMs + 1)));
+        const text = JSON.stringify({
+            schemaVersion: 1,
+            runId,
+            outcome: "no_changes",
+            summary: "Load test: no changes.",
+            tag: null,
+            tests: [],
+        });
+        const id = `resp_mock_${runId}`;
+        const item = {
+            id: `msg_${runId}`,
+            type: "message",
+            role: "assistant",
+            status: "completed",
+            content: [{ type: "output_text", text, annotations: [] }],
+        };
+        const usage = {
+            input_tokens: config.inputTokens,
+            input_tokens_details: { cached_tokens: 0 },
+            output_tokens: config.outputTokens,
+            output_tokens_details: { reasoning_tokens: 0 },
+            total_tokens: config.inputTokens + config.outputTokens,
+        };
+        const stream = sse("response.created", { type: "response.created", response: { id, status: "in_progress", output: [] } }) +
+            sse("response.output_item.added", {
+                type: "response.output_item.added",
+                output_index: 0,
+                item: { ...item, status: "in_progress", content: [] },
+            }) +
+            sse("response.output_text.delta", {
+                type: "response.output_text.delta",
+                output_index: 0,
+                content_index: 0,
+                item_id: item.id,
+                delta: text,
+            }) +
+            sse("response.output_item.done", { type: "response.output_item.done", output_index: 0, item }) +
+            sse("response.completed", {
+                type: "response.completed",
+                response: { id, status: "completed", output: [item], usage },
+            });
+        return new Response(stream, { status: 200, headers: { "content-type": "text/event-stream" } });
+    };
+}
+const FLAG_LOAD = "WARDBY_LOAD_TEST";
+const FLAG_MOCK = "WARDBY_CODING_PROXY_MOCK_UPSTREAM";
+function nonNegativeInt(env, name, fallback) {
+    const raw = env[name];
+    if (raw === undefined || raw === "")
+        return fallback;
+    // Plain decimal digits only: no sign, hex, exponent, or whitespace.
+    const n = /^\d+$/.test(raw) ? Number(raw) : NaN;
+    if (!Number.isSafeInteger(n) || n < 0) {
+        throw new Error(`mock_upstream_guard: ${name} must be a non-negative integer`);
+    }
+    return n;
+}
+/**
+ * The mock model upstream is a load-test seam inside a production binary, so
+ * it needs two deliberate switches: WARDBY_LOAD_TEST=1 and
+ * WARDBY_CODING_PROXY_MOCK_UPSTREAM=1. One without the other, or any other
+ * value, refuses to start the proxy rather than silently picking a side.
+ */
+export function mockUpstreamFromEnv(env) {
+    const load = env[FLAG_LOAD];
+    const mock = env[FLAG_MOCK];
+    if (load === undefined && mock === undefined)
+        return null;
+    if (load !== "1" || mock !== "1") {
+        throw new Error(`mock_upstream_guard: set both ${FLAG_LOAD}=1 and ${FLAG_MOCK}=1 to use the mock upstream, or neither`);
+    }
+    return {
+        ...DEFAULT_MOCK_UPSTREAM,
+        latencyMs: nonNegativeInt(env, "WARDBY_LOAD_MOCK_LATENCY_MS", DEFAULT_MOCK_UPSTREAM.latencyMs),
+        jitterMs: nonNegativeInt(env, "WARDBY_LOAD_MOCK_JITTER_MS", DEFAULT_MOCK_UPSTREAM.jitterMs),
+    };
+}

package/dist/providers/coding-proxy/registry/prisma-store.d.ts

@@ -1,4 +1,5 @@
 import type { PrismaClient } from "#prisma";
+import type { FileDependency } from "../../../coding/registry/types.js";
 import type { ApprovedVersion, PlanRefusedVersion, RegistryFetchRecord, RegistryRunContext, RegistryStore, StoredVersionFact } from "./store.js";
 export declare class PrismaRegistryStore implements RegistryStore {
     private readonly db;
@@ -6,6 +7,8 @@ export declare class PrismaRegistryStore implements RegistryStore {
     findRunByRegistryTokenHash(hash: string, now: Date): Promise<RegistryRunContext | null>;
     isAllowedDependency(runId: string, ecosystem: string, name: string): Promise<boolean>;
     addAllowances(runId: string, ecosystem: string, names: readonly string[]): Promise<void>;
+    allowedExtras(runId: string, ecosystem: string, name: string): Promise<string[]>;
+    addExtraAllowances(runId: string, ecosystem: string, dependencies: readonly FileDependency[]): Promise<void>;
     recordFetch(record: RegistryFetchRecord): Promise<void>;
     usage(runId: string): Promise<{
         files: number;

package/dist/providers/coding-proxy/registry/prisma-store.js

@@ -1,3 +1,4 @@
+import { extraAllowanceName, extraOfAllowanceName } from "./store.js";
 /** Versions looked up per query, so a 5000-entry lockfile is a handful of
  *  bounded queries rather than one enormous OR. */
 const FACT_QUERY_CHUNK = 500;
@@ -26,6 +27,9 @@ export class PrismaRegistryStore {
         };
     }
     async isAllowedDependency(runId, ecosystem, name) {
+        // An extra's row (`name[extra]`) is never a package allowance.
+        if (name.includes("["))
+            return false;
         const row = await this.db.registryAllowance.findUnique({
             where: { runId_ecosystem_name: { runId, ecosystem, name } },
             select: { runId: true },
@@ -40,6 +44,19 @@ export class PrismaRegistryStore {
             skipDuplicates: true,
         });
     }
+    async allowedExtras(runId, ecosystem, name) {
+        const rows = await this.db.registryAllowance.findMany({
+            where: { runId, ecosystem, name: { startsWith: `${name}[` } },
+            select: { name: true },
+        });
+        return rows
+            .map((row) => extraOfAllowanceName(row.name, name))
+            .filter((extra) => extra !== null)
+            .sort();
+    }
+    async addExtraAllowances(runId, ecosystem, dependencies) {
+        await this.addAllowances(runId, ecosystem, dependencies.flatMap((dependency) => dependency.extras.map((extra) => extraAllowanceName(dependency.name, extra))));
+    }
     async recordFetch(record) {
         await this.db.registryFetch.create({ data: record });
     }

package/dist/providers/coding-proxy/registry/service.d.ts

@@ -209,5 +209,9 @@ export declare class RegistryService {
      *  exactly what was reserved: the declared size when known, or the bytes
      *  actually streamed when it was not. */
     private releaseDownload;
+    /** The extras the run allows for `name`: those its allowlist entries name
+     *  plus those a served parent's dependency line asked of it. They decide
+     *  which of the package's extra-gated dependencies its files allow. */
+    private allowedExtras;
     private download;
 }

package/dist/providers/coding-proxy/registry/service.js

@@ -168,7 +168,7 @@ function versionDependencies(adapter, meta, version) {
 function isPackageName(adapter, name) {
     try {
         const entry = adapter.parseAllowlistEntry(name);
-        return !entry.wildcard && entry.range === undefined && entry.name === name;
+        return !entry.wildcard && entry.range === undefined && entry.extras === undefined && entry.name === name;
     }
     catch {
         return false;
@@ -962,6 +962,16 @@ export class RegistryService {
         else
             this.inFlight.set(runId, slot);
     }
+    /** The extras the run allows for `name`: those its allowlist entries name
+     *  plus those a served parent's dependency line asked of it. They decide
+     *  which of the package's extra-gated dependencies its files allow. */
+    async allowedExtras(adapter, context, name) {
+        const entries = parseAllowlist(context.allowlist, this.options.adapters).get(adapter.id) ?? [];
+        const extras = new Set(entries.flatMap((entry) => (!entry.wildcard && entry.name === name ? (entry.extras ?? []) : [])));
+        for (const extra of await this.options.store.allowedExtras(context.runId, adapter.id, name))
+            extras.add(extra);
+        return [...extras].sort();
+    }
     async download(adapter, context, name, route, file, signal) {
         const { limits, store } = this.options;
         const runId = context.runId;
@@ -1097,8 +1107,15 @@ export class RegistryService {
                         served.bytes += bytes;
                         if (adapter.dependenciesFromFile && buffered.length > 0) {
                             const body = Buffer.concat(buffered);
-                            const names = await adapter.dependenciesFromFile(route, body).catch(() => []);
-                            await store.addAllowances(context.runId, adapter.id, names.map((dependency) => adapter.normalizeName(dependency)));
+                            const extras = await this.allowedExtras(adapter, context, name);
+                            const dependencies = (await adapter.dependenciesFromFile(route, body, extras).catch(() => [])).map((dependency) => ({ name: adapter.normalizeName(dependency.name), extras: dependency.extras }));
+                            await store.addAllowances(context.runId, adapter.id, dependencies.map((dependency) => dependency.name));
+                            // Dependency extras are followed only below a package the run
+                            // allows with extras (an entry naming extras, or a dependency
+                            // such a package asked for with extras): a plain entry follows
+                            // no extras, its own or its dependencies'.
+                            if (extras.length > 0)
+                                await store.addExtraAllowances(context.runId, adapter.id, dependencies);
                         }
                         controller.close();
                     }

package/dist/providers/coding-proxy/registry/store.d.ts

@@ -1,5 +1,5 @@
 import type { PackageAllowlist } from "../../../coding/registry/allowlist.js";
-import type { DeclaredDependency } from "../../../coding/registry/types.js";
+import type { DeclaredDependency, FileDependency } from "../../../coding/registry/types.js";
 export interface RegistryRunContext {
     runId: string;
     deadlineAt: Date;
@@ -41,6 +41,17 @@ export interface PlanRefusedVersion {
     /** Set for a too-new refusal: it lapses once the version is old enough. */
     publishedAt?: Date | null;
 }
+/**
+ * An extra a run allows for a package (PyPI `uvicorn[standard]`) is kept as
+ * an allowance row named `name[extra]`, beside the package's own row. No
+ * registry route can ask for that name (routes accept only valid package
+ * names, which never contain `[`), so the row never allows a fetch itself:
+ * it only tells the proxy which of the package's extra-gated dependencies
+ * to follow when it serves the package's files.
+ */
+export declare function extraAllowanceName(name: string, extra: string): string;
+/** The extra in an allowance row name for `name`, or null when the row is not one of its extras. */
+export declare function extraOfAllowanceName(rowName: string, name: string): string | null;
 /** Run-scoped store over the registry-only token session lookup and the
  *  RegistryAllowance/RegistryFetch tables (Task 5). Backs the registry proxy:
  *  it never sees the model capability, only the derived registry token. */
@@ -48,6 +59,10 @@ export interface RegistryStore {
     findRunByRegistryTokenHash(hash: string, now: Date): Promise<RegistryRunContext | null>;
     isAllowedDependency(runId: string, ecosystem: string, name: string): Promise<boolean>;
     addAllowances(runId: string, ecosystem: string, names: readonly string[]): Promise<void>;
+    /** The extras the run allows for `name` (normalized, sorted). */
+    allowedExtras(runId: string, ecosystem: string, name: string): Promise<string[]>;
+    /** Records extras the run allows for each package (an existing one is kept). */
+    addExtraAllowances(runId: string, ecosystem: string, dependencies: readonly FileDependency[]): Promise<void>;
     recordFetch(record: RegistryFetchRecord): Promise<void>;
     usage(runId: string): Promise<{
         files: number;
@@ -99,6 +114,8 @@ export declare class MemoryRegistryStore implements RegistryStore {
     findRunByRegistryTokenHash(hash: string, now: Date): Promise<RegistryRunContext | null>;
     isAllowedDependency(runId: string, ecosystem: string, name: string): Promise<boolean>;
     addAllowances(runId: string, ecosystem: string, names: readonly string[]): Promise<void>;
+    allowedExtras(runId: string, ecosystem: string, name: string): Promise<string[]>;
+    addExtraAllowances(runId: string, ecosystem: string, dependencies: readonly FileDependency[]): Promise<void>;
     recordFetch(record: RegistryFetchRecord): Promise<void>;
     usage(runId: string): Promise<{
         files: number;

package/dist/providers/coding-proxy/registry/store.js

@@ -1,3 +1,22 @@
+/**
+ * An extra a run allows for a package (PyPI `uvicorn[standard]`) is kept as
+ * an allowance row named `name[extra]`, beside the package's own row. No
+ * registry route can ask for that name (routes accept only valid package
+ * names, which never contain `[`), so the row never allows a fetch itself:
+ * it only tells the proxy which of the package's extra-gated dependencies
+ * to follow when it serves the package's files.
+ */
+export function extraAllowanceName(name, extra) {
+    return `${name}[${extra}]`;
+}
+/** The extra in an allowance row name for `name`, or null when the row is not one of its extras. */
+export function extraOfAllowanceName(rowName, name) {
+    const prefix = `${name}[`;
+    if (!rowName.startsWith(prefix) || !rowName.endsWith("]"))
+        return null;
+    const extra = rowName.slice(prefix.length, -1);
+    return /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(extra) ? extra : null;
+}
 /** In-memory adapter for tests. `contexts` is settable directly so tests can
  *  seed a run without going through a full proxy session. */
 export class MemoryRegistryStore {
@@ -15,12 +34,26 @@ export class MemoryRegistryStore {
         return context && context.deadlineAt > now ? context : null;
     }
     async isAllowedDependency(runId, ecosystem, name) {
+        // An extra's row (`name[extra]`) is never a package allowance.
+        if (name.includes("["))
+            return false;
         return this.allowances.has(`${runId}\0${ecosystem}\0${name}`);
     }
     async addAllowances(runId, ecosystem, names) {
         for (const name of names)
             this.allowances.add(`${runId}\0${ecosystem}\0${name}`);
     }
+    async allowedExtras(runId, ecosystem, name) {
+        const prefix = `${runId}\0${ecosystem}\0`;
+        return [...this.allowances]
+            .filter((key) => key.startsWith(prefix))
+            .map((key) => extraOfAllowanceName(key.slice(prefix.length), name))
+            .filter((extra) => extra !== null)
+            .sort();
+    }
+    async addExtraAllowances(runId, ecosystem, dependencies) {
+        await this.addAllowances(runId, ecosystem, dependencies.flatMap((dependency) => dependency.extras.map((extra) => extraAllowanceName(dependency.name, extra))));
+    }
     async recordFetch(record) {
         this.fetches.push({ ...record, createdAt: new Date() });
     }

package/dist/providers/coding-proxy/runtime.js

@@ -1,7 +1,9 @@
+import { logger } from "../../core/logger.js";
 import { REGISTRY_ADAPTERS } from "../../coding/registry/adapters.js";
 import { CODING_PROXY_ALIAS, CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "../jobs/docker-isolation.js";
 import { startDenyPortListener } from "./deny-port.js";
 import { EnvironmentCredentialResolver } from "./environment-credentials.js";
+import { createMockUpstream, mockUpstreamFromEnv } from "./mock-upstream.js";
 import { CodingProxy } from "./proxy.js";
 import { PrismaProxyLedger } from "./prisma-ledger.js";
 import { OsvAudit } from "./registry/audit.js";
@@ -38,10 +40,19 @@ export function createRegistryUpstream(pinned) {
 /** Starts the trusted proxy with the fixed worker-only Docker endpoint, plus the deny port the enforcement witness probes. */
 export async function startConfiguredCodingProxy(options) {
     const env = options.env ?? process.env;
+    // Throws (mock_upstream_guard) on a partial or malformed setting, before anything listens.
+    const mock = mockUpstreamFromEnv(env);
+    if (mock) {
+        logger.warn({ module: "coding-proxy-runtime", event: "proxy.mock_upstream_enabled" }, "coding proxy: MOCK MODEL UPSTREAM ENABLED (load test). No request reaches a model provider; never use this on a real deployment.");
+    }
+    const audit = mock
+        ? (event) => options.audit?.({ ...event, mockUpstream: true })
+        : options.audit;
     const proxy = new CodingProxy({
         ledger: new PrismaProxyLedger(options.db),
         credentials: new EnvironmentCredentialResolver(env),
-        audit: options.audit,
+        audit,
+        ...(mock ? { fetch: createMockUpstream(mock) } : {}),
     });
     const buildPinnedFetch = options.createPinnedFetch ?? createPinnedProxyFetch;
     const upstreamHosts = [...new Set([...REGISTRY_ADAPTERS.values()].flatMap((adapter) => adapter.upstreamHosts))];

package/dist/providers/coding-proxy/types.d.ts

@@ -124,6 +124,8 @@ export interface ProxyAuditEvent {
     /** For a failed stream: the upstream response's content type and encoding headers, for diagnosis. */
     contentType?: string;
     contentEncoding?: string;
+    /** Set on every event while the load-test mock upstream is enabled. */
+    mockUpstream?: boolean;
 }
 export type ProxyAuditSink = (event: ProxyAuditEvent) => void;
 export interface CredentialResolver {

package/dist/providers/jobs/kubernetes-isolation.d.ts

@@ -167,3 +167,16 @@ export declare function assertRunNetworkPolicyMatches(actual: V1NetworkPolicy, e
  * The IP is validated and embedded as a JSON string literal.
  */
 export declare function enforcementProbeScript(proxyIp: string): string;
+/**
+ * A whole enforcement streak in one process: up to `streak` probes, each exactly
+ * `enforcementProbeScript`'s measurement and classification (the body is shared), `intervalMs`
+ * apart. Exits ENFORCEMENT_PROBE_PROVEN only after `streak` consecutive proven probes; at the
+ * first probe that is not proven it exits at once with that probe's own code, so the caller's
+ * verdict is still the last probe's. Running the streak in one exec (rather than one exec per
+ * probe) pays the keeper's exec + interpreter start-up once per streak instead of once per probe;
+ * the evidence required is unchanged.
+ *
+ * The IP is validated and embedded as a JSON string literal; `streak` and `intervalMs` must be
+ * positive safe integers and are embedded as numeric literals.
+ */
+export declare function enforcementStreakScript(proxyIp: string, streak: number, intervalMs: number): string;

package/dist/providers/jobs/kubernetes-isolation.js

@@ -770,9 +770,24 @@ export function assertRunNetworkPolicyMatches(actual, expected) {
  * The IP is validated and embedded as a JSON string literal.
  */
 export function enforcementProbeScript(proxyIp) {
+    return [...enforcementProbeBody(proxyIp), "(async () => {", "  process.exit(await probe());", "})();"].join("\n");
+}
+/**
+ * The one measurement both enforcement scripts make, as script lines defining `probe()`: connect to
+ * CODING_PROXY_PORT, then to CODING_PROXY_DENY_PORT (both with a 3 s connect timeout, always both,
+ * in that order), and resolve to the exit code classifying that pair. Its first statement presets
+ * `process.exitCode = 1` so that a natural exit is never mistaken for PROVEN. Shared verbatim so the
+ * single probe and the streak can never disagree about what "proven" means.
+ */
+function enforcementProbeBody(proxyIp) {
     if (isIP(proxyIp) === 0)
         throw isolationError();
     return [
+        // Preset a code no probe produces (it reads as "did not run"), so the only way to exit 0 is
+        // the explicit proven exit. Without it, a process that drains its event loop without ever
+        // calling process.exit — a probe promise that never settles, or a rejection under a
+        // non-throwing --unhandled-rejections mode — would exit 0 and read as PROVEN.
+        "process.exitCode = 1;",
         'const net = require("node:net");',
         "const tcp = (port) =>",
         "  new Promise((done) => {",
@@ -781,13 +796,45 @@ export function enforcementProbeScript(proxyIp) {
         '    socket.once("timeout", () => { socket.destroy(); done("timeout"); });',
         '    socket.once("error", () => done("error"));',
         "  });",
-        "(async () => {",
+        "const probe = async () => {",
         `  const allowed = await tcp(${CODING_PROXY_PORT});`,
         `  const denied = await tcp(${CODING_PROXY_DENY_PORT});`,
-        `  if (allowed !== "connect") process.exit(${ENFORCEMENT_PROBE_PROXY_UNREACHABLE});`,
-        `  if (denied === "connect") process.exit(${ENFORCEMENT_PROBE_DENY_REACHABLE});`,
-        `  if (denied === "error") process.exit(${ENFORCEMENT_PROBE_DENY_REFUSED});`,
-        `  process.exit(${ENFORCEMENT_PROBE_PROVEN});`,
+        `  if (allowed !== "connect") return ${ENFORCEMENT_PROBE_PROXY_UNREACHABLE};`,
+        `  if (denied === "connect") return ${ENFORCEMENT_PROBE_DENY_REACHABLE};`,
+        `  if (denied === "error") return ${ENFORCEMENT_PROBE_DENY_REFUSED};`,
+        `  return ${ENFORCEMENT_PROBE_PROVEN};`,
+        "};",
+    ];
+}
+/**
+ * A whole enforcement streak in one process: up to `streak` probes, each exactly
+ * `enforcementProbeScript`'s measurement and classification (the body is shared), `intervalMs`
+ * apart. Exits ENFORCEMENT_PROBE_PROVEN only after `streak` consecutive proven probes; at the
+ * first probe that is not proven it exits at once with that probe's own code, so the caller's
+ * verdict is still the last probe's. Running the streak in one exec (rather than one exec per
+ * probe) pays the keeper's exec + interpreter start-up once per streak instead of once per probe;
+ * the evidence required is unchanged.
+ *
+ * The IP is validated and embedded as a JSON string literal; `streak` and `intervalMs` must be
+ * positive safe integers and are embedded as numeric literals.
+ */
+export function enforcementStreakScript(proxyIp, streak, intervalMs) {
+    const body = enforcementProbeBody(proxyIp);
+    if (!isPositiveSafeInteger(streak) || !isPositiveSafeInteger(intervalMs))
+        throw isolationError();
+    return [
+        ...body,
+        "const pause = (ms) => new Promise((done) => setTimeout(done, ms));",
+        "(async () => {",
+        `  for (let index = 0; index < ${JSON.stringify(streak)}; index += 1) {`,
+        `    if (index > 0) await pause(${JSON.stringify(intervalMs)});`,
+        "    const code = await probe();",
+        `    if (code !== ${ENFORCEMENT_PROBE_PROVEN}) return process.exit(code);`,
+        "  }",
+        `  return process.exit(${ENFORCEMENT_PROBE_PROVEN});`,
         "})();",
     ].join("\n");
 }
+function isPositiveSafeInteger(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}

package/dist/providers/jobs/kubernetes.d.ts

@@ -24,15 +24,19 @@ export interface KubernetesJobLauncherOptions {
     readyTimeoutMs?: number;
     /**
      * How long to wait for the run's NetworkPolicy to be enforced before seeding. Default 30_000,
-     * but never *less* than `enforcementExecTimeoutMs * ENFORCEMENT_BLOCKED_STREAK`: see the
-     * constructor. An explicit override here is a floor raise, not an escape hatch — the gate still
-     * needs room for a full streak of probes at whatever the effective exec timeout is.
+     * but never *less* than one full streak exec's timeout
+     * (`enforcementExecTimeoutMs * ENFORCEMENT_BLOCKED_STREAK + ENFORCEMENT_POLL_MS * (ENFORCEMENT_BLOCKED_STREAK - 1)`,
+     * 31_000 at the default exec timeout): see the constructor. An explicit override here is a floor
+     * raise, not an escape hatch — the gate still needs room for a full streak of probes at whatever
+     * the effective per-probe budget is.
      */
     enforcementTimeoutMs?: number;
     /**
-     * Bound for a single enforcement probe exec. Default 10_000 (DEFAULT_ENFORCEMENT_EXEC_TIMEOUT_MS).
-     * Raise this on a resource-constrained cluster (e.g. `kind` on a laptop) where a healthy probe
-     * can legitimately take longer than 10 s to run inside the keeper's CPU/memory limits.
+     * Time budget for a single enforcement probe. Default 10_000 (DEFAULT_ENFORCEMENT_EXEC_TIMEOUT_MS).
+     * A streak's probes share one exec, whose timeout is this times ENFORCEMENT_BLOCKED_STREAK plus
+     * the poll gaps between them. Raise this on a resource-constrained cluster (e.g. `kind` on a
+     * laptop) where a healthy probe can legitimately take longer than 10 s to run inside the
+     * keeper's CPU/memory limits.
      */
     enforcementExecTimeoutMs?: number;
     createArchive?: (directory: string) => {
@@ -60,6 +64,8 @@ export declare class KubernetesJobLauncher implements WorkspaceJobLauncher {
     private readonly warn;
     private readonly enforcementTimeoutMs;
     private readonly enforcementExecTimeoutMs;
+    /** Timeout of one streak exec: ENFORCEMENT_BLOCKED_STREAK probes plus the gaps between them. */
+    private readonly streakExecTimeoutMs;
     private preflightResult?;
     constructor(options: KubernetesJobLauncherOptions);
     /**
@@ -96,6 +102,14 @@ export declare class KubernetesJobLauncher implements WorkspaceJobLauncher {
      * proxy on CODING_PROXY_PORT and fail to reach it on CODING_PROXY_DENY_PORT. Anything else resets
      * the streak; the wall-clock bound still applies.
      *
+     * The whole streak runs in ONE keeper exec (`enforcementStreakScript`), so exec and interpreter
+     * start-up is paid once per streak rather than once per probe. That exec exits 0 only after the
+     * full streak was proven; otherwise it stops at the first non-proven probe and exits with that
+     * probe's code. Any non-zero exit is a broken streak: if the bound has been reached it is the
+     * verdict, else the launcher waits ENFORCEMENT_POLL_MS and starts a fresh streak from zero. The
+     * exec is bounded by `streakExecTimeoutMs` (the per-probe budget times the streak, plus the gaps);
+     * an exec that times out or fails throws, failing the launch exactly as a failed probe exec did.
+     *
      * "Fail to reach" means the connect *timed out* — the packet was dropped. A refusal (RST) is not
      * a denial: it proves the SYN reached the destination host, so the deny port is merely unserved
      * and witnesses nothing. That is its own verdict, below.