@wrongstack/core 0.309.0 → 0.310.0

package/dist/infrastructure/index.js

@@ -1118,6 +1118,153 @@ var DefaultPathResolver = class {
   }
 };
 
+// src/utils/error.ts
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/types/errors.ts
+var ERROR_CODES = {
+  // Provider
+  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
+  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
+  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
+  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
+  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
+  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
+  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
+  // Tool
+  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
+  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
+  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
+  TOOL_TIMEOUT: "TOOL_TIMEOUT",
+  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
+  // Config
+  CONFIG_INVALID: "CONFIG_INVALID",
+  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
+  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
+  // Plugin
+  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
+  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
+  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
+  // Agent
+  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
+  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
+  AGENT_ABORTED: "AGENT_ABORTED",
+  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
+  // Session
+  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
+  SESSION_CORRUPTED: "SESSION_CORRUPTED",
+  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
+  // Container / Registry
+  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
+  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
+  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
+  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+  REGISTRY_INVALID: "REGISTRY_INVALID",
+  // File system
+  FS_READ_FAILED: "FS_READ_FAILED",
+  FS_WRITE_FAILED: "FS_WRITE_FAILED",
+  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
+  FS_DELETE_FAILED: "FS_DELETE_FAILED",
+  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
+  // SDD (Spec-Driven Development)
+  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
+  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
+  SDD_INVALID_STATE: "SDD_INVALID_STATE",
+  SDD_NOT_READY: "SDD_NOT_READY",
+  // General
+  VALIDATION_ERROR: "VALIDATION_ERROR",
+  PARSE_FAILED: "PARSE_FAILED",
+  UNKNOWN: "UNKNOWN"
+};
+var WrongStackError = class extends Error {
+  code;
+  subsystem;
+  severity;
+  recoverable;
+  context;
+  constructor(opts) {
+    super(opts.message, { cause: opts.cause });
+    this.name = "WrongStackError";
+    this.code = opts.code;
+    this.subsystem = opts.subsystem;
+    this.severity = opts.severity ?? "error";
+    this.recoverable = opts.recoverable ?? false;
+    this.context = opts.context;
+  }
+  /**
+   * Render a one-line user-facing description.
+   * Subclasses should override for domain-specific formatting.
+   */
+  describe() {
+    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
+    return `${this.code}: ${this.message}${ctx}`;
+  }
+};
+function formatContext(ctx) {
+  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
+  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
+}
+var ConfigError = class extends WrongStackError {
+  constructor(opts) {
+    super({
+      message: opts.message,
+      code: opts.code,
+      subsystem: "config",
+      severity: "fatal",
+      recoverable: false,
+      context: opts.context,
+      cause: opts.cause
+    });
+    this.name = "ConfigError";
+  }
+};
+var FsError = class extends WrongStackError {
+  path;
+  constructor(opts) {
+    super({
+      message: opts.message,
+      code: opts.code,
+      subsystem: "fs",
+      severity: "error",
+      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
+      context: { path: opts.path, ...opts.context },
+      cause: opts.cause
+    });
+    this.name = "FsError";
+    this.path = opts.path;
+  }
+};
+
+// src/types/provider.ts
+function effectiveInputTokens(usage) {
+  return usage.input + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0);
+}
+function promptCacheHitRatio(usage) {
+  const total = effectiveInputTokens(usage);
+  if (!Number.isFinite(total) || total <= 0) return 0;
+  const cached = Number.isFinite(usage.cacheRead) ? Math.max(0, usage.cacheRead ?? 0) : 0;
+  return Math.min(1, cached / total);
+}
+var MAX_RESET_HINT_MS = 7 * 24 * 60 * 60 * 1e3;
+var KIND_TO_CODE = {
+  network: ERROR_CODES.PROVIDER_NETWORK_ERROR,
+  timeout: ERROR_CODES.PROVIDER_NETWORK_ERROR,
+  rate_limit: ERROR_CODES.PROVIDER_RATE_LIMITED,
+  quota_exhausted: ERROR_CODES.PROVIDER_RATE_LIMITED,
+  auth: ERROR_CODES.PROVIDER_AUTH_FAILED,
+  overloaded: ERROR_CODES.PROVIDER_OVERLOADED,
+  context_overflow: ERROR_CODES.PROVIDER_CONTEXT_OVERFLOW,
+  server: ERROR_CODES.PROVIDER_SERVER_ERROR,
+  stream_hang: ERROR_CODES.PROVIDER_SERVER_ERROR,
+  content_filter: ERROR_CODES.PROVIDER_INVALID_REQUEST,
+  invalid_request: ERROR_CODES.PROVIDER_INVALID_REQUEST,
+  unknown: ERROR_CODES.PROVIDER_INVALID_REQUEST
+};
+
 // src/infrastructure/token-counter.ts
 var PRICE_CACHE_MAX_SIZE = 100;
 var DefaultTokenCounter = class {
@@ -1125,9 +1272,12 @@ var DefaultTokenCounter = class {
   output = 0;
   cacheRead = 0;
   cacheWrite = 0;
+  cacheWrite5m = 0;
+  cacheWrite1h = 0;
   costInput = 0;
   costOutput = 0;
   cacheSaved = 0;
+  cacheByProvider = /* @__PURE__ */ new Map();
   registry;
   providerId;
   events;
@@ -1151,10 +1301,15 @@ var DefaultTokenCounter = class {
     this.input += usage.input;
     this.output += usage.output;
     this.cacheRead += usage.cacheRead ?? 0;
-    this.cacheWrite += usage.cacheWrite ?? 0;
+    const ttlAggregate = usage.cacheWrite5m !== void 0 || usage.cacheWrite1h !== void 0 ? (usage.cacheWrite5m ?? 0) + (usage.cacheWrite1h ?? 0) : 0;
+    const cacheWriteTotal = usage.cacheWrite ?? ttlAggregate;
+    this.cacheWrite += cacheWriteTotal;
+    this.cacheWrite5m += usage.cacheWrite5m ?? 0;
+    this.cacheWrite1h += usage.cacheWrite1h ?? 0;
+    this.recordProviderCache(usage, providerId, cacheWriteTotal);
     this.lastInput = usage.input;
     this.lastCacheRead = usage.cacheRead ?? 0;
-    this.lastCacheWrite = usage.cacheWrite ?? 0;
+    this.lastCacheWrite = cacheWriteTotal;
     const priceKey = providerId && model ? `${providerId}\0${model}` : void 0;
     const price = priceKey ? this.priceCache.get(priceKey) : void 0;
     if (price) {
@@ -1192,10 +1347,15 @@ var DefaultTokenCounter = class {
     this.input += usage.input;
     this.output += usage.output;
     this.cacheRead += usage.cacheRead ?? 0;
-    this.cacheWrite += usage.cacheWrite ?? 0;
+    const ttlAggregate = usage.cacheWrite5m !== void 0 || usage.cacheWrite1h !== void 0 ? (usage.cacheWrite5m ?? 0) + (usage.cacheWrite1h ?? 0) : 0;
+    const cacheWriteTotal = usage.cacheWrite ?? ttlAggregate;
+    this.cacheWrite += cacheWriteTotal;
+    this.cacheWrite5m += usage.cacheWrite5m ?? 0;
+    this.cacheWrite1h += usage.cacheWrite1h ?? 0;
+    this.recordProviderCache(usage, resolved.providerId, cacheWriteTotal);
     this.lastInput = usage.input;
     this.lastCacheRead = usage.cacheRead ?? 0;
-    this.lastCacheWrite = usage.cacheWrite ?? 0;
+    this.lastCacheWrite = cacheWriteTotal;
     const price = priceFromModel(resolved);
     if (this.priceCache.size >= PRICE_CACHE_MAX_SIZE) {
       const keys = [...this.priceCache.keys()];
@@ -1214,7 +1374,11 @@ var DefaultTokenCounter = class {
     };
   }
   currentRequestTokens() {
-    return { input: this.lastInput, cacheRead: this.lastCacheRead, cacheWrite: this.lastCacheWrite };
+    return {
+      input: this.lastInput,
+      cacheRead: this.lastCacheRead,
+      cacheWrite: this.lastCacheWrite
+    };
   }
   setCurrentRequestTokens(input, cacheRead, cacheWrite) {
     this.lastInput = input;
@@ -1230,12 +1394,26 @@ var DefaultTokenCounter = class {
     };
   }
   cacheStats() {
-    const denom = this.cacheRead + this.input;
+    const exposeTtlSplit = this.cacheWrite5m > 0 || this.cacheWrite1h > 0;
     return {
       readTokens: this.cacheRead,
       writeTokens: this.cacheWrite,
-      hitRatio: denom === 0 ? 0 : this.cacheRead / denom,
-      savedUsd: round4(this.cacheSaved)
+      ...exposeTtlSplit ? { cacheWrite5m: this.cacheWrite5m, cacheWrite1h: this.cacheWrite1h } : {},
+      hitRatio: promptCacheHitRatio({
+        input: this.input,
+        output: this.output,
+        cacheRead: this.cacheRead,
+        cacheWrite: this.cacheWrite
+      }),
+      savedUsd: round4(this.cacheSaved),
+      providers: [...this.cacheByProvider.entries()].map(([provider, usage]) => ({
+        provider,
+        input: usage.input,
+        cacheRead: usage.cacheRead,
+        cacheWrite: usage.cacheWrite,
+        ...usage.cacheWrite5m > 0 || usage.cacheWrite1h > 0 ? { cacheWrite5m: usage.cacheWrite5m, cacheWrite1h: usage.cacheWrite1h } : {},
+        hitRatio: promptCacheHitRatio({ ...usage, output: 0 })
+      })).sort((a, b) => b.cacheRead - a.cacheRead)
     };
   }
   /** Invalidate cached prices so the next account() call fetches fresh data. */
@@ -1247,7 +1425,11 @@ var DefaultTokenCounter = class {
       ...sessionId ? { sessionId } : {},
       usage: this.total(),
       ...deltaUsage ? { deltaUsage: { ...deltaUsage } } : {},
-      cost: { input: this.costInput, output: this.costOutput, total: this.costInput + this.costOutput },
+      cost: {
+        input: this.costInput,
+        output: this.costOutput,
+        total: this.costInput + this.costOutput
+      },
       ...providerId ? { provider: providerId } : {},
       ...model ? { model } : {}
     });
@@ -1265,9 +1447,12 @@ var DefaultTokenCounter = class {
     this.output = 0;
     this.cacheRead = 0;
     this.cacheWrite = 0;
+    this.cacheWrite5m = 0;
+    this.cacheWrite1h = 0;
     this.costInput = 0;
     this.costOutput = 0;
     this.cacheSaved = 0;
+    this.cacheByProvider.clear();
     this.lastInput = 0;
     this.lastCacheRead = 0;
     this.lastCacheWrite = 0;
@@ -1278,6 +1463,16 @@ var DefaultTokenCounter = class {
       cacheWrite: 0
     });
   }
+  recordProviderCache(usage, providerId, derivedCacheWrite) {
+    const key = providerId ?? "unknown";
+    const current = this.cacheByProvider.get(key) ?? { input: 0, cacheRead: 0, cacheWrite: 0, cacheWrite5m: 0, cacheWrite1h: 0 };
+    current.input += usage.input;
+    current.cacheRead += usage.cacheRead ?? 0;
+    current.cacheWrite += derivedCacheWrite;
+    current.cacheWrite5m += usage.cacheWrite5m ?? 0;
+    current.cacheWrite1h += usage.cacheWrite1h ?? 0;
+    this.cacheByProvider.set(key, current);
+  }
   applyPrice(usage, price) {
     if (price.input) this.costInput += usage.input / 1e6 * price.input;
     if (price.output) this.costOutput += usage.output / 1e6 * price.output;
@@ -1356,13 +1551,17 @@ var ProviderCacheLedger = class {
   perProvider() {
     const out = [];
     for (const [provider, a] of this.byProvider) {
-      const denom = a.cacheRead + a.input;
       out.push({
         provider,
         input: a.input,
         cacheRead: a.cacheRead,
         cacheWrite: a.cacheWrite,
-        hitRatio: denom === 0 ? 0 : a.cacheRead / denom
+        hitRatio: promptCacheHitRatio({
+          input: a.input,
+          output: 0,
+          cacheRead: a.cacheRead,
+          cacheWrite: a.cacheWrite
+        })
       });
     }
     return out.sort((x, y) => y.cacheRead - x.cacheRead);
@@ -2202,127 +2401,6 @@ import * as fs2 from "node:fs";
 import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 
-// src/utils/error.ts
-function toErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  PARSE_FAILED: "PARSE_FAILED",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
-  }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
-  }
-};
-function formatContext(ctx) {
-  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
-  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
-}
-var ConfigError = class extends WrongStackError {
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "config",
-      severity: "fatal",
-      recoverable: false,
-      context: opts.context,
-      cause: opts.cause
-    });
-    this.name = "ConfigError";
-  }
-};
-var FsError = class extends WrongStackError {
-  path;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "fs",
-      severity: "error",
-      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
-      context: { path: opts.path, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FsError";
-    this.path = opts.path;
-  }
-};
-
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
 function encryptedPrefixForVersion(version) {
@@ -2378,7 +2456,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -2554,6 +2632,14 @@ function keyFileNeedsHardening(keyFile, opts) {
   }
   return false;
 }
+function mkdirSecretDirSync(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") return;
+  try {
+    fs2.chmodSync(dir, 448);
+  } catch {
+  }
+}
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes(4).toString("hex")}.tmp`;
   const fd = fs2.openSync(tmp, "w", 384);
@@ -2701,7 +2787,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path3.dirname(this.keyFile));
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -2785,7 +2871,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path3.dirname(this.keyFile));
     const key = randomBytes(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -3636,6 +3722,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
     path: "features.mailboxBridge",
     reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
   }
 ];
 function deleteNestedPath(target, path13) {

package/dist/infrastructure/provider-cache-ledger.d.ts

@@ -4,7 +4,7 @@ export interface ProviderCacheEntry {
     input: number;
     cacheRead: number;
     cacheWrite: number;
-    /** cacheRead / (cacheRead + input); 0 when nothing cached. */
+    /** cacheRead / total prompt context; clamped to [0, 1]. */
     hitRatio: number;
 }
 /**

package/dist/infrastructure/token-counter.d.ts

@@ -1,6 +1,6 @@
 import type { EventBus } from '../kernel/events.js';
 import type { ModelsRegistry, ResolvedModel } from '../types/models-registry.js';
-import type { Usage } from '../types/provider.js';
+import { type Usage } from '../types/provider.js';
 import type { CacheStats, TokenCounter } from '../types/token-counter.js';
 /**
  * Token counter that derives pricing from the ModelsRegistry instead of a
@@ -12,9 +12,12 @@ export declare class DefaultTokenCounter implements TokenCounter {
     private output;
     private cacheRead;
     private cacheWrite;
+    private cacheWrite5m;
+    private cacheWrite1h;
     private costInput;
     private costOutput;
     private cacheSaved;
+    private readonly cacheByProvider;
     private readonly registry?;
     private readonly providerId?;
     private readonly events?;
@@ -54,6 +57,7 @@ export declare class DefaultTokenCounter implements TokenCounter {
     private currentSessionId;
     private currentProviderId;
     reset(): void;
+    private recordProviderCache;
     private applyPrice;
 }
 //# sourceMappingURL=token-counter.d.ts.map

package/dist/kernel/events/file-events.d.ts

@@ -38,6 +38,12 @@ export interface FileEventMap {
         provider: string;
         /** LLM model id */
         model: string;
+        /** Logical provider request that produced the mutating tool call. */
+        logicalRequestId?: string | undefined;
+        /** Content-addressed provider-visible prompt identity. */
+        promptManifestId?: string | undefined;
+        /** Strength of the prompt-to-file attribution edge. */
+        provenanceConfidence?: 'explicit' | 'correlated' | 'inferred' | 'unknown' | undefined;
         /** Tool name */
         toolName: string;
         /** Tool-use block correlation ID */

package/dist/kernel/events/provider-events.d.ts

@@ -1,6 +1,6 @@
 import type { ChroniclePromptManifest } from '../../chronicle/prompt-manifest.js';
-import type { Context } from '../../core/context.js';
 import type { ContentBlock } from '../../types/blocks.js';
+import type { AgentContext } from '../../types/context.js';
 import type { ProviderErrorBody, Usage } from '../../types/provider.js';
 export interface ProviderEventMap {
     /** Fired before every physical provider/model attempt, including attempt zero. */
@@ -9,6 +9,7 @@ export interface ProviderEventMap {
         traceId?: string | undefined;
         agentId?: string | undefined;
         logicalRequestId: string;
+        promptManifestId?: string | undefined;
         attemptId: string;
         attempt: number;
         providerId: string;
@@ -29,6 +30,7 @@ export interface ProviderEventMap {
         traceId?: string | undefined;
         agentId?: string | undefined;
         logicalRequestId: string;
+        promptManifestId?: string | undefined;
         attemptId: string;
         attempt: number;
         providerId: string;
@@ -49,6 +51,7 @@ export interface ProviderEventMap {
         traceId?: string | undefined;
         agentId?: string | undefined;
         logicalRequestId: string;
+        promptManifestId?: string | undefined;
         attemptId: string;
         attempt: number;
         providerId: string;
@@ -72,7 +75,7 @@ export interface ProviderEventMap {
     };
     'provider.response': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         model: string;
         content?: ContentBlock[] | undefined;
         usage: Usage;
@@ -80,23 +83,23 @@ export interface ProviderEventMap {
     };
     'provider.text_delta': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         text: string;
     };
     'provider.thinking_delta': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         text: string;
     };
     'provider.tool_use_start': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         id: string;
         name: string;
     };
     'provider.tool_use_stop': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         id: string;
         name: string;
     };
@@ -108,7 +111,7 @@ export interface ProviderEventMap {
      */
     'provider.stream_error': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         eventType: string;
         msg: string;
     };

package/dist/kernel/events/session-events.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../../core/context.js';
+import type { AgentContext } from '../../types/context.js';
 import type { Usage } from '../../types/provider.js';
 import type { WorkspaceCheckpointRef } from '../../types/session.js';
 import type { TrackedAgentSnapshot } from '../events.js';
@@ -35,12 +35,12 @@ export interface SessionEventMap {
     };
     'iteration.started': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         index: number;
     };
     'iteration.completed': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         index: number;
     };
     /**
@@ -88,7 +88,7 @@ export interface SessionEventMap {
     };
     'context.repaired': {
         sessionId?: string | undefined;
-        ctx: Context;
+        ctx: AgentContext;
         changed: boolean;
         removedToolUses: string[];
         removedToolResults: string[];