@zigrivers/mmr 1.3.0 → 1.4.1

package/dist/core/ack-store.js

@@ -0,0 +1,363 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { jaccardSimilarity } from './stable-id.js';
+import { findProjectRoot } from './project-root.js';
+import { readFileAtRef, listFilesAtRef } from './git-show.js';
+const FUZZY_THRESHOLD = 0.7;
+/** Canonical finding_key format: sha1 hex. Exported so the CLI can validate
+ *  the same way before any path construction. */
+export const FINDING_KEY_RE = /^[a-f0-9]{40}$/;
+// Acks are tiny (a key, a location, a few dozen shingles, a short reason).
+// Cap reads well above any realistic record so a planted oversized file in an
+// untrusted project tree can't OOM the review.
+const MAX_ACK_BYTES = 256 * 1024;
+/** Repo-relative location of project-scoped acks (under <projectRoot>/). */
+const PROJECT_ACKS_REL = '.mmr/acks';
+/**
+ * Build an AckStore for a review run. User-scope acks (`<userRoot>/acks`,
+ * userRoot = resolveSessionRoot(), MMR_HOME-aware) are always loaded — they
+ * live on the operator's own machine. Project-scope acks live in the reviewed
+ * tree, which may be untrusted (a PR checkout in CI), so they are loaded only
+ * when explicitly trusted — otherwise an attacker could commit
+ * `.mmr/acks/<sha>.json` to self-suppress their own findings. The full trusted
+ * path (loading project acks from a git base ref) is added by the trust-mode
+ * thread; until then this gates project acks behind trust_project_acks.
+ *
+ * The project root is discovered by walking up from `cwd` (default
+ * process.cwd()) to the repository root, so acks resolve correctly even when
+ * the command runs from a subdirectory. userRoot is supplied by the caller
+ * (resolveSessionRoot()); cwd is injectable for tests.
+ */
+export function buildReviewAckStore(opts) {
+    // Precedence mirrors loadProjectYaml: an explicit trust opt-in reads project
+    // acks from the working tree; otherwise a base ref (when present) is the
+    // trusted source; otherwise project acks are disabled (untrusted tree).
+    const useBaseRef = !opts.trustProjectAcks && opts.configBaseRef !== undefined;
+    const useProject = opts.trustProjectAcks || useBaseRef;
+    return new AckStore({
+        projectRoot: useProject ? findProjectRoot(opts.cwd) : undefined,
+        userRoot: opts.userRoot,
+        configBaseRef: useBaseRef ? opts.configBaseRef : undefined,
+    });
+}
+/**
+ * Validates a parsed ack record's shape AND that its embedded finding_key
+ * matches the filename it was loaded from. The filename==key invariant guards
+ * against desync (manual edit, merge conflict, tampering) silently
+ * misattributing or shadowing acks — which matters because acks suppress
+ * review findings.
+ */
+function isValidAckRecord(value, expectedKey) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const r = value;
+    return (r.finding_key === expectedKey &&
+        typeof r.normalized_location === 'string' &&
+        Array.isArray(r.description_shingle) &&
+        r.description_shingle.every((s) => typeof s === 'string') &&
+        typeof r.created_at === 'string' &&
+        (r.reason === undefined || typeof r.reason === 'string'));
+}
+export class AckStore {
+    projectDir;
+    userDir;
+    projectRootResolved;
+    userRootResolved;
+    configBaseRef;
+    // Per-instance lazy cache so a review that calls lookup() once per finding
+    // reads each acks dir from disk at most once (avoids O(N*M) FS operations).
+    loaded = {};
+    constructor(opts) {
+        this.projectRootResolved = opts.projectRoot === undefined ? undefined : path.resolve(opts.projectRoot);
+        this.userRootResolved = path.resolve(opts.userRoot);
+        // Project acks are repo-committed under <projectRoot>/.mmr/acks. User acks
+        // live under the MMR state root at <userRoot>/acks (beside jobs/sessions),
+        // so they honor MMR_HOME — no extra `.mmr` segment for the user scope.
+        this.projectDir = this.projectRootResolved === undefined
+            ? undefined
+            : path.join(this.projectRootResolved, PROJECT_ACKS_REL);
+        this.userDir = path.join(this.userRootResolved, 'acks');
+        this.configBaseRef = opts.configBaseRef;
+    }
+    validateKey(key) {
+        if (!FINDING_KEY_RE.test(key)) {
+            throw new Error(`Invalid finding_key: ${key} — must match ^[a-f0-9]{40}$`);
+        }
+    }
+    /**
+     * Returns the acks dir for a scope after verifying it does not escape its
+     * root via a symlinked ancestor. A leaf-only symlink check is not enough:
+     * project acks live in the untrusted reviewed tree, where `.mmr` or
+     * `.mmr/acks` could itself be a symlink redirecting every mkdir/read/write/
+     * unlink out of the sandbox. We realpath the deepest existing ancestor of
+     * the acks dir and require it to stay within the (realpath'd) root.
+     */
+    dirForScope(scope) {
+        const dir = scope === 'project' ? this.projectDir : this.userDir;
+        const root = scope === 'project' ? this.projectRootResolved : this.userRootResolved;
+        if (dir === undefined || root === undefined) {
+            throw new Error('project-scope acks are disabled (no project root configured)');
+        }
+        // Resolve BOTH the root and the acks dir via their deepest existing
+        // ancestor, so the comparison is symlink-consistent even when the root
+        // itself does not exist yet (e.g. a fresh ~/.mmr). Comparing a realpath'd
+        // probe against an unresolved root would false-positive on platforms where
+        // a parent like /tmp is itself a symlink (/private/tmp on macOS).
+        const realRoot = this.realDeepestAncestor(root);
+        const realProbe = this.realDeepestAncestor(dir);
+        if (realRoot === undefined || realProbe === undefined)
+            return dir;
+        const rel = path.relative(realRoot, realProbe);
+        if (rel !== '' && (rel.startsWith('..') || path.isAbsolute(rel))) {
+            throw new Error(`ack ${scope} directory escapes its root via a symlinked ancestor: ${dir}`);
+        }
+        return dir;
+    }
+    /** realpath of the deepest existing ancestor of `p` (p itself if it exists). */
+    realDeepestAncestor(p) {
+        let probe = path.resolve(p);
+        while (probe !== path.dirname(probe) && !fs.existsSync(probe))
+            probe = path.dirname(probe);
+        try {
+            return fs.realpathSync(probe);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    filePath(key, scope) {
+        this.validateKey(key);
+        const dir = this.dirForScope(scope);
+        const resolved = path.resolve(dir, `${key}.json`);
+        // Defense in depth: the resolved path must stay inside the scope dir.
+        const rel = path.relative(dir, resolved);
+        if (rel.startsWith('..') || path.isAbsolute(rel)) {
+            throw new Error(`Resolved ack path escapes its scope directory: ${resolved}`);
+        }
+        return resolved;
+    }
+    add(record, scope) {
+        const key = record.finding_key;
+        this.validateKey(key);
+        // Enforce the full shape on write so every persisted record is guaranteed
+        // loadable; otherwise an invalid record could be written then silently
+        // dropped by the load-side integrity check (write/read asymmetry).
+        if (!isValidAckRecord(record, key)) {
+            throw new Error(`Invalid ack record for ${key}: missing or mistyped fields`);
+        }
+        const dir = this.dirForScope(scope);
+        fs.mkdirSync(dir, { recursive: true });
+        const fp = this.filePath(record.finding_key, scope);
+        // Refuse to write through a symlink: acks gate finding suppression, so a
+        // symlinked ack file must not be able to clobber an arbitrary target.
+        try {
+            if (fs.lstatSync(fp).isSymbolicLink()) {
+                throw new Error(`Refusing to write ack through a symlink: ${fp}`);
+            }
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+        // Atomic write: write to a fresh temp then rename. The temp name uses a
+        // random suffix and the 'wx' (O_CREAT|O_EXCL) flag, which fails if the path
+        // already exists — including a pre-planted symlink — closing the TOCTOU on
+        // the temp path. rename() replaces fp's directory entry without following a
+        // symlink target, so readers never observe a partial record.
+        const tmp = `${fp}.${crypto.randomBytes(6).toString('hex')}.tmp`;
+        try {
+            fs.writeFileSync(tmp, JSON.stringify(record, null, 2), { flag: 'wx' });
+            fs.renameSync(tmp, fp);
+        }
+        catch (err) {
+            // Clean up a partial/leftover temp on any failure (write or rename).
+            try {
+                fs.rmSync(tmp, { force: true });
+            }
+            catch {
+                // ignore cleanup failure; surface the original error
+            }
+            throw err;
+        }
+        this.loaded[scope] = undefined;
+    }
+    remove(key, scope) {
+        this.validateKey(key);
+        const fp = this.filePath(key, scope);
+        // Unlink directly and tolerate ENOENT rather than existsSync-then-unlink
+        // (which has a TOCTOU window if the file is removed concurrently).
+        try {
+            fs.unlinkSync(fp);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+        this.loaded[scope] = undefined;
+    }
+    readDir(dir) {
+        let entries;
+        try {
+            if (!fs.existsSync(dir))
+                return [];
+            entries = fs.readdirSync(dir);
+        }
+        catch {
+            return []; // transient FS error (ENOENT/ENOTDIR/race) → treat as no acks
+        }
+        const out = [];
+        for (const entry of entries) {
+            if (!entry.endsWith('.json'))
+                continue;
+            const keyOnly = entry.replace(/\.json$/, '');
+            if (!FINDING_KEY_RE.test(keyOnly))
+                continue;
+            const fp = path.join(dir, entry);
+            let st;
+            try {
+                st = fs.lstatSync(fp);
+            }
+            catch {
+                continue;
+            }
+            // Skip symlinks and oversized/non-regular files before reading. Project
+            // acks live in the untrusted reviewed tree, so a planted symlink could
+            // point readFileSync at a huge or sensitive target (DoS / disclosure) —
+            // mirror the write-side symlink hardening on the read path.
+            if (st.isSymbolicLink() || !st.isFile() || st.size > MAX_ACK_BYTES)
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(fs.readFileSync(fp, 'utf-8'));
+            }
+            catch {
+                continue; // best-effort: skip unreadable/malformed JSON
+            }
+            // Skip records whose shape is invalid or whose embedded key disagrees
+            // with the filename (desynced/tampered/corrupt) — see isValidAckRecord.
+            if (!isValidAckRecord(parsed, keyOnly))
+                continue;
+            out.push(parsed);
+        }
+        return out;
+    }
+    /**
+     * Read project-scope ack records from the configured base ref (committed
+     * blobs via git), not the working tree. Each file's embedded key must match
+     * its filename and the record must be shape-valid (isValidAckRecord), same as
+     * the working-tree path. git show returns blob content, so the FS symlink/
+     * traversal guards are unnecessary here; readFileAtRef caps the read size.
+     */
+    readProjectRecordsFromRef(ref) {
+        if (this.projectRootResolved === undefined)
+            return [];
+        const cwd = this.projectRootResolved;
+        const out = [];
+        for (const file of listFilesAtRef({ cwd, ref, dirPath: PROJECT_ACKS_REL })) {
+            const base = path.posix.basename(file);
+            if (!base.endsWith('.json'))
+                continue;
+            const keyOnly = base.replace(/\.json$/, '');
+            if (!FINDING_KEY_RE.test(keyOnly))
+                continue;
+            const raw = readFileAtRef({ cwd, ref, filePath: `./${PROJECT_ACKS_REL}/${base}` });
+            // Bound the parse, mirroring the working-tree path's MAX_ACK_BYTES guard.
+            if (raw === undefined || raw.length > MAX_ACK_BYTES)
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                continue;
+            }
+            if (!isValidAckRecord(parsed, keyOnly))
+                continue;
+            out.push(parsed);
+        }
+        return out;
+    }
+    // NOTE: in base-ref mode the project cache is a snapshot of the ref. add()/
+    // remove() invalidate the cache and write to the working tree, but a
+    // subsequent project lookup re-reads the (unchanged) ref, not the just-
+    // written file. That's correct for review use (writes are operator actions
+    // via the ack CLI, which runs in working-tree mode), just worth noting.
+    records(scope) {
+        let cached = this.loaded[scope];
+        if (cached === undefined) {
+            let records;
+            if (scope === 'project' && this.configBaseRef !== undefined) {
+                // Trust boundary: read project acks from the base ref, not the tree.
+                records = this.readProjectRecordsFromRef(this.configBaseRef);
+            }
+            else {
+                // A disabled project scope (no project root) contributes no records.
+                const dir = scope === 'project' ? this.projectDir : this.userDir;
+                records = dir === undefined ? [] : this.readDir(this.dirForScope(scope));
+            }
+            const byKey = new Map();
+            const byLocation = new Map();
+            for (const r of records) {
+                byKey.set(r.finding_key, r);
+                const bucket = byLocation.get(r.normalized_location);
+                if (bucket)
+                    bucket.push(r);
+                else
+                    byLocation.set(r.normalized_location, [r]);
+            }
+            cached = { records, byKey, byLocation };
+            this.loaded[scope] = cached;
+        }
+        return cached;
+    }
+    /** Merge project and user acks; project shadows user on finding_key conflict. */
+    listAll() {
+        const byKey = new Map();
+        for (const u of this.records('user').records)
+            byKey.set(u.finding_key, u);
+        for (const p of this.records('project').records)
+            byKey.set(p.finding_key, p); // project wins
+        return [...byKey.values()];
+    }
+    /**
+     * Lookup an ack matching the given finding identity, applying the two-step
+     * rule from T2-D: (1) exact `finding_key` match (O(1) via the per-scope
+     * index); (2) fuzzy fallback only when normalized_location matches AND
+     * shingle Jaccard ≥ 0.7. Project scope shadows user scope.
+     */
+    lookup(finding) {
+        const project = this.records('project');
+        const user = this.records('user');
+        // Exact match — project then user so project shadows user.
+        const exactProject = project.byKey.get(finding.finding_key);
+        if (exactProject)
+            return { record: exactProject, match: 'exact', scope: 'project' };
+        const exactUser = user.byKey.get(finding.finding_key);
+        if (exactUser)
+            return { record: exactUser, match: 'exact', scope: 'user' };
+        // Fuzzy fallback — location must match exactly, shingle Jaccard ≥ 0.7.
+        // Use the per-location index so only same-location acks (usually 0–1) are
+        // scored, not every record. Project scope wins over user.
+        if (finding.shingle.length === 0)
+            return undefined;
+        const projectFuzzy = this.fuzzyScan(project, finding);
+        if (projectFuzzy)
+            return { record: projectFuzzy, match: 'fuzzy', scope: 'project' };
+        const userFuzzy = this.fuzzyScan(user, finding);
+        if (userFuzzy)
+            return { record: userFuzzy, match: 'fuzzy', scope: 'user' };
+        return undefined;
+    }
+    fuzzyScan(scope, finding) {
+        const candidates = scope.byLocation.get(finding.normalized_location);
+        if (!candidates)
+            return undefined;
+        for (const r of candidates) {
+            if (jaccardSimilarity(r.description_shingle, finding.shingle) >= FUZZY_THRESHOLD)
+                return r;
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=ack-store.js.map

package/dist/core/ack-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ack-store.js","sourceRoot":"","sources":["../../src/core/ack-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE7D,MAAM,eAAe,GAAG,GAAG,CAAA;AAC3B;iDACiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAA;AAC9C,2EAA2E;AAC3E,8EAA8E;AAC9E,+CAA+C;AAC/C,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAA;AAChC,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,WAAW,CAAA;AA0CpC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,CAAA;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,IAAI,UAAU,CAAA;IACtD,OAAO,IAAI,QAAQ,CAAC;QAClB,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/D,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,WAAmB;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,CAAC,CAAC,WAAW,KAAK,WAAW;QAC7B,OAAO,CAAC,CAAC,mBAAmB,KAAK,QAAQ;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;QACpC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACzD,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CACzD,CAAA;AACH,CAAC;AAQD,MAAM,OAAO,QAAQ;IACF,UAAU,CAAoB;IAC9B,OAAO,CAAQ;IACf,mBAAmB,CAAoB;IACvC,gBAAgB,CAAQ;IACxB,aAAa,CAAoB;IAClD,2EAA2E;IAC3E,4EAA4E;IAC3D,MAAM,GAA2C,EAAE,CAAA;IAEpE,YAAY,IAAqB;QAC/B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACtG,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnD,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,mBAAmB,KAAK,SAAS;YACtD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAA;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;IACzC,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,8BAA8B,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,KAAe;QACjC,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAChE,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAA;QACnF,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,GAAG,CAAA;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC9C,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,yDAAyD,GAAG,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,gFAAgF;IACxE,mBAAmB,CAAC,CAAS;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC3B,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1F,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,KAAe;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,CAAA;QACjD,sEAAsE;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACxC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,MAAiB,EAAE,KAAe;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAA;QAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACrB,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,8BAA8B,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACnD,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,4CAA4C,EAAE,EAAE,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAA;QACjE,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAA;QAChE,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,CAAC,GAAW,EAAE,KAAe;QACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACpC,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAA;QACjE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAA;IAChC,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAA;YAClC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA,CAAC,8DAA8D;QAC1E,CAAC;QACD,MAAM,GAAG,GAAgB,EAAE,CAAA;QAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAQ;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YAC5C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAChC,IAAI,EAAY,CAAA;YAChB,IAAI,CAAC;gBACH,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,4DAA4D;YAC5D,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,aAAa;gBAAE,SAAQ;YAC5E,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ,CAAC,8CAA8C;YACzD,CAAC;YACD,sEAAsE;YACtE,wEAAwE;YACxE,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAE,SAAQ;YAChD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;OAMG;IACK,yBAAyB,CAAC,GAAW;QAC3C,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS;YAAE,OAAO,EAAE,CAAA;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACpC,MAAM,GAAG,GAAgB,EAAE,CAAA;QAC3B,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAQ;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,gBAAgB,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;YAClF,0EAA0E;YAC1E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa;gBAAE,SAAQ;YAC7D,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAE,SAAQ;YAChD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IAChE,OAAO,CAAC,KAAe;QAC7B,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAoB,CAAA;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC5D,qEAAqE;gBACrE,OAAO,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YAC9D,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;gBAChE,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1E,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;YAC1C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAA;YACjD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;gBAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAA;gBACpD,IAAI,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;;oBACrB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;YACjD,CAAC;YACD,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAA;QAC7B,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iFAAiF;IACjF,OAAO;QACL,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;QAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACzE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA,CAAC,eAAe;QAC5F,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAgF;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACjC,2DAA2D;QAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC3D,IAAI,YAAY;YAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACrD,IAAI,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,0DAA0D;QAC1D,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,IAAI,YAAY;YAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC/C,IAAI,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAC1E,OAAO,SAAS,CAAA;IAClB,CAAC;IAEO,SAAS,CACf,KAAkB,EAClB,OAA2D;QAE3D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;QACpE,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAA;QACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,eAAe;gBAAE,OAAO,CAAC,CAAA;QAC5F,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;CACF"}

package/dist/core/auth.d.ts

@@ -1,4 +1,6 @@
-import type { ChannelConfigParsed } from '../config/schema.js';
+import type { ChannelConfigParsed, HttpChannelParsed } from '../config/schema.js';
+import { deriveProbeUrl } from '../config/schema.js';
+export { deriveProbeUrl };
 export interface AuthResult {
     status: 'ok' | 'failed' | 'timeout';
     recovery?: string;
@@ -13,4 +15,11 @@ export declare function checkInstalled(command: string): Promise<boolean>;
  * to handle transient network issues.
  */
 export declare function checkAuth(config: ChannelConfigParsed): Promise<AuthResult>;
+/**
+ * Auth-probe an HTTP (openai-chat) channel: GET the configured (or derived)
+ * probe URL with the channel's full request context and map the status to
+ * ok/failed/timeout. The API key value is read only to build the request
+ * header — it is NEVER logged or returned in the result.
+ */
+export declare function checkHttpAuth(channel: HttpChannelParsed): Promise<AuthResult>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/core/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE9D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE;AAoDD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAOhF"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIpD,OAAO,EAAE,cAAc,EAAE,CAAA;AAMzB,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE;AAyDD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAehF;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA0CnF"}

package/dist/core/auth.js

@@ -1,4 +1,8 @@
 import { spawn } from 'node:child_process';
+import { deriveProbeUrl } from '../config/schema.js';
+import { withNeutralPosture } from './host-isolation.js';
+// Re-exported so callers (and tests) can derive an http probe URL from auth.ts.
+export { deriveProbeUrl };
 /**
  * Check whether a CLI command is installed (available on PATH).
  * Uses `command -v` via shell.
@@ -21,52 +25,119 @@ export async function checkInstalled(command) {
  */
 async function runAuthCheck(config) {
     const { auth, env } = config;
-    return new Promise((resolve) => {
-        let settled = false;
-        let timedOut = false;
-        const child = spawn('sh', ['-c', auth.check], {
-            env: { ...process.env, ...env },
-            stdio: 'ignore',
-        });
-        const timer = setTimeout(() => {
-            timedOut = true;
-            child.kill('SIGKILL');
-        }, auth.timeout * 1000);
-        child.on('close', (code) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            if (timedOut) {
-                resolve({ status: 'timeout' });
-                return;
-            }
-            if (code !== null && auth.failure_exit_codes.includes(code)) {
+    const posture = withNeutralPosture(env, config.cwd);
+    try {
+        return await new Promise((resolve) => {
+            let settled = false;
+            let timedOut = false;
+            const child = spawn('sh', ['-c', auth.check], {
+                env: { ...process.env, ...posture.env },
+                cwd: posture.cwd,
+                stdio: 'ignore',
+            });
+            const timer = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGKILL');
+            }, auth.timeout * 1000);
+            child.on('close', (code) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                if (timedOut) {
+                    resolve({ status: 'timeout' });
+                    return;
+                }
+                if (code !== null && auth.failure_exit_codes.includes(code)) {
+                    resolve({ status: 'failed', recovery: auth.recovery });
+                    return;
+                }
+                // Exit code 0 or any code not in failure_exit_codes -> ok (transient)
+                resolve({ status: 'ok' });
+            });
+            child.on('error', () => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
                 resolve({ status: 'failed', recovery: auth.recovery });
-                return;
-            }
-            // Exit code 0 or any code not in failure_exit_codes -> ok (transient)
-            resolve({ status: 'ok' });
-        });
-        child.on('error', () => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            resolve({ status: 'failed', recovery: auth.recovery });
+            });
         });
-    });
+    }
+    finally {
+        posture.cleanup();
+    }
 }
 /**
  * Run the auth check defined in a channel config, retrying once on timeout
  * to handle transient network issues.
  */
 export async function checkAuth(config) {
-    const result = await runAuthCheck(config);
+    // Polymorphic over channel kind: HTTP channels are auth-probed over the wire.
+    if (config.kind === 'http') {
+        return checkHttpAuth(config);
+    }
+    if (!config.auth) {
+        return { status: 'ok' };
+    }
+    const authConfig = { ...config, auth: config.auth };
+    const result = await runAuthCheck(authConfig);
     if (result.status === 'timeout') {
         // Retry once on timeout (transient network issue)
-        return runAuthCheck(config);
+        return runAuthCheck(authConfig);
     }
     return result;
 }
+/**
+ * Auth-probe an HTTP (openai-chat) channel: GET the configured (or derived)
+ * probe URL with the channel's full request context and map the status to
+ * ok/failed/timeout. The API key value is read only to build the request
+ * header — it is NEVER logged or returned in the result.
+ */
+export async function checkHttpAuth(channel) {
+    const probeUrl = channel.auth.check_endpoint ?? deriveProbeUrl(channel.endpoint);
+    if (!probeUrl) {
+        return { status: 'failed', recovery: channel.auth.recovery };
+    }
+    const headers = { ...(channel.headers ?? {}) };
+    if (channel.api_key_env) {
+        const value = process.env[channel.api_key_env];
+        if (!value) {
+            return { status: 'failed', recovery: channel.auth.recovery };
+        }
+        // Drop any case-variant of the target header so the api-key header wins.
+        const target = channel.api_key_header.toLowerCase();
+        for (const k of Object.keys(headers)) {
+            if (k.toLowerCase() === target)
+                delete headers[k];
+        }
+        headers[channel.api_key_header] = `${channel.api_key_prefix}${value}`;
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), channel.auth.timeout * 1000);
+    try {
+        const res = await fetch(probeUrl, {
+            method: channel.auth.check_method,
+            headers,
+            signal: controller.signal,
+        });
+        if (channel.auth.check_status_ok.includes(res.status)) {
+            return { status: 'ok' };
+        }
+        // A non-ok HTTP response is plausibly an auth problem (401/403/…) → surface
+        // the user's auth-setup recovery guidance.
+        return { status: 'failed', recovery: channel.auth.recovery };
+    }
+    catch (err) {
+        if (err.name === 'AbortError') {
+            return { status: 'timeout' };
+        }
+        // Transport-level failure (DNS, connection refused, TLS) is NOT an auth
+        // problem — do not attach auth recovery text, which would mislead.
+        return { status: 'failed' };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 //# sourceMappingURL=auth.js.map

package/dist/core/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAQ1C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IAClD,sDAAsD;IACtD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,mFAAmF;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;QAChD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,MAA2B;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,QAAQ,GAAG,KAAK,CAAA;QAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YAC5C,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;YAC/B,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAA;YACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvB,CAAC,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;QAEvB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YAEnB,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC9B,OAAM;YACR,CAAC;YAED,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,sEAAsE;YACtE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAA2B;IACzD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,kDAAkD;QAClD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAExD,gFAAgF;AAChF,OAAO,EAAE,cAAc,EAAE,CAAA;AAWzB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IAClD,sDAAsD;IACtD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,mFAAmF;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;QAChD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,MAAkC;IAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC5B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YAC/C,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,QAAQ,GAAG,KAAK,CAAA;YAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC5C,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;gBACvC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAA;gBACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;YAEvB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,OAAO;oBAAE,OAAM;gBACnB,OAAO,GAAG,IAAI,CAAA;gBACd,YAAY,CAAC,KAAK,CAAC,CAAA;gBAEnB,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;oBAC9B,OAAM;gBACR,CAAC;gBAED,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5D,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;oBACtD,OAAM;gBACR,CAAC;gBAED,sEAAsE;gBACtE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3B,CAAC,CAAC,CAAA;YAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,IAAI,OAAO;oBAAE,OAAM;gBACnB,OAAO,GAAG,IAAI,CAAA;gBACd,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YACxD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,OAAO,EAAE,CAAA;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAA2B;IACzD,8EAA8E;IAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,aAAa,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IACD,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IACnD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,kDAAkD;QAClD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA0B;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAA;IAC9D,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;IACtE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC9D,CAAC;QACD,yEAAyE;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,CAAA;QACnD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;QACnD,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,GAAG,OAAO,CAAC,cAAc,GAAG,KAAK,EAAE,CAAA;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;YACjC,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACzB,CAAC;QACD,4EAA4E;QAC5E,2CAA2C;QAC3C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAAyB,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC9B,CAAC;QACD,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC"}

package/dist/core/compensator.d.ts

@@ -1,21 +1,50 @@
 import type { JobStore } from './job-store.js';
+import type { ChannelConfigParsed, MmrConfigParsed, OutputParserConfig } from '../config/schema.js';
 import type { ChannelStatus } from '../types.js';
 export interface CompensatingChannel {
     /** Name of the original channel being compensated */
     originalChannel: string;
     /** Name used for the compensating dispatch (e.g., "compensating-codex") */
     compensatingName: string;
-    /** Focus prompt to prepend */
-    focusPrompt: string;
 }
+export interface CompensatorDispatch {
+    command: string;
+    flags: string[];
+    env: Record<string, string>;
+    timeout: number;
+    prompt_wrapper: string;
+    stderr: 'capture' | 'suppress' | 'passthrough';
+    output_parser: string | OutputParserConfig;
+    prompt_delivery?: 'stdin' | 'prompt-file';
+    cwd?: string;
+}
+export declare function resolveCompensatorDispatch(config: MmrConfigParsed): CompensatorDispatch;
+export declare function resolveCompensatorChannelName(config: MmrConfigParsed): string;
+/**
+ * Resolve the configured compensator channel config (any kind), or undefined
+ * when none is configured (the default `claude -p` subprocess fallback applies).
+ * Throws only for a missing / abstract reference. Unlike
+ * getDispatchableCompensatorChannel this does NOT require a `command`, so it is
+ * safe for http compensators.
+ */
+export declare function getCompensatorChannel(config: MmrConfigParsed): ChannelConfigParsed | undefined;
+/** Output parser for the configured compensator channel (any kind); 'default' when none. */
+export declare function resolveCompensatorOutputParser(config: MmrConfigParsed): string | OutputParserConfig;
+export declare function getDispatchableCompensatorChannel(config: MmrConfigParsed, channelName: string): ChannelConfigParsed & {
+    command: string;
+};
+/**
+ * Resolve the focus-area prompt prefix for a compensating pass.
+ */
+export declare function resolveCompensatorFocus(config: MmrConfigParsed, originalChannel: string): string;
 /**
  * Determine which channels need compensating passes.
  * Returns a list of compensating channel descriptors.
  */
-export declare function getCompensatingChannels(channelStatuses: Record<string, ChannelStatus>): CompensatingChannel[];
+export declare function getCompensatingChannels(channelStatuses: Record<string, ChannelStatus>, compensatorChannel: string): CompensatingChannel[];
 /**
  * Dispatch compensating passes via claude CLI for unavailable channels.
  * Each compensating pass uses the same prompt but with a focused preamble.
  */
-export declare function dispatchCompensatingPasses(store: JobStore, jobId: string, prompt: string, compensatingChannels: CompensatingChannel[], timeout: number): Promise<void>;
+export declare function dispatchCompensatingPasses(store: JobStore, jobId: string, prompt: string, compensatingChannels: CompensatingChannel[], config: MmrConfigParsed): Promise<void>;
 //# sourceMappingURL=compensator.d.ts.map

package/dist/core/compensator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compensator.d.ts","sourceRoot":"","sources":["../../src/core/compensator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAiBhD,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,eAAe,EAAE,MAAM,CAAA;IACvB,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAA;IACxB,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAC7C,mBAAmB,EAAE,CAwBvB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,oBAAoB,EAAE,mBAAmB,EAAE,EAC3C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"compensator.d.ts","sourceRoot":"","sources":["../../src/core/compensator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACnG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAkBhD,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,eAAe,EAAE,MAAM,CAAA;IACvB,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,aAAa,CAAA;IAC9C,aAAa,EAAE,MAAM,GAAG,kBAAkB,CAAA;IAC1C,eAAe,CAAC,EAAE,OAAO,GAAG,aAAa,CAAA;IACzC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAcD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,CAoBvF;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,GAAG,SAAS,CAW9F;AAED,4FAA4F;AAC5F,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,kBAAkB,CAEnG;AAED,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,MAAM,GAClB,mBAAmB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAY3C;AAQD;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,EACvB,eAAe,EAAE,MAAM,GACtB,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EAC9C,kBAAkB,EAAE,MAAM,GACzB,mBAAmB,EAAE,CAoBvB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,oBAAoB,EAAE,mBAAmB,EAAE,EAC3C,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAwCf"}