audit-tools 0.30.49 → 0.30.51

package/dist/shared/providers/providerPathGuard.d.ts

@@ -0,0 +1,21 @@
+import type { ResolvedProviderName } from "../types/sessionConfig.js";
+/**
+ * Probe PATH for a single command. Returns true if the command resolves.
+ * Routed through the injectable hook so tests can drive it deterministically.
+ */
+export declare function commandExists(command: string): boolean;
+/**
+ * Override the PATH-detection implementation for tests. Pass `null` to restore
+ * the real `where`/`which` probe. The hook is process-global; tests MUST restore
+ * it in a `finally` so they don't leak state into sibling tests.
+ */
+export declare function setCommandExistsForTesting(impl: ((command: string) => boolean) | null): void;
+/**
+ * Is `provider` self-spawn-blocked in the given environment? True iff the host
+ * is currently inside an active session of that same agent (e.g. `claude-code`
+ * while `CLAUDECODE` is set, `codex` while `CODEX` is set). Machine-readable,
+ * single-sourced, and the basis for both the auto-resolver's `*Available`
+ * guards and the Gate-0 `self_spawn_blocked` exclusion flag.
+ */
+export declare function isSelfSpawnBlocked(provider: ResolvedProviderName, env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=providerPathGuard.d.ts.map

package/dist/shared/providers/providerPathGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPathGuard.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/providerPathGuard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AA+BtE;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,IAAI,GAC1C,IAAI,CAEN;AAkBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAGT"}

package/dist/shared/providers/providerPathGuard.js

@@ -0,0 +1,69 @@
+import { spawnSync } from "node:child_process";
+/**
+ * Single-sourced PATH detection + self-spawn guard for the provider subsystem.
+ *
+ * Both `providerFactory.ts` (auto-resolution) and `providerConfirmation.ts`
+ * (Gate-0 discovery) used to carry their OWN copy of `commandExists` and their
+ * own ad-hoc `env.CLAUDECODE` / `env.CODEX` self-spawn checks. Two copies of a
+ * security-relevant guard is exactly the drift hazard the project's
+ * "single-source the guard" invariant exists to prevent — a fix to one copy
+ * silently leaves the other exploitable. This module is the ONE place that
+ * owns:
+ *   - probing PATH for a command (`commandExists`),
+ *   - deciding whether a provider would be self-spawn-blocked
+ *     (`isSelfSpawnBlocked`) from inside an active session of that same agent.
+ *
+ * A test-injectable PATH-detection hook (`setCommandExistsForTesting`) lets
+ * tests drive discovery deterministically without a real CLI on PATH — the
+ * security obligations (self-spawn-blocked exclusion) must be testable
+ * red-before-green without depending on what happens to be installed in CI.
+ */
+/** The real PATH probe: `where`/`which` exits 0 iff the command resolves. */
+function probeCommandOnPath(command) {
+    const lookupCommand = process.platform === "win32" ? "where" : "which";
+    const result = spawnSync(lookupCommand, [command], { stdio: "ignore" });
+    return result.status === 0;
+}
+let commandExistsImpl = probeCommandOnPath;
+/**
+ * Probe PATH for a single command. Returns true if the command resolves.
+ * Routed through the injectable hook so tests can drive it deterministically.
+ */
+export function commandExists(command) {
+    return commandExistsImpl(command);
+}
+/**
+ * Override the PATH-detection implementation for tests. Pass `null` to restore
+ * the real `where`/`which` probe. The hook is process-global; tests MUST restore
+ * it in a `finally` so they don't leak state into sibling tests.
+ */
+export function setCommandExistsForTesting(impl) {
+    commandExistsImpl = impl ?? probeCommandOnPath;
+}
+/**
+ * The in-session env signals that mark a host as already running INSIDE an agent
+ * of a given kind — a fresh subprocess of that same agent cannot be spawned from
+ * within one (it would self-spawn). Single-sourced so the auto-resolver and the
+ * Gate-0 discovery path agree byte-for-byte on what "self-spawn-blocked" means.
+ *
+ * Only `claude-code` and `codex` have a self-spawn hazard: they are headless
+ * CLIs auto-spawned as fresh subprocesses. The other providers are either
+ * IDE/template-bound, an API pool, or the always-available local-subprocess
+ * fallback — none can self-spawn.
+ */
+const SELF_SPAWN_ENV_SIGNAL = {
+    "claude-code": "CLAUDECODE",
+    codex: "CODEX",
+};
+/**
+ * Is `provider` self-spawn-blocked in the given environment? True iff the host
+ * is currently inside an active session of that same agent (e.g. `claude-code`
+ * while `CLAUDECODE` is set, `codex` while `CODEX` is set). Machine-readable,
+ * single-sourced, and the basis for both the auto-resolver's `*Available`
+ * guards and the Gate-0 `self_spawn_blocked` exclusion flag.
+ */
+export function isSelfSpawnBlocked(provider, env = process.env) {
+    const signal = SELF_SPAWN_ENV_SIGNAL[provider];
+    return signal !== undefined && Boolean(env[signal]);
+}
+//# sourceMappingURL=providerPathGuard.js.map

package/dist/shared/providers/providerPathGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPathGuard.js","sourceRoot":"","sources":["../../../src/shared/providers/providerPathGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,IAAI,iBAAiB,GAAiC,kBAAkB,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAA2C;IAE3C,iBAAiB,GAAG,IAAI,IAAI,kBAAkB,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB,GAAkD;IAC3E,aAAa,EAAE,YAAY;IAC3B,KAAK,EAAE,OAAO;CACf,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/shared/providers/sharedProviderConfirmation.d.ts

@@ -89,7 +89,7 @@ export type SharedProviderConfirmationRead = {
  * not surfaced unless explicitly configured), so it never spuriously perturbs
  * the roster.
  */
-export declare function currentProviderRoster(sessionConfig: SessionConfig, env?: NodeJS.ProcessEnv): ResolvedProviderName[];
+export declare function currentProviderRoster(sessionConfig: SessionConfig, env?: NodeJS.ProcessEnv, detectCommand?: (command: string) => boolean): ResolvedProviderName[];
 /**
  * Build a fresh shared confirmation from auto-discovery. Guarantees the
  * always-available `local-subprocess` fallback is present in the pool (it blocks
@@ -97,11 +97,23 @@ export declare function currentProviderRoster(sessionConfig: SessionConfig, env?
  * to fall back to it) and stamps the schema version, session-level flag, and
  * confirmation timestamp.
  *
+ * SECURITY (self-spawn exclusion): a provider that `discoverProviders` flags as
+ * `selfSpawnBlocked` (claude-code under `CLAUDECODE`, codex under `CODEX`) is set
+ * `excluded: true` AND carries the machine-readable `self_spawn_blocked` flag, so
+ * it is OUT of the dispatchable pool by default — launching it would self-spawn a
+ * fresh agent from inside an active session of the same agent. The operator can
+ * deliberately re-include it by naming it in `include`; that overrides the
+ * exclusion (the host still always retains the local-subprocess fallback).
+ *
  * @param sessionConfig - Current session config; may be an empty `{}`.
  * @param env           - Process env snapshot; defaults to `process.env`.
  * @param exclude       - Provider names to pre-exclude (from a prior gate).
+ * @param include       - Provider names the operator explicitly opts back IN,
+ *   overriding the default self-spawn-blocked exclusion for those names.
+ * @param detectCommand - Injectable PATH-detection hook, forwarded to
+ *   `discoverProviders` so tests can drive discovery deterministically.
  */
-export declare function buildSharedProviderConfirmation(sessionConfig?: SessionConfig, env?: NodeJS.ProcessEnv, exclude?: ResolvedProviderName[]): SharedProviderConfirmation;
+export declare function buildSharedProviderConfirmation(sessionConfig?: SessionConfig, env?: NodeJS.ProcessEnv, exclude?: ResolvedProviderName[], include?: ResolvedProviderName[], detectCommand?: (command: string) => boolean): SharedProviderConfirmation;
 /**
  * Atomically write the shared confirmation to
  * `<root>/.audit-tools/provider-confirmation.json`. The durable write goes

package/dist/shared/providers/sharedProviderConfirmation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharedProviderConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/sharedProviderConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAIrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAM3E;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAErE,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,+BACpB,CAAC;AAE/B,mEAAmE;AACnE,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,uDAAuD;IACvD,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,0EAA0E;IAC1E,aAAa,EAAE,IAAI,CAAC;IACpB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,MAAM,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GACtC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,0BAA0B,CAAA;CAAE,GACjE;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,0BAA0B,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB,GACD,IAAI,CAAC;AAMT;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,aAAa,EAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,EAAE,CAGxB;AAuBD;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,aAAa,GAAE,aAAkB,EACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,oBAAoB,EAAO,GACnC,0BAA0B,CAiC5B;AAMD;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,0BAA0B,EACxC,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CAef;AA2DD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,aAAkB,EACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,8BAA8B,CAAC,CA8BzC"}
+{"version":3,"file":"sharedProviderConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/sharedProviderConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAIrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAM3E;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAErE,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,+BACpB,CAAC;AAE/B,mEAAmE;AACnE,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,uDAAuD;IACvD,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,0EAA0E;IAC1E,aAAa,EAAE,IAAI,CAAC;IACpB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,MAAM,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GACtC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,0BAA0B,CAAA;CAAE,GACjE;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,0BAA0B,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB,GACD,IAAI,CAAC;AAMT;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,aAAa,EAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAC3C,oBAAoB,EAAE,CAKxB;AAuBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,+BAA+B,CAC7C,aAAa,GAAE,aAAkB,EACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,oBAAoB,EAAO,EACpC,OAAO,GAAE,oBAAoB,EAAO,EACpC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAC3C,0BAA0B,CA2C5B;AAMD;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,0BAA0B,EACxC,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CAef;AA2DD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,aAAkB,EACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,8BAA8B,CAAC,CA8BzC"}

package/dist/shared/providers/sharedProviderConfirmation.js

@@ -63,8 +63,8 @@ export function sharedProviderConfirmationPath(root) {
  * not surfaced unless explicitly configured), so it never spuriously perturbs
  * the roster.
  */
-export function currentProviderRoster(sessionConfig, env = process.env) {
-    const names = discoverProviders(sessionConfig, env).map((p) => p.name);
+export function currentProviderRoster(sessionConfig, env = process.env, detectCommand) {
+    const names = discoverProviders(sessionConfig, env, detectCommand).map((p) => p.name);
     return sortRoster(names);
 }
 function sortRoster(names) {
@@ -91,13 +91,26 @@ function rostersEqual(a, b) {
  * to fall back to it) and stamps the schema version, session-level flag, and
  * confirmation timestamp.
  *
+ * SECURITY (self-spawn exclusion): a provider that `discoverProviders` flags as
+ * `selfSpawnBlocked` (claude-code under `CLAUDECODE`, codex under `CODEX`) is set
+ * `excluded: true` AND carries the machine-readable `self_spawn_blocked` flag, so
+ * it is OUT of the dispatchable pool by default — launching it would self-spawn a
+ * fresh agent from inside an active session of the same agent. The operator can
+ * deliberately re-include it by naming it in `include`; that overrides the
+ * exclusion (the host still always retains the local-subprocess fallback).
+ *
  * @param sessionConfig - Current session config; may be an empty `{}`.
  * @param env           - Process env snapshot; defaults to `process.env`.
  * @param exclude       - Provider names to pre-exclude (from a prior gate).
+ * @param include       - Provider names the operator explicitly opts back IN,
+ *   overriding the default self-spawn-blocked exclusion for those names.
+ * @param detectCommand - Injectable PATH-detection hook, forwarded to
+ *   `discoverProviders` so tests can drive discovery deterministically.
  */
-export function buildSharedProviderConfirmation(sessionConfig = {}, env = process.env, exclude = []) {
-    const discovered = discoverProviders(sessionConfig, env);
+export function buildSharedProviderConfirmation(sessionConfig = {}, env = process.env, exclude = [], include = [], detectCommand) {
+    const discovered = discoverProviders(sessionConfig, env, detectCommand);
     const excludeSet = new Set(exclude);
+    const includeSet = new Set(include);
     const pool = [];
     // Always include local-subprocess as a fallback — it's always available and is
     // never surfaced by PATH discovery (it blocks auto-dispatch by design).
@@ -110,10 +123,18 @@ export function buildSharedProviderConfirmation(sessionConfig = {}, env = proces
         });
     }
     for (const provider of discovered) {
+        // Self-spawn-blocked providers are excluded from the dispatchable pool by
+        // default; the operator can opt one back in via `include`. An operator-named
+        // `exclude` always wins. The machine-readable flag rides along so downstream
+        // consumers never have to parse `reason`.
+        const blocked = provider.selfSpawnBlocked === true;
+        const operatorIncluded = includeSet.has(provider.name);
+        const excluded = excludeSet.has(provider.name) || (blocked && !operatorIncluded);
         pool.push({
             name: provider.name,
             capability_tier: provider.capabilityTier,
-            excluded: excludeSet.has(provider.name),
+            excluded,
+            ...(blocked ? { self_spawn_blocked: true } : {}),
             reason: provider.reason,
         });
     }

package/dist/shared/providers/sharedProviderConfirmation.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharedProviderConfirmation.js","sourceRoot":"","sources":["../../../src/shared/providers/sharedProviderConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EACL,iBAAiB,GAElB,MAAM,2BAA2B,CAAC;AAGnC,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,OAAgB,CAAC;AAErE,gFAAgF;AAChF,MAAM,CAAC,MAAM,qCAAqC,GAChD,4BAA4B,CAAC;AAE/B,mEAAmE;AACnE,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,qCAAqC,CAAC,CAAC;AAC1E,CAAC;AA6CD,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAA6B;IAC/C,8EAA8E;IAC9E,8BAA8B;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CACnB,CAAkC,EAClC,CAAkC;IAElC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC7C,gBAA+B,EAAE,EACjC,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAyB,EAAE,CAAC;IAEtC,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,eAAe,EAAE,SAAkC;YACnD,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5C,MAAM,EAAE,uDAAuD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,eAAe,EAAE,QAAQ,CAAC,cAAc;YACxC,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,cAAc,EAAE,oCAAoC;QACpD,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAAY,EACZ,YAAwC,EACxC,MAAkB;IAElB,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;IAChC,+EAA+E;IAC/E,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,CAChB,QAAQ,EACR,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC,EACD,SAAS,EACT,MAAM,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,SAAS,2BAA2B,CAClC,KAAc;IAEd,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ;QACvC,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,CAClC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,+BAA+B,CACtC,KAAc;IAEd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,cAAc,KAAK,oCAAoC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QACjC,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,cAAc,EAAE,oCAAoC;QACpD,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAqC;QACxD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,gBAA+B,EAAE,EACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAElD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,YAAY,CAAU,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,2EAA2E;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,yDAAyD;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,YAAY;YACZ,MAAM,EACJ,wDAAwD;gBACxD,SAAS,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"sharedProviderConfirmation.js","sourceRoot":"","sources":["../../../src/shared/providers/sharedProviderConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EACL,iBAAiB,GAElB,MAAM,2BAA2B,CAAC;AAGnC,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,OAAgB,CAAC;AAErE,gFAAgF;AAChF,MAAM,CAAC,MAAM,qCAAqC,GAChD,4BAA4B,CAAC;AAE/B,mEAAmE;AACnE,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,qCAAqC,CAAC,CAAC;AAC1E,CAAC;AA6CD,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG,EACpC,aAA4C;IAE5C,MAAM,KAAK,GAAG,iBAAiB,CAAC,aAAa,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,GAAG,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;IACF,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAA6B;IAC/C,8EAA8E;IAC9E,8BAA8B;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CACnB,CAAkC,EAClC,CAAkC;IAElC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,gBAA+B,EAAE,EACjC,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkC,EAAE,EACpC,UAAkC,EAAE,EACpC,aAA4C;IAE5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAyB,EAAE,CAAC;IAEtC,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,eAAe,EAAE,SAAkC;YACnD,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5C,MAAM,EAAE,uDAAuD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,0CAA0C;QAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,gBAAgB,KAAK,IAAI,CAAC;QACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,eAAe,EAAE,QAAQ,CAAC,cAAc;YACxC,QAAQ;YACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,cAAc,EAAE,oCAAoC;QACpD,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAAY,EACZ,YAAwC,EACxC,MAAkB;IAElB,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;IAChC,+EAA+E;IAC/E,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,CAChB,QAAQ,EACR,KAAK,IAAI,EAAE;QACT,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC,EACD,SAAS,EACT,MAAM,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,SAAS,2BAA2B,CAClC,KAAc;IAEd,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ;QACvC,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,CAClC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,+BAA+B,CACtC,KAAc;IAEd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,cAAc,KAAK,oCAAoC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QACjC,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,cAAc,EAAE,oCAAoC;QACpD,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAqC;QACxD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,gBAA+B,EAAE,EACjC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAElD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,YAAY,CAAU,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,2EAA2E;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,yDAAyD;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,YAAY;YACZ,MAAM,EACJ,wDAAwD;gBACxD,SAAS,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC/C,CAAC"}

package/dist/shared/quota/apiPool.d.ts

@@ -32,11 +32,16 @@ export declare function withSourceConfig(sessionConfig: SessionConfig, source: D
  * pool-shape + quota-probe core both orchestrators' host-pool builders use, so the
  * CapacityPool shape can't drift between them. The per-tool parts (the pool key and
  * the discovered-limits computation) are resolved by the caller and passed in.
+ *
+ * `hostModel` is DERIVED from `poolKey` (never accepted as a separate scalar) so the
+ * pool is correct-by-construction: `pool.hostModel === parseProviderModelKey(pool.id).model`
+ * always holds. A roster builds one pool per rank with a distinct per-rank model in
+ * the key; passing a single scalar host model alongside would mis-stamp every
+ * non-primary pool, which is the leak this seam closes. See {@link buildHostModelPools}.
  */
 export declare function buildHostModelPool(params: {
     poolKey: string;
     providerName: ResolvedProviderName;
-    hostModel: string | null;
     rank?: DispatchModelTier;
     hostConcurrencyLimit: HostConcurrencyLimit | null;
     quotaStateEntry: QuotaStateEntry | null;

package/dist/shared/quota/apiPool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiPool.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/apiPool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,kBAAkB,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAQtF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAGhG;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CA4BvF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,kBAAkB,GAAG,SAAS,GACrC,aAAa,CAEf;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;IACxC,gBAAgB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnD,WAAW,EAAE,WAAW,CAAC;CAC1B,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC9C,MAAM,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE,CACP,KAAK,EAAE,oBAAoB,GAAG,IAAI,KAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,yBAAyB,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG;QACtF,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,EAAE,yBAAyB,GAAG,IAAI,CAAC;KACpD,CAAC;CACH,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA2B1B;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAAE,CAAC,GACxD,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAMjC;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC/C,GAAG,OAAO,CAAC,YAAY,CAAC,CA+BxB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,aAAa,EAC5B,mBAAmB,EAAE,MAAM,GAC1B,kBAAkB,EAAE,CA2BtB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,aAAa,EAAE,aAAa,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC/C,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAO1B"}
+{"version":3,"file":"apiPool.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/apiPool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,kBAAkB,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAQtF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAGhG;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CA4BvF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,kBAAkB,GAAG,SAAS,GACrC,aAAa,CAEf;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,oBAAoB,CAAC;IACnC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;IACxC,gBAAgB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnD,WAAW,EAAE,WAAW,CAAC;CAC1B,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC9C,MAAM,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE,CACP,KAAK,EAAE,oBAAoB,GAAG,IAAI,KAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,yBAAyB,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG;QACtF,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,EAAE,yBAAyB,GAAG,IAAI,CAAC;KACpD,CAAC;CACH,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA0B1B;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAAE,CAAC,GACxD,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAMjC;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC/C,GAAG,OAAO,CAAC,YAAY,CAAC,CAqCxB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,aAAa,EAC5B,mBAAmB,EAAE,MAAM,GAC1B,kBAAkB,EAAE,CA2BtB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,aAAa,EAAE,aAAa,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC/C,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAO1B"}

package/dist/shared/quota/apiPool.js

@@ -66,13 +66,19 @@ export function withSourceConfig(sessionConfig, source) {
  * pool-shape + quota-probe core both orchestrators' host-pool builders use, so the
  * CapacityPool shape can't drift between them. The per-tool parts (the pool key and
  * the discovered-limits computation) are resolved by the caller and passed in.
+ *
+ * `hostModel` is DERIVED from `poolKey` (never accepted as a separate scalar) so the
+ * pool is correct-by-construction: `pool.hostModel === parseProviderModelKey(pool.id).model`
+ * always holds. A roster builds one pool per rank with a distinct per-rank model in
+ * the key; passing a single scalar host model alongside would mis-stamp every
+ * non-primary pool, which is the leak this seam closes. See {@link buildHostModelPools}.
  */
 export async function buildHostModelPool(params) {
     const probe = await probeQuotaSource(params.quotaSource, params.poolKey).catch(() => ({ snapshot: null, status: "degraded" }));
     return {
         id: params.poolKey,
         providerName: params.providerName,
-        hostModel: params.hostModel,
+        hostModel: parseProviderModelKey(params.poolKey).model,
         ...(params.rank ? { rank: params.rank } : {}),
         hostConcurrencyLimit: params.hostConcurrencyLimit,
         quotaStateEntry: params.quotaStateEntry ?? null,
@@ -105,7 +111,6 @@ export async function buildHostModelPools(params) {
         return buildHostModelPool({
             poolKey,
             providerName: params.providerName,
-            hostModel: params.hostModel,
             rank: entry?.rank,
             hostConcurrencyLimit: params.hostConcurrencyLimit,
             quotaStateEntry: params.quotaEntries[poolKey] ?? null,
@@ -146,6 +151,12 @@ export async function buildSourcePool(params) {
     return {
         id: poolKey,
         providerName: source.provider,
+        // Both the pool key (via dispatchableSourceId) and hostModel are derived from
+        // THIS one source, so they cannot leak apart: for a provider-shaped key the model
+        // segment is exactly `source.model ?? source.endpoint`; an explicit-`id` source is
+        // launched from `source.{endpoint,model,parameters}` (not from a recovered key), so
+        // its hostModel stays the source's own declared model rather than a parse of a
+        // non-provider-shaped id. The single-source derivation is the invariant here.
         hostModel: source.model ?? null,
         hostConcurrencyLimit: null,
         quotaStateEntry: quotaEntries[poolKey] ?? null,

package/dist/shared/quota/apiPool.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiPool.js","sourceRoot":"","sources":["../../../src/shared/quota/apiPool.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B,EAAE,OAAuB;IACtF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,OAAO,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAClC,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,mBAAmB;YACtB,OAAO;gBACL,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC;iBACL;aACF,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAC5E,KAAK,UAAU;YACb,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAC1D,KAAK,qBAAqB;YACxB,OAAO;gBACL,mBAAmB,EAAE;oBACnB,gBAAgB,EAAG,CAAC,CAAC,gBAAyC,IAAI,EAAE;oBACpE,GAAG,CAAC;iBACL;aACF,CAAC;QACJ,KAAK,kBAAkB;YACrB,yEAAyE;YACzE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,aAA4B,EAC5B,MAAsC;IAEtC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MASxC;IACC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAC5E,GAAqB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CACjE,CAAC;IACF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO;QAClB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QAC/C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;QACnC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,aAAa,EAAE,qBAAqB,CAClC,MAAM,CAAC,YAAY,EACnB,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAC9D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAazC;IACC,kFAAkF;IAClF,iFAAiF;IACjF,+EAA+E;IAC/E,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAC5C,MAAM,CAAC,WAAW,EAClB,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAC7D,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,+EAA+E;QAC/E,qEAAqE;QACrE,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAClF,OAAO,kBAAkB,CAAC;YACxB,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,KAAK,EAAE,IAAI;YACjB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI;YACrD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAC5B,KAAyD;IAEzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAIrC;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACrD,kFAAkF;IAClF,6EAA6E;IAC7E,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,CAAC,MAAM,oBAAoB,CACzB,MAAM,EACN,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAChF,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CACzD,GAAqB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CACjE,CAAC;IACF,OAAO;QACL,EAAE,EAAE,OAAO;QACX,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,SAAS,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC/B,oBAAoB,EAAE,IAAI;QAC1B,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI;QAC9C,iFAAiF;QACjF,2EAA2E;QAC3E,gBAAgB,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QACtC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;QACnC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,aAAa,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpG,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAA4B,EAC5B,mBAA2B;IAE3B,MAAM,GAAG,GAAyB,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,IACE,mBAAmB,KAAK,mBAAmB;QAC3C,6BAA6B,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC9D,CAAC;QACD,MAAM,EAAE,GAAG,aAAa,CAAC,iBAAkB,CAAC;QAC5C,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,mBAAmB;YAC7B,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,UAAU,EAAE;gBACV,GAAG,CAAC,EAAE,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,EAAE,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,GAAG,CAAC,EAAE,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnG,GAAG,CAAC,EAAE,CAAC,wBAAwB,KAAK,SAAS;oBAC3C,CAAC,CAAC,EAAE,wBAAwB,EAAE,EAAE,CAAC,wBAAwB,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;QACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAKtC;IACC,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,eAAe,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAChG,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"apiPool.js","sourceRoot":"","sources":["../../../src/shared/quota/apiPool.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B,EAAE,OAAuB;IACtF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,OAAO,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAClC,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,mBAAmB;YACtB,OAAO;gBACL,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC;iBACL;aACF,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAC5E,KAAK,UAAU;YACb,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAC1D,KAAK,qBAAqB;YACxB,OAAO;gBACL,mBAAmB,EAAE;oBACnB,gBAAgB,EAAG,CAAC,CAAC,gBAAyC,IAAI,EAAE;oBACpE,GAAG,CAAC;iBACL;aACF,CAAC;QACJ,KAAK,kBAAkB;YACrB,yEAAyE;YACzE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,aAA4B,EAC5B,MAAsC;IAEtC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAQxC;IACC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAC5E,GAAqB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CACjE,CAAC;IACF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO;QAClB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK;QACtD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QAC/C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;QACnC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,aAAa,EAAE,qBAAqB,CAClC,MAAM,CAAC,YAAY,EACnB,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAC9D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAazC;IACC,kFAAkF;IAClF,iFAAiF;IACjF,+EAA+E;IAC/E,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAC5C,MAAM,CAAC,WAAW,EAClB,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAC7D,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,+EAA+E;QAC/E,qEAAqE;QACrE,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAClF,OAAO,kBAAkB,CAAC;YACxB,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,IAAI,EAAE,KAAK,EAAE,IAAI;YACjB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI;YACrD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAC5B,KAAyD;IAEzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAIrC;IACC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACrD,kFAAkF;IAClF,6EAA6E;IAC7E,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,CAAC,MAAM,oBAAoB,CACzB,MAAM,EACN,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAChF,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CACzD,GAAqB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CACjE,CAAC;IACF,OAAO;QACL,EAAE,EAAE,OAAO;QACX,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,8EAA8E;QAC9E,kFAAkF;QAClF,mFAAmF;QACnF,oFAAoF;QACpF,+EAA+E;QAC/E,8EAA8E;QAC9E,SAAS,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC/B,oBAAoB,EAAE,IAAI;QAC1B,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI;QAC9C,iFAAiF;QACjF,2EAA2E;QAC3E,gBAAgB,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QACtC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;QACnC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,aAAa,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpG,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAA4B,EAC5B,mBAA2B;IAE3B,MAAM,GAAG,GAAyB,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,IACE,mBAAmB,KAAK,mBAAmB;QAC3C,6BAA6B,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAC9D,CAAC;QACD,MAAM,EAAE,GAAG,aAAa,CAAC,iBAAkB,CAAC;QAC5C,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,mBAAmB;YAC7B,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,UAAU,EAAE;gBACV,GAAG,CAAC,EAAE,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,EAAE,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,GAAG,CAAC,EAAE,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnG,GAAG,CAAC,EAAE,CAAC,wBAAwB,KAAK,SAAS;oBAC3C,CAAC,CAAC,EAAE,wBAAwB,EAAE,EAAE,CAAC,wBAAwB,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;QACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAKtC;IACC,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,eAAe,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAChG,CACF,CAAC;AACJ,CAAC"}

package/dist/shared/quota/fileLock.d.ts

@@ -1,9 +1,24 @@
 import type { RunLogger } from "../observability/runLog.js";
 export declare const STALE_LOCK_MS = 30000;
+/**
+ * Injectable monotonic-ish clock for the lock. Defaults to {@link Date.now}; tests
+ * pass a controllable stub so staleness / timeout windows are exercised
+ * deterministically without sleeping real wall-clock time. Every time read inside
+ * the lock — owner-token minting, staleness comparison, deadline, backoff clamp —
+ * routes through the `now` carried on the active options, so a single injected clock
+ * governs the whole acquisition. `STALE_LOCK_MS` is unchanged (a duration, not a
+ * clock) and stays exported.
+ */
+export type Clock = () => number;
 export declare class FileLockTimeoutError extends Error {
     constructor(lockPath: string);
 }
-export declare function acquireLock(lockPath: string, timeoutMs?: number, logger?: RunLogger): Promise<string>;
+/** Optional seams for the lock — currently just the injectable {@link Clock}. */
+export interface LockOptions {
+    /** Clock used for all time reads in this acquisition. Defaults to {@link Date.now}. */
+    now?: Clock;
+}
+export declare function acquireLock(lockPath: string, timeoutMs?: number, logger?: RunLogger, options?: LockOptions): Promise<string>;
 export declare function releaseLock(lockPath: string, ownerToken: string): Promise<void>;
-export declare function withFileLock<T>(lockPath: string, fn: () => Promise<T>, timeoutMs?: number, logger?: RunLogger): Promise<T>;
+export declare function withFileLock<T>(lockPath: string, fn: () => Promise<T>, timeoutMs?: number, logger?: RunLogger, options?: LockOptions): Promise<T>;
 //# sourceMappingURL=fileLock.d.ts.map

package/dist/shared/quota/fileLock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fileLock.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,eAAO,MAAM,aAAa,QAAS,CAAC;AASpC,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAI7B;AAkGD,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAA2B,EACtC,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAED,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAED,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,CAAC,CAAC,CAkBZ"}
+{"version":3,"file":"fileLock.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,eAAO,MAAM,aAAa,QAAS,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC;AAUjC,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAI7B;AAkGD,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAA2B,EACtC,MAAM,CAAC,EAAE,SAAS,EAClB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAED,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAED,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,SAAS,EAClB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,CAAC,CAAC,CAkBZ"}

package/dist/shared/quota/fileLock.js

@@ -1,6 +1,7 @@
 import { writeFile, unlink, stat, readFile, mkdir } from "node:fs/promises";
 import { dirname } from "node:path";
 export const STALE_LOCK_MS = 30_000;
+const defaultClock = Date.now;
 // Lock-acquire retry uses exponential backoff (initial → doubling → max) rather
 // than a fixed poll, so a long contention window costs far fewer wakeups. The
 // sleep is always clamped to the time left so backoff never overshoots timeoutMs.
@@ -14,17 +15,17 @@ export class FileLockTimeoutError extends Error {
         this.name = "FileLockTimeoutError";
     }
 }
-function generateOwnerToken() {
-    return `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+function generateOwnerToken(now = defaultClock) {
+    return `${process.pid}-${now()}-${Math.random().toString(36).slice(2)}`;
 }
 // Returns the owner token of a stale lock (older than STALE_LOCK_MS), or null
 // when the lock is fresh or already gone. Returning the token lets stale removal
 // reuse a token-checked delete, so a lock concurrently re-created with a
 // different token is never clobbered.
-async function readStaleLockToken(lockPath) {
+async function readStaleLockToken(lockPath, now) {
     try {
         const info = await stat(lockPath);
-        if (Date.now() - info.mtimeMs <= STALE_LOCK_MS)
+        if (now() - info.mtimeMs <= STALE_LOCK_MS)
             return null;
         return await readFile(lockPath, "utf8");
     }
@@ -69,10 +70,10 @@ async function bestEffortUnlink(path) {
 // reclaimed, mirroring the main lock's staleness recovery. The claim is always
 // removed in a finally on the happy path so it lives only for the brief
 // token-check + unlink window.
-async function stealStaleLock(lockPath, staleToken) {
+async function stealStaleLock(lockPath, staleToken, now) {
     const claimPath = `${lockPath}${STEAL_CLAIM_SUFFIX}`;
     try {
-        await writeFile(claimPath, generateOwnerToken(), { flag: "wx" });
+        await writeFile(claimPath, generateOwnerToken(now), { flag: "wx" });
     }
     catch (err) {
         const code = err.code;
@@ -83,7 +84,7 @@ async function stealStaleLock(lockPath, staleToken) {
             // loop retry the ordinary acquire path.
             try {
                 const claimInfo = await stat(claimPath);
-                if (Date.now() - claimInfo.mtimeMs > STALE_LOCK_MS) {
+                if (now() - claimInfo.mtimeMs > STALE_LOCK_MS) {
                     await bestEffortUnlink(claimPath);
                 }
             }
@@ -112,9 +113,10 @@ async function stealStaleLock(lockPath, staleToken) {
         await bestEffortUnlink(claimPath);
     }
 }
-export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logger) {
-    const token = generateOwnerToken();
-    const deadline = Date.now() + timeoutMs;
+export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logger, options = {}) {
+    const now = options.now ?? defaultClock;
+    const token = generateOwnerToken(now);
+    const deadline = now() + timeoutMs;
     let lastStaleCheckAt = 0;
     let retryInterval = RETRY_INTERVAL_INITIAL_MS;
     // A lock cannot be created in a directory that does not exist — the `wx` create
@@ -138,21 +140,21 @@ export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logg
         }
         // Check the deadline BEFORE any stale-check IO (stat/readFile) or sleep, so a
         // slow filesystem cannot push the actual return time past timeoutMs.
-        if (Date.now() >= deadline) {
+        if (now() >= deadline) {
             logger?.event({ kind: "error", note: "lock_timeout", lock_path: lockPath, timeout_ms: timeoutMs });
             throw new FileLockTimeoutError(lockPath);
         }
-        const now = Date.now();
-        if (now - lastStaleCheckAt >= STALE_CHECK_INTERVAL_MS) {
-            lastStaleCheckAt = now;
-            const staleToken = await readStaleLockToken(lockPath);
+        const checkAt = now();
+        if (checkAt - lastStaleCheckAt >= STALE_CHECK_INTERVAL_MS) {
+            lastStaleCheckAt = checkAt;
+            const staleToken = await readStaleLockToken(lockPath, now);
             if (staleToken !== null) {
                 // Steal the exact stale lock we observed via a lease-style, mutually
                 // exclusive claim (see stealStaleLock). Only the single claim winner ever
                 // unlinks, and only while the lock still carries this stale token — so a
                 // fresh lock another holder created in the gap is never clobbered, and two
                 // concurrent stealers can never both end up holding the lock.
-                await stealStaleLock(lockPath, staleToken);
+                await stealStaleLock(lockPath, staleToken, now);
                 logger?.event({ kind: "step", note: "stale_lock_removed", lock_path: lockPath });
                 // Progress was made (a slot may have opened); retry promptly and reset
                 // the backoff window.
@@ -162,7 +164,7 @@ export async function acquireLock(lockPath, timeoutMs = DEFAULT_TIMEOUT_MS, logg
         }
         // Exponential backoff, clamped to the time left so we never sleep past the
         // deadline. Doubles each idle cycle up to RETRY_INTERVAL_MAX_MS.
-        const sleepMs = Math.min(retryInterval, Math.max(0, deadline - Date.now()));
+        const sleepMs = Math.min(retryInterval, Math.max(0, deadline - now()));
         await new Promise((r) => setTimeout(r, sleepMs));
         retryInterval = Math.min(retryInterval * 2, RETRY_INTERVAL_MAX_MS);
     }
@@ -182,8 +184,8 @@ export async function releaseLock(lockPath, ownerToken) {
         // ENOENT: lock already gone — swallow silently
     }
 }
-export async function withFileLock(lockPath, fn, timeoutMs, logger) {
-    const token = await acquireLock(lockPath, timeoutMs, logger);
+export async function withFileLock(lockPath, fn, timeoutMs, logger, options = {}) {
+    const token = await acquireLock(lockPath, timeoutMs, logger, options);
     let hasFnError = false;
     try {
         return await fn();

package/dist/shared/quota/fileLock.js.map

@@ -1 +1 @@
-{"version":3,"file":"fileLock.js","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAgB;QAC1B,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,kBAAkB;IACzB,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,sCAAsC;AACtC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAEpC,2EAA2E;AAC3E,+EAA+E;AAC/E,kDAAkD;AAClD,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,+EAA+E;AAC/E,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,+EAA+E;AAC/E,mFAAmF;AACnF,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,oBAAoB;AACpB,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AACxE,+BAA+B;AAC/B,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,UAAkB;IAChE,MAAM,SAAS,GAAG,GAAG,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,2EAA2E;YAC3E,qEAAqE;YACrE,4EAA4E;YAC5E,wCAAwC;YACxC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBACnD,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,+BAA+B;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,YAAoB,kBAAkB,EACtC,MAAkB;IAElB,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,aAAa,GAAG,yBAAyB,CAAC;IAE9C,gFAAgF;IAChF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,uEAAuE;YACvE,qEAAqE;YACrE,0EAA0E;YAC1E,4DAA4D;YAC5D,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAC5E,CAAC;QAED,8EAA8E;QAC9E,qEAAqE;QACrE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAW,CAAC,CAAC;YAC5G,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,gBAAgB,IAAI,uBAAuB,EAAE,CAAC;YACtD,gBAAgB,GAAG,GAAG,CAAC;YACvB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,0EAA0E;gBAC1E,yEAAyE;gBACzE,2EAA2E;gBAC3E,8DAA8D;gBAC9D,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC3C,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAW,CAAC,CAAC;gBAC1F,uEAAuE;gBACvE,sBAAsB;gBACtB,aAAa,GAAG,yBAAyB,CAAC;gBAC1C,SAAS;YACX,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,UAAkB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QAChE,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAAoB,EACpB,SAAkB,EAClB,MAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,CAAC,UAAU;gBAAE,MAAM,UAAU,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"fileLock.js","sourceRoot":"","sources":["../../../src/shared/quota/fileLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAYpC,MAAM,YAAY,GAAU,IAAI,CAAC,GAAG,CAAC;AACrC,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAgB;QAC1B,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,MAAa,YAAY;IACnD,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,sCAAsC;AACtC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,GAAU;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAEpC,2EAA2E;AAC3E,+EAA+E;AAC/E,kDAAkD;AAClD,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,+EAA+E;AAC/E,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,+EAA+E;AAC/E,mFAAmF;AACnF,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,oBAAoB;AACpB,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AACxE,+BAA+B;AAC/B,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,UAAkB,EAAE,GAAU;IAC5E,MAAM,SAAS,GAAG,GAAG,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,2EAA2E;YAC3E,qEAAqE;YACrE,4EAA4E;YAC5E,wCAAwC;YACxC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC9C,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,+BAA+B;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,YAAoB,kBAAkB,EACtC,MAAkB,EAClB,UAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,YAAY,CAAC;IACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC;IACnC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,aAAa,GAAG,yBAAyB,CAAC;IAE9C,gFAAgF;IAChF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,uEAAuE;YACvE,qEAAqE;YACrE,0EAA0E;YAC1E,4DAA4D;YAC5D,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAC5E,CAAC;QAED,8EAA8E;QAC9E,qEAAqE;QACrE,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAW,CAAC,CAAC;YAC5G,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,gBAAgB,IAAI,uBAAuB,EAAE,CAAC;YAC1D,gBAAgB,GAAG,OAAO,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC3D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,0EAA0E;gBAC1E,yEAAyE;gBACzE,2EAA2E;gBAC3E,8DAA8D;gBAC9D,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;gBAChD,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAW,CAAC,CAAC;gBAC1F,uEAAuE;gBACvE,sBAAsB;gBACtB,aAAa,GAAG,yBAAyB,CAAC;gBAC1C,SAAS;YACX,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,UAAkB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QAChE,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAAoB,EACpB,SAAkB,EAClB,MAAkB,EAClB,UAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,CAAC,UAAU;gBAAE,MAAM,UAAU,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/shared/types/providerConfirmation.d.ts

@@ -26,6 +26,15 @@ export interface ConfirmedPoolEntry {
      * (or by self-spawn guard). Excluded entries are recorded but not dispatched.
      */
     excluded: boolean;
+    /**
+     * Machine-readable self-spawn-blocked flag. True when this provider was
+     * detected on PATH but cannot be launched as a fresh subprocess from inside an
+     * active session of that same agent (claude-code under `CLAUDECODE`, codex
+     * under `CODEX`). Such an entry is `excluded: true` by default — and so out of
+     * the dispatchable pool — unless the operator explicitly re-includes it. This
+     * flag is the security signal; `reason` is advisory text only.
+     */
+    self_spawn_blocked?: boolean;
     /** Optional reason for exclusion or detection restriction. */
     reason?: string;
 }

package/dist/shared/types/providerConfirmation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/types/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAM3E;;;GAGG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAMrE,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,eAAe,EAAE,cAAc,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB"}
+{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/types/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAM3E;;;GAGG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAMrE,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,eAAe,EAAE,cAAc,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.30.49",
+  "version": "0.30.51",
   "private": false,
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",
   "type": "module",
@@ -46,7 +46,7 @@
     "test:remediate": "vitest run",
     "test:single": "npm run build && node --import tsx/esm --test",
     "verify:release": "npm run check && npm run check:deadcode && npm run check:doc-manifest && npm test && npm run verify:hosts && npm run smoke:packaged-audit-code && npm run smoke:packaged-remediate-code",
-    "check:deadcode": "knip --include exports,types,nsExports,nsTypes --no-config-hints",
+    "check:deadcode": "knip --no-config-hints",
     "check:doc-manifest": "node scripts/check-doc-manifest.mjs",
     "verify:hosts": "node scripts/audit/verify-hosts.mjs",
     "smoke:linked-audit-code": "node scripts/audit/smoke-linked-audit-code.mjs",

package/scripts/audit/postinstall.mjs

@@ -304,22 +304,27 @@ for (const install of installs) {
 
 // Install OpenCode global command and MCP via merged config
 const opencodeGlobalConfig = join(homedir(), '.config', 'opencode', 'opencode.json');
-try {
-  if (!sharedOpenCodePermissions) {
-    throw new Error(
-      'audit-tools/shared is unavailable (build the shared workspace first); skipping OpenCode config deployment',
+if (!sharedOpenCodePermissions) {
+  // Expected when audit-tools/shared isn't built yet — notably during `npm ci`
+  // in CI, where postinstall runs before the shared build step. This is a SKIP,
+  // not a failure: counting it would trip the `failed > 0` exit-1 guard below and
+  // break `npm ci`. Genuine OpenCode write errors are still counted as failures.
+  console.warn(
+    'audit-code: audit-tools/shared is unavailable (build the shared workspace first); skipping OpenCode config deployment',
+  );
+} else {
+  try {
+    const action = installMergedJson(opencodeGlobalConfig, (existing) =>
+      mergeOpenCodeGlobalConfig(existing),
     );
+    console.log(`audit-code: ${action} global OpenCode config in ${opencodeGlobalConfig}`);
+    succeeded++;
+  } catch (err) {
+    console.warn(`audit-code: could not install global OpenCode config (${err.message})`);
+    console.warn(`  To install manually, add the mcp.auditor and command["audit-code"] entries to:`);
+    console.warn(`    ${opencodeGlobalConfig}`);
+    failed++;
   }
-  const action = installMergedJson(opencodeGlobalConfig, (existing) =>
-    mergeOpenCodeGlobalConfig(existing),
-  );
-  console.log(`audit-code: ${action} global OpenCode config in ${opencodeGlobalConfig}`);
-  succeeded++;
-} catch (err) {
-  console.warn(`audit-code: could not install global OpenCode config (${err.message})`);
-  console.warn(`  To install manually, add the mcp.auditor and command["audit-code"] entries to:`);
-  console.warn(`    ${opencodeGlobalConfig}`);
-  failed++;
 }
 
 // Install Antigravity plugin (global skill for Gemini IDE / Antigravity Hub)
@@ -383,3 +388,6 @@ try {
 }
 
 console.log(`audit-code: postinstall complete — ${succeeded} succeeded, ${failed} failed (${Date.now() - postinstallStart}ms)`);
+if (failed > 0) {
+  process.exitCode = 1;
+}