audit-tools 0.32.68 → 0.33.1

package/dist/shared/providers/auditorSources.js

@@ -0,0 +1,453 @@
+import { accessSync, constants, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { resolveAuditCodeStateDir } from "../io/stateDir.js";
+import { spawnSyncHidden } from "../tooling/exec.js";
+import { validateSessionConfig } from "../validation/sessionConfig.js";
+import { populateProxyCatalog, readProxyCatalog, } from "./proxyCatalog.js";
+import { commandExists } from "./providerPathGuard.js";
+/**
+ * The machine-level declaration file: the backends the OPERATOR owns, hand-authored
+ * like `session-config.json`. Deliberately NOT id-keyed and deliberately NOT named
+ * like the POPULATE cache (`catalog-cache.json`, `proxyCatalog.ts` — the
+ * `catalog-<auditor-id>.json` name this comment once reserved landed WITHOUT the
+ * auditor-id key; see the rationale there) — squatting the cache name would turn
+ * this read into a direct cache read, violating never-inherit by filename collision.
+ *
+ * A declaration is not a cache: it is operator INTENT, not a prior auditor's resolved
+ * state. Reading it and intersecting it with live ambient reach does not inherit
+ * anything ([[capability-is-per-auditor-not-per-audit]]).
+ */
+export const SOURCE_DECLARATION_FILENAME = "sources-declared.json";
+/**
+ * Default launcher command per CLI-backed dispatchable source, mirroring each
+ * provider's own `config.command ?? "<default>"` fallback (`codexProvider.ts:59`,
+ * `opencodeProvider.ts:58`, `agyProvider.ts:67-69`). A source overrides it via
+ * `endpoint`, which IS the launcher command for CLI providers
+ * (`DispatchableSource.endpoint` docs, `sessionConfig.ts`).
+ */
+const CLI_DEFAULT_COMMAND = {
+    codex: "codex",
+    opencode: "opencode",
+    agy: "agy",
+};
+/** Gated for the 2026-07-18 agy sunset: `agy` falls back to a legacy `gemini` binary. */
+const AGY_LEGACY_COMMAND = "gemini";
+function defaultFileReadable(path) {
+    try {
+        accessSync(path, constants.R_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function defaultReadDeclarationFile(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Default {@link AmbientSourceDeps.probeHttpReachable}: a short-timeout
+ * `GET <url>` run in a hidden node child so the check stays SYNCHRONOUS (resolve is
+ * sync by design — see the populate/resolve split) without blocking the event loop
+ * machinery this process owns. Exit 0 ⇔ HTTP 2xx within the 750ms budget.
+ */
+function defaultProbeHttpReachable(url) {
+    const script = "const [url] = process.argv.slice(1);" +
+        "fetch(url, { signal: AbortSignal.timeout(750) })" +
+        ".then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1));";
+    const result = spawnSyncHidden(process.execPath, ["-e", script, url], {
+        timeout: 2_000,
+    });
+    return result.status === 0;
+}
+/** The source's stable id, matching `DispatchableSource.id`'s documented default. */
+function sourceId(source) {
+    return source.id ?? `${source.provider}:${source.model ?? source.endpoint ?? "?"}`;
+}
+/** Resolve the declaration file path for this machine (state dir via `io/stateDir.ts`). */
+export function resolveSourceDeclarationPath(homeDir) {
+    return join(resolveAuditCodeStateDir(homeDir), SOURCE_DECLARATION_FILENAME);
+}
+/**
+ * Read the operator's machine-level source declaration.
+ *
+ * Degrades to `[]` on absent / unparseable / structurally-invalid input — never
+ * throws. This read sits on the path of every `next-step`, so a malformed file must
+ * not be able to fail a run (the two-tier dependency policy's "wrap the parser so
+ * malformed input degrades to empty"). Validation reuses `validateSessionConfig`, so
+ * the declaration is held to exactly the same bar as a `--auditor sources[]`.
+ */
+export function readSourceDeclaration(deps = {}) {
+    const path = resolveSourceDeclarationPath(deps.homeDir);
+    const raw = (deps.readDeclarationFile ?? defaultReadDeclarationFile)(path);
+    if (raw === null)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return [];
+    }
+    const sources = parsed.sources;
+    if (sources === undefined)
+        return [];
+    // Hold the declaration to the same validator both other boundaries use. Any
+    // error-severity issue ⇒ degrade to empty rather than admit a half-checked pool.
+    const issues = validateSessionConfig({ sources });
+    if (issues.some((issue) => issue.severity === "error"))
+        return [];
+    return sources;
+}
+/**
+ * Read the optional `repair_proxy` block from the machine declaration. Tolerant like
+ * {@link readSourceDeclaration}: an absent / unparseable file or a missing key is
+ * simply `{declaration: null}`; a PRESENT-but-malformed block degrades to lane-absent
+ * WITH a reason (surfaced via `resolveAmbientSources`' `dropped[]`), never a throw.
+ * Malformed optional knobs (`top_k` / `cost_per_mtok`) are dropped individually — a
+ * bad tuning value must not cost the operator the whole lane.
+ */
+export function readRepairProxyDeclaration(deps = {}) {
+    const path = resolveSourceDeclarationPath(deps.homeDir);
+    const raw = (deps.readDeclarationFile ?? defaultReadDeclarationFile)(path);
+    if (raw === null)
+        return { declaration: null };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { declaration: null };
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return { declaration: null };
+    }
+    const block = parsed.repair_proxy;
+    if (block === undefined)
+        return { declaration: null };
+    if (typeof block !== "object" || block === null || Array.isArray(block)) {
+        return {
+            declaration: null,
+            reason: "repair_proxy must be a JSON object with an endpoint — fix the declaration.",
+        };
+    }
+    const { endpoint, top_k, cost_per_mtok } = block;
+    if (typeof endpoint !== "string" || endpoint.trim().length === 0) {
+        return {
+            declaration: null,
+            reason: "repair_proxy.endpoint must be a non-empty url string — fix the declaration.",
+        };
+    }
+    const declaration = {
+        // Trailing slashes stripped so the reach probe, the populate cache's stored
+        // endpoint, and the expanded sources all compare on one canonical form.
+        endpoint: endpoint.trim().replace(/\/+$/u, ""),
+    };
+    if (typeof top_k === "number" && Number.isInteger(top_k) && top_k > 0) {
+        declaration.top_k = top_k;
+    }
+    if (typeof cost_per_mtok === "number" &&
+        Number.isFinite(cost_per_mtok) &&
+        cost_per_mtok >= 0) {
+        declaration.cost_per_mtok = cost_per_mtok;
+    }
+    return { declaration };
+}
+/**
+ * The default populate fetch: time-boxed so a routable-but-dead proxy cannot hang a
+ * `next-step` at the Gate-0 build (network-tolerant means bounded, not just caught).
+ */
+const populateFetchWithTimeout = (input, init) => fetch(input, { ...init, signal: AbortSignal.timeout(5_000) });
+/**
+ * POPULATE the declared repair-proxy lane (plan §populate-vs-resolve): read the
+ * machine declaration's `repair_proxy` block and, when present, fetch its registry
+ * into the machine-level populate cache ({@link populateProxyCatalog}). This is the
+ * network half the resolve path must never run — call it at Gate-0 build time (once
+ * per run) or on explicit refresh, NEVER from `resolveAmbientSources`.
+ *
+ * "Present + reachable" gating is the fetch itself: the registry GET is both the
+ * liveness proof and the payload, so a separate pre-probe would only double the
+ * network. Never throws: no declared lane ⇒ `null`; a failed/unreachable fetch ⇒
+ * `{written:false, reason}` and any prior cache is left untouched — the lane then
+ * resolves from the existing cache or unexpanded with its own `dropped[]` reason,
+ * degrading Gate-0, never blocking it.
+ */
+export async function populateDeclaredProxyCatalog(deps = {}) {
+    const { declaration } = readRepairProxyDeclaration(deps);
+    if (declaration === null)
+        return null;
+    return populateProxyCatalog({
+        endpoint: declaration.endpoint,
+        ...(declaration.top_k !== undefined ? { topK: declaration.top_k } : {}),
+        ...(declaration.cost_per_mtok !== undefined
+            ? { costPerMtok: declaration.cost_per_mtok }
+            : {}),
+        fetchImpl: deps.fetchImpl ?? populateFetchWithTimeout,
+        ...(deps.homeDir !== undefined ? { homeDir: deps.homeDir } : {}),
+    });
+}
+/**
+ * Populate the proxy catalog ONLY when the resolve half would otherwise drop the
+ * lane for it: a `repair_proxy` is declared but the cache is absent or was fetched
+ * from a different endpoint. Bounded by construction — after one success the cache
+ * exists and this is a cheap read — so a draw with no Gate-0 build moment (remediate)
+ * can call it on every config load without a per-load network fetch. Freshness
+ * (TTL / explicit refresh) is deliberately NOT this function's job (backlog).
+ * [[silent-fail-closed-on-one-draw]] — both draws must trigger populate, not just audit.
+ */
+export async function populateProxyCatalogIfMissing(deps = {}) {
+    const { declaration } = readRepairProxyDeclaration(deps);
+    if (declaration === null)
+        return null;
+    const cache = readProxyCatalog(deps);
+    if (cache !== null &&
+        cache.endpoint.replace(/\/+$/u, "") === declaration.endpoint) {
+        return {
+            sources: cache.sources,
+            written: false,
+            reason: "populate cache already present",
+            dropped: [],
+        };
+    }
+    return populateDeclaredProxyCatalog(deps);
+}
+/**
+ * Can THIS process prove it can reach this declared source?
+ *
+ * The spec's rule is `declared ∩ ambient-verifiable-by-this-process` — a declared lane
+ * enters the pool only if this process PROVES reach, never `declared ∪ stored`. Each
+ * check verifies what the declaration actually asserts:
+ *
+ * - `api_key_env` → the env var is present and non-empty
+ * - CLI provider → its launcher resolves on PATH
+ * - `subprocess-template` → its `command_template[0]` resolves on PATH
+ * - `credentials_path` → the file is readable
+ * - inline `api_key` → NOT verifiable (see below)
+ *
+ * **Inline `api_key` is refused.** Possessing a credential proves nothing about reach:
+ * the endpoint may be dead, the key revoked. It is also the one shape an operator can
+ * always choose, so admitting it would make the whole rule opt-out by construction —
+ * and it is an always-passes lane whose only catcher (the reactive `lies reachably`
+ * quarantine) is G5, not yet built. A stale free-tier declaration would be admitted as
+ * reachable and, under cost-first routing (λ=0), take EVERY packet first and fail them
+ * all. A public constant lives in an env var fine.
+ *
+ * NOTE — this is the repo's first ambient CREDENTIAL probe, and it deliberately
+ * inverts the policy stated at `providerFactory.ts` ("env presence is intentionally not
+ * probed here"). That policy governs LAUNCH-TIME resolution; this is REACH declaration.
+ * The two are different questions; see that comment's pointer back here.
+ */
+export function verifySourceReach(source, deps = {}) {
+    const env = deps.env ?? process.env;
+    const exists = deps.commandExists ?? commandExists;
+    const readable = deps.fileReadable ?? defaultFileReadable;
+    if (source.credentials_path !== undefined) {
+        if (typeof source.credentials_path !== "string" || !readable(source.credentials_path)) {
+            return {
+                verified: false,
+                reason: `credentials_path "${String(source.credentials_path)}" is not readable.`,
+            };
+        }
+    }
+    switch (source.provider) {
+        case "openai-compatible": {
+            if (!source.endpoint?.trim()) {
+                return { verified: false, reason: "openai-compatible source has no endpoint (base_url)." };
+            }
+            if (!source.model?.trim()) {
+                return { verified: false, reason: "openai-compatible source has no model." };
+            }
+            if (source.api_key !== undefined && source.api_key_env === undefined) {
+                return {
+                    verified: false,
+                    reason: "inline api_key is not ambient-verifiable (it proves possession, not reach) — move the key into an env var and declare api_key_env.",
+                };
+            }
+            if (!source.api_key_env?.trim()) {
+                return { verified: false, reason: "openai-compatible source has no api_key_env." };
+            }
+            if (!(env[source.api_key_env] ?? "").trim()) {
+                return {
+                    verified: false,
+                    reason: `env var "${source.api_key_env}" is unset or empty in this process.`,
+                };
+            }
+            return { verified: true };
+        }
+        case "codex":
+        case "opencode":
+        case "agy": {
+            const declared = source.endpoint?.trim();
+            if (declared) {
+                return exists(declared)
+                    ? { verified: true }
+                    : { verified: false, reason: `launcher "${declared}" is not on PATH.` };
+            }
+            const fallback = CLI_DEFAULT_COMMAND[source.provider];
+            if (exists(fallback))
+                return { verified: true };
+            // Gated for the 2026-07-18 sunset, mirroring agyProvider's own fallback.
+            if (source.provider === "agy" && exists(AGY_LEGACY_COMMAND)) {
+                return { verified: true };
+            }
+            return { verified: false, reason: `launcher "${fallback}" is not on PATH.` };
+        }
+        case "subprocess-template": {
+            const template = source.parameters?.command_template;
+            const launcher = Array.isArray(template) ? template[0] : undefined;
+            if (typeof launcher !== "string" || !launcher.trim()) {
+                return {
+                    verified: false,
+                    reason: "subprocess-template source has no parameters.command_template[0] to probe.",
+                };
+            }
+            return exists(launcher)
+                ? { verified: true }
+                : { verified: false, reason: `launcher "${launcher}" is not on PATH.` };
+        }
+        case "worker-command": {
+            // worker-command runs `task.worker_command` — a PER-TASK argv with no
+            // source-level launcher, so there is nothing to probe ahead of dispatch.
+            return {
+                verified: false,
+                reason: "worker-command reach is per-task (task.worker_command), so it is not declarable as an ambient source.",
+            };
+        }
+        case "claude-worker": {
+            // The proxied isolated Claude-harness worker: its reach IS the repair-proxy's
+            // liveness (endpoint = the proxy url). Normally these sources come pre-verified
+            // from the populate cache via the `repair_proxy` lane; a hand-declared one is
+            // held to the same bar. Inline api_key refused for the same possession≠reach
+            // reasons as openai-compatible above (the loopback proxy needs no key anyway).
+            if (!source.endpoint?.trim()) {
+                return {
+                    verified: false,
+                    reason: "claude-worker source has no endpoint (the repair-proxy url).",
+                };
+            }
+            if (!source.model?.trim()) {
+                return { verified: false, reason: "claude-worker source has no model." };
+            }
+            if (source.api_key !== undefined) {
+                return {
+                    verified: false,
+                    reason: "inline api_key is not ambient-verifiable (it proves possession, not reach) — the proxied lane needs no inline key; remove it (declare api_key_env if the proxy requires one).",
+                };
+            }
+            const probe = deps.probeHttpReachable ?? defaultProbeHttpReachable;
+            const endpoint = source.endpoint.trim().replace(/\/+$/u, "");
+            return probe(`${endpoint}/registry`)
+                ? { verified: true }
+                : {
+                    verified: false,
+                    reason: `repair-proxy at "${endpoint}" failed the liveness probe (GET /registry).`,
+                };
+        }
+    }
+}
+/**
+ * `declared ∩ ambient-verifiable` — the dispatch pool THIS process can actually reach.
+ *
+ * Resolved IN-PROCESS, never routed through the conversational host. That is a
+ * correctness property, not an optimization: `openAiCompatibleProvider` reads its key
+ * from `process.env` AT LAUNCH, so resolving here makes the reach check and the launch
+ * read the SAME env — they cannot disagree. A host relay would open a gap between what
+ * was promised and what is true at the moment of use (CLAUDE.md, *Auditor-agnostic
+ * robustness*).
+ *
+ * It is also what makes concurrent multi-IDE runs safe with no identity machinery: each
+ * IDE spawns its own audit-tools process, which inherits THAT IDE's env, so each
+ * intersects the same machine-level declaration against its own real reach and gets its
+ * own answer. Nothing is shared, so nothing can contaminate
+ * ([[capability-is-per-auditor-not-per-audit]]).
+ */
+export function resolveAmbientSources(deps = {}) {
+    const declared = readSourceDeclaration(deps);
+    const sources = [];
+    const dropped = [];
+    for (const source of declared) {
+        const reach = verifySourceReach(source, deps);
+        if (reach.verified)
+            sources.push(source);
+        else
+            dropped.push({ id: sourceId(source), reason: reach.reason });
+    }
+    resolveRepairProxyLane(deps, sources, dropped);
+    return { sources, dropped };
+}
+/**
+ * The repair-proxy lane of the resolve half (plan §populate-vs-resolve): a declared
+ * `repair_proxy` whose liveness probe passes expands from the POPULATE CACHE — never
+ * a mid-resolve fetch. Fail-open, mirroring the declared-source contract: every
+ * outcome short of expansion lands in `dropped[]` with an operator-facing reason
+ * (malformed declaration / probe failure / cache absent-stale-empty), so the lane is
+ * never silently discarded.
+ */
+function resolveRepairProxyLane(deps, sources, dropped) {
+    const { declaration, reason } = readRepairProxyDeclaration(deps);
+    if (reason !== undefined) {
+        dropped.push({ id: "repair-proxy", reason });
+        return;
+    }
+    if (declaration === null)
+        return;
+    const { endpoint } = declaration;
+    const laneId = `repair-proxy:${endpoint}`;
+    const probe = deps.probeHttpReachable ?? defaultProbeHttpReachable;
+    if (!probe(`${endpoint}/registry`)) {
+        dropped.push({
+            id: laneId,
+            reason: `repair-proxy at "${endpoint}" failed the liveness probe (GET /registry) — lane dropped for this invocation.`,
+        });
+        return;
+    }
+    const catalog = readProxyCatalog(deps);
+    if (catalog === null) {
+        dropped.push({
+            id: laneId,
+            reason: "repair-proxy is reachable but the populate cache is absent/invalid — run the registry populate (populateProxyCatalog) to expand this lane.",
+        });
+        return;
+    }
+    if (catalog.endpoint.replace(/\/+$/u, "") !== endpoint) {
+        dropped.push({
+            id: laneId,
+            reason: `populate cache was fetched from "${catalog.endpoint}", not the declared "${endpoint}" — re-run the registry populate.`,
+        });
+        return;
+    }
+    if (catalog.sources.length === 0) {
+        dropped.push({
+            id: laneId,
+            reason: "repair-proxy registry expansion is empty (no reachable+keyed backend models at populate time) — lane present but unexpanded.",
+        });
+        return;
+    }
+    // Declared-wins dedup: an expanded lane whose (backend_provider, model)
+    // identity a DECLARED source already covers is skipped, so one pool identity
+    // never maps to two sources (the launch bridge's pool→source map is 1:1 by
+    // assumption — a duplicate would arbitrate the transport by silent map-order
+    // clobber). The operator's explicit lane always beats auto-expansion; routing
+    // through the proxy for that model is still available by declaring the
+    // claude-worker source explicitly.
+    const declaredIdentities = new Set(sources.map((s) => `${s.backend_provider ?? s.provider}/${s.model ?? ""}`));
+    for (const expanded of catalog.sources) {
+        const identity = `${expanded.backend_provider ?? expanded.provider}/${expanded.model ?? ""}`;
+        if (declaredIdentities.has(identity)) {
+            dropped.push({
+                id: sourceId(expanded),
+                reason: `expanded lane skipped — a declared source already covers backend identity "${identity}" (declared wins over registry expansion).`,
+            });
+            continue;
+        }
+        sources.push(expanded);
+    }
+}
+//# sourceMappingURL=auditorSources.js.map

package/dist/shared/providers/auditorSources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditorSources.js","sourceRoot":"","sources":["../../../src/shared/providers/auditorSources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AA0CnE;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAqC;IAC5D,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAEpC,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,MAAM,GACV,sCAAsC;QACtC,kDAAkD;QAClD,kEAAkE,CAAC;IACrE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QACpE,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,qFAAqF;AACrF,SAAS,QAAQ,CAAC,MAA0B;IAC1C,OAAO,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;AACrF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAC3D,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,4EAA4E;IAC5E,iFAAiF;IACjF,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAClE,OAAO,OAA+B,CAAC;AACzC,CAAC;AAsBD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAI,MAAqC,CAAC,YAAY,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAgC,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,6EAA6E;SACtF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAA2B;QAC1C,4EAA4E;QAC5E,wEAAwE;QACxE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;KAC/C,CAAC;IACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;IAC5B,CAAC;IACD,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC9B,aAAa,IAAI,CAAC,EAClB,CAAC;QACD,WAAW,CAAC,aAAa,GAAG,aAAa,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC7D,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyD,EAAE;IAE3D,MAAM,EAAE,WAAW,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,oBAAoB,CAAC;QAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,aAAa,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,wBAAwB;QACrD,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAyD,EAAE;IAE3D,MAAM,EAAE,WAAW,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IACE,KAAK,KAAK,IAAI;QACd,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,WAAW,CAAC,QAAQ,EAC5D,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gCAAgC;YACxC,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IACD,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAE1D,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,qBAAqB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,oBAAoB;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrE,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EACJ,oIAAoI;iBACvI,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;gBAChC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC5C,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY,MAAM,CAAC,WAAW,sCAAsC;iBAC7E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,OAAO,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,QAAQ,CAAC;oBACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;YAC5E,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAChD,yEAAyE;YACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;QAC/E,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrD,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,4EAA4E;iBACrF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,CAAC;gBACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,sEAAsE;YACtE,yEAAyE;YACzE,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EACJ,uGAAuG;aAC1G,CAAC;QACJ,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,8EAA8E;YAC9E,gFAAgF;YAChF,8EAA8E;YAC9E,6EAA6E;YAC7E,+EAA+E;YAC/E,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,8DAA8D;iBACvE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;YAC3E,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EACJ,+KAA+K;iBAClL,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,GAAG,QAAQ,WAAW,CAAC;gBAClC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC;oBACE,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,oBAAoB,QAAQ,8CAA8C;iBACnF,CAAC;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAAE;IAE5B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,IAAuB,EACvB,OAA6B,EAC7B,OAAwB;IAExB,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO;IACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;IACjC,MAAM,MAAM,GAAG,gBAAgB,QAAQ,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,oBAAoB,QAAQ,iFAAiF;SACtH,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EACJ,4IAA4I;SAC/I,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,oCAAoC,OAAO,CAAC,QAAQ,wBAAwB,QAAQ,mCAAmC;SAChI,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EACJ,8HAA8H;SACjI,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAC3E,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC7F,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBACtB,MAAM,EAAE,8EAA8E,QAAQ,4CAA4C;aAC3I,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/shared/providers/claudeWorkerProvider.d.ts

@@ -0,0 +1,71 @@
+import type { FreshSessionProvider, LaunchFreshSessionInput } from "./types.js";
+import type { ClaudeWorkerConfig } from "../types/sessionConfig.js";
+import { spawnLoggedCommand } from "./spawnLoggedCommand.js";
+export declare const CLAUDE_WORKER_PROVIDER_NAME: "claude-worker";
+/**
+ * The explicit DUMMY key presented to a proxied spawn. The loopback repair-proxy
+ * needs no key, and an ambient real `ANTHROPIC_API_KEY` must NEVER be silently
+ * presented to a proxied spawn — so the overlay always sets this sentinel rather
+ * than leaving the variable to inherit from the parent env.
+ */
+export declare const CLAUDE_WORKER_DUMMY_API_KEY = "audit-tools-claude-worker";
+/**
+ * Per-orchestrator tuning for the otherwise-identical claude-worker provider —
+ * mirrors {@link ClaudeCodeProviderOptions} minus the nested-session guard message
+ * (this class has no guard; see the class doc). The only intended delta between
+ * orchestrators is the skip-permissions default.
+ */
+export interface ClaudeWorkerProviderOptions {
+    /**
+     * Whether to default to `--dangerously-skip-permissions` when the config does
+     * not set `dangerously_skip_permissions` explicitly. The auditor keeps the safe
+     * `false`; the autonomous remediator passes `true` (it applies changes
+     * unattended and cannot pause mid-run). An explicit config value wins.
+     */
+    skipPermissionsDefault?: boolean;
+}
+/**
+ * The `projects` key the Claude CLI trusts a repo under: the absolute repo root
+ * with FORWARD slashes on every platform (live probe: the trust warning referenced
+ * `projects["C:/Code/audit-tools"].hasTrustDialogAccepted` on win32). Trailing
+ * separators are stripped so the key matches the CLI's cwd-derived form.
+ */
+export declare function claudeWorkerTrustProjectKey(repoRoot: string): string;
+/**
+ * claude-worker backend — the proxied, ISOLATED, per-packet-routed Claude-harness
+ * worker (the kind-1 launch transport,
+ * docs/reviews/commit3-proxy-kind1-transport-plan-2026-07-16.md). It spawns
+ * `claude -p` with a REQUIRED `ANTHROPIC_BASE_URL` overlay pointing at the
+ * repair-proxy, a dummy `ANTHROPIC_API_KEY` (never the ambient real key), an
+ * isolated per-launch `CLAUDE_CONFIG_DIR`, and `--model
+ * <backend_provider>/<model>` — the namespace string the proxy routes on,
+ * composed at launch for argv only (it never enters the quota identity).
+ *
+ * Deliberately NO nested-session guard: this class is NOT `claude-code` (the
+ * conversation host) wearing a flag — isolation is its CONSTRUCTOR INVARIANT, not
+ * a guard exception. Construction throws unless endpoint/backend_provider/model
+ * are present, so every spawn is proxy-fronted with a scrubbed parent env
+ * (spawnLoggedCommand strips `CLAUDECODE`/`CLAUDE_CODE*`; `CLAUDE_CONFIG_DIR`
+ * survives the scrub and is overlaid per launch) and can safely run from inside a
+ * live Claude Code session. The `claude-code` host provider KEEPS its blanket
+ * guard, and all four in-session refusal layers key on `claude-code` and never
+ * see this name — no guard is refined for this class to exist.
+ */
+export declare class ClaudeWorkerProvider implements FreshSessionProvider {
+    name: "claude-worker";
+    private readonly config;
+    private readonly endpoint;
+    private readonly backendProvider;
+    private readonly model;
+    private readonly launchCommand;
+    private readonly skipPermissionsDefault;
+    constructor(config?: ClaudeWorkerConfig, options?: ClaudeWorkerProviderOptions, launchCommand?: typeof spawnLoggedCommand);
+    /**
+     * Create the per-launch isolated `CLAUDE_CONFIG_DIR` and mechanically pre-seed
+     * trust for the node's repo root, so the spawned harness never stalls on the
+     * interactive trust dialog (tool-enforced, never host-remembered).
+     */
+    private prepareIsolatedConfigDir;
+    launch(input: LaunchFreshSessionInput): Promise<import("./types.js").LaunchFreshSessionResult>;
+}
+//# sourceMappingURL=claudeWorkerProvider.d.ts.map

package/dist/shared/providers/claudeWorkerProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeWorkerProvider.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/claudeWorkerProvider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAU7D,eAAO,MAAM,2BAA2B,EAAG,eAAwB,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGpE;AAqBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,oBAAqB,YAAW,oBAAoB;IAC/D,IAAI,kBAA+B;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;IAC1D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;gBAG/C,MAAM,GAAE,kBAAuB,EAC/B,OAAO,GAAE,2BAAgC,EACzC,aAAa,GAAE,OAAO,kBAAuC;IAa/D;;;;OAIG;YACW,wBAAwB;IAuBhC,MAAM,CAAC,KAAK,EAAE,uBAAuB;CA4C5C"}