audit-tools 0.33.0 → 0.33.1

package/dist/shared/providers/auditorSources.js

@@ -1,22 +1,23 @@
 import { accessSync, constants, readFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { join } from "node:path";
+import { resolveAuditCodeStateDir } from "../io/stateDir.js";
+import { spawnSyncHidden } from "../tooling/exec.js";
 import { validateSessionConfig } from "../validation/sessionConfig.js";
+import { populateProxyCatalog, readProxyCatalog, } from "./proxyCatalog.js";
 import { commandExists } from "./providerPathGuard.js";
 /**
  * The machine-level declaration file: the backends the OPERATOR owns, hand-authored
  * like `session-config.json`. Deliberately NOT id-keyed and deliberately NOT named
- * `catalog-<auditor-id>.json` — that name is reserved for the future POPULATE cache
- * (`spec/unified-dispatch-worker-model.md`), and squatting it would turn this read
- * into a direct cache read, violating never-inherit by filename collision.
+ * like the POPULATE cache (`catalog-cache.json`, `proxyCatalog.ts` — the
+ * `catalog-<auditor-id>.json` name this comment once reserved landed WITHOUT the
+ * auditor-id key; see the rationale there) — squatting the cache name would turn
+ * this read into a direct cache read, violating never-inherit by filename collision.
  *
  * A declaration is not a cache: it is operator INTENT, not a prior auditor's resolved
  * state. Reading it and intersecting it with live ambient reach does not inherit
  * anything ([[capability-is-per-auditor-not-per-audit]]).
  */
 export const SOURCE_DECLARATION_FILENAME = "sources-declared.json";
-/** `~/.audit-code` — the established home-dir state dir (`src/audit/cli.ts` puts quota state here). */
-const STATE_DIR_NAME = ".audit-code";
 /**
  * Default launcher command per CLI-backed dispatchable source, mirroring each
  * provider's own `config.command ?? "<default>"` fallback (`codexProvider.ts:59`,
@@ -48,13 +49,28 @@ function defaultReadDeclarationFile(path) {
         return null;
     }
 }
+/**
+ * Default {@link AmbientSourceDeps.probeHttpReachable}: a short-timeout
+ * `GET <url>` run in a hidden node child so the check stays SYNCHRONOUS (resolve is
+ * sync by design — see the populate/resolve split) without blocking the event loop
+ * machinery this process owns. Exit 0 ⇔ HTTP 2xx within the 750ms budget.
+ */
+function defaultProbeHttpReachable(url) {
+    const script = "const [url] = process.argv.slice(1);" +
+        "fetch(url, { signal: AbortSignal.timeout(750) })" +
+        ".then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1));";
+    const result = spawnSyncHidden(process.execPath, ["-e", script, url], {
+        timeout: 2_000,
+    });
+    return result.status === 0;
+}
 /** The source's stable id, matching `DispatchableSource.id`'s documented default. */
 function sourceId(source) {
     return source.id ?? `${source.provider}:${source.model ?? source.endpoint ?? "?"}`;
 }
-/** Resolve the declaration file path for this machine. */
+/** Resolve the declaration file path for this machine (state dir via `io/stateDir.ts`). */
 export function resolveSourceDeclarationPath(homeDir) {
-    return join(homeDir ?? homedir(), STATE_DIR_NAME, SOURCE_DECLARATION_FILENAME);
+    return join(resolveAuditCodeStateDir(homeDir), SOURCE_DECLARATION_FILENAME);
 }
 /**
  * Read the operator's machine-level source declaration.
@@ -90,6 +106,118 @@ export function readSourceDeclaration(deps = {}) {
         return [];
     return sources;
 }
+/**
+ * Read the optional `repair_proxy` block from the machine declaration. Tolerant like
+ * {@link readSourceDeclaration}: an absent / unparseable file or a missing key is
+ * simply `{declaration: null}`; a PRESENT-but-malformed block degrades to lane-absent
+ * WITH a reason (surfaced via `resolveAmbientSources`' `dropped[]`), never a throw.
+ * Malformed optional knobs (`top_k` / `cost_per_mtok`) are dropped individually — a
+ * bad tuning value must not cost the operator the whole lane.
+ */
+export function readRepairProxyDeclaration(deps = {}) {
+    const path = resolveSourceDeclarationPath(deps.homeDir);
+    const raw = (deps.readDeclarationFile ?? defaultReadDeclarationFile)(path);
+    if (raw === null)
+        return { declaration: null };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { declaration: null };
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return { declaration: null };
+    }
+    const block = parsed.repair_proxy;
+    if (block === undefined)
+        return { declaration: null };
+    if (typeof block !== "object" || block === null || Array.isArray(block)) {
+        return {
+            declaration: null,
+            reason: "repair_proxy must be a JSON object with an endpoint — fix the declaration.",
+        };
+    }
+    const { endpoint, top_k, cost_per_mtok } = block;
+    if (typeof endpoint !== "string" || endpoint.trim().length === 0) {
+        return {
+            declaration: null,
+            reason: "repair_proxy.endpoint must be a non-empty url string — fix the declaration.",
+        };
+    }
+    const declaration = {
+        // Trailing slashes stripped so the reach probe, the populate cache's stored
+        // endpoint, and the expanded sources all compare on one canonical form.
+        endpoint: endpoint.trim().replace(/\/+$/u, ""),
+    };
+    if (typeof top_k === "number" && Number.isInteger(top_k) && top_k > 0) {
+        declaration.top_k = top_k;
+    }
+    if (typeof cost_per_mtok === "number" &&
+        Number.isFinite(cost_per_mtok) &&
+        cost_per_mtok >= 0) {
+        declaration.cost_per_mtok = cost_per_mtok;
+    }
+    return { declaration };
+}
+/**
+ * The default populate fetch: time-boxed so a routable-but-dead proxy cannot hang a
+ * `next-step` at the Gate-0 build (network-tolerant means bounded, not just caught).
+ */
+const populateFetchWithTimeout = (input, init) => fetch(input, { ...init, signal: AbortSignal.timeout(5_000) });
+/**
+ * POPULATE the declared repair-proxy lane (plan §populate-vs-resolve): read the
+ * machine declaration's `repair_proxy` block and, when present, fetch its registry
+ * into the machine-level populate cache ({@link populateProxyCatalog}). This is the
+ * network half the resolve path must never run — call it at Gate-0 build time (once
+ * per run) or on explicit refresh, NEVER from `resolveAmbientSources`.
+ *
+ * "Present + reachable" gating is the fetch itself: the registry GET is both the
+ * liveness proof and the payload, so a separate pre-probe would only double the
+ * network. Never throws: no declared lane ⇒ `null`; a failed/unreachable fetch ⇒
+ * `{written:false, reason}` and any prior cache is left untouched — the lane then
+ * resolves from the existing cache or unexpanded with its own `dropped[]` reason,
+ * degrading Gate-0, never blocking it.
+ */
+export async function populateDeclaredProxyCatalog(deps = {}) {
+    const { declaration } = readRepairProxyDeclaration(deps);
+    if (declaration === null)
+        return null;
+    return populateProxyCatalog({
+        endpoint: declaration.endpoint,
+        ...(declaration.top_k !== undefined ? { topK: declaration.top_k } : {}),
+        ...(declaration.cost_per_mtok !== undefined
+            ? { costPerMtok: declaration.cost_per_mtok }
+            : {}),
+        fetchImpl: deps.fetchImpl ?? populateFetchWithTimeout,
+        ...(deps.homeDir !== undefined ? { homeDir: deps.homeDir } : {}),
+    });
+}
+/**
+ * Populate the proxy catalog ONLY when the resolve half would otherwise drop the
+ * lane for it: a `repair_proxy` is declared but the cache is absent or was fetched
+ * from a different endpoint. Bounded by construction — after one success the cache
+ * exists and this is a cheap read — so a draw with no Gate-0 build moment (remediate)
+ * can call it on every config load without a per-load network fetch. Freshness
+ * (TTL / explicit refresh) is deliberately NOT this function's job (backlog).
+ * [[silent-fail-closed-on-one-draw]] — both draws must trigger populate, not just audit.
+ */
+export async function populateProxyCatalogIfMissing(deps = {}) {
+    const { declaration } = readRepairProxyDeclaration(deps);
+    if (declaration === null)
+        return null;
+    const cache = readProxyCatalog(deps);
+    if (cache !== null &&
+        cache.endpoint.replace(/\/+$/u, "") === declaration.endpoint) {
+        return {
+            sources: cache.sources,
+            written: false,
+            reason: "populate cache already present",
+            dropped: [],
+        };
+    }
+    return populateDeclaredProxyCatalog(deps);
+}
 /**
  * Can THIS process prove it can reach this declared source?
  *
@@ -192,6 +320,36 @@ export function verifySourceReach(source, deps = {}) {
                 reason: "worker-command reach is per-task (task.worker_command), so it is not declarable as an ambient source.",
             };
         }
+        case "claude-worker": {
+            // The proxied isolated Claude-harness worker: its reach IS the repair-proxy's
+            // liveness (endpoint = the proxy url). Normally these sources come pre-verified
+            // from the populate cache via the `repair_proxy` lane; a hand-declared one is
+            // held to the same bar. Inline api_key refused for the same possession≠reach
+            // reasons as openai-compatible above (the loopback proxy needs no key anyway).
+            if (!source.endpoint?.trim()) {
+                return {
+                    verified: false,
+                    reason: "claude-worker source has no endpoint (the repair-proxy url).",
+                };
+            }
+            if (!source.model?.trim()) {
+                return { verified: false, reason: "claude-worker source has no model." };
+            }
+            if (source.api_key !== undefined) {
+                return {
+                    verified: false,
+                    reason: "inline api_key is not ambient-verifiable (it proves possession, not reach) — the proxied lane needs no inline key; remove it (declare api_key_env if the proxy requires one).",
+                };
+            }
+            const probe = deps.probeHttpReachable ?? defaultProbeHttpReachable;
+            const endpoint = source.endpoint.trim().replace(/\/+$/u, "");
+            return probe(`${endpoint}/registry`)
+                ? { verified: true }
+                : {
+                    verified: false,
+                    reason: `repair-proxy at "${endpoint}" failed the liveness probe (GET /registry).`,
+                };
+        }
     }
 }
 /**
@@ -221,6 +379,75 @@ export function resolveAmbientSources(deps = {}) {
         else
             dropped.push({ id: sourceId(source), reason: reach.reason });
     }
+    resolveRepairProxyLane(deps, sources, dropped);
     return { sources, dropped };
 }
+/**
+ * The repair-proxy lane of the resolve half (plan §populate-vs-resolve): a declared
+ * `repair_proxy` whose liveness probe passes expands from the POPULATE CACHE — never
+ * a mid-resolve fetch. Fail-open, mirroring the declared-source contract: every
+ * outcome short of expansion lands in `dropped[]` with an operator-facing reason
+ * (malformed declaration / probe failure / cache absent-stale-empty), so the lane is
+ * never silently discarded.
+ */
+function resolveRepairProxyLane(deps, sources, dropped) {
+    const { declaration, reason } = readRepairProxyDeclaration(deps);
+    if (reason !== undefined) {
+        dropped.push({ id: "repair-proxy", reason });
+        return;
+    }
+    if (declaration === null)
+        return;
+    const { endpoint } = declaration;
+    const laneId = `repair-proxy:${endpoint}`;
+    const probe = deps.probeHttpReachable ?? defaultProbeHttpReachable;
+    if (!probe(`${endpoint}/registry`)) {
+        dropped.push({
+            id: laneId,
+            reason: `repair-proxy at "${endpoint}" failed the liveness probe (GET /registry) — lane dropped for this invocation.`,
+        });
+        return;
+    }
+    const catalog = readProxyCatalog(deps);
+    if (catalog === null) {
+        dropped.push({
+            id: laneId,
+            reason: "repair-proxy is reachable but the populate cache is absent/invalid — run the registry populate (populateProxyCatalog) to expand this lane.",
+        });
+        return;
+    }
+    if (catalog.endpoint.replace(/\/+$/u, "") !== endpoint) {
+        dropped.push({
+            id: laneId,
+            reason: `populate cache was fetched from "${catalog.endpoint}", not the declared "${endpoint}" — re-run the registry populate.`,
+        });
+        return;
+    }
+    if (catalog.sources.length === 0) {
+        dropped.push({
+            id: laneId,
+            reason: "repair-proxy registry expansion is empty (no reachable+keyed backend models at populate time) — lane present but unexpanded.",
+        });
+        return;
+    }
+    // Declared-wins dedup: an expanded lane whose (backend_provider, model)
+    // identity a DECLARED source already covers is skipped, so one pool identity
+    // never maps to two sources (the launch bridge's pool→source map is 1:1 by
+    // assumption — a duplicate would arbitrate the transport by silent map-order
+    // clobber). The operator's explicit lane always beats auto-expansion; routing
+    // through the proxy for that model is still available by declaring the
+    // claude-worker source explicitly.
+    const declaredIdentities = new Set(sources.map((s) => `${s.backend_provider ?? s.provider}/${s.model ?? ""}`));
+    for (const expanded of catalog.sources) {
+        const identity = `${expanded.backend_provider ?? expanded.provider}/${expanded.model ?? ""}`;
+        if (declaredIdentities.has(identity)) {
+            dropped.push({
+                id: sourceId(expanded),
+                reason: `expanded lane skipped — a declared source already covers backend identity "${identity}" (declared wins over registry expansion).`,
+            });
+            continue;
+        }
+        sources.push(expanded);
+    }
+}
 //# sourceMappingURL=auditorSources.js.map

package/dist/shared/providers/auditorSources.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditorSources.js","sourceRoot":"","sources":["../../../src/shared/providers/auditorSources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,uGAAuG;AACvG,MAAM,cAAc,GAAG,aAAa,CAAC;AAgCrC;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAqC;IAC5D,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAEpC,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,QAAQ,CAAC,MAA0B;IAC1C,OAAO,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;AACrF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAC3D,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,4EAA4E;IAC5E,iFAAiF;IACjF,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAClE,OAAO,OAA+B,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAE1D,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,qBAAqB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,oBAAoB;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrE,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EACJ,oIAAoI;iBACvI,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;gBAChC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC5C,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY,MAAM,CAAC,WAAW,sCAAsC;iBAC7E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,OAAO,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,QAAQ,CAAC;oBACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;YAC5E,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAChD,yEAAyE;YACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;QAC/E,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrD,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,4EAA4E;iBACrF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,CAAC;gBACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,sEAAsE;YACtE,yEAAyE;YACzE,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EACJ,uGAAuG;aAC1G,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAAE;IAE5B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"auditorSources.js","sourceRoot":"","sources":["../../../src/shared/providers/auditorSources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AA0CnE;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAqC;IAC5D,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAEpC,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,MAAM,GACV,sCAAsC;QACtC,kDAAkD;QAClD,kEAAkE,CAAC;IACrE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QACpE,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,qFAAqF;AACrF,SAAS,QAAQ,CAAC,MAA0B;IAC1C,OAAO,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;AACrF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAC3D,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,4EAA4E;IAC5E,iFAAiF;IACjF,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAClE,OAAO,OAA+B,CAAC;AACzC,CAAC;AAsBD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAI,MAAqC,CAAC,YAAY,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAgC,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,6EAA6E;SACtF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAA2B;QAC1C,4EAA4E;QAC5E,wEAAwE;QACxE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;KAC/C,CAAC;IACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;IAC5B,CAAC;IACD,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC9B,aAAa,IAAI,CAAC,EAClB,CAAC;QACD,WAAW,CAAC,aAAa,GAAG,aAAa,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC7D,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyD,EAAE;IAE3D,MAAM,EAAE,WAAW,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,oBAAoB,CAAC;QAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,aAAa,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,wBAAwB;QACrD,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAyD,EAAE;IAE3D,MAAM,EAAE,WAAW,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IACE,KAAK,KAAK,IAAI;QACd,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,WAAW,CAAC,QAAQ,EAC5D,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gCAAgC;YACxC,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IACD,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAE1D,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,qBAAqB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,oBAAoB;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrE,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EACJ,oIAAoI;iBACvI,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;gBAChC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC5C,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY,MAAM,CAAC,WAAW,sCAAsC;iBAC7E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,OAAO,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,QAAQ,CAAC;oBACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;YAC5E,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAChD,yEAAyE;YACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;QAC/E,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrD,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,4EAA4E;iBACrF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,CAAC;gBACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,sEAAsE;YACtE,yEAAyE;YACzE,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EACJ,uGAAuG;aAC1G,CAAC;QACJ,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,8EAA8E;YAC9E,gFAAgF;YAChF,8EAA8E;YAC9E,6EAA6E;YAC7E,+EAA+E;YAC/E,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,8DAA8D;iBACvE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;YAC3E,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EACJ,+KAA+K;iBAClL,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,GAAG,QAAQ,WAAW,CAAC;gBAClC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC;oBACE,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,oBAAoB,QAAQ,8CAA8C;iBACnF,CAAC;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAAE;IAE5B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,IAAuB,EACvB,OAA6B,EAC7B,OAAwB;IAExB,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO;IACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;IACjC,MAAM,MAAM,GAAG,gBAAgB,QAAQ,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,oBAAoB,QAAQ,iFAAiF;SACtH,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EACJ,4IAA4I;SAC/I,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,oCAAoC,OAAO,CAAC,QAAQ,wBAAwB,QAAQ,mCAAmC;SAChI,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,MAAM;YACV,MAAM,EACJ,8HAA8H;SACjI,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAC3E,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC7F,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBACtB,MAAM,EAAE,8EAA8E,QAAQ,4CAA4C;aAC3I,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/shared/providers/claudeWorkerProvider.d.ts

@@ -0,0 +1,71 @@
+import type { FreshSessionProvider, LaunchFreshSessionInput } from "./types.js";
+import type { ClaudeWorkerConfig } from "../types/sessionConfig.js";
+import { spawnLoggedCommand } from "./spawnLoggedCommand.js";
+export declare const CLAUDE_WORKER_PROVIDER_NAME: "claude-worker";
+/**
+ * The explicit DUMMY key presented to a proxied spawn. The loopback repair-proxy
+ * needs no key, and an ambient real `ANTHROPIC_API_KEY` must NEVER be silently
+ * presented to a proxied spawn — so the overlay always sets this sentinel rather
+ * than leaving the variable to inherit from the parent env.
+ */
+export declare const CLAUDE_WORKER_DUMMY_API_KEY = "audit-tools-claude-worker";
+/**
+ * Per-orchestrator tuning for the otherwise-identical claude-worker provider —
+ * mirrors {@link ClaudeCodeProviderOptions} minus the nested-session guard message
+ * (this class has no guard; see the class doc). The only intended delta between
+ * orchestrators is the skip-permissions default.
+ */
+export interface ClaudeWorkerProviderOptions {
+    /**
+     * Whether to default to `--dangerously-skip-permissions` when the config does
+     * not set `dangerously_skip_permissions` explicitly. The auditor keeps the safe
+     * `false`; the autonomous remediator passes `true` (it applies changes
+     * unattended and cannot pause mid-run). An explicit config value wins.
+     */
+    skipPermissionsDefault?: boolean;
+}
+/**
+ * The `projects` key the Claude CLI trusts a repo under: the absolute repo root
+ * with FORWARD slashes on every platform (live probe: the trust warning referenced
+ * `projects["C:/Code/audit-tools"].hasTrustDialogAccepted` on win32). Trailing
+ * separators are stripped so the key matches the CLI's cwd-derived form.
+ */
+export declare function claudeWorkerTrustProjectKey(repoRoot: string): string;
+/**
+ * claude-worker backend — the proxied, ISOLATED, per-packet-routed Claude-harness
+ * worker (the kind-1 launch transport,
+ * docs/reviews/commit3-proxy-kind1-transport-plan-2026-07-16.md). It spawns
+ * `claude -p` with a REQUIRED `ANTHROPIC_BASE_URL` overlay pointing at the
+ * repair-proxy, a dummy `ANTHROPIC_API_KEY` (never the ambient real key), an
+ * isolated per-launch `CLAUDE_CONFIG_DIR`, and `--model
+ * <backend_provider>/<model>` — the namespace string the proxy routes on,
+ * composed at launch for argv only (it never enters the quota identity).
+ *
+ * Deliberately NO nested-session guard: this class is NOT `claude-code` (the
+ * conversation host) wearing a flag — isolation is its CONSTRUCTOR INVARIANT, not
+ * a guard exception. Construction throws unless endpoint/backend_provider/model
+ * are present, so every spawn is proxy-fronted with a scrubbed parent env
+ * (spawnLoggedCommand strips `CLAUDECODE`/`CLAUDE_CODE*`; `CLAUDE_CONFIG_DIR`
+ * survives the scrub and is overlaid per launch) and can safely run from inside a
+ * live Claude Code session. The `claude-code` host provider KEEPS its blanket
+ * guard, and all four in-session refusal layers key on `claude-code` and never
+ * see this name — no guard is refined for this class to exist.
+ */
+export declare class ClaudeWorkerProvider implements FreshSessionProvider {
+    name: "claude-worker";
+    private readonly config;
+    private readonly endpoint;
+    private readonly backendProvider;
+    private readonly model;
+    private readonly launchCommand;
+    private readonly skipPermissionsDefault;
+    constructor(config?: ClaudeWorkerConfig, options?: ClaudeWorkerProviderOptions, launchCommand?: typeof spawnLoggedCommand);
+    /**
+     * Create the per-launch isolated `CLAUDE_CONFIG_DIR` and mechanically pre-seed
+     * trust for the node's repo root, so the spawned harness never stalls on the
+     * interactive trust dialog (tool-enforced, never host-remembered).
+     */
+    private prepareIsolatedConfigDir;
+    launch(input: LaunchFreshSessionInput): Promise<import("./types.js").LaunchFreshSessionResult>;
+}
+//# sourceMappingURL=claudeWorkerProvider.d.ts.map

package/dist/shared/providers/claudeWorkerProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeWorkerProvider.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/claudeWorkerProvider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAU7D,eAAO,MAAM,2BAA2B,EAAG,eAAwB,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGpE;AAqBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,oBAAqB,YAAW,oBAAoB;IAC/D,IAAI,kBAA+B;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;IAC1D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;gBAG/C,MAAM,GAAE,kBAAuB,EAC/B,OAAO,GAAE,2BAAgC,EACzC,aAAa,GAAE,OAAO,kBAAuC;IAa/D;;;;OAIG;YACW,wBAAwB;IAuBhC,MAAM,CAAC,KAAK,EAAE,uBAAuB;CA4C5C"}

package/dist/shared/providers/claudeWorkerProvider.js

@@ -0,0 +1,133 @@
+import { readFile, mkdir, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { readJsonFile } from "../io/json.js";
+import { spawnLoggedCommand } from "./spawnLoggedCommand.js";
+import { applyWorkerTaskLaunchSettings, } from "./workerTaskLaunch.js";
+import { emitProviderLaunchDiagnostic, emitProviderDoneDiagnostic, } from "./providerDiagnostics.js";
+export const CLAUDE_WORKER_PROVIDER_NAME = "claude-worker";
+/**
+ * The explicit DUMMY key presented to a proxied spawn. The loopback repair-proxy
+ * needs no key, and an ambient real `ANTHROPIC_API_KEY` must NEVER be silently
+ * presented to a proxied spawn — so the overlay always sets this sentinel rather
+ * than leaving the variable to inherit from the parent env.
+ */
+export const CLAUDE_WORKER_DUMMY_API_KEY = "audit-tools-claude-worker";
+/**
+ * The `projects` key the Claude CLI trusts a repo under: the absolute repo root
+ * with FORWARD slashes on every platform (live probe: the trust warning referenced
+ * `projects["C:/Code/audit-tools"].hasTrustDialogAccepted` on win32). Trailing
+ * separators are stripped so the key matches the CLI's cwd-derived form.
+ */
+export function claudeWorkerTrustProjectKey(repoRoot) {
+    const forward = repoRoot.trim().replace(/\\/g, "/");
+    return forward.length > 1 ? forward.replace(/\/+$/u, "") : forward;
+}
+/** A filesystem-safe stem for the per-launch isolated config dir. */
+function sanitizeForDirName(value) {
+    return value.replace(/[^A-Za-z0-9._-]/gu, "-");
+}
+function requireNonEmpty(value, field) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`claude-worker provider requires a non-empty ${field} — the source carries it ` +
+            `({endpoint: <repair-proxy url>, backend_provider, model}); an isolated spawn ` +
+            `with no proxy ${field === "endpoint" ? "endpoint" : "route"} must be impossible.`);
+    }
+    return value.trim();
+}
+/**
+ * claude-worker backend — the proxied, ISOLATED, per-packet-routed Claude-harness
+ * worker (the kind-1 launch transport,
+ * docs/reviews/commit3-proxy-kind1-transport-plan-2026-07-16.md). It spawns
+ * `claude -p` with a REQUIRED `ANTHROPIC_BASE_URL` overlay pointing at the
+ * repair-proxy, a dummy `ANTHROPIC_API_KEY` (never the ambient real key), an
+ * isolated per-launch `CLAUDE_CONFIG_DIR`, and `--model
+ * <backend_provider>/<model>` — the namespace string the proxy routes on,
+ * composed at launch for argv only (it never enters the quota identity).
+ *
+ * Deliberately NO nested-session guard: this class is NOT `claude-code` (the
+ * conversation host) wearing a flag — isolation is its CONSTRUCTOR INVARIANT, not
+ * a guard exception. Construction throws unless endpoint/backend_provider/model
+ * are present, so every spawn is proxy-fronted with a scrubbed parent env
+ * (spawnLoggedCommand strips `CLAUDECODE`/`CLAUDE_CODE*`; `CLAUDE_CONFIG_DIR`
+ * survives the scrub and is overlaid per launch) and can safely run from inside a
+ * live Claude Code session. The `claude-code` host provider KEEPS its blanket
+ * guard, and all four in-session refusal layers key on `claude-code` and never
+ * see this name — no guard is refined for this class to exist.
+ */
+export class ClaudeWorkerProvider {
+    name = CLAUDE_WORKER_PROVIDER_NAME;
+    config;
+    endpoint;
+    backendProvider;
+    model;
+    launchCommand;
+    skipPermissionsDefault;
+    constructor(config = {}, options = {}, launchCommand = spawnLoggedCommand) {
+        this.config = config;
+        this.endpoint = requireNonEmpty(config.endpoint, "endpoint");
+        this.backendProvider = requireNonEmpty(config.backend_provider, "backend_provider");
+        this.model = requireNonEmpty(config.model, "model");
+        this.launchCommand = launchCommand;
+        this.skipPermissionsDefault = options.skipPermissionsDefault ?? false;
+    }
+    /**
+     * Create the per-launch isolated `CLAUDE_CONFIG_DIR` and mechanically pre-seed
+     * trust for the node's repo root, so the spawned harness never stalls on the
+     * interactive trust dialog (tool-enforced, never host-remembered).
+     */
+    async prepareIsolatedConfigDir(input) {
+        const configDir = join(tmpdir(), "audit-tools-claude-worker", `${sanitizeForDirName(input.runId)}-${randomUUID()}`);
+        await mkdir(configDir, { recursive: true });
+        await writeFile(join(configDir, ".claude.json"), JSON.stringify({
+            projects: {
+                [claudeWorkerTrustProjectKey(input.repoRoot)]: {
+                    hasTrustDialogAccepted: true,
+                },
+            },
+        }), "utf8");
+        return configDir;
+    }
+    async launch(input) {
+        const prompt = await readFile(input.promptPath, "utf8");
+        const task = await readJsonFile(input.taskPath);
+        const command = this.config.command ?? "claude";
+        const promptFlag = this.config.prompt_flag ?? "-p";
+        const skipPermissions = this.config.dangerously_skip_permissions ?? this.skipPermissionsDefault;
+        // The prompt is delivered via stdin (mirrors ClaudeCodeProvider), so
+        // `promptFlag` is a bare flag; `--model` carries the proxy's namespace
+        // routing key `<backend_provider>/<model>`, passed VERBATIM to the endpoint.
+        const args = [
+            promptFlag,
+            "--model",
+            `${this.backendProvider}/${this.model}`,
+            ...(this.config.extra_args ?? []),
+            ...(skipPermissions ? ["--dangerously-skip-permissions"] : []),
+        ];
+        const configDir = await this.prepareIsolatedConfigDir(input);
+        emitProviderLaunchDiagnostic(this.name, input);
+        try {
+            const result = await this.launchCommand(command, args, {
+                ...applyWorkerTaskLaunchSettings(input, task),
+                stdinText: prompt,
+            }, 
+            // spawnLoggedCommand merges this overlay over process.env, THEN scrubs
+            // CLAUDECODE/CLAUDE_CODE* — CLAUDE_CONFIG_DIR survives the scrub (prefix
+            // is CLAUDE_CONF), so the child sees exactly this isolated dir.
+            {
+                ANTHROPIC_BASE_URL: this.endpoint,
+                ANTHROPIC_API_KEY: CLAUDE_WORKER_DUMMY_API_KEY,
+                CLAUDE_CONFIG_DIR: configDir,
+            });
+            emitProviderDoneDiagnostic(this.name, input, result);
+            return result;
+        }
+        finally {
+            // Best-effort cleanup of the per-launch config dir — a cleanup failure
+            // must never fail (or mask) the launch result.
+            await rm(configDir, { recursive: true, force: true }).catch(() => { });
+        }
+    }
+}
+//# sourceMappingURL=claudeWorkerProvider.js.map

package/dist/shared/providers/claudeWorkerProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeWorkerProvider.js","sourceRoot":"","sources":["../../../src/shared/providers/claudeWorkerProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,6BAA6B,GAE9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAwB,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAkBvE;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACrE,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CACtB,KAAyB,EACzB,KAAgD;IAEhD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,+CAA+C,KAAK,2BAA2B;YAC7E,+EAA+E;YAC/E,iBAAiB,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,sBAAsB,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,oBAAoB;IAC/B,IAAI,GAAG,2BAA2B,CAAC;IAClB,MAAM,CAAqB;IAC3B,QAAQ,CAAS;IACjB,eAAe,CAAS;IACxB,KAAK,CAAS;IACd,aAAa,CAA4B;IACzC,sBAAsB,CAAU;IAEjD,YACE,SAA6B,EAAE,EAC/B,UAAuC,EAAE,EACzC,gBAA2C,kBAAkB;QAE7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,eAAe,CACpC,MAAM,CAAC,gBAAgB,EACvB,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,KAAK,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CACpC,KAA8B;QAE9B,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,EAAE,EACR,2BAA2B,EAC3B,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,EAAE,EAAE,CACrD,CAAC;QACF,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE;gBACR,CAAC,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE;oBAC7C,sBAAsB,EAAE,IAAI;iBAC7B;aACF;SACF,CAAC,EACF,MAAM,CACP,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA8B;QACzC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAwB,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;QACnD,MAAM,eAAe,GACnB,IAAI,CAAC,MAAM,CAAC,4BAA4B,IAAI,IAAI,CAAC,sBAAsB,CAAC;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,6EAA6E;QAC7E,MAAM,IAAI,GAAG;YACX,UAAU;YACV,SAAS;YACT,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,KAAK,EAAE;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC7D,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CACrC,OAAO,EACP,IAAI,EACJ;gBACE,GAAG,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC;gBAC7C,SAAS,EAAE,MAAM;aAClB;YACD,uEAAuE;YACvE,yEAAyE;YACzE,gEAAgE;YAChE;gBACE,kBAAkB,EAAE,IAAI,CAAC,QAAQ;gBACjC,iBAAiB,EAAE,2BAA2B;gBAC9C,iBAAiB,EAAE,SAAS;aAC7B,CACF,CAAC;YACF,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,uEAAuE;YACvE,+CAA+C;YAC/C,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF"}

package/dist/shared/providers/providerConfirmation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/providerConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAO3E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,kCAAkC,CAAC;AAM1C,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAkFD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,aAAa,EAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,aAAa,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAuB,GAC1D,kBAAkB,EAAE,CAgDtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,oBAAoB,EAAE,oBAAoB,EAC1C,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GACnD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,oBAAoB,EAC1B,aAAa,EAAE,aAAa,GAC3B,MAAM,GAAG,SAAS,CASpB;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;IAC5C;;;;OAIG;IACH,sBAAsB,EAAE,mBAAmB,EAAE,CAAC;CAC/C;AA+CD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EAAE,EAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,CAAC,EAAE,yBAAyB,EACjC,OAAO,GAAE,kBAAkB,EAAO,GACjC,qBAAqB,CA8EvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,EAAE,EAC1B,aAAa,EAAE,aAAa,GAC3B,kBAAkB,EAAE,CAEtB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,aAAa,GAC3B,sBAAsB,EAAE,CAE1B;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC5B,sBAAsB,EAAE,CAmB1B"}
+{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/providers/providerConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAO3E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,kCAAkC,CAAC;AAM1C,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAqFD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,aAAa,EAC5B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,aAAa,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAuB,GAC1D,kBAAkB,EAAE,CAgDtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,oBAAoB,EAAE,oBAAoB,EAC1C,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GACnD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAUpC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,oBAAoB,EAC1B,aAAa,EAAE,aAAa,GAC3B,MAAM,GAAG,SAAS,CASpB;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;IAC5C;;;;OAIG;IACH,sBAAsB,EAAE,mBAAmB,EAAE,CAAC;CAC/C;AAiED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EAAE,EAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,CAAC,EAAE,yBAAyB,EACjC,OAAO,GAAE,kBAAkB,EAAO,GACjC,qBAAqB,CA8EvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,EAAE,EAC1B,aAAa,EAAE,aAAa,GAC3B,kBAAkB,EAAE,CAEtB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,aAAa,GAC3B,sBAAsB,EAAE,CAE1B;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,kBAAkB,EAAE,GAC5B,sBAAsB,EAAE,CAmB1B"}

package/dist/shared/providers/providerConfirmation.js

@@ -29,6 +29,9 @@ function defaultCapabilityTier(name) {
         case "vscode-task":
         case "antigravity":
         case "agy":
+        case "claude-worker":
+            // Proxied non-Claude backend behind the Claude harness — ranks strictly below
+            // the host tier by default (the operator promotes deliberately; plan §risks).
             return "capable";
         case "worker-command":
             return "unknown";
@@ -175,8 +178,9 @@ function dispatchSourceKey(source) {
  * would let one entry's `cost_order` silently overwrite the other's. The prefix is internal
  * only; the emitted `source_id` + the operator `cost_order` keyspace are unaffected.
  */
+const SOURCE_CANDIDATE_KEY_PREFIX = "source::";
 function sourceCandidateKey(source) {
-    return `source::${dispatchSourceKey(source)}`;
+    return `${SOURCE_CANDIDATE_KEY_PREFIX}${dispatchSourceKey(source)}`;
 }
 /**
  * Resolve the FINAL 0-based cost position for every candidate key. Without an
@@ -191,10 +195,27 @@ function resolveFinalCostOrder(candidates, operatorOrder) {
         return new Map(suggested.map((c) => [c.key, c.suggested_order]));
     }
     const knownKeys = new Set(candidates.map((c) => c.key));
+    // Display keyspace ≡ match keyspace (backlog: source pools were displayed as
+    // orderable but silently ignored). A source candidate is keyed
+    // `source::<id>` internally (collision-proofing against provider names / host
+    // model ids in this shared position map) but the Gate-0 prompt DISPLAYS it under
+    // its bare id — so the bare id must match too. An exact candidate key always
+    // wins the token: a bare alias never shadows a genuine provider/model key, which
+    // preserves exactly the collision-safety the prefix exists for.
+    const bareSourceAliases = new Map();
+    for (const key of knownKeys) {
+        if (!key.startsWith(SOURCE_CANDIDATE_KEY_PREFIX))
+            continue;
+        const bare = key.slice(SOURCE_CANDIDATE_KEY_PREFIX.length);
+        if (!knownKeys.has(bare) && !bareSourceAliases.has(bare)) {
+            bareSourceAliases.set(bare, key);
+        }
+    }
     const seen = new Set();
     const orderedNamed = [];
-    for (const key of operatorOrder) {
-        if (knownKeys.has(key) && !seen.has(key)) {
+    for (const token of operatorOrder) {
+        const key = knownKeys.has(token) ? token : bareSourceAliases.get(token);
+        if (key !== undefined && !seen.has(key)) {
             seen.add(key);
             orderedNamed.push(key);
         }