cclaw-cli 0.49.0 → 0.51.0

package/dist/eval/baseline.js

@@ -1,282 +0,0 @@
-/**
- * Baseline I/O + regression comparison for the eval subsystem.
- *
- * Layout on disk (committed):
- *
- *   .cclaw/evals/baselines/<stage>.json
- *
- * Each file contains a `BaselineSnapshot` keyed by `EvalCase.id`. We compute
- * regressions by comparing per-verifier `ok` flags across runs: any verifier
- * that was `ok:true` in the baseline and is `ok:false` now counts as a
- * critical failure. A case whose aggregate `passed` flipped from true to
- * false is flagged as `case-now-failing` regardless of per-verifier churn.
- *
- * Writes are gated behind an explicit `--update-baseline --confirm` pair at
- * the CLI layer so accidental resets do not slip into PRs.
- */
-import { createHash } from "node:crypto";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { EVALS_ROOT, CCLAW_VERSION } from "../constants.js";
-import { exists } from "../fs-utils.js";
-import { FLOW_STAGES } from "../types.js";
-export const BASELINE_SCHEMA_VERSION = 1;
-/**
- * Thrown when a signed baseline's on-disk digest does not match the
- * canonical encoding of its `{ schemaVersion, stage, cases }` block.
- * Callers should treat this as a hard failure: the baseline was either
- * hand-edited or corrupted and cannot be trusted for regression gating.
- */
-export class BaselineSignatureError extends Error {
-    file;
-    expected;
-    actual;
-    constructor(opts) {
-        super(`Baseline signature mismatch at ${opts.file}: expected ${opts.expected}, got ${opts.actual}. ` +
-            `The file was modified outside of \`cclaw eval --update-baseline\`. ` +
-            `Re-run with --update-baseline --confirm to re-sign a known-good snapshot.`);
-        this.name = "BaselineSignatureError";
-        this.file = opts.file;
-        this.expected = opts.expected;
-        this.actual = opts.actual;
-    }
-}
-function baselinePath(projectRoot, stage) {
-    return path.join(projectRoot, EVALS_ROOT, "baselines", `${stage}.json`);
-}
-/**
- * Produce a deterministic sha256 digest over the signable portion of a
- * baseline. We intentionally exclude `generatedAt` and `cclawVersion`
- * from the digest so that rebuilding the same baseline from identical
- * case results on a new CLI version doesn't invalidate the signature —
- * only changes to the observed pass/ok/score payloads do.
- */
-export function computeBaselineDigest(snapshot) {
-    const canonical = canonicalJson({
-        schemaVersion: snapshot.schemaVersion,
-        stage: snapshot.stage,
-        cases: snapshot.cases
-    });
-    return createHash("sha256").update(canonical).digest("hex");
-}
-/**
- * JSON.stringify with object keys sorted recursively so the digest is
- * stable across filesystem / serializer variations.
- */
-function canonicalJson(value) {
-    if (value === null || typeof value !== "object") {
-        return JSON.stringify(value);
-    }
-    if (Array.isArray(value)) {
-        return `[${value.map((v) => canonicalJson(v)).join(",")}]`;
-    }
-    const record = value;
-    const keys = Object.keys(record).sort();
-    const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(record[k])}`);
-    return `{${parts.join(",")}}`;
-}
-export async function loadBaseline(projectRoot, stage) {
-    const filePath = baselinePath(projectRoot, stage);
-    if (!(await exists(filePath)))
-        return null;
-    const raw = await fs.readFile(filePath, "utf8");
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (err) {
-        throw new Error(`Invalid baseline at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (!isBaseline(parsed, stage)) {
-        throw new Error(`Invalid baseline at ${filePath}: shape mismatch (expected schemaVersion=${BASELINE_SCHEMA_VERSION}, stage=${stage})`);
-    }
-    const signature = parsed.signature;
-    if (signature) {
-        if (signature.algorithm !== "sha256") {
-            throw new Error(`Invalid baseline at ${filePath}: unsupported signature algorithm "${signature.algorithm}".`);
-        }
-        const actual = computeBaselineDigest(parsed);
-        if (actual !== signature.digest) {
-            throw new BaselineSignatureError({
-                file: filePath,
-                expected: signature.digest,
-                actual
-            });
-        }
-    }
-    return parsed;
-}
-function isBaseline(value, stage) {
-    if (!value || typeof value !== "object")
-        return false;
-    const candidate = value;
-    if (candidate.schemaVersion !== BASELINE_SCHEMA_VERSION)
-        return false;
-    if (candidate.stage !== stage)
-        return false;
-    if (typeof candidate.generatedAt !== "string")
-        return false;
-    if (typeof candidate.cclawVersion !== "string")
-        return false;
-    if (!candidate.cases || typeof candidate.cases !== "object")
-        return false;
-    return true;
-}
-export async function loadBaselinesByStage(projectRoot, stages) {
-    const out = new Map();
-    for (const stage of stages) {
-        const snapshot = await loadBaseline(projectRoot, stage);
-        if (snapshot)
-            out.set(stage, snapshot);
-    }
-    return out;
-}
-function entryFromResult(result) {
-    const verifierResults = result.verifierResults.map((v) => ({
-        id: v.id,
-        kind: v.kind,
-        ok: v.ok,
-        ...(v.score !== undefined ? { score: v.score } : {})
-    }));
-    return { passed: result.passed, verifierResults };
-}
-export function buildBaselineForStage(stage, report) {
-    const stageCases = report.cases.filter((c) => c.stage === stage);
-    const cases = {};
-    for (const c of stageCases) {
-        cases[c.caseId] = entryFromResult(c);
-    }
-    const now = new Date().toISOString();
-    const unsigned = {
-        schemaVersion: BASELINE_SCHEMA_VERSION,
-        stage,
-        generatedAt: now,
-        cclawVersion: CCLAW_VERSION,
-        cases
-    };
-    unsigned.signature = {
-        algorithm: "sha256",
-        digest: computeBaselineDigest(unsigned),
-        signedAt: now
-    };
-    return unsigned;
-}
-export async function writeBaselinesFromReport(projectRoot, report) {
-    const written = [];
-    const stages = new Set(report.cases.map((c) => c.stage));
-    for (const stage of stages) {
-        const snapshot = buildBaselineForStage(stage, report);
-        const file = baselinePath(projectRoot, stage);
-        await fs.mkdir(path.dirname(file), { recursive: true });
-        await fs.writeFile(file, `${JSON.stringify(snapshot, null, 2)}\n`, "utf8");
-        written.push(file);
-    }
-    return written.sort();
-}
-function verifierMap(entries) {
-    const out = new Map();
-    for (const entry of entries) {
-        out.set(entry.id, entry);
-    }
-    return out;
-}
-function computePassRate(cases) {
-    if (cases.length === 0)
-        return 1;
-    const passed = cases.filter((c) => c.passed).length;
-    return passed / cases.length;
-}
-function baselinePassRate(snapshot) {
-    const entries = Object.values(snapshot.cases);
-    if (entries.length === 0)
-        return 1;
-    const passed = entries.filter((e) => e.passed).length;
-    return passed / entries.length;
-}
-/**
- * Compare a freshly computed report against loaded baselines. If no baseline
- * exists for a stage covered by the report, that stage contributes zero
- * regressions (first run of that stage). Current is the source of truth.
- */
-export function compareAgainstBaselines(report, baselines) {
-    if (baselines.size === 0)
-        return undefined;
-    const regressions = [];
-    const caseResultsByStage = new Map();
-    for (const c of report.cases) {
-        const bucket = caseResultsByStage.get(c.stage) ?? [];
-        bucket.push(c);
-        caseResultsByStage.set(c.stage, bucket);
-    }
-    let baselineTotalPassRate = 0;
-    let baselineStagesCounted = 0;
-    for (const [stage, snapshot] of baselines) {
-        const current = caseResultsByStage.get(stage) ?? [];
-        baselineTotalPassRate += baselinePassRate(snapshot);
-        baselineStagesCounted += 1;
-        for (const caseResult of current) {
-            const baselineEntry = snapshot.cases[caseResult.caseId];
-            if (!baselineEntry)
-                continue;
-            if (baselineEntry.passed && !caseResult.passed) {
-                regressions.push({
-                    caseId: caseResult.caseId,
-                    stage,
-                    verifierId: "<case>",
-                    reason: "case-now-failing",
-                    previousScore: 1,
-                    currentScore: 0
-                });
-            }
-            const baselineVerifiers = verifierMap(baselineEntry.verifierResults);
-            for (const currentVerifier of caseResult.verifierResults) {
-                const prev = baselineVerifiers.get(currentVerifier.id);
-                if (!prev)
-                    continue;
-                if (prev.ok && !currentVerifier.ok) {
-                    regressions.push({
-                        caseId: caseResult.caseId,
-                        stage,
-                        verifierId: currentVerifier.id,
-                        reason: "newly-failing",
-                        previousScore: prev.score ?? 1,
-                        currentScore: currentVerifier.score ?? 0
-                    });
-                }
-                else if (prev.score !== undefined &&
-                    currentVerifier.score !== undefined &&
-                    currentVerifier.score < prev.score) {
-                    regressions.push({
-                        caseId: caseResult.caseId,
-                        stage,
-                        verifierId: currentVerifier.id,
-                        reason: "score-drop",
-                        previousScore: prev.score,
-                        currentScore: currentVerifier.score
-                    });
-                }
-            }
-        }
-    }
-    const currentPassRate = computePassRate(report.cases);
-    const baselineAveragePassRate = baselineStagesCounted === 0 ? currentPassRate : baselineTotalPassRate / baselineStagesCounted;
-    const scoreDelta = Number((currentPassRate - baselineAveragePassRate).toFixed(4));
-    const criticalFailures = regressions.filter((r) => r.reason === "newly-failing" || r.reason === "case-now-failing").length;
-    const baselineStages = [...baselines.keys()].sort().join(",");
-    return {
-        baselineId: baselineStages.length > 0 ? baselineStages : "(empty)",
-        scoreDelta,
-        criticalFailures,
-        regressions
-    };
-}
-export function listBaselineStages(projectRoot) {
-    const root = path.join(projectRoot, EVALS_ROOT, "baselines");
-    return fs
-        .readdir(root, { withFileTypes: true })
-        .then((entries) => entries
-        .filter((entry) => entry.isFile() && entry.name.endsWith(".json"))
-        .map((entry) => entry.name.replace(/\.json$/, ""))
-        .filter((name) => FLOW_STAGES.includes(name)))
-        .catch(() => []);
-}

package/dist/eval/config-loader.d.ts

@@ -1,14 +0,0 @@
-import type { EvalConfig, ResolvedEvalConfig } from "./types.js";
-/**
- * Default eval config. Optimized for the z.ai OpenAI-compatible coding endpoint
- * with GLM 5.1 per the roadmap locked decisions (D-EVAL-01..05). Any field can
- * be overridden by `.cclaw/evals/config.yaml` and then by `CCLAW_EVAL_*` env
- * variables (env wins last).
- */
-export declare const DEFAULT_EVAL_CONFIG: EvalConfig;
-/**
- * Resolve eval config in layered order: defaults -> config.yaml -> env vars.
- * Returns a fully-populated config plus a provenance marker so `--dry-run` can
- * surface where each setting came from.
- */
-export declare function loadEvalConfig(projectRoot: string, env?: NodeJS.ProcessEnv): Promise<ResolvedEvalConfig>;

package/dist/eval/config-loader.js

@@ -1,395 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import { parse } from "yaml";
-import { EVALS_CONFIG_PATH } from "../constants.js";
-import { exists } from "../fs-utils.js";
-import { EVAL_MODES } from "./types.js";
-import { parseModeInput } from "./mode.js";
-/**
- * Default eval config. Optimized for the z.ai OpenAI-compatible coding endpoint
- * with GLM 5.1 per the roadmap locked decisions (D-EVAL-01..05). Any field can
- * be overridden by `.cclaw/evals/config.yaml` and then by `CCLAW_EVAL_*` env
- * variables (env wins last).
- */
-export const DEFAULT_EVAL_CONFIG = {
-    provider: "zai",
-    baseUrl: "https://api.z.ai/api/coding/paas/v4",
-    model: "glm-5.1",
-    defaultMode: "fixture",
-    regression: {
-        failIfDeltaBelow: -0.15,
-        failIfCriticalBelow: 3.0
-    },
-    timeoutMs: 120_000,
-    maxRetries: 2,
-    judgeSamples: 3,
-    judgeTemperature: 0,
-    agentTemperature: 0.2
-};
-const NUMERIC_ENVS = new Set([
-    "CCLAW_EVAL_DAILY_USD_CAP",
-    "CCLAW_EVAL_TIMEOUT_MS",
-    "CCLAW_EVAL_MAX_RETRIES",
-    "CCLAW_EVAL_JUDGE_SAMPLES",
-    "CCLAW_EVAL_JUDGE_TEMPERATURE",
-    "CCLAW_EVAL_AGENT_TEMPERATURE",
-    "CCLAW_EVAL_TOOL_MAX_TURNS",
-    "CCLAW_EVAL_TOOL_MAX_ARG_BYTES",
-    "CCLAW_EVAL_TOOL_MAX_RESULT_BYTES",
-    "CCLAW_EVAL_WORKFLOW_MAX_TOTAL_TURNS"
-]);
-function evalConfigError(configFilePath, reason) {
-    return new Error(`Invalid cclaw eval config at ${configFilePath}: ${reason}\n` +
-        `Supported modes: ${EVAL_MODES.join(", ")} (legacy tier values A|B|C also accepted).\n` +
-        `See docs/evals.md for the full schema. After fixing, run: cclaw eval --dry-run`);
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function parseNumericEnv(name, raw) {
-    const value = Number(raw);
-    if (!Number.isFinite(value)) {
-        throw new Error(`Environment variable ${name} must be numeric, got: ${raw}`);
-    }
-    return value;
-}
-function parseModeEnv(raw, envName) {
-    return parseModeInput(envName === "CCLAW_EVAL_TIER" ? raw.toUpperCase() : raw, {
-        source: "env",
-        raw: `${envName}=${raw}`
-    });
-}
-function validateFileConfig(raw, configFilePath) {
-    if (raw === undefined || raw === null)
-        return {};
-    if (!isRecord(raw)) {
-        throw evalConfigError(configFilePath, "top-level value must be a mapping");
-    }
-    const out = {};
-    const assignString = (key, value) => {
-        if (value === undefined)
-            return;
-        if (typeof value !== "string" || value.trim().length === 0) {
-            throw evalConfigError(configFilePath, `"${String(key)}" must be a non-empty string`);
-        }
-        out[key] = value.trim();
-    };
-    assignString("provider", raw.provider);
-    assignString("baseUrl", raw.baseUrl);
-    assignString("model", raw.model);
-    assignString("judgeModel", raw.judgeModel);
-    if (raw.defaultMode !== undefined) {
-        if (typeof raw.defaultMode !== "string") {
-            throw evalConfigError(configFilePath, `"defaultMode" must be one of: ${EVAL_MODES.join(", ")}`);
-        }
-        try {
-            out.defaultMode = parseModeInput(raw.defaultMode, {
-                source: "config",
-                raw: `defaultMode: ${raw.defaultMode}`
-            });
-        }
-        catch (err) {
-            throw evalConfigError(configFilePath, err instanceof Error ? err.message : String(err));
-        }
-    }
-    else if (raw.defaultTier !== undefined) {
-        if (typeof raw.defaultTier !== "string") {
-            throw evalConfigError(configFilePath, `"defaultTier" must be a string (legacy; prefer "defaultMode")`);
-        }
-        try {
-            out.defaultMode = parseModeInput(raw.defaultTier, {
-                source: "config",
-                raw: `defaultTier: ${raw.defaultTier}`
-            });
-        }
-        catch (err) {
-            throw evalConfigError(configFilePath, err instanceof Error ? err.message : String(err));
-        }
-    }
-    if (raw.dailyUsdCap !== undefined) {
-        if (typeof raw.dailyUsdCap !== "number" || raw.dailyUsdCap < 0) {
-            throw evalConfigError(configFilePath, `"dailyUsdCap" must be a non-negative number`);
-        }
-        out.dailyUsdCap = raw.dailyUsdCap;
-    }
-    if (raw.timeoutMs !== undefined) {
-        if (typeof raw.timeoutMs !== "number" || raw.timeoutMs <= 0) {
-            throw evalConfigError(configFilePath, `"timeoutMs" must be a positive number`);
-        }
-        out.timeoutMs = raw.timeoutMs;
-    }
-    if (raw.maxRetries !== undefined) {
-        if (!Number.isInteger(raw.maxRetries) || raw.maxRetries < 0) {
-            throw evalConfigError(configFilePath, `"maxRetries" must be a non-negative integer`);
-        }
-        out.maxRetries = raw.maxRetries;
-    }
-    if (raw.judgeSamples !== undefined) {
-        const value = raw.judgeSamples;
-        if (!Number.isInteger(value) || value < 1) {
-            throw evalConfigError(configFilePath, `"judgeSamples" must be a positive integer`);
-        }
-        if (value % 2 === 0) {
-            throw evalConfigError(configFilePath, `"judgeSamples" must be odd (so median-of-N is a true integer)`);
-        }
-        out.judgeSamples = value;
-    }
-    if (raw.judgeTemperature !== undefined) {
-        if (typeof raw.judgeTemperature !== "number" || !Number.isFinite(raw.judgeTemperature)) {
-            throw evalConfigError(configFilePath, `"judgeTemperature" must be a finite number`);
-        }
-        if (raw.judgeTemperature < 0 || raw.judgeTemperature > 2) {
-            throw evalConfigError(configFilePath, `"judgeTemperature" must be within [0, 2]`);
-        }
-        out.judgeTemperature = raw.judgeTemperature;
-    }
-    if (raw.agentTemperature !== undefined) {
-        if (typeof raw.agentTemperature !== "number" || !Number.isFinite(raw.agentTemperature)) {
-            throw evalConfigError(configFilePath, `"agentTemperature" must be a finite number`);
-        }
-        if (raw.agentTemperature < 0 || raw.agentTemperature > 2) {
-            throw evalConfigError(configFilePath, `"agentTemperature" must be within [0, 2]`);
-        }
-        out.agentTemperature = raw.agentTemperature;
-    }
-    if (raw.tokenPricing !== undefined) {
-        if (!isRecord(raw.tokenPricing)) {
-            throw evalConfigError(configFilePath, `"tokenPricing" must be a mapping`);
-        }
-        const pricing = {};
-        for (const [model, value] of Object.entries(raw.tokenPricing)) {
-            if (!isRecord(value)) {
-                throw evalConfigError(configFilePath, `"tokenPricing.${model}" must be a mapping with numeric input + output keys`);
-            }
-            const input = value.input;
-            const output = value.output;
-            if (typeof input !== "number" || input < 0) {
-                throw evalConfigError(configFilePath, `"tokenPricing.${model}.input" must be a non-negative number`);
-            }
-            if (typeof output !== "number" || output < 0) {
-                throw evalConfigError(configFilePath, `"tokenPricing.${model}.output" must be a non-negative number`);
-            }
-            const extraneous = Object.keys(value).filter((key) => key !== "input" && key !== "output");
-            if (extraneous.length > 0) {
-                throw evalConfigError(configFilePath, `"tokenPricing.${model}" has unknown key(s): ${extraneous.join(", ")}`);
-            }
-            pricing[model] = { input, output };
-        }
-        out.tokenPricing = pricing;
-    }
-    const assignPositiveInt = (key, value, label) => {
-        if (value === undefined)
-            return;
-        if (!Number.isInteger(value) || value < 1) {
-            throw evalConfigError(configFilePath, `"${label}" must be a positive integer`);
-        }
-        out[key] = value;
-    };
-    assignPositiveInt("toolMaxTurns", raw.toolMaxTurns, "toolMaxTurns");
-    assignPositiveInt("toolMaxArgumentsBytes", raw.toolMaxArgumentsBytes, "toolMaxArgumentsBytes");
-    assignPositiveInt("toolMaxResultBytes", raw.toolMaxResultBytes, "toolMaxResultBytes");
-    assignPositiveInt("workflowMaxTotalTurns", raw.workflowMaxTotalTurns, "workflowMaxTotalTurns");
-    if (raw.regression !== undefined) {
-        if (!isRecord(raw.regression)) {
-            throw evalConfigError(configFilePath, `"regression" must be a mapping`);
-        }
-        const failIfDeltaBelow = raw.regression.failIfDeltaBelow;
-        const failIfCriticalBelow = raw.regression.failIfCriticalBelow;
-        if (failIfDeltaBelow !== undefined && typeof failIfDeltaBelow !== "number") {
-            throw evalConfigError(configFilePath, `"regression.failIfDeltaBelow" must be a number`);
-        }
-        if (failIfCriticalBelow !== undefined && typeof failIfCriticalBelow !== "number") {
-            throw evalConfigError(configFilePath, `"regression.failIfCriticalBelow" must be a number`);
-        }
-        out.regression = {
-            failIfDeltaBelow: typeof failIfDeltaBelow === "number"
-                ? failIfDeltaBelow
-                : DEFAULT_EVAL_CONFIG.regression.failIfDeltaBelow,
-            failIfCriticalBelow: typeof failIfCriticalBelow === "number"
-                ? failIfCriticalBelow
-                : DEFAULT_EVAL_CONFIG.regression.failIfCriticalBelow
-        };
-    }
-    const knownKeys = new Set([
-        "provider",
-        "baseUrl",
-        "model",
-        "judgeModel",
-        "defaultMode",
-        "defaultTier",
-        "dailyUsdCap",
-        "timeoutMs",
-        "maxRetries",
-        "regression",
-        "judgeSamples",
-        "judgeTemperature",
-        "agentTemperature",
-        "tokenPricing",
-        "toolMaxTurns",
-        "toolMaxArgumentsBytes",
-        "toolMaxResultBytes",
-        "workflowMaxTotalTurns"
-    ]);
-    const unknown = Object.keys(raw).filter((key) => !knownKeys.has(key));
-    if (unknown.length > 0) {
-        throw evalConfigError(configFilePath, `unknown top-level key(s): ${unknown.join(", ")}`);
-    }
-    return out;
-}
-async function readFileConfig(projectRoot) {
-    const configFilePath = path.join(projectRoot, EVALS_CONFIG_PATH);
-    if (!(await exists(configFilePath))) {
-        return { patch: {}, source: "default" };
-    }
-    let parsed;
-    try {
-        parsed = parse(await fs.readFile(configFilePath, "utf8"));
-    }
-    catch (err) {
-        throw evalConfigError(configFilePath, err instanceof Error ? err.message : String(err));
-    }
-    const patch = validateFileConfig(parsed, configFilePath);
-    return { patch, source: "file" };
-}
-function applyEnvOverrides(base, env) {
-    let overridden = false;
-    const patched = {
-        ...base,
-        regression: { ...base.regression }
-    };
-    for (const name of Object.keys(env)) {
-        if (!name.startsWith("CCLAW_EVAL_"))
-            continue;
-        if (NUMERIC_ENVS.has(name) && typeof env[name] === "string") {
-            // validated below when applied
-        }
-    }
-    const read = (name) => {
-        const value = env[name];
-        return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
-    };
-    const baseUrl = read("CCLAW_EVAL_BASE_URL");
-    if (baseUrl) {
-        patched.baseUrl = baseUrl;
-        overridden = true;
-    }
-    const model = read("CCLAW_EVAL_MODEL");
-    if (model) {
-        patched.model = model;
-        overridden = true;
-    }
-    const judgeModel = read("CCLAW_EVAL_JUDGE_MODEL");
-    if (judgeModel) {
-        patched.judgeModel = judgeModel;
-        overridden = true;
-    }
-    const provider = read("CCLAW_EVAL_PROVIDER");
-    if (provider) {
-        patched.provider = provider;
-        overridden = true;
-    }
-    const modeEnv = read("CCLAW_EVAL_MODE");
-    if (modeEnv) {
-        patched.defaultMode = parseModeEnv(modeEnv, "CCLAW_EVAL_MODE");
-        overridden = true;
-    }
-    else {
-        const legacyTier = read("CCLAW_EVAL_TIER");
-        if (legacyTier) {
-            patched.defaultMode = parseModeEnv(legacyTier, "CCLAW_EVAL_TIER");
-            overridden = true;
-        }
-    }
-    const cap = read("CCLAW_EVAL_DAILY_USD_CAP");
-    if (cap) {
-        patched.dailyUsdCap = parseNumericEnv("CCLAW_EVAL_DAILY_USD_CAP", cap);
-        overridden = true;
-    }
-    const timeout = read("CCLAW_EVAL_TIMEOUT_MS");
-    if (timeout) {
-        patched.timeoutMs = parseNumericEnv("CCLAW_EVAL_TIMEOUT_MS", timeout);
-        overridden = true;
-    }
-    const retries = read("CCLAW_EVAL_MAX_RETRIES");
-    if (retries) {
-        patched.maxRetries = parseNumericEnv("CCLAW_EVAL_MAX_RETRIES", retries);
-        overridden = true;
-    }
-    const judgeSamples = read("CCLAW_EVAL_JUDGE_SAMPLES");
-    if (judgeSamples) {
-        const value = parseNumericEnv("CCLAW_EVAL_JUDGE_SAMPLES", judgeSamples);
-        if (!Number.isInteger(value) || value < 1) {
-            throw new Error(`Environment variable CCLAW_EVAL_JUDGE_SAMPLES must be a positive integer, got: ${judgeSamples}`);
-        }
-        if (value % 2 === 0) {
-            throw new Error(`Environment variable CCLAW_EVAL_JUDGE_SAMPLES must be odd, got: ${judgeSamples}`);
-        }
-        patched.judgeSamples = value;
-        overridden = true;
-    }
-    const judgeTemp = read("CCLAW_EVAL_JUDGE_TEMPERATURE");
-    if (judgeTemp) {
-        const value = parseNumericEnv("CCLAW_EVAL_JUDGE_TEMPERATURE", judgeTemp);
-        if (value < 0 || value > 2) {
-            throw new Error(`Environment variable CCLAW_EVAL_JUDGE_TEMPERATURE must be within [0, 2], got: ${judgeTemp}`);
-        }
-        patched.judgeTemperature = value;
-        overridden = true;
-    }
-    const agentTemp = read("CCLAW_EVAL_AGENT_TEMPERATURE");
-    if (agentTemp) {
-        const value = parseNumericEnv("CCLAW_EVAL_AGENT_TEMPERATURE", agentTemp);
-        if (value < 0 || value > 2) {
-            throw new Error(`Environment variable CCLAW_EVAL_AGENT_TEMPERATURE must be within [0, 2], got: ${agentTemp}`);
-        }
-        patched.agentTemperature = value;
-        overridden = true;
-    }
-    const readPositiveInt = (name, key, label) => {
-        const raw = read(name);
-        if (!raw)
-            return;
-        const value = parseNumericEnv(name, raw);
-        if (!Number.isInteger(value) || value < 1) {
-            throw new Error(`Environment variable ${name} must be a positive integer, got: ${raw}`);
-        }
-        patched[key] = value;
-        overridden = true;
-        void label;
-    };
-    readPositiveInt("CCLAW_EVAL_TOOL_MAX_TURNS", "toolMaxTurns", "toolMaxTurns");
-    readPositiveInt("CCLAW_EVAL_WORKFLOW_MAX_TOTAL_TURNS", "workflowMaxTotalTurns", "workflowMaxTotalTurns");
-    readPositiveInt("CCLAW_EVAL_TOOL_MAX_ARG_BYTES", "toolMaxArgumentsBytes", "toolMaxArgumentsBytes");
-    readPositiveInt("CCLAW_EVAL_TOOL_MAX_RESULT_BYTES", "toolMaxResultBytes", "toolMaxResultBytes");
-    const apiKey = read("CCLAW_EVAL_API_KEY");
-    return { patched, overridden, apiKey };
-}
-/**
- * Resolve eval config in layered order: defaults -> config.yaml -> env vars.
- * Returns a fully-populated config plus a provenance marker so `--dry-run` can
- * surface where each setting came from.
- */
-export async function loadEvalConfig(projectRoot, env = process.env) {
-    const { patch, source: fileSource } = await readFileConfig(projectRoot);
-    const merged = {
-        ...DEFAULT_EVAL_CONFIG,
-        ...patch,
-        regression: {
-            ...DEFAULT_EVAL_CONFIG.regression,
-            ...(patch.regression ?? {})
-        }
-    };
-    const { patched, overridden, apiKey } = applyEnvOverrides(merged, env);
-    let source = "default";
-    if (fileSource === "file" && overridden)
-        source = "file+env";
-    else if (fileSource === "file")
-        source = "file";
-    else if (overridden)
-        source = "env";
-    return {
-        ...patched,
-        apiKey,
-        source
-    };
-}