harness-dispatch 0.4.0 → 0.5.0

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAOA,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS5D;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAOvD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAKvD;AAmBD,wBAAgB,YAAY,CAC1B,mBAAmB,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAClD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAOT;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AASA,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS5D;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAOvD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAKvD;AAmBD,wBAAgB,YAAY,CAC1B,mBAAmB,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAClD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAOT;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C"}

package/dist/auth.js

@@ -1,10 +1,10 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { promises as fs } from "node:fs";
-import os from "node:os";
 import path from "node:path";
+import { stateRoot } from "./state-dir.js";
 const TOKEN_ENV = "HARNESS_DISPATCH_HTTP_TOKEN";
 export function authDir() {
-    return process.env.HARNESS_DISPATCH_HOME ?? path.join(os.homedir(), ".harness-dispatch");
+    return process.env.HARNESS_DISPATCH_HOME ?? stateRoot();
 }
 export function tokenPath() {
     return path.join(authDir(), "http-token");

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAEhD,MAAM,UAAU,OAAO;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,OAAO,KAAK,IAAI,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,KAAa,EAAE,QAAgB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC3C,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,mBAAkD,EAClD,KAAoB;IAEpB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAC9C,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,mBAAmB,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,SAAS,CAAC,KAAK,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAEhD,MAAM,UAAU,OAAO;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,OAAO,KAAK,IAAI,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,KAAa,EAAE,QAAgB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC3C,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,mBAAkD,EAClD,KAAoB;IAEpB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAC9C,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,mBAAmB,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,SAAS,CAAC,KAAK,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/billing.d.ts

@@ -1,7 +1,38 @@
-import type { RouteBilling, ServiceConfig } from "./types.js";
-export declare function buildRouteBilling(svc: ServiceConfig, opts?: {
-    now?: Date;
-}): RouteBilling;
+import type { BillingKind, RouteBilling, ServiceConfig } from "./types.js";
+/**
+ * Whether a route can incur a REAL charge with no further action from the
+ * user, by default — i.e. whether harness-dispatch should block it until
+ * explicitly allowed.
+ *
+ * "included_X_then_optional_Y" kinds (Codex flexible credits, Claude usage
+ * credits, Cursor on-demand) are NOT blocked by default: researched across
+ * Anthropic, OpenAI, and Cursor (2026-07), all three hard-stop at the
+ * included cap by default — continuing past it requires the user to have
+ * ALREADY completed a separate, deliberate opt-in on the PROVIDER's own
+ * side (enabling usage credits/flexible pricing/on-demand billing, usually
+ * with its own payment method and spend limit). harness-dispatch blocking
+ * these by default would just be re-gating something the provider already
+ * gates, and asking every user to prove a negative ("I haven't opted into
+ * my provider's overage") for a state that's off by default anyway.
+ *
+ * A user who HAS enabled provider-side overage can still restore the block
+ * by setting `paid_usage_possible: true` explicitly in that route's config
+ * — the override in buildRouteBilling() takes precedence over this
+ * function. Only kinds with no such provider-side backstop — metered_api
+ * (raw API keys bill from the first token, no included pool at all) and
+ * unknown (no data to reason about) — are blocked by default here.
+ */
+export declare function inferredPaidUsagePossible(kind: BillingKind): boolean;
+/**
+ * Classification is date-independent by construction.
+ *
+ * This took an `opts.now` that was threaded into inferredKind/defaultNotes
+ * and used by neither — a leftover from when the Agent SDK credit split was
+ * expected to change classification on 2026-06-15. Anthropic paused that on
+ * launch day, the date logic was removed, and the parameter stayed behind
+ * implying a time dependency that no longer exists.
+ */
+export declare function buildRouteBilling(svc: ServiceConfig): RouteBilling;
 export declare function billingIsUnknown(billing: RouteBilling): boolean;
 export declare function billingIsBlocked(billing: RouteBilling): boolean;
 //# sourceMappingURL=billing.d.ts.map

package/dist/billing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAMV,YAAY,EACZ,aAAa,EACd,MAAM,YAAY,CAAC;AAmLpB,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,aAAa,EAClB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GACxB,YAAY,CAqBd;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAE/D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAI/D"}
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,WAAW,EAGX,YAAY,EACZ,aAAa,EACd,MAAM,YAAY,CAAC;AA0IpB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAapE;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAoBlE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAE/D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAI/D"}

package/dist/billing.js

@@ -1,17 +1,40 @@
-function isLoopback(baseUrl) {
+/**
+ * Parse a base_url into (hostname, port), or undefined if it isn't a URL.
+ *
+ * Both predicates below used `String.includes`, which is not a host check:
+ * `https://evil.example.com/proxy?upstream=localhost:11434/v1` contains
+ * "localhost:11434" and so classified as free local compute — provider
+ * "local", kind "local_compute", paidUsagePossible false. That also exempted
+ * it from the caller-supplied `local_only` and `approval_required` policies,
+ * because route-policy.ts's isLocalRoute ORs those same four fields.
+ *
+ * Requires a hostile or mistaken config entry, so it is not remotely
+ * triggerable — but "is this host local" is exactly the question a substring
+ * cannot answer. config.ts:inferEndpointProvider already did this correctly;
+ * this is the same approach applied to the two predicates that did not.
+ */
+function hostOf(baseUrl) {
     if (!baseUrl)
-        return false;
-    return (baseUrl.includes("localhost") ||
-        baseUrl.includes("127.0.0.1") ||
-        baseUrl.includes("::1"));
+        return undefined;
+    try {
+        const url = new URL(baseUrl);
+        return { host: url.hostname.toLowerCase(), port: url.port };
+    }
+    catch {
+        return undefined;
+    }
+}
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isLoopback(baseUrl) {
+    const parsed = hostOf(baseUrl);
+    return parsed !== undefined && LOOPBACK_HOSTS.has(parsed.host);
 }
+/** Ollama (11434) and LM Studio (1234) on loopback — the two runtimes we can name. */
 function isKnownLocalRuntime(baseUrl) {
-    if (!baseUrl)
+    const parsed = hostOf(baseUrl);
+    if (parsed === undefined || !LOOPBACK_HOSTS.has(parsed.host))
         return false;
-    return (baseUrl.includes("localhost:11434") ||
-        baseUrl.includes("127.0.0.1:11434") ||
-        baseUrl.includes("localhost:1234") ||
-        baseUrl.includes("127.0.0.1:1234"));
+    return parsed.port === "11434" || parsed.port === "1234";
 }
 // NOTE: no harness-name special cases here. Built-in harnesses declare
 // provider/surface/auth_source/billing_kind in the shipped config.default.yaml,
@@ -58,7 +81,7 @@ function authSourceFromService(svc, surface) {
     }
     return "unknown";
 }
-function inferredKind(svc, surface, authSource, now) {
+function inferredKind(svc, surface, authSource) {
     if (svc.billingKind)
         return svc.billingKind;
     if (authSource === "api_key")
@@ -136,7 +159,7 @@ function inferredConfidence(svc, surface, kind) {
  * (raw API keys bill from the first token, no included pool at all) and
  * unknown (no data to reason about) — are blocked by default here.
  */
-function inferredPaidUsagePossible(kind) {
+export function inferredPaidUsagePossible(kind) {
     switch (kind) {
         case "local_compute":
         case "included_plan_usage":
@@ -150,7 +173,7 @@ function inferredPaidUsagePossible(kind) {
             return true;
     }
 }
-function defaultNotes(svc, surface, kind, now) {
+function defaultNotes(svc, surface, kind) {
     if (svc.billingNotes)
         return svc.billingNotes;
     if (surface === "claude_agent_sdk" || surface === "claude_code") {
@@ -165,12 +188,20 @@ function defaultNotes(svc, surface, kind, now) {
     }
     return undefined;
 }
-export function buildRouteBilling(svc, opts = {}) {
-    const now = opts.now ?? new Date();
+/**
+ * Classification is date-independent by construction.
+ *
+ * This took an `opts.now` that was threaded into inferredKind/defaultNotes
+ * and used by neither — a leftover from when the Agent SDK credit split was
+ * expected to change classification on 2026-06-15. Anthropic paused that on
+ * launch day, the date logic was removed, and the parameter stayed behind
+ * implying a time dependency that no longer exists.
+ */
+export function buildRouteBilling(svc) {
     const provider = providerFromService(svc);
     const surface = surfaceFromService(svc);
     const authSource = authSourceFromService(svc, surface);
-    const kind = inferredKind(svc, surface, authSource, now);
+    const kind = inferredKind(svc, surface, authSource);
     const confidence = inferredConfidence(svc, surface, kind);
     const paidUsagePossible = svc.paidUsagePossible ?? inferredPaidUsagePossible(kind);
     const billing = {
@@ -183,7 +214,7 @@ export function buildRouteBilling(svc, opts = {}) {
         paidUsageRequiresOptIn: paidUsagePossible ? true : false,
         confidence,
     };
-    const notes = defaultNotes(svc, surface, kind, now);
+    const notes = defaultNotes(svc, surface, kind);
     if (notes !== undefined)
         billing.notes = notes;
     return billing;

package/dist/billing.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAUA,SAAS,UAAU,CAAC,OAA2B;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA2B;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,4CAA4C;AAE5C,SAAS,mBAAmB,CAAC,GAAkB;IAC7C,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtC,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACzF,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAkB;IAC5C,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACpC,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC;YAAE,OAAO,YAAY,CAAC;QACjE,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,gBAAgB,CAAC;QAC9D,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAkB,EAAE,OAAuB;IACxE,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,eAAe,CAAC;IACzD,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,qBAAqB,CAAC;IACnE,IAAI,OAAO,KAAK,kBAAkB;QAAE,OAAO,eAAe,CAAC;IAC3D,IACE,OAAO,KAAK,WAAW;QACvB,OAAO,KAAK,kBAAkB;QAC9B,OAAO,KAAK,iBAAiB,EAC7B,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,GAAkB,EAClB,OAAuB,EACvB,UAAsB,EACtB,GAAS;IAET,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC,WAAW,CAAC;IAC5C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,kBAAkB,CAAC;QACxB,KAAK,aAAa;YAChB,qEAAqE;YACrE,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,+DAA+D;YAC/D,2CAA2C;YAC3C,0DAA0D;YAC1D,OAAO,qBAAqB,CAAC;QAC/B,KAAK,WAAW,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,qCAAqC,CAAC;QAC/C,KAAK,kBAAkB;YACrB,OAAO,+BAA+B,CAAC;QACzC,KAAK,iBAAiB;YACpB,OAAO,YAAY,CAAC;QACtB,KAAK,gBAAgB;YACnB,OAAO,eAAe,CAAC;QACzB,KAAK,YAAY,CAAC;QAClB,KAAK,eAAe,CAAC;QACrB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,aAAa,CAAC;QACvB,KAAK,mBAAmB;YACtB,OAAO,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7D,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAkB,EAClB,OAAuB,EACvB,IAAiB;IAEjB,IAAI,GAAG,CAAC,iBAAiB;QAAE,OAAO,GAAG,CAAC,iBAAiB,CAAC;IACxD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,OAAO,KAAK,mBAAmB,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,OAAO,KAAK,kBAAkB,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACtF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,yBAAyB,CAAC,IAAiB;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,eAAe,CAAC;QACrB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,YAAY,CAAC;QAClB,KAAK,qCAAqC,CAAC;QAC3C,KAAK,uCAAuC,CAAC;QAC7C,KAAK,+BAA+B;YAClC,OAAO,KAAK,CAAC;QACf,KAAK,aAAa,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,GAAkB,EAClB,OAAuB,EACvB,IAAiB,EACjB,GAAS;IAET,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC;IAC9C,IAAI,OAAO,KAAK,kBAAkB,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAChE,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,CACL,uEAAuE;YACvE,uEAAuE;YACvE,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,mBAAmB,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrF,OAAO,oFAAoF,CAAC;IAC9F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,OAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,OAAO,GAAiB;QAC5B,QAAQ;QACR,OAAO;QACP,UAAU;QACV,IAAI;QACJ,iBAAiB;QACjB,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;QAC3C,sBAAsB,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QACxD,UAAU;KACX,CAAC;IACF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;IAC9D,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;GAcG;AACH,SAAS,MAAM,CAAC,OAA2B;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E,SAAS,UAAU,CAAC,OAA2B;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,sFAAsF;AACtF,SAAS,mBAAmB,CAAC,OAA2B;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC;AAC3D,CAAC;AAED,uEAAuE;AACvE,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,4CAA4C;AAE5C,SAAS,mBAAmB,CAAC,GAAkB;IAC7C,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtC,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACzF,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAkB;IAC5C,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACpC,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC;YAAE,OAAO,YAAY,CAAC;QACjE,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,gBAAgB,CAAC;QAC9D,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAkB,EAAE,OAAuB;IACxE,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,eAAe,CAAC;IACzD,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,qBAAqB,CAAC;IACnE,IAAI,OAAO,KAAK,kBAAkB;QAAE,OAAO,eAAe,CAAC;IAC3D,IACE,OAAO,KAAK,WAAW;QACvB,OAAO,KAAK,kBAAkB;QAC9B,OAAO,KAAK,iBAAiB,EAC7B,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,GAAkB,EAClB,OAAuB,EACvB,UAAsB;IAEtB,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC,WAAW,CAAC;IAC5C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,kBAAkB,CAAC;QACxB,KAAK,aAAa;YAChB,qEAAqE;YACrE,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,+DAA+D;YAC/D,2CAA2C;YAC3C,0DAA0D;YAC1D,OAAO,qBAAqB,CAAC;QAC/B,KAAK,WAAW,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,qCAAqC,CAAC;QAC/C,KAAK,kBAAkB;YACrB,OAAO,+BAA+B,CAAC;QACzC,KAAK,iBAAiB;YACpB,OAAO,YAAY,CAAC;QACtB,KAAK,gBAAgB;YACnB,OAAO,eAAe,CAAC;QACzB,KAAK,YAAY,CAAC;QAClB,KAAK,eAAe,CAAC;QACrB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,aAAa,CAAC;QACvB,KAAK,mBAAmB;YACtB,OAAO,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7D,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAkB,EAClB,OAAuB,EACvB,IAAiB;IAEjB,IAAI,GAAG,CAAC,iBAAiB;QAAE,OAAO,GAAG,CAAC,iBAAiB,CAAC;IACxD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,OAAO,KAAK,mBAAmB,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,OAAO,KAAK,kBAAkB,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACtF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAiB;IACzD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,eAAe,CAAC;QACrB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,YAAY,CAAC;QAClB,KAAK,qCAAqC,CAAC;QAC3C,KAAK,uCAAuC,CAAC;QAC7C,KAAK,+BAA+B;YAClC,OAAO,KAAK,CAAC;QACf,KAAK,aAAa,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,GAAkB,EAClB,OAAuB,EACvB,IAAiB;IAEjB,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC;IAC9C,IAAI,OAAO,KAAK,kBAAkB,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAChE,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,CACL,uEAAuE;YACvE,uEAAuE;YACvE,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,mBAAmB,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrF,OAAO,oFAAoF,CAAC;IAC9F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,OAAO,GAAiB;QAC5B,QAAQ;QACR,OAAO;QACP,UAAU;QACV,IAAI;QACJ,iBAAiB;QACjB,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;QAC3C,sBAAsB,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QACxD,UAAU;KACX,CAAC;IACF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;IAC9D,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/bin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;GAEG;AAkfH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyF1D"}
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;GAEG;AA6sBH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiH1D"}

package/dist/bin.js

@@ -2,13 +2,13 @@
 /**
  * harness-dispatch CLI entrypoint.
  */
-import { existsSync } from "node:fs";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { parseArgs } from "node:util";
 import yaml from "js-yaml";
 import { ensureHttpToken, maskToken, readHttpToken, rotateHttpToken, tokenPath } from "./auth.js";
-import { loadConfig } from "./config.js";
+import { AUTO_DETECT_COMMANDS, loadConfig } from "./config.js";
 import { LeaderboardCache } from "./leaderboard.js";
 import { buildDispatchers } from "./mcp/dispatcher-factory.js";
 import { startMcpServer } from "./mcp/server.js";
@@ -19,11 +19,14 @@ import { buildStatus, buildUsage, renderStatusText, renderUsageText } from "./st
 import { startHttpServer } from "./http/server.js";
 import { billingIsBlocked, buildRouteBilling } from "./billing.js";
 import { effectiveSafetyProfile } from "./safety.js";
+import { stateRoot } from "./state-dir.js";
 async function buildRuntime(configPath) {
     const config = await loadConfig(configPath);
     const dispatchers = await buildDispatchers(config);
     const quota = new QuotaCache(dispatchers);
-    const leaderboard = new LeaderboardCache();
+    const leaderboard = new LeaderboardCache(undefined, {
+        enabled: config.leaderboard?.enabled === true,
+    });
     const router = new Router(config, quota, dispatchers, leaderboard);
     return { config, dispatchers, quota, leaderboard, router };
 }
@@ -52,6 +55,7 @@ function printUsage() {
         "  --json                Print JSON where supported.",
         "  --print               configure: print generated config YAML without writing it.",
         "  --yes                 configure: write config.yaml instead of only previewing it.",
+        "  --force               configure: overwrite an existing config file.",
         "  --allow-paid          Allow doctor --live to probe paid or unknown-paid routes.",
         "  -h, --help            Show help.",
         "",
@@ -86,6 +90,7 @@ function commonEntryFields(svc) {
         escalate_model: svc.escalateModel,
         escalate_on: svc.escalateOn.length > 0 ? svc.escalateOn : undefined,
         capabilities: Object.keys(svc.capabilities).length > 0 ? svc.capabilities : undefined,
+        timeout_ms: svc.timeoutMs,
         max_output_tokens: svc.maxOutputTokens,
         max_input_tokens: svc.maxInputTokens,
         allow_paid_usage: svc.allowPaidUsage ? true : undefined,
@@ -99,33 +104,131 @@ function commonEntryFields(svc) {
         model_hint: svc.modelHint,
     };
 }
-function cliEntryToYaml(svc) {
+/**
+ * Render a route's api_key WITHOUT materialising the secret.
+ *
+ * `svc.apiKey` is the RESOLVED value — config.ts interpolates `${VAR}` at
+ * load time, so by here the reference is gone. Emitting it verbatim wrote
+ * live credentials into config.yaml and echoed them to stdout on
+ * `configure --print`, which is documented as the safe preview and is exactly
+ * what someone pastes into a bug report. It also broke the project's own
+ * stated invariant (plugin/commands/setup.md: "API keys MUST be written as
+ * ${ENV_VAR} references — never literal").
+ *
+ * `config.envRefs` maps the resolved value back to the reference that
+ * produced it, so a key that came from `${GROQ_API_KEY}` round-trips exactly.
+ *
+ * A key written as a LITERAL in the source file has no reference to restore.
+ * That case splits by destination: `--yes` writes to disk, where the literal
+ * already lives and dropping it would break a working config, so it is
+ * preserved; `--print` goes to a terminal and a bug report, so it is redacted
+ * to the placeholder below.
+ */
+function apiKeyForYaml(svc, config, opts) {
+    if (svc.apiKey === undefined || svc.apiKey === "")
+        return undefined;
+    const ref = config.envRefs?.get(svc.apiKey);
+    if (ref !== undefined)
+        return ref;
+    if (!opts.redactLiterals)
+        return svc.apiKey;
+    // protocol.apiKeyEnvVar is the var the CHILD CLI reads, which is only a
+    // suggestion for what to name the config reference — they need not match,
+    // and endpoint routes have no protocol at all. Hence the generic fallback.
+    const envVar = svc.protocol?.apiKeyEnvVar ?? "YOUR_API_KEY_ENV_VAR";
+    return `\${${envVar}}`;
+}
+function cliEntryToYaml(svc, config, opts) {
+    // `harness: generic` has NO shipped preset behind it, so anything omitted
+    // here is not recoverable on reload — it is gone. Dropping `protocol:` was
+    // fatal: config.ts refuses a generic entry without one ("requires a
+    // protocol block — entry ignored"), so a round-trip deleted every
+    // user-added harness, and `configure --yes --force` wrote that over their
+    // file. This is the documented README#adding-a-harness path.
+    //
+    // Built-in harnesses keep the lean output: their preset supplies protocol
+    // and billing, and emitting a copy would freeze a snapshot that stops
+    // tracking future default changes — the same reasoning commonEntryFields
+    // gives for omitting billing fields generally.
+    const isGeneric = svc.harness === "generic";
     return {
         name: svc.name,
         harness: svc.harness,
         command: svc.command,
-        api_key: svc.apiKey,
+        api_key: apiKeyForYaml(svc, config, opts),
         ...commonEntryFields(svc),
+        ...(isGeneric
+            ? {
+                provider: svc.provider,
+                surface: svc.surface,
+                auth_source: svc.authSource,
+                billing_kind: svc.billingKind,
+                paid_usage_possible: svc.paidUsagePossible,
+                billing_notes: svc.billingNotes,
+                protocol: svc.protocol,
+            }
+            : {}),
     };
 }
-function endpointEntryToYaml(svc) {
+function endpointEntryToYaml(svc, config, opts) {
     return {
         name: svc.name,
         base_url: svc.baseUrl,
-        api_key: svc.apiKey,
+        api_key: apiKeyForYaml(svc, config, opts),
         ...commonEntryFields(svc),
+        // Endpoints have no shipped preset behind them, so an omitted billing
+        // field is not recomputed on reload — it is lost. Verified: an endpoint
+        // declaring `billing_kind: local_compute` and `paid_usage_possible: false`
+        // came back undefined, flipping it to paid=possible and getting it skipped
+        // by billing policy.
+        //
+        // This is the same reasoning already applied to `harness: generic` CLI
+        // routes, and it should have been applied here at the same time. Built-in
+        // harnesses still keep the lean output because their preset supplies these.
+        provider: svc.provider,
+        surface: svc.surface,
+        auth_source: svc.authSource,
+        billing_kind: svc.billingKind,
+        paid_usage_possible: svc.paidUsagePossible,
+        billing_notes: svc.billingNotes,
     };
 }
-function configToYaml(config) {
+/**
+ * Top-level settings a user set and that have no defaults to track.
+ *
+ * These were silently dropped on every round-trip. Unlike the billing fields
+ * (see commonEntryFields — omitted deliberately so they keep following harness
+ * defaults), nothing recomputes these: a dropped `max_concurrent_runs` is
+ * simply gone, and `configure --yes --force` wrote the result over the user's
+ * file.
+ */
+function topLevelToYaml(config) {
+    const out = {};
+    if (config.disabled && config.disabled.length > 0)
+        out.disabled = [...config.disabled];
+    if (config.maxConcurrentRuns !== undefined)
+        out.max_concurrent_runs = config.maxConcurrentRuns;
+    if (config.retention?.jobsDays !== undefined) {
+        out.retention = { jobs_days: config.retention.jobsDays };
+    }
+    if (config.telemetry?.enabled !== undefined) {
+        out.telemetry = { enabled: config.telemetry.enabled };
+    }
+    if (config.leaderboard?.enabled !== undefined) {
+        out.leaderboard = { enabled: config.leaderboard.enabled };
+    }
+    return out;
+}
+function configToYaml(config, opts) {
     const clis = [];
     const endpoints = [];
     for (const svc of Object.values(config.services)) {
         if (svc.type === "cli")
-            clis.push(cliEntryToYaml(svc));
+            clis.push(cliEntryToYaml(svc, config, opts));
         else
-            endpoints.push(endpointEntryToYaml(svc));
+            endpoints.push(endpointEntryToYaml(svc, config, opts));
     }
-    const doc = {};
+    const doc = { ...topLevelToYaml(config) };
     if (clis.length > 0)
         doc.clis = clis;
     if (endpoints.length > 0)
@@ -133,13 +236,27 @@ function configToYaml(config) {
     return yaml.dump(doc, { noRefs: true, lineWidth: 100 });
 }
 async function cmdConfigure(configPath, explicitConfigPath, opts) {
-    const config = await loadConfig(configPath);
-    const yamlText = configToYaml(config);
+    // configure's --config names where it will WRITE, so a path that does not
+    // exist yet is the normal first-run case, not a typo.
+    const config = await loadConfig(configPath, { allowMissing: true });
     const routeCount = Object.keys(config.services).length;
     if (opts.print) {
-        process.stdout.write(yamlText);
+        // Preview goes to a terminal and, routinely, into a bug report — a
+        // literal key with no ${VAR} to restore is redacted rather than echoed.
+        const preview = configToYaml(config, { redactLiterals: true });
+        process.stdout.write(preview);
+        const redacted = Object.values(config.services).some((svc) => svc.apiKey !== undefined &&
+            svc.apiKey !== "" &&
+            config.envRefs?.get(svc.apiKey) === undefined);
+        if (redacted) {
+            process.stderr.write("note: one or more api_key values are literals in the source config and were " +
+                "replaced with ${ENV_VAR} placeholders in this preview. Move them to " +
+                "environment variables — this output is not a drop-in replacement for that file " +
+                "until you do.\n");
+        }
         return 0;
     }
+    const yamlText = configToYaml(config, { redactLiterals: false });
     process.stdout.write(`Detected ${routeCount} harness route${routeCount === 1 ? "" : "s"}.\n`);
     for (const [name, svc] of Object.entries(config.services)) {
         process.stdout.write(`- ${name}: harness=${svc.harness ?? name} billing=${buildRouteBilling(svc).kind} safety=${effectiveSafetyProfile(svc)} model=${svc.model ?? svc.leaderboardModel ?? "unknown"}\n`);
@@ -165,8 +282,17 @@ async function cmdConfigure(configPath, explicitConfigPath, opts) {
         process.stdout.write("After writing config, connect agents by adding the harness-dispatch MCP snippet to the agent you use.\n");
         return 0;
     }
-    if (existsSync(target) && explicitConfigPath === undefined) {
-        process.stderr.write("configure: config.yaml already exists. Pass --config <path> or --print to avoid overwriting it.\n");
+    // Guard ANY existing file, however the path was supplied.
+    //
+    // This previously read `existsSync(target) && explicitConfigPath === undefined`,
+    // so passing --config skipped the protection entirely — and the message told
+    // you to pass --config, which is exactly what disabled it. Overwriting a
+    // hand-written config is not recoverable, so it now takes an explicit
+    // --force rather than an accident of which flag you happened to use.
+    if (existsSync(target) && !opts.force) {
+        process.stderr.write(`configure: ${target} already exists and would be overwritten.\n` +
+            "Use --print to inspect the generated YAML, --config <other-path> to write\n" +
+            "elsewhere, or --force to overwrite it deliberately.\n");
         return 1;
     }
     await fs.writeFile(target, yamlText, "utf-8");
@@ -220,6 +346,30 @@ async function cmdUsage(configPath, opts) {
     process.stdout.write(opts.json ? `${JSON.stringify(usage, null, 2)}\n` : `${renderUsageText(usage)}\n`);
     return 0;
 }
+/**
+ * Can we actually persist state? Breaker cooldowns, quota counters and job
+ * records all live here, and every write path deliberately swallows its own
+ * failures so a dispatch is never lost to a bookkeeping problem. The cost of
+ * that choice is silence, which is what this check buys back.
+ */
+function stateDirWritable() {
+    const dir = stateRoot();
+    const probe = path.join(dir, `.write-probe-${process.pid}`);
+    try {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        writeFileSync(probe, "", { mode: 0o600 });
+        rmSync(probe, { force: true });
+        return { ok: true, detail: `writable: ${dir}` };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            detail: `NOT writable: ${dir} (${err instanceof Error ? err.message : String(err)}). ` +
+                `Breaker cooldowns and usage counters will not persist, and jobs may be ` +
+                `reported as orphaned after they have actually succeeded.`,
+        };
+    }
+}
 async function cmdDoctor(configPath, opts) {
     const runtime = await buildRuntime(configPath);
     if (opts.allowPaid) {
@@ -228,12 +378,24 @@ async function cmdDoctor(configPath, opts) {
         }
     }
     const status = await buildStatus(runtime.config, runtime.dispatchers, runtime.quota, runtime.router, runtime.leaderboard);
-    const nodeMajor = Number(process.versions.node.split(".")[0] ?? "0");
+    // Must agree with package.json engines (>=22.22.2) and the README. It said
+    // >= 24 while both of those said 22, so a user following the README's own
+    // install block hit `fail node` on the second command — on a runtime where
+    // dispatch works correctly. Three sources, two answers, and the one the
+    // user sees first was the wrong one.
+    const [nodeMajor, nodeMinor, nodePatch] = process.versions.node
+        .split(".")
+        .map((n) => Number(n) || 0);
+    const nodeOk = (nodeMajor ?? 0) > 22 ||
+        ((nodeMajor ?? 0) === 22 &&
+            ((nodeMinor ?? 0) > 22 || ((nodeMinor ?? 0) === 22 && (nodePatch ?? 0) >= 2)));
     const checks = [
         {
             name: "node",
-            ok: nodeMajor >= 24,
-            detail: `Node ${process.versions.node}`,
+            ok: nodeOk,
+            detail: nodeOk
+                ? `Node ${process.versions.node}`
+                : `Node ${process.versions.node} — harness-dispatch needs >=22.22.2`,
         },
         {
             name: "config",
@@ -250,7 +412,23 @@ async function cmdDoctor(configPath, opts) {
         {
             name: "routes",
             ok: status.ready.length > 0,
-            detail: `${status.ready.length} ready route(s)`,
+            // When nothing is ready, say what was looked for. "0 ready route(s)" on
+            // its own leaves a new user with no idea whether the tool is broken or
+            // simply has nothing to route to, and no hint what to install.
+            detail: status.ready.length > 0
+                ? `${status.ready.length} ready route(s)`
+                : `0 ready route(s). Looked for these harness CLIs on PATH: ` +
+                    `${Object.values(AUTO_DETECT_COMMANDS).join(", ")}. ` +
+                    `Install one, or add a route to config.yaml (endpoints: need no CLI).`,
+        },
+        {
+            // Nothing checked this, so an unwritable state directory surfaced only
+            // as jobs mysteriously reported "the dispatch server exited before the
+            // run finished" — a false cause, 90s after the work had actually
+            // succeeded.
+            name: "state-dir",
+            ok: stateDirWritable().ok,
+            detail: stateDirWritable().detail,
         },
         {
             name: "http-auth",
@@ -385,10 +563,26 @@ function parsePositiveInt(value, fallback) {
     const parsed = Number(value);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 }
+/**
+ * Thrown for a flag value the user typed wrong. main() turns it into a plain
+ * one-line message and exit 1 — never a stack trace, which tells a CLI user
+ * nothing they can act on.
+ */
+class UsageError extends Error {
+}
 function serveOpts(values) {
     const out = {};
-    if (values.port !== undefined)
-        out.port = parsePositiveInt(values.port, 0);
+    if (values.port !== undefined) {
+        // `--port abc` used to fall back to 0, which binds a RANDOM free port and
+        // prints it as though it were what was asked for. A typo'd port silently
+        // serving somewhere else is worse than refusing to start.
+        const port = parsePositiveInt(values.port, 0);
+        if (port === 0 || !Number.isInteger(port) || port > 65535) {
+            throw new UsageError(`--port must be an integer between 1 and 65535 (got ${JSON.stringify(values.port)}). ` +
+                `Omit --port to bind a random free one.`);
+        }
+        out.port = port;
+    }
     if (typeof values.host === "string")
         out.host = values.host;
     return out;
@@ -408,17 +602,37 @@ export async function main(argv) {
             host: { type: "string" },
             print: { type: "boolean" },
             yes: { type: "boolean" },
+            force: { type: "boolean" },
             http: { type: "string" },
         },
         allowPositionals: true,
         strict: false,
     });
+    // parseArgs runs with strict:false so positionals and subcommand shapes stay
+    // flexible — the cost is that an unknown flag is silently accepted. `status
+    // --jsonn` printed human text and exited 0, so a cron job piping it to jq
+    // got garbage AND a success code. PRODUCT.md names automation as a user, and
+    // a wrong exit code is the one thing automation cannot recover from.
+    const knownFlags = new Set([
+        "help", "config", "json", "live", "allow-paid", "watch", "interval",
+        "port", "host", "print", "yes", "force", "http",
+    ]);
+    const unknownFlags = Object.keys(values).filter((k) => !knownFlags.has(k));
+    if (unknownFlags.length > 0) {
+        throw new UsageError(`unknown option${unknownFlags.length > 1 ? "s" : ""}: ` +
+            `${unknownFlags.map((f) => `--${f}`).join(", ")}. Run --help for the list.`);
+    }
     if (values.help) {
         printUsage();
         return 0;
     }
     await initObservability();
     const [command, ...rest] = positionals;
+    // `--config` with no value: parseArgs yields boolean true, which reached
+    // path.join and threw ERR_INVALID_ARG_TYPE as a raw Node stack trace.
+    if (values.config !== undefined && typeof values.config !== "string") {
+        throw new UsageError("--config needs a path, e.g. --config ./config.yaml");
+    }
     const explicitConfigPath = values.config;
     // If the caller didn't pass --config, fall back to ./config.yaml when it
     // exists, rather than silently ignoring it and running pure auto-detect.
@@ -445,6 +659,7 @@ export async function main(argv) {
             return cmdConfigure(configPath, explicitConfigPath, {
                 print: Boolean(values.print),
                 yes: Boolean(values.yes),
+                force: Boolean(values.force),
             });
         case "doctor":
             return cmdDoctor(configPath, {
@@ -481,8 +696,23 @@ export async function main(argv) {
 }
 const entrypoint = typeof process !== "undefined" && Array.isArray(process.argv) ? process.argv[1] : "";
 if (entrypoint && (entrypoint.endsWith("bin.ts") || entrypoint.endsWith("bin.js"))) {
-    void main(process.argv.slice(2)).then((code) => {
+    void main(process.argv.slice(2))
+        .then((code) => {
         process.exit(code);
+    })
+        .catch((err) => {
+        // A CLI user gets one actionable line, not a stack trace. Every Error is
+        // flattened to its message — UsageError and config-loading failures
+        // (missing file, bad YAML) are things the user typed and can fix, and
+        // the codebase throws user-facing Errors by convention, so there is no
+        // reliable way to tell "bug" from "bad input" by class here. Only a
+        // non-Error throw (a genuine programming error) keeps its stack.
+        if (err instanceof UsageError || err instanceof Error) {
+            process.stderr.write(`harness-dispatch: ${err.message}
+`);
+            process.exit(1);
+        }
+        throw err;
     });
 }
 //# sourceMappingURL=bin.js.map