harness-dispatch 0.8.0 → 0.10.0

package/dist/redaction.d.ts

@@ -0,0 +1,90 @@
+/**
+ * One place that knows every secret this process holds, and one function that
+ * removes them from anything on its way out.
+ *
+ * WHY THIS EXISTS, because the alternative was tried six times and failed six
+ * times. The same defect — a configured credential reaching a caller, a log
+ * file or an agent's context — was found and "fixed" in six consecutive
+ * rounds. Every fix was correct. Every fix was also incomplete, because each
+ * one scrubbed at a SITE: a specific error path in a specific file. Four of
+ * the six were found as "the fix landed in one branch and the sibling beside
+ * it kept leaking", twice inside a single file. One round shipped a comment
+ * asserting that every branch was covered while a branch was not.
+ *
+ * Sites are the wrong unit. There is no bounded list of places a string can be
+ * built, and a new one is added by ordinary feature work with no reason for
+ * its author to think about credentials. What IS bounded is the set of ways a
+ * string leaves this process: it is serialized to JSON for a tool result or an
+ * HTTP response, appended to the dispatch log, written into a job file, or
+ * printed to the terminal. Those are sinks, there are few of them, and they
+ * change rarely.
+ *
+ * So: scrub at the sinks, and derive the secrets from the loaded config rather
+ * than naming them per call site. A leak then requires someone to add a whole
+ * new egress mechanism, not merely to write a new error message.
+ *
+ * This is deliberately more machinery than the individual fixes it replaces.
+ * It has earned that: it is not guarding against a hypothetical, it is
+ * guarding against six measured, reproduced disclosures, one of which put a
+ * key into a file on disk and another into an orchestrating agent's context.
+ */
+import type { RouterConfig } from "./types.js";
+/** What a removed secret is replaced with. Matches `scrubEndpointSecrets`. */
+export declare const REDACTED = "<redacted>";
+/**
+ * Every secret value reachable from a loaded config.
+ *
+ * Collected from fields that HOLD credentials, and deliberately not from
+ * `envRefs`. Keying off `envRefs` was the obvious shortcut — it records every
+ * `${VAR}` in the file by resolved value — and it was wrong in a way that
+ * mattered: `${VAR}` is documented as legal in any string value, so a config
+ * writing `model: ${MY_MODEL}` or `command: ${CODEX_BIN}` turned a model name
+ * and a file path into process-wide redaction targets. An acceptance pass
+ * measured `model=<redacted>` in `status` output, and a harness answer
+ * mentioning that model would have been mangled the same way, silently.
+ *
+ * That failure is worse than the leak this guards against: a corrupted answer
+ * is wrong work product delivered as if it were right. A `${VAR}` in a
+ * credential field still resolves into `apiKey` before this runs, so nothing
+ * real is lost by dropping the shortcut.
+ */
+export declare function collectSecrets(config: RouterConfig | undefined): string[];
+/** Remove every one of `secrets` from `text`, by value. */
+export declare function scrubSecrets(text: string, secrets: readonly string[]): string;
+/** Record a secret found while parsing, for redaction to pick up. */
+export declare function registerSecretValue(value: string | undefined): void;
+/** Install the secrets for a loaded config. Safe to call on every reload. */
+export declare function setActiveSecrets(config: RouterConfig | undefined): void;
+/** For tests that need to restore a clean slate. */
+export declare function clearActiveSecrets(): void;
+/** How many secrets are currently registered. For diagnostics and tests. */
+export declare function activeSecretCount(): number;
+/**
+ * Remove every registered secret from text that is about to leave the process.
+ *
+ * Call this at SINKS — serialization, disk writes, terminal output — not at
+ * the places strings are built. That distinction is the whole design.
+ */
+export declare function redact(text: string): string;
+/**
+ * Redact everything written to stdout and stderr, for the life of the process.
+ *
+ * The terminal is a sink like any other, and it was the one left unwired when
+ * the JSON and disk sinks were done — measured immediately afterwards, with a
+ * path-embedded credential surviving into `status --json`, `usage` and
+ * `configure --print` while the same value was correctly removed from the MCP
+ * and HTTP payloads. That is the per-site failure this whole design exists to
+ * end, reproduced one more time by doing four sinks out of five.
+ *
+ * Installed once at the entrypoint rather than applied at each print, because
+ * `bin.ts` alone writes to stdout from dozens of places and every future
+ * command adds more. `redact` reads the registry at call time, so installing
+ * before config load is correct: writes made before any secret is known are
+ * unchanged, and everything after is covered with no ordering requirement.
+ *
+ * Non-string chunks pass through untouched — a Buffer write is not text this
+ * process composed, and decoding one to scan it would risk corrupting binary
+ * output for no benefit.
+ */
+export declare function installOutputRedaction(): void;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,eAAe,CAAC;AA4BrC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,MAAM,EAAE,CAiCzE;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAc7E;AA+BD,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAInE;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI,CAGvE;AAED,oDAAoD;AACpD,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAY7C"}

package/dist/redaction.js

@@ -0,0 +1,221 @@
+/**
+ * One place that knows every secret this process holds, and one function that
+ * removes them from anything on its way out.
+ *
+ * WHY THIS EXISTS, because the alternative was tried six times and failed six
+ * times. The same defect — a configured credential reaching a caller, a log
+ * file or an agent's context — was found and "fixed" in six consecutive
+ * rounds. Every fix was correct. Every fix was also incomplete, because each
+ * one scrubbed at a SITE: a specific error path in a specific file. Four of
+ * the six were found as "the fix landed in one branch and the sibling beside
+ * it kept leaking", twice inside a single file. One round shipped a comment
+ * asserting that every branch was covered while a branch was not.
+ *
+ * Sites are the wrong unit. There is no bounded list of places a string can be
+ * built, and a new one is added by ordinary feature work with no reason for
+ * its author to think about credentials. What IS bounded is the set of ways a
+ * string leaves this process: it is serialized to JSON for a tool result or an
+ * HTTP response, appended to the dispatch log, written into a job file, or
+ * printed to the terminal. Those are sinks, there are few of them, and they
+ * change rarely.
+ *
+ * So: scrub at the sinks, and derive the secrets from the loaded config rather
+ * than naming them per call site. A leak then requires someone to add a whole
+ * new egress mechanism, not merely to write a new error message.
+ *
+ * This is deliberately more machinery than the individual fixes it replaces.
+ * It has earned that: it is not guarding against a hypothetical, it is
+ * guarding against six measured, reproduced disclosures, one of which put a
+ * key into a file on disk and another into an orchestrating agent's context.
+ */
+/** What a removed secret is replaced with. Matches `scrubEndpointSecrets`. */
+export const REDACTED = "<redacted>";
+/**
+ * Below this length a "secret" is more likely to be a coincidence than a
+ * credential, and redacting it would corrupt ordinary output.
+ *
+ * A real key is far longer. The risk being traded here is asymmetric and worth
+ * stating: too low a bound mangles legitimate text (a route named `a` would
+ * turn every `a` in an answer into a placeholder), while too high a bound
+ * misses a short key. Eight is below every provider key format in this
+ * project's own config and far above the length at which a value collides with
+ * prose by accident.
+ */
+const MIN_SECRET_LENGTH = 8;
+/**
+ * Query keys whose VALUE is a credential.
+ *
+ * A name test, not a length test. The length heuristic this replaces treated
+ * any URL path segment of 16+ characters as a secret, which made an Azure
+ * deployment name (`.../deployments/gpt-4-turbo-preview`) a redaction target —
+ * measured by an acceptance pass. A credential in the path is a real shape,
+ * but it cannot be told from a deployment name by inspection, and guessing
+ * wrong corrupts output. `warnCredentialInUrlPath` in config.ts says so out
+ * loud instead, which is actionable where a silent guess is not.
+ */
+const CREDENTIAL_QUERY_KEY = /^(api[_-]?key|key|token|access[_-]?token|auth|password|secret|sig|signature)$/i;
+/**
+ * Every secret value reachable from a loaded config.
+ *
+ * Collected from fields that HOLD credentials, and deliberately not from
+ * `envRefs`. Keying off `envRefs` was the obvious shortcut — it records every
+ * `${VAR}` in the file by resolved value — and it was wrong in a way that
+ * mattered: `${VAR}` is documented as legal in any string value, so a config
+ * writing `model: ${MY_MODEL}` or `command: ${CODEX_BIN}` turned a model name
+ * and a file path into process-wide redaction targets. An acceptance pass
+ * measured `model=<redacted>` in `status` output, and a harness answer
+ * mentioning that model would have been mangled the same way, silently.
+ *
+ * That failure is worse than the leak this guards against: a corrupted answer
+ * is wrong work product delivered as if it were right. A `${VAR}` in a
+ * credential field still resolves into `apiKey` before this runs, so nothing
+ * real is lost by dropping the shortcut.
+ */
+export function collectSecrets(config) {
+    const out = new Set();
+    if (!config)
+        return [];
+    const add = (value) => {
+        if (value === undefined)
+            return;
+        const trimmed = value.trim();
+        if (trimmed.length >= MIN_SECRET_LENGTH)
+            out.add(trimmed);
+    };
+    for (const svc of Object.values(config.services ?? {})) {
+        add(svc.apiKey);
+        if (svc.baseUrl === undefined)
+            continue;
+        try {
+            const url = new URL(svc.baseUrl);
+            add(url.password);
+            add(url.username);
+            // Only query values under a credential-looking KEY. Taking every value
+            // meant `?model=gemini-2.5-flash` made that model name a redaction
+            // target — measured. A query string carries ordinary parameters too.
+            for (const [key, value] of url.searchParams.entries()) {
+                if (CREDENTIAL_QUERY_KEY.test(key))
+                    add(value);
+            }
+        }
+        catch {
+            // An unparseable base_url has no parts to take apart. A credential
+            // written into one is still caught if it also appears as an api_key,
+            // which is how it is normally configured.
+        }
+    }
+    // Longest first, so a secret that contains another is removed whole rather
+    // than being left as a recognisable fragment around a placeholder.
+    return [...out].sort((a, b) => b.length - a.length);
+}
+/** Remove every one of `secrets` from `text`, by value. */
+export function scrubSecrets(text, secrets) {
+    let out = text;
+    for (const secret of secrets) {
+        if (out.includes(secret))
+            out = out.split(secret).join(REDACTED);
+        // Redaction runs AFTER JSON.stringify at most sinks, so a secret holding a
+        // character JSON escapes — a quote, or the backslashes in a Windows path —
+        // is no longer present in its raw form and survived. Measured with a key
+        // containing a double quote.
+        const escaped = JSON.stringify(secret).slice(1, -1);
+        if (escaped !== secret && out.includes(escaped)) {
+            out = out.split(escaped).join(REDACTED);
+        }
+    }
+    return out;
+}
+/**
+ * The secrets of the config this process is currently running.
+ *
+ * Process-wide mutable state, which is normally a smell and is the right shape
+ * here: whether a given string is a credential is a property of the process,
+ * not of the call. Threading config into the dispatch log, the JSON
+ * serializers and the job-file writers is exactly the per-site plumbing whose
+ * absence caused six rounds of this bug — every one of those sinks would have
+ * needed a caller to remember to pass it.
+ */
+let activeSecrets = [];
+/**
+ * Secrets seen while PARSING a config, which never become a route field.
+ *
+ * The top-level `api_keys:` block is the case that forced this. Its entries
+ * are applied to routes by name, so an entry whose route also declares an
+ * inline `api_key:` — or that names no route at all — is a live credential
+ * sitting in the config file that `collectSecrets` cannot see from the
+ * finished RouterConfig. A pass measured every entry after the first in that
+ * block leaking, and this is the machine setup this project documents.
+ *
+ * Accumulated rather than replaced on reload, deliberately: continuing to
+ * scrub a credential that has been removed from the config costs one
+ * unnecessary replacement in output that would not have contained it anyway,
+ * whereas forgetting one costs a disclosure.
+ */
+const parsedSecrets = new Set();
+/** Record a secret found while parsing, for redaction to pick up. */
+export function registerSecretValue(value) {
+    if (value === undefined)
+        return;
+    const trimmed = value.trim();
+    if (trimmed.length >= MIN_SECRET_LENGTH)
+        parsedSecrets.add(trimmed);
+}
+/** Install the secrets for a loaded config. Safe to call on every reload. */
+export function setActiveSecrets(config) {
+    const merged = new Set([...collectSecrets(config), ...parsedSecrets]);
+    activeSecrets = [...merged].sort((a, b) => b.length - a.length);
+}
+/** For tests that need to restore a clean slate. */
+export function clearActiveSecrets() {
+    activeSecrets = [];
+    parsedSecrets.clear();
+}
+/** How many secrets are currently registered. For diagnostics and tests. */
+export function activeSecretCount() {
+    return activeSecrets.length;
+}
+/**
+ * Remove every registered secret from text that is about to leave the process.
+ *
+ * Call this at SINKS — serialization, disk writes, terminal output — not at
+ * the places strings are built. That distinction is the whole design.
+ */
+export function redact(text) {
+    if (activeSecrets.length === 0)
+        return text;
+    return scrubSecrets(text, activeSecrets);
+}
+/**
+ * Redact everything written to stdout and stderr, for the life of the process.
+ *
+ * The terminal is a sink like any other, and it was the one left unwired when
+ * the JSON and disk sinks were done — measured immediately afterwards, with a
+ * path-embedded credential surviving into `status --json`, `usage` and
+ * `configure --print` while the same value was correctly removed from the MCP
+ * and HTTP payloads. That is the per-site failure this whole design exists to
+ * end, reproduced one more time by doing four sinks out of five.
+ *
+ * Installed once at the entrypoint rather than applied at each print, because
+ * `bin.ts` alone writes to stdout from dozens of places and every future
+ * command adds more. `redact` reads the registry at call time, so installing
+ * before config load is correct: writes made before any secret is known are
+ * unchanged, and everything after is covered with no ordering requirement.
+ *
+ * Non-string chunks pass through untouched — a Buffer write is not text this
+ * process composed, and decoding one to scan it would risk corrupting binary
+ * output for no benefit.
+ */
+export function installOutputRedaction() {
+    for (const stream of [process.stdout, process.stderr]) {
+        const original = stream.write.bind(stream);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        stream.write = ((chunk, ...rest) => {
+            if (typeof chunk === "string" && activeSecrets.length > 0) {
+                return original(redact(chunk), ...rest);
+            }
+            return original(chunk, ...rest);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        });
+    }
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,oBAAoB,GAAG,gFAAgF,CAAC;AAE9G;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAQ,EAAE;QAC9C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,iBAAiB;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtD,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,qEAAqE;YACrE,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,mEAAmE;IACnE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAA0B;IACnE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,6BAA6B;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,IAAI,aAAa,GAAsB,EAAE,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,iBAAiB;QAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IACtE,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,kBAAkB;IAChC,aAAa,GAAG,EAAE,CAAC;IACnB,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,aAAa,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB;IACpC,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,8DAA8D;QAC9D,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAU,EAAE,GAAG,IAAW,EAAW,EAAE;YACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAI,IAAW,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAI,IAAW,CAAC,CAAC;YACxC,8DAA8D;QAChE,CAAC,CAAQ,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/route-policy.d.ts

@@ -1,5 +1,5 @@
 import type { Dispatcher } from "./dispatchers/base.js";
-import type { RouteBilling, RoutePolicy, RouteSkip, SafetyProfile, ServiceConfig } from "./types.js";
+import type { RouteBilling, RoutePolicy, RouteSkip, SafetyProfile, ServiceConfig, TaskType } from "./types.js";
 export interface RoutePolicyResult {
     blocked: boolean;
     skipped?: RouteSkip;
@@ -9,6 +9,7 @@ export declare function evaluateRoutePolicy(route: string, svc: ServiceConfig, o
     circuitBroken?: boolean;
     requestedSafetyProfile?: SafetyProfile;
     routePolicy?: RoutePolicy;
+    taskType?: TaskType;
 }): RoutePolicyResult;
 /**
  * Scoring penalty applied to nudge route selection toward cheaper options

package/dist/route-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-policy.d.ts","sourceRoot":"","sources":["../src/route-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,EAClB,IAAI,GAAE;IACJ,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sBAAsB,CAAC,EAAE,aAAa,CAAC;IACvC,WAAW,CAAC,EAAE,WAAW,CAAC;CACtB,GACL,iBAAiB,CAwEnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAI1E;AAwCD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAO3D"}
+{"version":3,"file":"route-policy.d.ts","sourceRoot":"","sources":["../src/route-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,EACb,QAAQ,EACT,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,EAClB,IAAI,GAAE;IACJ,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sBAAsB,CAAC,EAAE,aAAa,CAAC;IACvC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAChB,GACL,iBAAiB,CA2InB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAI1E;AAwCD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAO3D"}

package/dist/route-policy.js

@@ -26,6 +26,22 @@ export function evaluateRoutePolicy(route, svc, opts = {}) {
         // about a route `status` prints as `billing=metered_api` — the kind is
         // known perfectly well; what is unknown is how sure we are of it. An
         // acceptance pass caught the two surfaces contradicting each other.
+        // A KNOWN kind that has declared it cannot bill you gets the remedy that
+        // works, and it has to be given HERE.
+        //
+        // The same advice was added to the `billingIsBlocked` branch below and was
+        // unreachable for any non-included kind, because this branch catches those
+        // first — so a `metered_api` route with `paid_usage_possible: false` was
+        // still told to add `allow_paid_usage: true`, which is "yes, bill me" for
+        // a route the operator has said cannot. The fix that was supposed to stop
+        // that was one branch too late.
+        if (billing.kind !== "unknown" && !billing.paidUsagePossible) {
+            return skip(route, "unknown_billing", `billing_confidence is \`unknown\` for '${route}', which blocks it even though its ` +
+                `billing kind (${billing.kind}) is declared and \`paid_usage_possible\` is false. ` +
+                `That is what \`billing_confidence: unknown\` means — "do not trust this ` +
+                `classification". Set it to the value you actually believe (\`documented\` or ` +
+                `\`inferred\`); do NOT allow paid usage on a route you have said cannot bill you.`);
+        }
         const why = billing.kind === "unknown"
             ? "billing source is unknown"
             : `billing is recorded as ${billing.kind} but its confidence is unknown`;
@@ -34,6 +50,25 @@ export function evaluateRoutePolicy(route, svc, opts = {}) {
             `to '${route}' in config.yaml to enable it`);
     }
     if (billingIsBlocked(billing)) {
+        // THREE conditions reach `billingIsBlocked`, and the message below fitted
+        // only two of them.
+        //
+        // A route with `paid_usage_possible: false` and a KNOWN kind is blocked
+        // solely because its `billing_confidence` is `unknown` — a deliberate
+        // operator signal meaning "I do not trust this classification", kept on
+        // purpose. But it was told "route can incur paid usage" (contradicting
+        // `paid=no` on the same screen) and handed `paid_usage_possible: false` as
+        // the remedy, which it already had. An acceptance pass measured the
+        // recommended fix producing byte-identical output: the only working escape
+        // was `allow_paid_usage: true` — "yes, bill me" — for a free local model.
+        if (billing.kind !== "unknown" && !billing.paidUsagePossible) {
+            return skip(route, "paid_blocked", `billing_confidence is \`unknown\` for '${route}', which blocks it even though ` +
+                `its billing kind (${billing.kind}) is declared and \`paid_usage_possible\` is ` +
+                `false. That is what \`billing_confidence: unknown\` means — "do not trust this ` +
+                `classification" — so the fix is to set it to the value you actually believe ` +
+                `(\`documented\` or \`inferred\`), NOT to allow paid usage on a route you have ` +
+                `said cannot bill you.`);
+        }
         return skip(route, "paid_blocked", 
         // Two different fixes, and recommending only the permissive one is a
         // steer in the wrong direction. If the route genuinely CANNOT cost money
@@ -48,6 +83,25 @@ export function evaluateRoutePolicy(route, svc, opts = {}) {
             `route already covered by a subscription — the correct fix is ` +
             `\`paid_usage_possible: false\` instead.`);
     }
+    // An HTTP endpoint cannot execute, structurally: no agent loop, no file
+    // access, no shell. PRODUCT.md states this as design rather than gap — and
+    // routing still sent `execute` work to one, because an undeclared capability
+    // defaults to 1.0 and NO endpoint example in config.default.yaml declares
+    // any. An acceptance pass measured a `--task-type execute` dispatch routed to
+    // an endpoint returning prose and exit 0: execution reported as succeeded
+    // when none happened. It surfaces exactly when the CLI routes are busy or
+    // tripped — the degraded case the caller is least able to check.
+    //
+    // A REFUSAL rather than a capability score, for two reasons. A score of 0
+    // still leaves the route selectable when it is the only candidate, which is
+    // the failing case itself. And declared capabilities must not be able to
+    // override it: this is the same rule as the safety-flag check below — a
+    // declaration cannot conjure an ability the route does not have.
+    if (opts.taskType === "execute" && svc.type === "openai_compatible") {
+        return skip(route, "cannot_execute", "this is an HTTP model endpoint — it has no agent loop, no file access and no shell, " +
+            "so it cannot carry out an `execute` task. Endpoint routes serve plan, review and " +
+            "second opinions. Use a CLI route for execution, or send this as taskType: plan/review.");
+    }
     if (!safetyProfileCompatible(svc, opts.requestedSafetyProfile)) {
         return skip(route, "safety_incompatible", `effective safety ${effectiveSafetyProfile(svc, opts.requestedSafetyProfile)} exceeds requested safety`);
     }

package/dist/route-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-policy.js","sourceRoot":"","sources":["../src/route-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAc9E,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,GAAkB,EAClB,OAKI,EAAE;IAEN,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,4CAA4C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACrF,IAAI,WAAW,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC;IAE5C,IACE,gBAAgB,CAAC,OAAO,CAAC;QACzB,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAChC,CAAC,OAAO,CAAC,cAAc,EACvB,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,GAAG,GACP,OAAO,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,0BAA0B,OAAO,CAAC,IAAI,gCAAgC,CAAC;QAC7E,OAAO,IAAI,CACT,KAAK,EACL,iBAAiB,EACjB,GAAG,GAAG,0DAA0D;YAC9D,uFAAuF;YACvF,OAAO,KAAK,+BAA+B,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CACT,KAAK,EACL,cAAc;QACd,qEAAqE;QACrE,yEAAyE;QACzE,+DAA+D;QAC/D,0EAA0E;QAC1E,yEAAyE;QACzE,2DAA2D;QAC3D,oFAAoF;YAClF,2CAA2C,KAAK,6BAA6B;YAC7E,0DAA0D;YAC1D,qFAAqF;YACrF,+DAA+D;YAC/D,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CACT,KAAK,EACL,qBAAqB,EACrB,oBAAoB,sBAAsB,CACxC,GAAG,EACH,IAAI,CAAC,sBAAsB,CAC5B,2BAA2B,CAC7B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAqB;IAChE,IAAI,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,sBAAsB,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAa,EACb,OAAqB,EACrB,WAAoC;IAEpC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,CACT,KAAK,EACL,cAAc,EACd,qFAAqF;YACnF,iFAAiF;YACjF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CACT,KAAK,EACL,cAAc,EACd,8EAA8E;YAC5E,iFAAiF;YACjF,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,mBAAmB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CACT,KAAK,EACL,mBAAmB,EACnB,qFAAqF;YACnF,iFAAiF;YACjF,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAqB;IAChD,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,eAAe;QAChC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,OAAO,CAAC,OAAO,KAAK,gBAAgB;QACpC,OAAO,CAAC,UAAU,KAAK,eAAe,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAqB;IACnD,OAAO,CACL,YAAY,CAAC,OAAO,CAAC;QACrB,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,OAAO,CAAC,IAAI,KAAK,qBAAqB;QACtC,OAAO,CAAC,IAAI,KAAK,qCAAqC;QACtD,OAAO,CAAC,IAAI,KAAK,uCAAuC;QACxD,OAAO,CAAC,IAAI,KAAK,+BAA+B,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB,EAAE,OAAe;IACnE,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;KAClC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"route-policy.js","sourceRoot":"","sources":["../src/route-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAe9E,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,GAAkB,EAClB,OAMI,EAAE;IAEN,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,4CAA4C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACrF,IAAI,WAAW,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC;IAE5C,IACE,gBAAgB,CAAC,OAAO,CAAC;QACzB,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAChC,CAAC,OAAO,CAAC,cAAc,EACvB,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,yEAAyE;QACzE,sCAAsC;QACtC,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,gCAAgC;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC7D,OAAO,IAAI,CACT,KAAK,EACL,iBAAiB,EACjB,0CAA0C,KAAK,qCAAqC;gBAClF,iBAAiB,OAAO,CAAC,IAAI,sDAAsD;gBACnF,0EAA0E;gBAC1E,+EAA+E;gBAC/E,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GACP,OAAO,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,0BAA0B,OAAO,CAAC,IAAI,gCAAgC,CAAC;QAC7E,OAAO,IAAI,CACT,KAAK,EACL,iBAAiB,EACjB,GAAG,GAAG,0DAA0D;YAC9D,uFAAuF;YACvF,OAAO,KAAK,+BAA+B,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,oBAAoB;QACpB,EAAE;QACF,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC7D,OAAO,IAAI,CACT,KAAK,EACL,cAAc,EACd,0CAA0C,KAAK,iCAAiC;gBAC9E,qBAAqB,OAAO,CAAC,IAAI,+CAA+C;gBAChF,iFAAiF;gBACjF,8EAA8E;gBAC9E,gFAAgF;gBAChF,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CACT,KAAK,EACL,cAAc;QACd,qEAAqE;QACrE,yEAAyE;QACzE,+DAA+D;QAC/D,0EAA0E;QAC1E,yEAAyE;QACzE,2DAA2D;QAC3D,oFAAoF;YAClF,2CAA2C,KAAK,6BAA6B;YAC7E,0DAA0D;YAC1D,qFAAqF;YACrF,+DAA+D;YAC/D,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,EAAE;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACpE,OAAO,IAAI,CACT,KAAK,EACL,gBAAgB,EAChB,sFAAsF;YACpF,mFAAmF;YACnF,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CACT,KAAK,EACL,qBAAqB,EACrB,oBAAoB,sBAAsB,CACxC,GAAG,EACH,IAAI,CAAC,sBAAsB,CAC5B,2BAA2B,CAC7B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAqB;IAChE,IAAI,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,sBAAsB,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAa,EACb,OAAqB,EACrB,WAAoC;IAEpC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,CACT,KAAK,EACL,cAAc,EACd,qFAAqF;YACnF,iFAAiF;YACjF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CACT,KAAK,EACL,cAAc,EACd,8EAA8E;YAC5E,iFAAiF;YACjF,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,mBAAmB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CACT,KAAK,EACL,mBAAmB,EACnB,qFAAqF;YACnF,iFAAiF;YACjF,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAqB;IAChD,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,eAAe;QAChC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,OAAO,CAAC,OAAO,KAAK,gBAAgB;QACpC,OAAO,CAAC,UAAU,KAAK,eAAe,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAqB;IACnD,OAAO,CACL,YAAY,CAAC,OAAO,CAAC;QACrB,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,OAAO,CAAC,IAAI,KAAK,qBAAqB;QACtC,OAAO,CAAC,IAAI,KAAK,qCAAqC;QACtD,OAAO,CAAC,IAAI,KAAK,uCAAuC;QACxD,OAAO,CAAC,IAAI,KAAK,+BAA+B,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAuB,EAAE,OAAe;IACnE,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;KAClC,CAAC;AACJ,CAAC"}

package/dist/router.d.ts

@@ -55,8 +55,18 @@
  * Explicit `tier` in config is the fallback when ELO is unavailable.
  *
  * R3: adds `stream()` / `streamTo()` that emit `DispatcherEvent`s with an
- * attached `RoutingDecision`. The buffered `route` / `routeTo` methods are
- * reimplemented on top of the streaming primitives.
+ * attached `RoutingDecision`.
+ *
+ * There is ONE selection-and-fallback loop per shape — `#runStream` for the
+ * routed path, `#runStreamTo` for an explicit route — and the buffered
+ * `route()` / `routeTo()` drain them. This paragraph used to claim exactly
+ * that while it was false: the buffered methods were separate 120-line
+ * implementations, and the copies drifted. The timeout rule ended up written
+ * four times, and an audit mutation showed a test pinned only the `route()`
+ * copy, leaving the pair that jobs and the HTTP server actually use unguarded.
+ *
+ * What still differs between buffered and streaming is the dispatcher call
+ * itself, and only that: see `DispatcherInvoke`.
  */
 import type { DispatchResult, DispatcherEvent, RouterConfig, RoutingDecision, RouteHints, RouteSkip, SafetyProfile, ServiceConfig, TaskType } from "./types.js";
 import { CircuitBreaker } from "./circuit-breaker.js";
@@ -120,27 +130,6 @@ export interface ExplicitDispatchOpts {
      */
     defaultTimeoutMs?: number;
 }
-/**
- * Every hint that means something to an explicitly-chosen route, in one place.
- *
- * The HTTP fanout path built these options by naming three fields inline and
- * missed two: `routePolicy` never reached `routeTo`, so
- * `{"mode":"fanout","hints":{"routePolicy":"blocked"}}` — documented as
- * "dry-run: block everything" — returned 200 having run a live agent in the
- * caller's working tree, and `local_only` let a metered route run. `timeoutMs`
- * was dropped the same way, so the bound the release notes describe never
- * reached the child in fanout mode. Single mode enforced both correctly, so
- * one surface disagreed with itself.
- *
- * Picking fields by name is what allowed that: nothing fails when a new hint
- * is added and a call site is not updated. Adding one here reaches every
- * caller, and `ExplicitDispatchOpts` is the compiler's list of what belongs.
- *
- * `model` is deliberately absent — fanout selects routes with `models`, and
- * each arm runs its own. `preferLargeContext` and `service` only steer which
- * route is PICKED, which an explicit route has already decided.
- */
-export declare function explicitOptsFromHints(hints: RouteHints): ExplicitDispatchOpts;
 /**
  * Does this route actually DECLARE this model? The route's own name does not
  * count.

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,SAAS,EACT,aAAa,EACb,aAAa,EACb,QAAQ,EACT,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAA+B,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAsB9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO;IAClB,kEAAkE;;IAElE,uEAAuE;;IAEvE,uEAAuE;;;;IAIvE,6DAA6D;;CAErD,CAAC;AAYX;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,eAAe,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACnD,WAAW,CAAC,EAAE,OAAO,YAAY,EAAE,WAAW,CAAC;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAQ7E;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOpF;AAyLD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC;AAYD,qBAAa,MAAM;;IAMf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAR9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,iBAAiB,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAGzB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,WAAW,EAAE,gBAAgB,EAC9C,YAAY,CAAC,EAAE,YAAY;IAe7B,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIvD,aAAa,IAAI,SAAS,EAAE;IAI5B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAuBtB,WAAW,CAAC,IAAI,GAAE;QACtB,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAClB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA6SxC;;;;;;;;OAQG;IACH,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACxG,aAAa,CAAC,iBAAiB,CAAC;IAkHnC;;;OAGG;IACH,QAAQ,CACN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,oBAAyB,GAC9B,aAAa,CAAC,iBAAiB,CAAC;IAuInC;;;;;;;;;;;OAWG;IACG,KAAK,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAC7E,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,CAAC;IAyIxE;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,CAAC;IA0GxE,OAAO,CAAC,YAAY;IAsDpB;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAO5E;;;;;OAKG;IACH,sBAAsB,IAAI,MAAM,EAAE;IAIlC;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,wBAAwB;CAYjC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,SAAS,EACT,aAAa,EACb,aAAa,EACb,QAAQ,EACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAA+B,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAsB9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO;IAClB,kEAAkE;;IAElE,uEAAuE;;IAEvE,uEAAuE;;;;IAIvE,6DAA6D;;CAErD,CAAC;AAYX;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,eAAe,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACnD,WAAW,CAAC,EAAE,OAAO,YAAY,EAAE,WAAW,CAAC;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOpF;AA4MD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC;AAYD,qBAAa,MAAM;;IAMf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAR9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,iBAAiB,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAGzB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,WAAW,EAAE,gBAAgB,EAC9C,YAAY,CAAC,EAAE,YAAY;IAe7B,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIvD,aAAa,IAAI,SAAS,EAAE;IAI5B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAuBtB,WAAW,CAAC,IAAI,GAAE;QACtB,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAClB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA+SxC;;;;;;;;OAQG;IACH,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACxG,aAAa,CAAC,iBAAiB,CAAC;IAyHnC;;;OAGG;IACH,QAAQ,CACN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,oBAAyB,GAC9B,aAAa,CAAC,iBAAiB,CAAC;IAyInC;;;;;;;;;;;OAWG;IACG,KAAK,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAC7E,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,CAAC;IA0DxE;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,CAAC;IA0BxE,OAAO,CAAC,YAAY;IAsDpB;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAO5E;;;;;OAKG;IACH,sBAAsB,IAAI,MAAM,EAAE;IAIlC;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,wBAAwB;CAYjC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}