kuzushi 0.12.0 → 0.17.0

package/README.md

@@ -24,18 +24,18 @@ kuzushi
 Just type `kuzushi`. The interactive copilot shell starts with your loaded modules, available tools, and any active workspace. Talk naturally or use structured commands.
 
 ```
-kuzushi shell                            # default — just `kuzushi` works
-kuzushi shell --workspace acme-pentest   # resume an engagement
-kuzushi shell --target ./repo            # set initial target
-kuzushi shell --load blackbox,honeypot   # pre-load specific modules
+kuzushi shell                                  # default — just `kuzushi` works
+kuzushi shell --workspace acme-pentest         # resume an engagement
+kuzushi shell --target ./repo                  # set initial target
+kuzushi shell --load randori,vuln-scout,tob    # pre-load specific built-in modules
 ```
 
 ```
-┌─────────────────────────────────────────────────────────────┐
+╭─────────────────────────────────────────────────────────────╮
 │  kuzushi shell                      workspace: acme-api     │
-│  modules: sast, randori, blackbox, honeypot, shinsa         │
+│  modules: sast, randori, vuln-scout, tob, variant-hunter    │
 │  target: ./acme-api  (Node.js + Express + PostgreSQL)       │
-└─────────────────────────────────────────────────────────────┘
+╰─────────────────────────────────────────────────────────────╯
 
 kuzushi> modules
 kuzushi> use sast
@@ -93,26 +93,94 @@ kuzushi scan /path/to/repo --model google:gemini-2.0-flash
 
 Kuzushi auto-downloads Opengrep if you don't have a scanner installed. Zero dependencies to manage.
 
+## Quick Start (Contributors)
+
+Two commands, deterministic, loud on failure:
+
+```sh
+git clone https://github.com/allsmog/Kuzushi.git
+cd Kuzushi
+pnpm setup      # verifies Node 22+, pins pnpm via corepack, checks externals, pnpm install
+pnpm doctor     # optional: re-verify the environment at any time
+```
+
+Then:
+
+```sh
+pnpm dev --help       # run the CLI from source via tsx
+pnpm test             # unit tests (vitest)
+pnpm check:types      # typecheck src + benchmarks + perf (in parallel)
+pnpm build            # incremental compile to dist/ — incremental, fast
+pnpm build:clean      # wipe dist/ and rebuild from scratch (used by `pnpm prepack`)
+```
+
+Optional benchmark corpuses (clones 3rd-party vulnerable apps on demand):
+
+```sh
+pnpm setup:benchmarks list          # list available corpuses
+pnpm setup:benchmarks govwa         # clone one
+pnpm setup:benchmarks all           # clone everything
+```
+
+Prefer a containerised environment? Open the repo in VS Code / Codespaces and
+"Reopen in Container" — the `.devcontainer/devcontainer.json` runs
+`pnpm setup --strict` automatically and installs semgrep + python for you.
+
 ## Module System
 
-Kuzushi's capabilities come from pluggable modules. Each module exposes tools (for shell and run modes) and optionally pipeline tasks (for scan mode DAG execution).
-
-| Module | Category | What It Does |
-|--------|----------|-------------|
-| **sast** (built-in) | offense | 40+ task SAST pipeline: Semgrep, CodeQL, agentic detectors, AI triage, verification, PoC, patch |
-| **randori** | intel | 7-stage PASTA threat modeling with ATT&CK/CAPEC/NVD intel, attack trees, probabilistic risk |
-| **vuln-scout** | offense | Whitebox SAST with 15 Joern CPG verification scripts, 8 autonomous agents |
-| **augur** | offense | Neuro-symbolic SAST (IRIS/ICLR 2025 LLM-driven CodeQL taint analysis) |
-| **blackbox** | offense | Black/grey-box pentesting: nmap, gobuster, nikto, hydra, privilege escalation |
-| **pwn** | offense | Binary exploitation: checksec, GDB, ROP chains, heap exploitation, SROP |
-| **pentest** | offense | MCP server wrapping metasploit, nmap, hydra, john |
-| **honeypot** | defense | Autonomous honeypot orchestration: 14 service types, 6 honeytokens, Falco |
-| **yokai** | defense | Supply chain tripwires: dependency confusion, typosquatting, registry canaries |
-| **prompt-armor** | offense | LLM red teaming: 80+ attack plugins, 25+ mutation strategies |
-| **shinsa** | governance | Multi-framework compliance: ISO 27001, NIST 800-53, SOC 2, PCI DSS |
-| **revgraph** | intel | Binary reverse engineering: Ghidra + Neo4j, NL2Cypher, function embeddings |
-
-Modules are loaded via the shell (`use <module>`) or at startup (`--load blackbox,honeypot`).
+Kuzushi's capabilities come from `CopilotModule`s that expose tools (for shell and run modes) and optionally pipeline tasks (for scan mode DAG execution), plus a set of Claude Code plugins that are wrapped by built-in modules. Three buckets:
+
+### Built-in `CopilotModule`s (always available)
+
+| Module | Category | What It Does | Key Tools |
+|--------|----------|--------------|-----------|
+| **sast** | offense | 40+ task SAST pipeline: Semgrep, CodeQL, agentic detectors, AI triage, verification, PoC, patch | `sast:scan`, `sast:semgrep`, `sast:codeql`, `sast:triage`, `sast:verify`, `sast:patch`, `sast:findings`, `sast:context`, `sast:threat-hunt`, `sast:taint-iris` |
+| **randori** | intel | PASTA threat modeling via the `@kuzushi/randori-plugin` — S1–S4 stages plus narrative synthesis, returning a `ThreatModelDocument` | `randori:pasta`, `randori:threat-model` |
+| **vuln-scout** | offense | Whitebox pentest via the `@kuzushi/vuln-scout` plugin — agentic SAST + taint analysis returning normalized Findings | `vuln-scout:audit` |
+| **tob** | offense | Trail of Bits skills audit via `@kuzushi/tob-skills` — fp-check, sharp-edges, insecure-defaults, static-analysis, variant-analysis, and more | `tob:audit`, `tob:skills` |
+| **shinsa** | governance | ISO 27001 Annex A + NIST SP 800-53 Rev 5 compliance assessment via `shinsa-plugin` — evidence-backed controls mapped to file:line citations | `shinsa:scan`, `shinsa:quick-check`, `shinsa:nist-scan`, `shinsa:nist-quick-check`, `shinsa:frameworks` |
+| **prompt-armor** | offense | LLM red teaming via `promptarmor-plugin` — 80+ attack plugins, 25+ mutation strategies, code-aware remediation (network commands require `authorized: true`) | `prompt-armor:scan`, `prompt-armor:analyze`, `prompt-armor:attack`, `prompt-armor:diff`, `prompt-armor:report`, `prompt-armor:config` |
+| **variant-hunter** | offense | Lifts confirmed findings into portable signatures and hunts for variants across the repo (including vendored deps) | `variant:lift-pattern`, `variant:hunt` |
+| **n-day-diff-hunter** | offense | CVE-diff-based n-day hunting and variant search against a target | `ndiff:fetch-cve`, `ndiff:search-patch-shape`, `ndiff:hunt-variants` |
+
+Load with the shell or at startup: `kuzushi shell --load randori,vuln-scout,tob,shinsa,prompt-armor,variant-hunter,n-day-diff-hunter` (the bare id works — `builtin:` prefix is optional).
+
+### External `CopilotModule` packages
+
+| Package | Module ID | Usage |
+|---------|-----------|-------|
+| `@kuzushi/augur` | `augur` | Neuro-symbolic SAST (IRIS/ICLR 2025 LLM-driven CodeQL taint analysis). Load with `--load package:@kuzushi/augur`. |
+
+### Referenced Claude Code plugins
+
+These are dependencies consumed by the built-in wrappers above, not directly loadable as `CopilotModule`s. Attempting `--load package:@kuzushi/randori-plugin` (etc.) prints a pointer to the corresponding built-in module.
+
+| Package | Wrapped by | Notes |
+|---------|------------|-------|
+| `@kuzushi/randori-plugin` | built-in `randori` | PASTA threat-modeling plugin (commands, agents, skills, hooks). |
+| `@kuzushi/vuln-scout` | built-in `vuln-scout` | Whitebox pentest skill pack under `whitebox-pentest/`. |
+| `@kuzushi/tob-skills` | built-in `tob` | Fork of trailofbits/skills — security-relevant plugins under `plugins/`. |
+| `shinsa-plugin` | built-in `shinsa` | ISO 27001 + NIST 800-53 compliance assessment (4 commands, 10 assessor agents). |
+| `promptarmor-plugin` | built-in `prompt-armor` | LLM red teaming (6 commands + MCP server under `server/`). |
+
+### Roadmap (not yet shipped)
+
+`blackbox`, `pwn`, `pentest`, `honeypot`, `yokai`, `revgraph` — referenced in the long-term vision but not currently implemented as loadable modules. See [VISION.md](VISION.md) for direction.
+
+### Authoring your own module
+
+```sh
+kuzushi create-module my-module --template offense   # scaffolds manifest + starter tool + vitest
+```
+
+The scaffolder emits `module.manifest.json`, a TypeScript starter tool, and a vitest skeleton. Import types and test helpers from the SDK subpaths:
+
+```ts
+import type { CopilotModule, ModuleTool, ToolResult } from "kuzushi/modules"
+import { createMockToolContext, createMockBus, noopRuntime } from "kuzushi/testing"
+```
+
+Load a local build with `--load file:///abs/path/to/my-module`, or a published package with `--load package:@scope/name`. MCP servers can be bridged with `--load mcp:<spec>` (stdio or HTTP Streamable). See [CLAUDE.md](CLAUDE.md) for the full module authoring guide.
 
 ## The SAST Pipeline
 
@@ -159,7 +227,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npx kuzushi scan . --sarif results.sarif --quality-gate --fail-on-tp
+      - run: npx kuzushi scan . --sarif results.sarif --junit results.xml --quality-gate --fail-on-tp
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
       - uses: github/codeql-action/upload-sarif@v3
@@ -168,6 +236,8 @@ jobs:
           sarif_file: results.sarif
 ```
 
+Exit codes: `0` clean, `1` findings (or task failures), `2` usage/config/auth, `3` unexpected crash. See `.github/workflows/kuzushi-reference.yml` for a reference workflow with SARIF upload, JUnit publish, and PR sticky comment.
+
 ### Quality Gates
 
 ```sh
@@ -207,7 +277,7 @@ kuzushi scan <repo> --preset glasswing   # + PoC + threat-informed hunting + fro
 
 **Resumable runs** — checkpoints to SQLite. `--resume` picks up where you left off.
 
-**Interactive terminal UI** — React+Ink-powered live display with pipeline progress tree, spinners, trophy screen for confirmed exploits. REPL during scans (pause, skip, inspect). First-run setup wizard. Falls back to plain text in non-TTY.
+**Interactive terminal UI** — React+Ink-powered live display with pipeline progress tree, spinners, trophy screen for confirmed exploits. REPL during scans (pause, skip, inspect). First-run setup wizard. Falls back to plain text in non-TTY. Built on a unified primitive library (`src/ui/primitives/`: `SelectList`, `TextInput`, `ConfirmDialog`, `Table`, `Breadcrumb`, `KeybindFooter`, `ExpandableSection`, `Divider`, `MultilineText`) with shared hooks (`src/ui/hooks/`: `useBoundedIndex`, `useFocusTrap`, `useTerminalSize`, `useCursorVisibility`, `useExpanded`, `useKeybindings`) for consistent focus, keyboard navigation, and resize handling.
 
 **Incremental scanning** — skips re-triage for unchanged findings. Dependency-aware invalidation via import graph.
 
@@ -267,10 +337,20 @@ kuzushi scan <repo> --output report.md
 kuzushi scan <repo> --sarif results.sarif
 kuzushi scan <repo> --json results.json
 kuzushi scan <repo> --csv results.csv
+kuzushi scan <repo> --junit results.xml
 kuzushi scan <repo> --stream
 kuzushi scan <repo> --audit-log
 ```
 
+### Run History
+
+```
+kuzushi runs list                          # 50 most recent runs
+kuzushi runs list --status interrupted     # only resumable runs
+kuzushi runs show <runId> --costs          # details + cost breakdown
+kuzushi runs show <runId> --json           # JSON output for tooling
+```
+
 ### Run Mode
 
 ```
@@ -367,6 +447,25 @@ kuzushi config set tasks semgrep,codeql
 
 See [VISION.md](VISION.md) for the full architecture vision, module system design, workspace/knowledge graph, intel layer, governance model, and implementation roadmap.
 
+### Terminal UI layer
+
+The Ink React frontend lives in `src/ui/`:
+
+| Path | Role |
+| --- | --- |
+| `src/ui/App.tsx` | Root Ink component; dispatches on `UIState.mode` (`preflight`, `running`, `summary`, `review`, `done`, `shell`). |
+| `src/ui/state.ts` | `UIStore` — observer-pattern state + `useSyncExternalStore` binding. |
+| `src/ui/render.ts` | Entry point; TTY detection and Ink mount / plain fallback. |
+| `src/ui/plain-renderer.ts` | Non-TTY subscriber that prints delta-based updates. |
+| `src/ui/tokens.ts` | Semantic color/typography tokens + `SPACING` / `COLUMN_WIDTHS` constants. |
+| `src/ui/format.ts` | Terminal formatting utilities — progress bars, cost/duration, column padding, ANSI-aware truncation (`truncateEnd`, `truncateMiddle`, `padCell`, `visibleWidth`). |
+| `src/ui/error-format.ts` | Ink-free error classification (`classifyError`, `formatError`, `suggestNextStep`) consumed by `ErrorCard`. |
+| `src/ui/primitives/` | Reusable building blocks: `SelectList`, `TextInput`, `ConfirmDialog`, `Table`, `Breadcrumb`, `KeybindFooter`, `ExpandableSection`, `Divider`, `MultilineText`. |
+| `src/ui/hooks/` | Behavioral hooks: `useBoundedIndex`, `useFocusTrap`, `useTerminalSize` (SIGWINCH-aware), `useCursorVisibility`, `useExpanded`, `useKeybindings`. |
+| `src/ui/components/` | Feature components (pipeline, findings, setup wizard, copilot shell) composed from the primitives above. |
+
+Styling discipline: components import from `tokens` (never `chalk` directly) and lay out with Ink `<Box>` flexbox properties (`flexDirection`, `justifyContent`, `gap`, `padding`, `margin`) rather than string-padding tricks.
+
 ## License
 
 MIT

package/dist/agent-runtime/batch-files.js

@@ -1,4 +1,4 @@
-import { mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 /** Sanitize a path component to prevent traversal (strip slashes, .., etc.) */
 function sanitizeComponent(value) {

package/dist/agent-runtime/batch-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"batch-files.js","sourceRoot":"","sources":["../../src/agent-runtime/batch-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,IAAa;IAEb,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3F,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAa;IAC/D,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"batch-files.js","sourceRoot":"","sources":["../../src/agent-runtime/batch-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,IAAa;IAEb,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3F,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAa;IAC/D,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/agent-runtime/claude.d.ts

@@ -1,7 +1,13 @@
-import type { AgentRuntimeConfig } from "../types.js";
 import type { MessageBus } from "../bus/types.js";
-import type { AgentBatchRequest, AgentMessage, AgentQueryOptions, AgentQueryRequest, AgentRuntime, AgentSession } from "./types.js";
+import type { AgentRuntimeConfig } from "../types.js";
 import type { AgentQueryExecutionResult } from "./execution.js";
+import type { AgentBatchRequest, AgentMessage, AgentQueryOptions, AgentQueryRequest, AgentRuntime, AgentSession } from "./types.js";
+/** Exported for tests only — observes internal semaphore state. */
+export declare function __getSemaphoreState(): {
+    active: number;
+    leaked: number;
+    waiting: number;
+};
 export declare class ClaudeAgentRuntime implements AgentRuntime {
     readonly id = "claude";
     private readonly config;

package/dist/agent-runtime/claude.js

@@ -1,7 +1,7 @@
-import Anthropic from "@anthropic-ai/sdk";
 import { query as claudeQuery, } from "@anthropic-ai/claude-agent-sdk";
-import { normalizeCostUsd, toErrorMessage } from "../utils.js";
+import Anthropic from "@anthropic-ai/sdk";
 import { getLogger } from "../logger.js";
+import { normalizeCostUsd, toErrorMessage } from "../utils.js";
 const log = getLogger("claude-runtime");
 // Prevent EPIPE from crashing the process when Claude SDK subprocesses die.
 // Multiple concurrent query() calls each spawn a Claude Code subprocess;
@@ -27,22 +27,32 @@ for (const stream of [process.stdout, process.stderr]) {
 // rapid "process exited with code 1" failures.
 const MAX_CONCURRENT_QUERIES = 5;
 let activeQueries = 0;
+// Slots marked as leaked — a prior caller timed out waiting, so we assume
+// its holder died. A subsequent release pays the leak marker down instead
+// of decrementing the live count, which keeps the effective capacity honest
+// even if the "dead" subprocess later recovers and releases.
+let leakedSlots = 0;
 const waitQueue = [];
 const SLOT_TIMEOUT_MS = 600_000; // 10 minutes max wait for a slot
+function effectiveActive() {
+    return Math.max(0, activeQueries - leakedSlots);
+}
 async function acquireSlot() {
-    if (activeQueries < MAX_CONCURRENT_QUERIES) {
+    if (effectiveActive() < MAX_CONCURRENT_QUERIES) {
         activeQueries++;
         return;
     }
     let forcedAcquire = false;
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve) => {
         const timer = setTimeout(() => {
-            // Remove from queue and force-acquire — a subprocess likely died without releasing.
-            // Don't increment activeQueries; the orphaned slot already holds that count.
+            // Remove from queue; treat one existing holder as leaked. The next
+            // healthy release() will pay the leak marker down, so ultimately
+            // capacity can never drift negative or permanently below MAX.
             const idx = waitQueue.indexOf(resolve);
             if (idx >= 0)
                 waitQueue.splice(idx, 1);
-            log.warn("Semaphore slot timeout — force-acquiring (likely leaked slot from dead subprocess)");
+            log.warn("Semaphore slot timeout — assuming leaked slot from dead subprocess, force-acquiring");
+            leakedSlots++;
             forcedAcquire = true;
             resolve();
         }, SLOT_TIMEOUT_MS);
@@ -51,16 +61,29 @@ async function acquireSlot() {
             resolve();
         });
     });
-    if (!forcedAcquire) {
-        activeQueries++;
+    activeQueries++;
+    if (forcedAcquire) {
+        // leakedSlots was incremented in the timeout handler. We own a live slot
+        // now; the leak marker remains until paid down by a subsequent release.
     }
 }
 function releaseSlot() {
-    activeQueries = Math.max(0, activeQueries - 1);
+    if (leakedSlots > 0) {
+        // Pay down the leak marker instead of touching the live count; this
+        // release "belongs" to the orphaned slot, not our caller.
+        leakedSlots--;
+    }
+    else {
+        activeQueries = Math.max(0, activeQueries - 1);
+    }
     const next = waitQueue.shift();
     if (next)
         next();
 }
+/** Exported for tests only — observes internal semaphore state. */
+export function __getSemaphoreState() {
+    return { active: activeQueries, leaked: leakedSlots, waiting: waitQueue.length };
+}
 export class ClaudeAgentRuntime {
     id = "claude";
     config;
@@ -135,9 +158,7 @@ export class ClaudeAgentRuntime {
                 stream: false,
                 service_tier: "standard_only",
                 ...(Object.keys(outputConfig).length > 0 ? { output_config: outputConfig } : {}),
-                ...(thinkingDisabled
-                    ? { thinking: { type: "disabled" } }
-                    : {}),
+                ...(thinkingDisabled ? { thinking: { type: "disabled" } } : {}),
             };
             return { custom_id: req.id, params };
         });
@@ -145,10 +166,17 @@ export class ClaudeAgentRuntime {
         let batch = await this.client.messages.batches.create({ requests: batchRequests });
         log.info(`Batch ${batch.id} submitted, polling for completion`);
         const startMs = Date.now();
-        const POLL_INTERVAL_MS = 2_000;
-        const MAX_POLL_MS = 600_000; // 10 minutes
+        // Exponential backoff: batches typically run for minutes. A fixed 2 s
+        // poll wastes ~30 retrieves per minute after the first minute; this
+        // starts at 2 s and grows to a 30 s cap.
+        const INITIAL_POLL_MS = 2_000;
+        const MAX_POLL_MS_PER_CYCLE = 30_000;
+        const BACKOFF_FACTOR = 1.5;
+        const MAX_POLL_MS = 600_000; // 10 minutes overall cap
+        let pollDelay = INITIAL_POLL_MS;
         while (batch.processing_status !== "ended") {
-            await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+            await new Promise((r) => setTimeout(r, pollDelay));
+            pollDelay = Math.min(MAX_POLL_MS_PER_CYCLE, Math.floor(pollDelay * BACKOFF_FACTOR));
             batch = await this.client.messages.batches.retrieve(batch.id);
             if (Date.now() - startMs > MAX_POLL_MS) {
                 await this.client.messages.batches.cancel(batch.id);
@@ -172,19 +200,17 @@ export class ClaudeAgentRuntime {
                 const usage = msg.usage;
                 const inputCost = (usage.input_tokens / 1_000_000) * inputRate;
                 const outputCost = (usage.output_tokens / 1_000_000) * outputRate;
-                const cacheReadTokens = usage["cache_read_input_tokens"] ?? 0;
+                const cacheReadTokens = usage.cache_read_input_tokens ?? 0;
                 const cacheSavings = (cacheReadTokens / 1_000_000) * (inputRate * 0.9);
                 results.set(item.custom_id, {
                     resultText: textBlock?.text ?? "",
-                    structuredOutput: msg["parsed_output"] ?? undefined,
+                    structuredOutput: msg.parsed_output ?? undefined,
                     executionError: null,
                     costUsd: normalizeCostUsd(inputCost + outputCost - cacheSavings),
                 });
             }
             else {
-                const errorMsg = item.result.type === "errored"
-                    ? JSON.stringify(item.result.error)
-                    : item.result.type;
+                const errorMsg = item.result.type === "errored" ? JSON.stringify(item.result.error) : item.result.type;
                 results.set(item.custom_id, {
                     resultText: "",
                     structuredOutput: undefined,
@@ -237,7 +263,9 @@ export class ClaudeAgentRuntime {
                     payload: { model, promptLength: request.prompt.length, runId: turnRunId },
                 });
             }
-            catch { /* non-fatal */ }
+            catch {
+                /* non-fatal */
+            }
         }
         try {
             // Build output_config — effort errors on Haiku, so skip it
@@ -255,9 +283,7 @@ export class ClaudeAgentRuntime {
             const maxTokens = request.options.maxOutputTokens ?? 16000;
             // Thinking: disable for classification, use adaptive+omitted for analysis
             // display: "omitted" skips streaming thinking tokens (faster time-to-first-text)
-            const shouldDisableThinking = request.options.thinkingDisabled
-                || isHaiku
-                || request.options.effort === "low";
+            const shouldDisableThinking = request.options.thinkingDisabled || isHaiku || request.options.effort === "low";
             // Use streaming + finalMessage() to avoid HTTP timeouts on large outputs
             const stream = this.client.messages.stream({
                 model,
@@ -301,7 +327,7 @@ export class ClaudeAgentRuntime {
             const outputRate = isHaiku ? 5 : isMythos ? 125 : isOpus ? 25 : 15;
             const inputCost = (response.usage.input_tokens / 1_000_000) * inputRate;
             const outputCost = (response.usage.output_tokens / 1_000_000) * outputRate;
-            const cacheReadTokens = response.usage["cache_read_input_tokens"] ?? 0;
+            const cacheReadTokens = response.usage.cache_read_input_tokens ?? 0;
             const cacheSavings = (cacheReadTokens / 1_000_000) * (inputRate * 0.9); // 90% savings on cached tokens
             const totalCostUsd = normalizeCostUsd(inputCost + outputCost - cacheSavings);
             // Extract text result
@@ -312,17 +338,29 @@ export class ClaudeAgentRuntime {
                 try {
                     await this.bus.publish({
                         type: "llm:call-complete",
-                        meta: { id: crypto.randomUUID(), timestamp: new Date().toISOString(), runId: turnRunId },
-                        payload: { model, durationMs, tokensUsed: response.usage.input_tokens + response.usage.output_tokens, costUsd: totalCostUsd, runId: turnRunId },
+                        meta: {
+                            id: crypto.randomUUID(),
+                            timestamp: new Date().toISOString(),
+                            runId: turnRunId,
+                        },
+                        payload: {
+                            model,
+                            durationMs,
+                            tokensUsed: response.usage.input_tokens + response.usage.output_tokens,
+                            costUsd: totalCostUsd,
+                            runId: turnRunId,
+                        },
                     });
                 }
-                catch { /* non-fatal */ }
+                catch {
+                    /* non-fatal */
+                }
             }
             yield {
                 type: "result",
                 subtype: "success",
                 result: resultText,
-                structuredOutput: response["parsed_output"] ?? undefined,
+                structuredOutput: response.parsed_output ?? undefined,
                 durationMs,
                 numTurns: 1,
                 totalCostUsd,
@@ -330,18 +368,23 @@ export class ClaudeAgentRuntime {
         }
         catch (error) {
             const durationMs = Date.now() - startedAtMs;
-            const retryable = error instanceof Anthropic.RateLimitError
-                || error instanceof Anthropic.InternalServerError;
+            const retryable = error instanceof Anthropic.RateLimitError || error instanceof Anthropic.InternalServerError;
             log.error(`Direct API query failed (${durationMs}ms, retryable=${retryable}): ${toErrorMessage(error)}`);
             if (this.bus) {
                 try {
                     await this.bus.publish({
                         type: "llm:call-error",
-                        meta: { id: crypto.randomUUID(), timestamp: new Date().toISOString(), runId: turnRunId },
+                        meta: {
+                            id: crypto.randomUUID(),
+                            timestamp: new Date().toISOString(),
+                            runId: turnRunId,
+                        },
                         payload: { model, error: toErrorMessage(error), retryable, runId: turnRunId },
                     });
                 }
-                catch { /* non-fatal */ }
+                catch {
+                    /* non-fatal */
+                }
             }
             yield {
                 type: "result",
@@ -356,9 +399,9 @@ export class ClaudeAgentRuntime {
     async *query(request) {
         // Fast path: tool-less calls go directly to Anthropic API — no subprocess.
         // Only when an API key is available — OAuth mode must use subprocess path.
-        if (!request.options.allowedTools?.length
-            && !request.options.disallowedTools?.length
-            && this.config?.apiKey) {
+        if (!request.options.allowedTools?.length &&
+            !request.options.disallowedTools?.length &&
+            this.config?.apiKey) {
             yield* this.queryDirect(request);
             return;
         }
@@ -482,16 +525,16 @@ export class ClaudeAgentRuntime {
                     continue;
                 if (mapped.type === "result") {
                     // Extract cost and metadata from SDK result
-                    const sdkMsg = message;
-                    totalCostUsd = normalizeCostUsd(sdkMsg["total_cost_usd"]);
-                    numTurns = sdkMsg["num_turns"] ?? 0;
+                    const sdkResult = message;
+                    totalCostUsd = normalizeCostUsd(sdkResult.total_cost_usd);
+                    numTurns = sdkResult.num_turns ?? 0;
                     const durationMs = Date.now() - startedAtMs;
-                    if (mapped.subtype === "success" && "result" in mapped) {
+                    if (sdkResult.subtype === "success" && "result" in mapped) {
                         yield {
                             type: "result",
                             subtype: "success",
                             result: mapped.result,
-                            structuredOutput: sdkMsg["structured_output"],
+                            structuredOutput: sdkResult.structured_output,
                             durationMs,
                             numTurns,
                             totalCostUsd,
@@ -610,9 +653,13 @@ class MessageQueue {
         if (this.isDone) {
             return Promise.resolve({ done: true, value: undefined });
         }
-        return new Promise((resolve) => { this.resolve = resolve; });
+        return new Promise((resolve) => {
+            this.resolve = resolve;
+        });
+    }
+    [Symbol.asyncIterator]() {
+        return this;
     }
-    [Symbol.asyncIterator]() { return this; }
 }
 /**
  * A session backed by a single Claude Code subprocess. Uses the SDK's
@@ -623,18 +670,18 @@ class MessageQueue {
 class ClaudeSession {
     baseOptions;
     config;
-    bus;
-    runId;
+    _bus;
+    _runId;
     messageQueue = new MessageQueue();
     queryIterator = null;
     closed = false;
     slotAcquired = false;
     queryInFlight = false; // Mutex: prevent concurrent query() calls
-    constructor(baseOptions, config, bus, runId) {
+    constructor(baseOptions, config, _bus, _runId) {
         this.baseOptions = baseOptions;
         this.config = config;
-        this.bus = bus;
-        this.runId = runId;
+        this._bus = _bus;
+        this._runId = _runId;
     }
     ensureStarted() {
         if (this.queryIterator)
@@ -770,15 +817,15 @@ class ClaudeSession {
                 if (!mapped)
                     continue;
                 if (mapped.type === "result") {
-                    const sdkMsg = value;
-                    const totalCostUsd = normalizeCostUsd(sdkMsg["total_cost_usd"]);
-                    const numTurns = sdkMsg["num_turns"] ?? 0;
-                    if (mapped.subtype === "success" && "result" in mapped) {
+                    const sdkResult = value;
+                    const totalCostUsd = normalizeCostUsd(sdkResult.total_cost_usd);
+                    const numTurns = sdkResult.num_turns ?? 0;
+                    if (sdkResult.subtype === "success" && "result" in mapped) {
                         yield {
                             type: "result",
                             subtype: "success",
                             result: mapped.result,
-                            structuredOutput: sdkMsg["structured_output"],
+                            structuredOutput: sdkResult.structured_output,
                             numTurns,
                             totalCostUsd,
                         };
@@ -828,52 +875,53 @@ function mapPermissionMode(mode) {
     }
 }
 function mapMessage(msg) {
-    const type = msg["type"];
-    switch (type) {
+    switch (msg.type) {
         case "result": {
-            const sdkMsg = msg;
-            const subtype = sdkMsg["subtype"];
-            if (subtype === "success") {
+            const sdkResult = msg;
+            if (sdkResult.subtype === "success") {
                 return {
                     type: "result",
                     subtype: "success",
-                    result: sdkMsg["result"] ?? "",
-                    structuredOutput: sdkMsg["structured_output"],
-                    totalCostUsd: normalizeCostUsd(sdkMsg["total_cost_usd"]),
+                    result: sdkResult.result ?? "",
+                    structuredOutput: sdkResult.structured_output,
+                    totalCostUsd: normalizeCostUsd(sdkResult.total_cost_usd),
                 };
             }
             return {
                 type: "result",
-                subtype: subtype ?? "error_runtime",
-                errors: Array.isArray(sdkMsg["errors"])
-                    ? sdkMsg["errors"]
-                    : [String(sdkMsg["errors"] ?? "Unknown error")],
-                totalCostUsd: normalizeCostUsd(sdkMsg["total_cost_usd"]),
+                subtype: sdkResult.subtype ?? "error_runtime",
+                errors: Array.isArray(sdkResult.errors)
+                    ? sdkResult.errors
+                    : [String(sdkResult.errors ?? "Unknown error")],
+                totalCostUsd: normalizeCostUsd(sdkResult.total_cost_usd),
             };
         }
         case "assistant": {
-            const sdkMsg = msg;
+            const sdkAssistant = msg;
+            const content = sdkAssistant.message?.content;
             return {
                 type: "assistant",
-                content: Array.isArray(sdkMsg["content"]) ? sdkMsg["content"] : [],
+                // BetaContentBlock[] -> Record<string, unknown>[] via spread to satisfy
+                // the AgentAssistantMessage interface (strips the rigid index signature constraint)
+                content: Array.isArray(content) ? content.map((block) => ({ ...block })) : [],
             };
         }
-        case "tool_use_progress": {
-            const sdkMsg = msg;
+        case "tool_progress": {
+            const sdkProgress = msg;
             return {
                 type: "tool-progress",
-                toolUseId: String(sdkMsg["tool_use_id"] ?? ""),
-                toolName: String(sdkMsg["tool_name"] ?? ""),
-                elapsedSeconds: sdkMsg["elapsed_seconds"] ?? 0,
+                toolUseId: sdkProgress.tool_use_id ?? "",
+                toolName: sdkProgress.tool_name ?? "",
+                elapsedSeconds: sdkProgress.elapsed_time_seconds ?? 0,
             };
         }
         case "tool_use_summary": {
-            const sdkMsg = msg;
+            const sdkSummary = msg;
             return {
                 type: "tool-summary",
-                summary: String(sdkMsg["summary"] ?? ""),
-                precedingToolUseIds: Array.isArray(sdkMsg["preceding_tool_use_ids"])
-                    ? sdkMsg["preceding_tool_use_ids"]
+                summary: sdkSummary.summary ?? "",
+                precedingToolUseIds: Array.isArray(sdkSummary.preceding_tool_use_ids)
+                    ? sdkSummary.preceding_tool_use_ids
                     : [],
             };
         }