looply-cli 0.0.0-stage → 0.2.0

package/dist/provider-limit.d.ts

@@ -0,0 +1,79 @@
+import type { AgentInvoke } from './agent-exec';
+import type { CommandResult } from './gate';
+/**
+ * F35 — A PROVIDER'S USAGE LIMIT IS WEATHER, NOT A VERDICT.
+ *
+ * 🔴 MEASURED LIVE (LIVE-2, 2026-09-25T23:27–23:30Z). The provider profile had hit its
+ * session limit. Every call came back in a few seconds as
+ *
+ *   {"type":"result","is_error":true,"api_error_status":429,
+ *    "result":"You've hit your session limit · resets 2:30am (Asia/Amman)", …}
+ *
+ * and nothing in the product could tell that from a real failure. Three Starts of one goal
+ * compiled nothing ("the compiler failed"), each ended as "nothing to do", and the controller
+ * bought the next Start at once: three of eight gone in ninety seconds, for a condition that
+ * cleared by itself at 2:30. The brain's question about another goal met the same refusal, and
+ * "the brain failed" was recorded as that goal version's standing answer, never asked again.
+ *
+ * So the refusal is read where it is written — the CLI's own envelope, never the model's prose
+ * — and the two callers stop treating it as an outcome: a run waits it out inside the Start it
+ * already holds (`waitingOutProviderLimits`), and the brain records nothing (`ask-brain.ts`).
+ *
+ * ⚠️ THE BUILT-IN PROVIDER ONLY. A configured provider's stdout is the model's own stream, so
+ * an "envelope" in it could be typed by the model; callers apply this only where the CLI writes
+ * the envelope, exactly as `unwrapping` is applied.
+ */
+export interface ProviderLimit {
+    /** The provider's own sentence, e.g. "You've hit your session limit · resets 2:30am (Asia/Amman)". */
+    readonly because: string;
+    /** When the sentence says the limit resets, as epoch ms; null when it says so in no form read here. */
+    readonly resetsAt: number | null;
+}
+/** The longest one call waits out a limit, counted from its first refusal. A session window is five hours. */
+export declare const MAX_PROVIDER_LIMIT_WAIT_MS: number;
+/** How long to wait when the refusal names no reset time, and the least wait once a retry is refused again. */
+export declare const UNKNOWN_RESET_WAIT_MS: number;
+/** The provider prints the reset to the minute, rounded down; this covers the seconds and a little clock skew. */
+export declare const RESET_GRACE_MS: number;
+/** How often a waiting run looks at whether it was told to stop. */
+export declare const LIMIT_WAIT_SLICE_MS: number;
+/** The provider's usage-limit refusal in this result, or null when it is not one. */
+export declare function providerLimitOf(raw: CommandResult, now: number): ProviderLimit | null;
+/** When a caller may ask again: the stated reset and a grace, or a fixed wait when none is stated. */
+export declare function quietUntilOf(limit: ProviderLimit, now: number): number;
+/**
+ * The reset instant in the provider's sentence, or null.
+ *
+ * The CLI writes a reset within a day as `2:30am (Asia/Amman)` or `5pm (Asia/Amman)`, and a
+ * later one as `Oct 2, 5pm (…)`, with the year added only when it is not this one — each in
+ * the wall clock of the zone it names. A zone this runtime does not know, or any other shape,
+ * is null: the caller then waits a fixed time rather than guessing. (`\s` covers the no-break spaces
+ * newer ICU writes before the meridiem.)
+ */
+export declare function resetOf(sentence: string, now: number): number | null;
+export interface LimitWaitDeps {
+    readonly now: () => number;
+    readonly sleep: (ms: number) => Promise<void>;
+    /** Whether the run was told to stop or pause; a waiting call then stops waiting and returns the refusal. */
+    readonly interrupted: () => boolean | Promise<boolean>;
+    readonly log: (line: string) => void;
+    /**
+     * Where a person reads it. A run the daemon starts has its output discarded, so a wait only
+     * in the log would be a Start that looks stuck for hours; the run records it as an alert.
+     */
+    readonly announce?: (text: string) => Promise<void>;
+    readonly maxWaitMs?: number;
+}
+/**
+ * An invoke that waits out the provider's usage limit instead of reporting it as the answer.
+ *
+ * The Start that is waiting keeps its place: the controller sees a run that is still going and
+ * buys nothing, and nothing is spent while it waits. The same prompt is asked again once the
+ * provider said the limit resets. Bounded three ways — the call gives up (and the refusal stands,
+ * as before F35) when the reset is later than `maxWaitMs` from its first refusal, when it has
+ * waited that long, or when the run is told to stop — and a retry refused again waits at least
+ * `UNKNOWN_RESET_WAIT_MS`, so a reset that did not happen when it said is not asked every minute.
+ * Anything that is not a usage limit passes through untouched.
+ */
+export declare function waitingOutProviderLimits(invoke: AgentInvoke, deps: LimitWaitDeps): AgentInvoke;
+//# sourceMappingURL=provider-limit.d.ts.map

package/dist/provider-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-limit.d.ts","sourceRoot":"","sources":["../src/provider-limit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,aAAa;IAC5B,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B,QAAqB,CAAC;AAC7D,+GAA+G;AAC/G,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AACpD,kHAAkH;AAClH,eAAO,MAAM,cAAc,QAAgB,CAAC;AAC5C,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,QAAY,CAAC;AAE7C,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAKrF;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtE;AAID;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA6BpE;AAuCD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,4GAA4G;IAC5G,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA8B9F"}

package/dist/provider-limit.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LIMIT_WAIT_SLICE_MS = exports.RESET_GRACE_MS = exports.UNKNOWN_RESET_WAIT_MS = exports.MAX_PROVIDER_LIMIT_WAIT_MS = void 0;
+exports.providerLimitOf = providerLimitOf;
+exports.quietUntilOf = quietUntilOf;
+exports.resetOf = resetOf;
+exports.waitingOutProviderLimits = waitingOutProviderLimits;
+const agent_envelope_1 = require("./agent-envelope");
+/** The longest one call waits out a limit, counted from its first refusal. A session window is five hours. */
+exports.MAX_PROVIDER_LIMIT_WAIT_MS = 6 * 60 * 60 * 1000;
+/** How long to wait when the refusal names no reset time, and the least wait once a retry is refused again. */
+exports.UNKNOWN_RESET_WAIT_MS = 15 * 60 * 1000;
+/** The provider prints the reset to the minute, rounded down; this covers the seconds and a little clock skew. */
+exports.RESET_GRACE_MS = 2 * 60 * 1000;
+/** How often a waiting run looks at whether it was told to stop. */
+exports.LIMIT_WAIT_SLICE_MS = 15 * 1000;
+/** The provider's usage-limit refusal in this result, or null when it is not one. */
+function providerLimitOf(raw, now) {
+    const env = (0, agent_envelope_1.parseAgentEnvelope)(raw.output ?? '');
+    if (env === null || env.ok || env.apiErrorStatus !== 429)
+        return null;
+    const because = env.text.trim().slice(0, 300) || 'the provider refused with HTTP 429';
+    return { because, resetsAt: resetOf(because, now) };
+}
+/** When a caller may ask again: the stated reset and a grace, or a fixed wait when none is stated. */
+function quietUntilOf(limit, now) {
+    return limit.resetsAt === null ? now + exports.UNKNOWN_RESET_WAIT_MS : Math.max(limit.resetsAt, now) + exports.RESET_GRACE_MS;
+}
+const MONTHS = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct', 'nov', 'dec'];
+/**
+ * The reset instant in the provider's sentence, or null.
+ *
+ * The CLI writes a reset within a day as `2:30am (Asia/Amman)` or `5pm (Asia/Amman)`, and a
+ * later one as `Oct 2, 5pm (…)`, with the year added only when it is not this one — each in
+ * the wall clock of the zone it names. A zone this runtime does not know, or any other shape,
+ * is null: the caller then waits a fixed time rather than guessing. (`\s` covers the no-break spaces
+ * newer ICU writes before the meridiem.)
+ */
+function resetOf(sentence, now) {
+    const m = /resets\s+(?:([A-Za-z]{3})\s+(\d{1,2}),\s+(?:(\d{4}),\s+)?)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*\(([^)]+)\)/i.exec(sentence);
+    if (m === null)
+        return null;
+    const [, mon, day, year, hourText, minuteText, meridiem, zone] = m;
+    const hour12 = Number(hourText);
+    const minute = minuteText === undefined ? 0 : Number(minuteText);
+    if (!Number.isInteger(hour12) || hour12 < 1 || hour12 > 12 || !Number.isInteger(minute) || minute > 59)
+        return null;
+    const hour = (hour12 % 12) + (meridiem?.toLowerCase() === 'pm' ? 12 : 0);
+    const tz = (zone ?? '').trim();
+    let today;
+    try {
+        today = wallClockIn(tz, now);
+    }
+    catch {
+        return null;
+    }
+    // Within five minutes past still counts as this reset: the sentence was written before this ran.
+    const recent = now - 5 * 60 * 1000;
+    if (mon === undefined) {
+        const at = instantOf(tz, today.y, today.mo, today.d, hour, minute);
+        if (at >= recent)
+            return at;
+        const next = new Date(Date.UTC(today.y, today.mo - 1, today.d + 1));
+        return instantOf(tz, next.getUTCFullYear(), next.getUTCMonth() + 1, next.getUTCDate(), hour, minute);
+    }
+    const month = MONTHS.indexOf(mon.toLowerCase()) + 1;
+    const date = Number(day);
+    if (month === 0 || date < 1 || date > 31)
+        return null;
+    const y = year === undefined ? today.y : Number(year);
+    const at = instantOf(tz, y, month, date, hour, minute);
+    return year === undefined && at < recent ? instantOf(tz, y + 1, month, date, hour, minute) : at;
+}
+/** The wall clock in `zone` at `at`. Throws a RangeError for a zone this runtime does not know. */
+function wallClockIn(zone, at) {
+    const parts = new Intl.DateTimeFormat('en-US', {
+        timeZone: zone,
+        hourCycle: 'h23',
+        year: 'numeric',
+        month: 'numeric',
+        day: 'numeric',
+        hour: 'numeric',
+        minute: 'numeric',
+    }).formatToParts(new Date(at));
+    const n = (t) => Number(parts.find((p) => p.type === t)?.value);
+    return { y: n('year'), mo: n('month'), d: n('day'), h: n('hour') % 24, mi: n('minute') };
+}
+/** The instant at which `zone`'s wall clock reads the given date and time. */
+function instantOf(zone, y, mo, d, h, mi) {
+    const target = Date.UTC(y, mo - 1, d, h, mi);
+    let guess = target;
+    // Two corrections settle any fixed offset; the third covers a guess that crossed a DST change.
+    for (let i = 0; i < 3; i++) {
+        const w = wallClockIn(zone, guess);
+        const diff = target - Date.UTC(w.y, w.mo - 1, w.d, w.h, w.mi);
+        if (diff === 0)
+            break;
+        guess += diff;
+    }
+    return guess;
+}
+/**
+ * An invoke that waits out the provider's usage limit instead of reporting it as the answer.
+ *
+ * The Start that is waiting keeps its place: the controller sees a run that is still going and
+ * buys nothing, and nothing is spent while it waits. The same prompt is asked again once the
+ * provider said the limit resets. Bounded three ways — the call gives up (and the refusal stands,
+ * as before F35) when the reset is later than `maxWaitMs` from its first refusal, when it has
+ * waited that long, or when the run is told to stop — and a retry refused again waits at least
+ * `UNKNOWN_RESET_WAIT_MS`, so a reset that did not happen when it said is not asked every minute.
+ * Anything that is not a usage limit passes through untouched.
+ */
+function waitingOutProviderLimits(invoke, deps) {
+    return async (prompt, timeoutMs) => {
+        let deadline = null;
+        let refusals = 0;
+        const say = async (text) => {
+            deps.log(`provider: ${text}`);
+            await deps.announce?.(text);
+        };
+        for (;;) {
+            const r = await invoke(prompt, timeoutMs);
+            const now = deps.now();
+            const limit = providerLimitOf(r, now);
+            if (limit === null)
+                return r;
+            refusals += 1;
+            deadline ??= now + (deps.maxWaitMs ?? exports.MAX_PROVIDER_LIMIT_WAIT_MS);
+            const until = Math.max(quietUntilOf(limit, now), refusals > 1 ? now + exports.UNKNOWN_RESET_WAIT_MS : now);
+            if (until > deadline) {
+                await say(`${limit.because} — later than this call waits (${iso(deadline)}); the refusal stands`);
+                return r;
+            }
+            await say(`${limit.because} — waiting until ${iso(until)} to ask again; this Start keeps its place and spends nothing while it waits`);
+            while (deps.now() < until) {
+                if (await deps.interrupted()) {
+                    await say('stopped waiting for the usage limit — the run was told to stop');
+                    return r;
+                }
+                await deps.sleep(Math.min(exports.LIMIT_WAIT_SLICE_MS, until - deps.now()));
+            }
+        }
+    };
+}
+function iso(ms) {
+    return new Date(ms).toISOString();
+}
+//# sourceMappingURL=provider-limit.js.map

package/dist/provider-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-limit.js","sourceRoot":"","sources":["../src/provider-limit.ts"],"names":[],"mappings":";;;AA4CA,0CAKC;AAGD,oCAEC;AAaD,0BA6BC;AAgED,4DA8BC;AA9LD,qDAAsD;AAkCtD,8GAA8G;AACjG,QAAA,0BAA0B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7D,+GAA+G;AAClG,QAAA,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpD,kHAAkH;AACrG,QAAA,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,oEAAoE;AACvD,QAAA,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,qFAAqF;AACrF,SAAgB,eAAe,CAAC,GAAkB,EAAE,GAAW;IAC7D,MAAM,GAAG,GAAG,IAAA,mCAAkB,EAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,oCAAoC,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,sGAAsG;AACtG,SAAgB,YAAY,CAAC,KAAoB,EAAE,GAAW;IAC5D,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,6BAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,sBAAc,CAAC;AAChH,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAEpG;;;;;;;;GAQG;AACH,SAAgB,OAAO,CAAC,QAAgB,EAAE,GAAW;IACnD,MAAM,CAAC,GAAG,4GAA4G,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACpH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,iGAAiG;IACjG,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,EAAE,IAAI,MAAM;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,IAAI,KAAK,SAAS,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClG,CAAC;AAUD,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAAY,EAAE,EAAU;IAC3C,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QAC7C,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,CAA+B,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY,EAAE,CAAS,EAAE,EAAU,EAAE,CAAS,EAAE,CAAS,EAAE,EAAU;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,+FAA+F;IAC/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;QACtB,KAAK,IAAI,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,SAAgB,wBAAwB,CAAC,MAAmB,EAAE,IAAmB;IAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QACjC,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;YACjC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC9B,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;YAC7B,QAAQ,IAAI,CAAC,CAAC;YACd,QAAQ,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,kCAA0B,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,6BAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnG,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,kCAAkC,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;gBAClG,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,oBAAoB,GAAG,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;YACvI,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;gBAC1B,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC7B,MAAM,GAAG,CAAC,gEAAgE,CAAC,CAAC;oBAC5E,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,2BAAmB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,EAAU;IACrB,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC"}

package/dist/provider-preflight.d.ts

@@ -0,0 +1,171 @@
+import type { AgentSpec } from './agent-exec';
+/**
+ * DOES THE CONFIGURED PROVIDER ACTUALLY ANSWER?
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * 🔴 THIS IS THE ONLY THING THAT MAKES A PRESET TRUSTWORTHY.
+ *
+ * `providers.ts` ships command lines, and two of the three have never been run
+ * by anybody here — the binaries are not installed on the machine they were
+ * written on. No amount of care in a table fixes that. What fixes it is running
+ * the thing on the machine that HAS it and reporting what happened, which is
+ * what this does.
+ *
+ * ⚠️ `looply doctor` DELIBERATELY MAKES NO AGENT CALL — it exists to find a
+ * wrong `tsc` command in ninety seconds. That was the right decision for the
+ * gate and it left a hole either side of it: a wrong AGENT command was found at
+ * round 1 of an overnight run, by which point a person is asleep. This is the
+ * other half, and it is opt-in for the same reason doctor is fast: it spends a
+ * model call.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * 🔴 WHAT IT ASKS FOR, AND WHY THAT EXACT SHAPE
+ *
+ * A prompt with one instruction and a literal answer. Not "hello", which any
+ * process echoing its input would pass; not a code task, which spends real
+ * money and takes real time. A token the provider could only produce by having
+ * read the prompt and generated from it.
+ *
+ * ⚠️ IT STILL CANNOT PROVE THE MODEL IS ANY GOOD. It proves the process starts,
+ * accepts a prompt on stdin, and returns something derived from it. That is
+ * exactly the class of failure the flags cause, and no more.
+ */
+/** The word the probe asks for, chosen to be one nothing else would emit. */
+export declare const PREFLIGHT_TOKEN = "looply-preflight-ok";
+export declare const PREFLIGHT_PROMPT = "Reply with exactly this word and nothing else: looply-preflight-ok";
+/**
+ * How long to wait before calling it hung.
+ *
+ * 🔴 A HANG IS THE FAILURE THIS EXISTS TO CATCH, so the timeout is not a
+ * formality. An AppContainer that cannot create a named pipe returns EACCES and
+ * the spawn waits FOR EVER rather than failing — that is measured behaviour in
+ * this repository, and without a ceiling this check would inherit it.
+ */
+export declare const PREFLIGHT_TIMEOUT_MS = 120000;
+export type PreflightVerdict = 
+/** Started, read the prompt, and produced the token. */
+'answered'
+/** Started and produced output, but not the token. Working, or not — unclear. */
+ | 'unrecognised'
+/** The binary is not there. Almost always a name or a PATH. */
+ | 'missing'
+/** Started and exited non-zero. Usually a flag it does not know. */
+ | 'refused'
+/** Produced nothing within the ceiling. */
+ | 'hung';
+export interface PreflightResult {
+    readonly verdict: PreflightVerdict;
+    readonly ms: number;
+    /** Bounded and safe to print. Never the whole transcript. */
+    readonly detail: string;
+    /** What a person should do next, in their terms. Empty when nothing is wrong. */
+    readonly advice: string;
+}
+export interface PreflightDeps {
+    /**
+     * Run the command line, write the prompt to stdin, and resolve with what came
+     * back. Injected so the tests drive real child processes of their own rather
+     * than the provider.
+     */
+    run(input: {
+        commandLine: string;
+        prompt: string;
+        timeoutMs: number;
+    }): Promise<{
+        stdout: string;
+        stderr: string;
+        code: number | null;
+        timedOut: boolean;
+    }>;
+    now(): number;
+    /**
+     * The absolute provider executable the RUN would spawn, when one is known.
+     *
+     * Supplied so the check starts the same binary the run starts — see
+     * `preflightCommandLine`. Absent means "not resolved", and the spec's own
+     * command line is used unchanged.
+     */
+    executable?: string | null;
+}
+/**
+ * The command line the preflight actually spawns.
+ *
+ * 🔴 THE BUILT-IN PROVIDER HAS TO BE SPAWNED BY ABSOLUTE PATH, BECAUSE THIS
+ * CHECK'S OWN ENVIRONMENT CANNOT FIND IT BY NAME. `buildProviderEnv` pins PATH
+ * to the system directories deliberately — "not the machine's toolchain
+ * directory, which on this machine also holds `claude`" — so the bare `claude`
+ * in `DEFAULT_AGENT.command` resolves to nothing and `cmd` answers "is not
+ * recognized as an internal or external command".
+ *
+ * MEASURED: `looply doctor --provider` returned `missing` in 18 ms on a machine
+ * where the provider was installed, logged in, and perfectly able to run —
+ * three lines after `checkProviderAuth` had resolved its absolute path and
+ * printed "logged in (claude.ai)". The check contradicted itself inside one
+ * command, and it contradicted the run: `model-transport` spawns
+ * `spec.executable ?? providerExecutableFor(pkg)` and never consults PATH.
+ *
+ * A check that REFUSES a configuration the run ACCEPTS is the mirror of the
+ * defect this file's own header warns about, and costs the same thing — a
+ * person is told the provider is missing and goes looking for an install that
+ * is already there.
+ *
+ * ⚠️ ONLY THE BUILT-IN IS REWRITTEN. A configured `agent.command` is the
+ * person's own line, and rewriting it would discard exactly the intent
+ * `resolveProvider` takes such care to keep. An explicit `agent.executable` is
+ * already absolute and the transport already prefers it.
+ */
+export declare function preflightCommandLine(spec: AgentSpec, executable: string | null): string;
+export declare function preflightProvider(spec: AgentSpec, deps: PreflightDeps): Promise<PreflightResult>;
+/** Whether a run should be allowed to start on this result. */
+export declare function preflightPasses(r: Pick<PreflightResult, 'verdict'>): boolean;
+/**
+ * The real implementation, kept out of the module above so its logic stays
+ * drivable without spawning anything.
+ *
+ * 🔴 THE ENVIRONMENT HAD TO MATCH THE TRANSPORT'S, AND THE OLD DOCBLOCK
+ * CLAIMED IT ALREADY DID.
+ *
+ * It said "`shell: true` MATCHES HOW THE TRANSPORT STARTS THE PROVIDER", while
+ * the transport's own docblock says "NEVER `shell: true`" — and, far worse,
+ * this spawn passed no `env` at all, so the child inherited the OPERATOR'S
+ * ENTIRE AMBIENT ENVIRONMENT and their real HOME.
+ *
+ * MEASURED: the preflight child saw an injected marker variable and the
+ * operator's own home directory; the transport gives a scrubbed environment and
+ * a HOME redirected into `.looply/provider-sessions`. So a provider that
+ * authenticates from the operator's real home, or that is found on the
+ * operator's PATH rather than in `agent.runtime`, PASSED this check and then
+ * could not start in the run — precisely the failure the preflight exists to
+ * prevent, with the check itself supplying the credentials.
+ *
+ * ⚠️ THE SHELL STAYS, because the thing being checked IS a command line and
+ * the transport also reaches a configured provider through `cmd /c`. What
+ * changes is the environment that shell is given: `buildProviderEnv` over a
+ * session directory — the same function, and the same shape, the transport uses.
+ */
+/**
+ * The environment a preflight hands the provider, as a pure function of its three
+ * inputs — so a test can hold it against what the transport builds.
+ *
+ * 🔴 EXTRACTED BECAUSE THE DIVERGENCE WAS INVISIBLE. It lived inside the spawn
+ * closure, where nothing could observe it, and it quietly omitted
+ * `CLAUDE_CONFIG_DIR` while `model-transport` always set it. The result was a
+ * readiness check that reported `refused` for a provider the run would have
+ * authenticated, advising the operator to go and compare command-line flags.
+ */
+export declare function preflightEnv(base: Record<string, string>, runtime: readonly string[], profile?: string): Record<string, string>;
+/**
+ * @param runtime `agent.runtime`, prepended to PATH exactly as the transport does.
+ * @param profile The provider profile directory, set as `CLAUDE_CONFIG_DIR`.
+ *
+ * 🔴 THE PROFILE IS NOT OPTIONAL DECORATION. `buildProviderEnv` hands the provider
+ * an isolated HOME, so without `CLAUDE_CONFIG_DIR` the binary looks for its login
+ * in a directory nothing has ever logged into — and answers "Not logged in" for a
+ * profile the RUN never uses. Measured on a machine whose operator was logged in
+ * perfectly well: `doctor --provider` said `refused`, and advised checking flags.
+ *
+ * ⚠️ NO CREDENTIAL PASSES THROUGH HERE. This is a directory NAME. The provider owns
+ * its own login inside it; Looply names the place and holds nothing.
+ */
+export declare function nodePreflightDeps(runtime?: readonly string[], profile?: string, executable?: string | null): PreflightDeps;
+//# sourceMappingURL=provider-preflight.d.ts.map

package/dist/provider-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-preflight.d.ts","sourceRoot":"","sources":["../src/provider-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,eAAe,wBAAwB,CAAC;AAErD,eAAO,MAAM,gBAAgB,uEAAsE,CAAC;AAEpG;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,SAAU,CAAC;AAE5C,MAAM,MAAM,gBAAgB;AAC1B,wDAAwD;AACtD,UAAU;AACZ,iFAAiF;GAC/E,cAAc;AAChB,+DAA+D;GAC7D,SAAS;AACX,oEAAoE;GAClE,SAAS;AACX,2CAA2C;GACzC,MAAM,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxF,GAAG,IAAI,MAAM,CAAC;IACd;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAQvF;AAyCD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,CAAC,CA0G1B;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,OAAO,CAM5E;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,SAAS,MAAM,EAAO,EAC/B,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,aAAa,CA8Gf"}