open-multi-agent-kit 0.95.0 → 0.95.2

package/dist/core/turn-metrics.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Per-turn runtime metrics.
+ *
+ * Before this, `telemetry.ts` covered install opt-in and nothing else, and
+ * `run-journal.ts` recorded a hash-chained *integrity* log (run started /
+ * finished / tool timeout). Neither could answer the questions that actually
+ * drive harness work: which tools fail, how long they take, what a turn costs,
+ * and whether the context cache is doing anything.
+ *
+ * Shape: one JSON object per line under `<cwd>/.omk/metrics/turns.jsonl`.
+ * Append-only, bounded by size with a single rotation, and never load-bearing —
+ * a failed write is dropped, never surfaced as a turn error.
+ *
+ * Privacy: records counts, durations, ids, and error *classes*. It never
+ * records prompt text, tool arguments, tool output, or file contents. Tool
+ * error strings are truncated and kept only to distinguish failure modes.
+ */
+import { type RuntimeProvenance } from "./runtime-provenance.ts";
+export declare const TURN_METRICS_SCHEMA_VERSION: "omk-turn-metrics-1";
+/** Rotate once the active file passes this size. */
+export declare const DEFAULT_MAX_METRICS_BYTES: number;
+/** Cap on a retained error string. Enough to classify, too short to carry a payload. */
+export declare const MAX_ERROR_CHARS = 200;
+export interface ToolCallMetric {
+    readonly name: string;
+    readonly durationMs: number;
+    readonly ok: boolean;
+    /** Truncated failure text, present only when `ok` is false. */
+    readonly error?: string;
+}
+export interface TurnUsageMetric {
+    readonly input: number;
+    readonly output: number;
+    readonly cacheRead: number;
+    readonly cacheWrite: number;
+    readonly costUsd: number;
+}
+export interface TurnMetricInput {
+    readonly sessionId: string;
+    readonly turnIndex: number;
+    readonly provider?: string;
+    readonly model?: string;
+    readonly startedAtEpochMs: number;
+    readonly endedAtEpochMs: number;
+    /** Time to the first streamed assistant chunk, when observed. */
+    readonly timeToFirstChunkMs?: number;
+    readonly usage?: TurnUsageMetric;
+    readonly stopReason?: string;
+    readonly toolCalls?: readonly ToolCallMetric[];
+    /** Whether compaction ran during this turn. */
+    readonly compacted?: boolean;
+    /** Provider failover attempts made during this turn. */
+    readonly failovers?: number;
+    /** Context-budget cache outcome for the turn's prompt build. */
+    readonly contextCache?: {
+        readonly planHit: boolean;
+        readonly hits: number;
+        readonly misses: number;
+    };
+    /** Requested/selected/response model and thinking projection. Advisory metadata only. */
+    readonly runtimeProvenance?: RuntimeProvenance;
+}
+export interface TurnMetricRecord extends TurnMetricInput {
+    readonly schemaVersion: typeof TURN_METRICS_SCHEMA_VERSION;
+    readonly durationMs: number;
+    readonly toolCallCount: number;
+    readonly toolFailureCount: number;
+}
+/**
+ * Build the record written for one turn. Pure: no clock, no filesystem, so the
+ * derived fields can be asserted directly.
+ */
+export declare function buildTurnMetricRecord(input: TurnMetricInput): TurnMetricRecord;
+export interface TurnMetricsSinkOptions {
+    readonly dir: string;
+    readonly maxBytes?: number;
+    readonly fileName?: string;
+}
+/**
+ * Append-only JSONL sink. Writes are synchronous and best-effort: metrics must
+ * never be the reason a turn fails, so every filesystem error is swallowed and
+ * counted instead of thrown.
+ */
+export declare class TurnMetricsSink {
+    private readonly filePath;
+    private readonly maxBytes;
+    private dropped;
+    private written;
+    constructor(options: TurnMetricsSinkOptions);
+    get path(): string;
+    /** Records written successfully this process. */
+    get writtenCount(): number;
+    /** Records lost to a filesystem error this process. */
+    get droppedCount(): number;
+    /** Append one turn. Returns `true` when the line reached disk. */
+    record(input: TurnMetricInput): boolean;
+    private rotateIfNeeded;
+}
+export interface ToolAggregate {
+    readonly name: string;
+    readonly calls: number;
+    readonly failures: number;
+    readonly failureRate: number;
+    readonly p50Ms: number;
+    readonly p95Ms: number;
+    readonly totalMs: number;
+}
+export interface TurnMetricsSummary {
+    readonly turns: number;
+    readonly sessions: number;
+    readonly models: readonly string[];
+    readonly totalCostUsd: number;
+    readonly totals: TurnUsageMetric;
+    readonly turnDurationP50Ms: number;
+    readonly turnDurationP95Ms: number;
+    readonly timeToFirstChunkP50Ms?: number;
+    readonly cacheReadShare: number;
+    readonly compactions: number;
+    readonly failovers: number;
+    readonly contextCachePlanHitRate?: number;
+    /** Turns where a valid projection's response model differs from the selected model. */
+    readonly provenanceMismatchTurns: number;
+    readonly tools: readonly ToolAggregate[];
+    /** Lines that could not be parsed as a metric record. */
+    readonly malformedLines: number;
+}
+/**
+ * Aggregate JSONL lines into a summary. Malformed lines are counted rather than
+ * discarded silently, so a truncated tail is visible instead of pretending the
+ * data is complete.
+ */
+export declare function summarizeTurnMetrics(lines: readonly string[]): TurnMetricsSummary;
+/** Read and summarize a metrics file. A missing file summarizes as zero turns. */
+export declare function summarizeTurnMetricsFile(filePath: string): TurnMetricsSummary;
+//# sourceMappingURL=turn-metrics.d.ts.map

package/dist/core/turn-metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-metrics.d.ts","sourceRoot":"","sources":["../../src/core/turn-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAA0B,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEzF,eAAO,MAAM,2BAA2B,sBAAgC,CAAC;AACzE,oDAAoD;AACpD,eAAO,MAAM,yBAAyB,QAAkB,CAAC;AACzD,wFAAwF;AACxF,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,iEAAiE;IACjE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtG,yFAAyF;IACzF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACxD,QAAQ,CAAC,aAAa,EAAE,OAAO,2BAA2B,CAAC;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CAClC;AASD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAqB9E;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,OAAO,CAAK;IAEpB,YAAY,OAAO,EAAE,sBAAsB,EAG1C;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,iDAAiD;IACjD,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,uDAAuD;IACvD,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,kEAAkE;IAClE,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAkBtC;IAED,OAAO,CAAC,cAAc;CAetB;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,uFAAuF;IACvF,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CAChC;AAwBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,CAgGjF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAQ7E","sourcesContent":["/**\n * Per-turn runtime metrics.\n *\n * Before this, `telemetry.ts` covered install opt-in and nothing else, and\n * `run-journal.ts` recorded a hash-chained *integrity* log (run started /\n * finished / tool timeout). Neither could answer the questions that actually\n * drive harness work: which tools fail, how long they take, what a turn costs,\n * and whether the context cache is doing anything.\n *\n * Shape: one JSON object per line under `<cwd>/.omk/metrics/turns.jsonl`.\n * Append-only, bounded by size with a single rotation, and never load-bearing —\n * a failed write is dropped, never surfaced as a turn error.\n *\n * Privacy: records counts, durations, ids, and error *classes*. It never\n * records prompt text, tool arguments, tool output, or file contents. Tool\n * error strings are truncated and kept only to distinguish failure modes.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { parseRuntimeProvenance, type RuntimeProvenance } from \"./runtime-provenance.ts\";\n\nexport const TURN_METRICS_SCHEMA_VERSION = \"omk-turn-metrics-1\" as const;\n/** Rotate once the active file passes this size. */\nexport const DEFAULT_MAX_METRICS_BYTES = 8 * 1024 * 1024;\n/** Cap on a retained error string. Enough to classify, too short to carry a payload. */\nexport const MAX_ERROR_CHARS = 200;\n\nexport interface ToolCallMetric {\n\treadonly name: string;\n\treadonly durationMs: number;\n\treadonly ok: boolean;\n\t/** Truncated failure text, present only when `ok` is false. */\n\treadonly error?: string;\n}\n\nexport interface TurnUsageMetric {\n\treadonly input: number;\n\treadonly output: number;\n\treadonly cacheRead: number;\n\treadonly cacheWrite: number;\n\treadonly costUsd: number;\n}\n\nexport interface TurnMetricInput {\n\treadonly sessionId: string;\n\treadonly turnIndex: number;\n\treadonly provider?: string;\n\treadonly model?: string;\n\treadonly startedAtEpochMs: number;\n\treadonly endedAtEpochMs: number;\n\t/** Time to the first streamed assistant chunk, when observed. */\n\treadonly timeToFirstChunkMs?: number;\n\treadonly usage?: TurnUsageMetric;\n\treadonly stopReason?: string;\n\treadonly toolCalls?: readonly ToolCallMetric[];\n\t/** Whether compaction ran during this turn. */\n\treadonly compacted?: boolean;\n\t/** Provider failover attempts made during this turn. */\n\treadonly failovers?: number;\n\t/** Context-budget cache outcome for the turn's prompt build. */\n\treadonly contextCache?: { readonly planHit: boolean; readonly hits: number; readonly misses: number };\n\t/** Requested/selected/response model and thinking projection. Advisory metadata only. */\n\treadonly runtimeProvenance?: RuntimeProvenance;\n}\n\nexport interface TurnMetricRecord extends TurnMetricInput {\n\treadonly schemaVersion: typeof TURN_METRICS_SCHEMA_VERSION;\n\treadonly durationMs: number;\n\treadonly toolCallCount: number;\n\treadonly toolFailureCount: number;\n}\n\nfunction truncateError(value: string | undefined): string | undefined {\n\tif (value === undefined) return undefined;\n\tconst collapsed = value.replace(/\\s+/gu, \" \").trim();\n\tif (collapsed.length === 0) return undefined;\n\treturn collapsed.length > MAX_ERROR_CHARS ? `${collapsed.slice(0, MAX_ERROR_CHARS)}\\u2026` : collapsed;\n}\n\n/**\n * Build the record written for one turn. Pure: no clock, no filesystem, so the\n * derived fields can be asserted directly.\n */\nexport function buildTurnMetricRecord(input: TurnMetricInput): TurnMetricRecord {\n\tconst toolCalls = (input.toolCalls ?? []).map((call) => ({\n\t\tname: call.name,\n\t\tdurationMs: Math.max(0, Math.round(call.durationMs)),\n\t\tok: call.ok,\n\t\t...(call.ok ? {} : { error: truncateError(call.error) }),\n\t}));\n\tconst runtimeProvenance =\n\t\tinput.runtimeProvenance === undefined ? undefined : parseRuntimeProvenance(input.runtimeProvenance);\n\t// Spread the raw input minus its projection: a validated projection is re-added\n\t// below, an invalid one is dropped rather than persisted.\n\tconst { runtimeProvenance: _rawProvenance, ...rest } = input;\n\treturn {\n\t\t...rest,\n\t\tschemaVersion: TURN_METRICS_SCHEMA_VERSION,\n\t\tdurationMs: Math.max(0, input.endedAtEpochMs - input.startedAtEpochMs),\n\t\ttoolCalls,\n\t\ttoolCallCount: toolCalls.length,\n\t\ttoolFailureCount: toolCalls.filter((call) => !call.ok).length,\n\t\t...(runtimeProvenance === null || runtimeProvenance === undefined ? {} : { runtimeProvenance }),\n\t};\n}\n\nexport interface TurnMetricsSinkOptions {\n\treadonly dir: string;\n\treadonly maxBytes?: number;\n\treadonly fileName?: string;\n}\n\n/**\n * Append-only JSONL sink. Writes are synchronous and best-effort: metrics must\n * never be the reason a turn fails, so every filesystem error is swallowed and\n * counted instead of thrown.\n */\nexport class TurnMetricsSink {\n\tprivate readonly filePath: string;\n\tprivate readonly maxBytes: number;\n\tprivate dropped = 0;\n\tprivate written = 0;\n\n\tconstructor(options: TurnMetricsSinkOptions) {\n\t\tthis.filePath = path.join(options.dir, options.fileName ?? \"turns.jsonl\");\n\t\tthis.maxBytes = Math.max(1024, options.maxBytes ?? DEFAULT_MAX_METRICS_BYTES);\n\t}\n\n\tget path(): string {\n\t\treturn this.filePath;\n\t}\n\n\t/** Records written successfully this process. */\n\tget writtenCount(): number {\n\t\treturn this.written;\n\t}\n\n\t/** Records lost to a filesystem error this process. */\n\tget droppedCount(): number {\n\t\treturn this.dropped;\n\t}\n\n\t/** Append one turn. Returns `true` when the line reached disk. */\n\trecord(input: TurnMetricInput): boolean {\n\t\tlet line: string;\n\t\ttry {\n\t\t\tline = `${JSON.stringify(buildTurnMetricRecord(input))}\\n`;\n\t\t} catch {\n\t\t\tthis.dropped++;\n\t\t\treturn false;\n\t\t}\n\t\ttry {\n\t\t\tfs.mkdirSync(path.dirname(this.filePath), { recursive: true });\n\t\t\tthis.rotateIfNeeded(Buffer.byteLength(line, \"utf8\"));\n\t\t\tfs.appendFileSync(this.filePath, line, { encoding: \"utf8\", mode: 0o600 });\n\t\t\tthis.written++;\n\t\t\treturn true;\n\t\t} catch {\n\t\t\tthis.dropped++;\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tprivate rotateIfNeeded(incomingBytes: number): void {\n\t\tlet size: number;\n\t\ttry {\n\t\t\tsize = fs.statSync(this.filePath).size;\n\t\t} catch {\n\t\t\treturn; // No file yet.\n\t\t}\n\t\tif (size + incomingBytes <= this.maxBytes) return;\n\t\ttry {\n\t\t\t// Single generation: the previous file is replaced, so disk use stays bounded at 2x.\n\t\t\tfs.renameSync(this.filePath, `${this.filePath}.1`);\n\t\t} catch {\n\t\t\t// Rotation failure is not fatal; the next append still succeeds.\n\t\t}\n\t}\n}\n\nexport interface ToolAggregate {\n\treadonly name: string;\n\treadonly calls: number;\n\treadonly failures: number;\n\treadonly failureRate: number;\n\treadonly p50Ms: number;\n\treadonly p95Ms: number;\n\treadonly totalMs: number;\n}\n\nexport interface TurnMetricsSummary {\n\treadonly turns: number;\n\treadonly sessions: number;\n\treadonly models: readonly string[];\n\treadonly totalCostUsd: number;\n\treadonly totals: TurnUsageMetric;\n\treadonly turnDurationP50Ms: number;\n\treadonly turnDurationP95Ms: number;\n\treadonly timeToFirstChunkP50Ms?: number;\n\treadonly cacheReadShare: number;\n\treadonly compactions: number;\n\treadonly failovers: number;\n\treadonly contextCachePlanHitRate?: number;\n\t/** Turns where a valid projection's response model differs from the selected model. */\n\treadonly provenanceMismatchTurns: number;\n\treadonly tools: readonly ToolAggregate[];\n\t/** Lines that could not be parsed as a metric record. */\n\treadonly malformedLines: number;\n}\n\nfunction percentile(sorted: readonly number[], fraction: number): number {\n\tif (sorted.length === 0) return 0;\n\tconst index = Math.min(sorted.length - 1, Math.max(0, Math.ceil(fraction * sorted.length) - 1));\n\treturn sorted[index];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseRecord(line: string): TurnMetricRecord | undefined {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(line);\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (!isRecord(parsed) || parsed.schemaVersion !== TURN_METRICS_SCHEMA_VERSION) return undefined;\n\tif (typeof parsed.turnIndex !== \"number\" || typeof parsed.durationMs !== \"number\") return undefined;\n\treturn parsed as unknown as TurnMetricRecord;\n}\n\n/**\n * Aggregate JSONL lines into a summary. Malformed lines are counted rather than\n * discarded silently, so a truncated tail is visible instead of pretending the\n * data is complete.\n */\nexport function summarizeTurnMetrics(lines: readonly string[]): TurnMetricsSummary {\n\tconst records: TurnMetricRecord[] = [];\n\tlet malformedLines = 0;\n\tfor (const line of lines) {\n\t\tconst trimmed = line.trim();\n\t\tif (trimmed.length === 0) continue;\n\t\tconst record = parseRecord(trimmed);\n\t\tif (record) records.push(record);\n\t\telse malformedLines++;\n\t}\n\n\tconst sessions = new Set<string>();\n\tconst models = new Set<string>();\n\tconst totals = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, costUsd: 0 };\n\tconst turnDurations: number[] = [];\n\tconst firstChunkTimes: number[] = [];\n\tconst toolStats = new Map<string, { durations: number[]; failures: number }>();\n\tlet compactions = 0;\n\tlet failovers = 0;\n\tlet planHits = 0;\n\tlet planObservations = 0;\n\tlet provenanceMismatchTurns = 0;\n\n\tfor (const record of records) {\n\t\tsessions.add(record.sessionId);\n\t\tif (record.model) models.add(record.provider ? `${record.provider}/${record.model}` : record.model);\n\t\tif (record.usage) {\n\t\t\ttotals.input += record.usage.input;\n\t\t\ttotals.output += record.usage.output;\n\t\t\ttotals.cacheRead += record.usage.cacheRead;\n\t\t\ttotals.cacheWrite += record.usage.cacheWrite;\n\t\t\ttotals.costUsd += record.usage.costUsd;\n\t\t}\n\t\tturnDurations.push(record.durationMs);\n\t\tif (typeof record.timeToFirstChunkMs === \"number\") firstChunkTimes.push(record.timeToFirstChunkMs);\n\t\tif (record.compacted) compactions++;\n\t\tfailovers += record.failovers ?? 0;\n\t\tif (record.contextCache) {\n\t\t\tplanObservations++;\n\t\t\tif (record.contextCache.planHit) planHits++;\n\t\t}\n\t\t// Re-validate provenance at read time: a tampered projection never counts.\n\t\tconst provenance =\n\t\t\trecord.runtimeProvenance === undefined ? undefined : parseRuntimeProvenance(record.runtimeProvenance);\n\t\tif (\n\t\t\tprovenance !== undefined &&\n\t\t\tprovenance !== null &&\n\t\t\tprovenance.responseModel !== null &&\n\t\t\tprovenance.responseModel !== provenance.selectedModel\n\t\t) {\n\t\t\tprovenanceMismatchTurns++;\n\t\t}\n\t\tfor (const call of record.toolCalls ?? []) {\n\t\t\tconst stats = toolStats.get(call.name) ?? { durations: [], failures: 0 };\n\t\t\tstats.durations.push(call.durationMs);\n\t\t\tif (!call.ok) stats.failures++;\n\t\t\ttoolStats.set(call.name, stats);\n\t\t}\n\t}\n\n\tturnDurations.sort((a, b) => a - b);\n\tfirstChunkTimes.sort((a, b) => a - b);\n\n\tconst tools: ToolAggregate[] = [...toolStats.entries()]\n\t\t.map(([name, stats]) => {\n\t\t\tconst sorted = [...stats.durations].sort((a, b) => a - b);\n\t\t\treturn {\n\t\t\t\tname,\n\t\t\t\tcalls: sorted.length,\n\t\t\t\tfailures: stats.failures,\n\t\t\t\tfailureRate: sorted.length === 0 ? 0 : stats.failures / sorted.length,\n\t\t\t\tp50Ms: percentile(sorted, 0.5),\n\t\t\t\tp95Ms: percentile(sorted, 0.95),\n\t\t\t\ttotalMs: sorted.reduce((sum, value) => sum + value, 0),\n\t\t\t};\n\t\t})\n\t\t.sort((a, b) => b.totalMs - a.totalMs || a.name.localeCompare(b.name));\n\n\tconst promptSideTotal = totals.input + totals.cacheRead;\n\treturn {\n\t\tturns: records.length,\n\t\tsessions: sessions.size,\n\t\tmodels: [...models].sort(),\n\t\ttotalCostUsd: totals.costUsd,\n\t\ttotals,\n\t\tturnDurationP50Ms: percentile(turnDurations, 0.5),\n\t\tturnDurationP95Ms: percentile(turnDurations, 0.95),\n\t\ttimeToFirstChunkP50Ms: firstChunkTimes.length > 0 ? percentile(firstChunkTimes, 0.5) : undefined,\n\t\tcacheReadShare: promptSideTotal === 0 ? 0 : totals.cacheRead / promptSideTotal,\n\t\tcompactions,\n\t\tfailovers,\n\t\tcontextCachePlanHitRate: planObservations === 0 ? undefined : planHits / planObservations,\n\t\tprovenanceMismatchTurns,\n\t\ttools,\n\t\tmalformedLines,\n\t};\n}\n\n/** Read and summarize a metrics file. A missing file summarizes as zero turns. */\nexport function summarizeTurnMetricsFile(filePath: string): TurnMetricsSummary {\n\tlet raw: string;\n\ttry {\n\t\traw = fs.readFileSync(filePath, \"utf8\");\n\t} catch {\n\t\treturn summarizeTurnMetrics([]);\n\t}\n\treturn summarizeTurnMetrics(raw.split(\"\\n\"));\n}\n"]}

package/dist/core/turn-metrics.js

@@ -0,0 +1,261 @@
+/**
+ * Per-turn runtime metrics.
+ *
+ * Before this, `telemetry.ts` covered install opt-in and nothing else, and
+ * `run-journal.ts` recorded a hash-chained *integrity* log (run started /
+ * finished / tool timeout). Neither could answer the questions that actually
+ * drive harness work: which tools fail, how long they take, what a turn costs,
+ * and whether the context cache is doing anything.
+ *
+ * Shape: one JSON object per line under `<cwd>/.omk/metrics/turns.jsonl`.
+ * Append-only, bounded by size with a single rotation, and never load-bearing —
+ * a failed write is dropped, never surfaced as a turn error.
+ *
+ * Privacy: records counts, durations, ids, and error *classes*. It never
+ * records prompt text, tool arguments, tool output, or file contents. Tool
+ * error strings are truncated and kept only to distinguish failure modes.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { parseRuntimeProvenance } from "./runtime-provenance.js";
+export const TURN_METRICS_SCHEMA_VERSION = "omk-turn-metrics-1";
+/** Rotate once the active file passes this size. */
+export const DEFAULT_MAX_METRICS_BYTES = 8 * 1024 * 1024;
+/** Cap on a retained error string. Enough to classify, too short to carry a payload. */
+export const MAX_ERROR_CHARS = 200;
+function truncateError(value) {
+    if (value === undefined)
+        return undefined;
+    const collapsed = value.replace(/\s+/gu, " ").trim();
+    if (collapsed.length === 0)
+        return undefined;
+    return collapsed.length > MAX_ERROR_CHARS ? `${collapsed.slice(0, MAX_ERROR_CHARS)}\u2026` : collapsed;
+}
+/**
+ * Build the record written for one turn. Pure: no clock, no filesystem, so the
+ * derived fields can be asserted directly.
+ */
+export function buildTurnMetricRecord(input) {
+    const toolCalls = (input.toolCalls ?? []).map((call) => ({
+        name: call.name,
+        durationMs: Math.max(0, Math.round(call.durationMs)),
+        ok: call.ok,
+        ...(call.ok ? {} : { error: truncateError(call.error) }),
+    }));
+    const runtimeProvenance = input.runtimeProvenance === undefined ? undefined : parseRuntimeProvenance(input.runtimeProvenance);
+    // Spread the raw input minus its projection: a validated projection is re-added
+    // below, an invalid one is dropped rather than persisted.
+    const { runtimeProvenance: _rawProvenance, ...rest } = input;
+    return {
+        ...rest,
+        schemaVersion: TURN_METRICS_SCHEMA_VERSION,
+        durationMs: Math.max(0, input.endedAtEpochMs - input.startedAtEpochMs),
+        toolCalls,
+        toolCallCount: toolCalls.length,
+        toolFailureCount: toolCalls.filter((call) => !call.ok).length,
+        ...(runtimeProvenance === null || runtimeProvenance === undefined ? {} : { runtimeProvenance }),
+    };
+}
+/**
+ * Append-only JSONL sink. Writes are synchronous and best-effort: metrics must
+ * never be the reason a turn fails, so every filesystem error is swallowed and
+ * counted instead of thrown.
+ */
+export class TurnMetricsSink {
+    filePath;
+    maxBytes;
+    dropped = 0;
+    written = 0;
+    constructor(options) {
+        this.filePath = path.join(options.dir, options.fileName ?? "turns.jsonl");
+        this.maxBytes = Math.max(1024, options.maxBytes ?? DEFAULT_MAX_METRICS_BYTES);
+    }
+    get path() {
+        return this.filePath;
+    }
+    /** Records written successfully this process. */
+    get writtenCount() {
+        return this.written;
+    }
+    /** Records lost to a filesystem error this process. */
+    get droppedCount() {
+        return this.dropped;
+    }
+    /** Append one turn. Returns `true` when the line reached disk. */
+    record(input) {
+        let line;
+        try {
+            line = `${JSON.stringify(buildTurnMetricRecord(input))}\n`;
+        }
+        catch {
+            this.dropped++;
+            return false;
+        }
+        try {
+            fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+            this.rotateIfNeeded(Buffer.byteLength(line, "utf8"));
+            fs.appendFileSync(this.filePath, line, { encoding: "utf8", mode: 0o600 });
+            this.written++;
+            return true;
+        }
+        catch {
+            this.dropped++;
+            return false;
+        }
+    }
+    rotateIfNeeded(incomingBytes) {
+        let size;
+        try {
+            size = fs.statSync(this.filePath).size;
+        }
+        catch {
+            return; // No file yet.
+        }
+        if (size + incomingBytes <= this.maxBytes)
+            return;
+        try {
+            // Single generation: the previous file is replaced, so disk use stays bounded at 2x.
+            fs.renameSync(this.filePath, `${this.filePath}.1`);
+        }
+        catch {
+            // Rotation failure is not fatal; the next append still succeeds.
+        }
+    }
+}
+function percentile(sorted, fraction) {
+    if (sorted.length === 0)
+        return 0;
+    const index = Math.min(sorted.length - 1, Math.max(0, Math.ceil(fraction * sorted.length) - 1));
+    return sorted[index];
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseRecord(line) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(parsed) || parsed.schemaVersion !== TURN_METRICS_SCHEMA_VERSION)
+        return undefined;
+    if (typeof parsed.turnIndex !== "number" || typeof parsed.durationMs !== "number")
+        return undefined;
+    return parsed;
+}
+/**
+ * Aggregate JSONL lines into a summary. Malformed lines are counted rather than
+ * discarded silently, so a truncated tail is visible instead of pretending the
+ * data is complete.
+ */
+export function summarizeTurnMetrics(lines) {
+    const records = [];
+    let malformedLines = 0;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            continue;
+        const record = parseRecord(trimmed);
+        if (record)
+            records.push(record);
+        else
+            malformedLines++;
+    }
+    const sessions = new Set();
+    const models = new Set();
+    const totals = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, costUsd: 0 };
+    const turnDurations = [];
+    const firstChunkTimes = [];
+    const toolStats = new Map();
+    let compactions = 0;
+    let failovers = 0;
+    let planHits = 0;
+    let planObservations = 0;
+    let provenanceMismatchTurns = 0;
+    for (const record of records) {
+        sessions.add(record.sessionId);
+        if (record.model)
+            models.add(record.provider ? `${record.provider}/${record.model}` : record.model);
+        if (record.usage) {
+            totals.input += record.usage.input;
+            totals.output += record.usage.output;
+            totals.cacheRead += record.usage.cacheRead;
+            totals.cacheWrite += record.usage.cacheWrite;
+            totals.costUsd += record.usage.costUsd;
+        }
+        turnDurations.push(record.durationMs);
+        if (typeof record.timeToFirstChunkMs === "number")
+            firstChunkTimes.push(record.timeToFirstChunkMs);
+        if (record.compacted)
+            compactions++;
+        failovers += record.failovers ?? 0;
+        if (record.contextCache) {
+            planObservations++;
+            if (record.contextCache.planHit)
+                planHits++;
+        }
+        // Re-validate provenance at read time: a tampered projection never counts.
+        const provenance = record.runtimeProvenance === undefined ? undefined : parseRuntimeProvenance(record.runtimeProvenance);
+        if (provenance !== undefined &&
+            provenance !== null &&
+            provenance.responseModel !== null &&
+            provenance.responseModel !== provenance.selectedModel) {
+            provenanceMismatchTurns++;
+        }
+        for (const call of record.toolCalls ?? []) {
+            const stats = toolStats.get(call.name) ?? { durations: [], failures: 0 };
+            stats.durations.push(call.durationMs);
+            if (!call.ok)
+                stats.failures++;
+            toolStats.set(call.name, stats);
+        }
+    }
+    turnDurations.sort((a, b) => a - b);
+    firstChunkTimes.sort((a, b) => a - b);
+    const tools = [...toolStats.entries()]
+        .map(([name, stats]) => {
+        const sorted = [...stats.durations].sort((a, b) => a - b);
+        return {
+            name,
+            calls: sorted.length,
+            failures: stats.failures,
+            failureRate: sorted.length === 0 ? 0 : stats.failures / sorted.length,
+            p50Ms: percentile(sorted, 0.5),
+            p95Ms: percentile(sorted, 0.95),
+            totalMs: sorted.reduce((sum, value) => sum + value, 0),
+        };
+    })
+        .sort((a, b) => b.totalMs - a.totalMs || a.name.localeCompare(b.name));
+    const promptSideTotal = totals.input + totals.cacheRead;
+    return {
+        turns: records.length,
+        sessions: sessions.size,
+        models: [...models].sort(),
+        totalCostUsd: totals.costUsd,
+        totals,
+        turnDurationP50Ms: percentile(turnDurations, 0.5),
+        turnDurationP95Ms: percentile(turnDurations, 0.95),
+        timeToFirstChunkP50Ms: firstChunkTimes.length > 0 ? percentile(firstChunkTimes, 0.5) : undefined,
+        cacheReadShare: promptSideTotal === 0 ? 0 : totals.cacheRead / promptSideTotal,
+        compactions,
+        failovers,
+        contextCachePlanHitRate: planObservations === 0 ? undefined : planHits / planObservations,
+        provenanceMismatchTurns,
+        tools,
+        malformedLines,
+    };
+}
+/** Read and summarize a metrics file. A missing file summarizes as zero turns. */
+export function summarizeTurnMetricsFile(filePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(filePath, "utf8");
+    }
+    catch {
+        return summarizeTurnMetrics([]);
+    }
+    return summarizeTurnMetrics(raw.split("\n"));
+}
+//# sourceMappingURL=turn-metrics.js.map

package/dist/core/turn-metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-metrics.js","sourceRoot":"","sources":["../../src/core/turn-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAA0B,MAAM,yBAAyB,CAAC;AAEzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAA6B,CAAC;AACzE,oDAAoD;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACzD,wFAAwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AA+CnC,SAAS,aAAa,CAAC,KAAyB,EAAsB;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,SAAS,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACvG;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAsB,EAAoB;IAC/E,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC,CAAC;IACJ,MAAM,iBAAiB,GACtB,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrG,gFAAgF;IAChF,0DAA0D;IAC1D,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC7D,OAAO;QACN,GAAG,IAAI;QACP,aAAa,EAAE,2BAA2B;QAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACtE,SAAS;QACT,aAAa,EAAE,SAAS,CAAC,MAAM;QAC/B,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM;QAC7D,GAAG,CAAC,iBAAiB,KAAK,IAAI,IAAI,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;KAC/F,CAAC;AAAA,CACF;AAQD;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACV,QAAQ,CAAS;IACjB,QAAQ,CAAS;IAC1B,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC,CAAC;IAEpB,YAAY,OAA+B,EAAE;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,yBAAyB,CAAC,CAAC;IAAA,CAC9E;IAED,IAAI,IAAI,GAAW;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC;IAAA,CACrB;IAED,iDAAiD;IACjD,IAAI,YAAY,GAAW;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC;IAAA,CACpB;IAED,uDAAuD;IACvD,IAAI,YAAY,GAAW;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC;IAAA,CACpB;IAED,kEAAkE;IAClE,MAAM,CAAC,KAAsB,EAAW;QACvC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACJ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACrD,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACd,CAAC;IAAA,CACD;IAEO,cAAc,CAAC,aAAqB,EAAQ;QACnD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,eAAe;QACxB,CAAC;QACD,IAAI,IAAI,GAAG,aAAa,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAClD,IAAI,CAAC;YACJ,qFAAqF;YACrF,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACR,iEAAiE;QAClE,CAAC;IAAA,CACD;CACD;AAgCD,SAAS,UAAU,CAAC,MAAyB,EAAE,QAAgB,EAAU;IACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CACrB;AAED,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,WAAW,CAAC,IAAY,EAAgC;IAChE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,2BAA2B;QAAE,OAAO,SAAS,CAAC;IAChG,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpG,OAAO,MAAqC,CAAC;AAAA,CAC7C;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB,EAAsB;IAClF,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YAC5B,cAAc,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAChF,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqD,CAAC;IAC/E,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAEhC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YACrC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAC3C,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAC7C,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnG,IAAI,MAAM,CAAC,SAAS;YAAE,WAAW,EAAE,CAAC;QACpC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,gBAAgB,EAAE,CAAC;YACnB,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO;gBAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QACD,2EAA2E;QAC3E,MAAM,UAAU,GACf,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACvG,IACC,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,IAAI;YACnB,UAAU,CAAC,aAAa,KAAK,IAAI;YACjC,UAAU,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa,EACpD,CAAC;YACF,uBAAuB,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACzE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;IAED,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtC,MAAM,KAAK,GAAoB,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,OAAO;YACN,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;YACrE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;YAC9B,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;SACtD,CAAC;IAAA,CACF,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;IACxD,OAAO;QACN,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;QAC1B,YAAY,EAAE,MAAM,CAAC,OAAO;QAC5B,MAAM;QACN,iBAAiB,EAAE,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC;QACjD,iBAAiB,EAAE,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC;QAClD,qBAAqB,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAChG,cAAc,EAAE,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,eAAe;QAC9E,WAAW;QACX,SAAS;QACT,uBAAuB,EAAE,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,gBAAgB;QACzF,uBAAuB;QACvB,KAAK;QACL,cAAc;KACd,CAAC;AAAA,CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAsB;IAC9E,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CAC7C","sourcesContent":["/**\n * Per-turn runtime metrics.\n *\n * Before this, `telemetry.ts` covered install opt-in and nothing else, and\n * `run-journal.ts` recorded a hash-chained *integrity* log (run started /\n * finished / tool timeout). Neither could answer the questions that actually\n * drive harness work: which tools fail, how long they take, what a turn costs,\n * and whether the context cache is doing anything.\n *\n * Shape: one JSON object per line under `<cwd>/.omk/metrics/turns.jsonl`.\n * Append-only, bounded by size with a single rotation, and never load-bearing —\n * a failed write is dropped, never surfaced as a turn error.\n *\n * Privacy: records counts, durations, ids, and error *classes*. It never\n * records prompt text, tool arguments, tool output, or file contents. Tool\n * error strings are truncated and kept only to distinguish failure modes.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { parseRuntimeProvenance, type RuntimeProvenance } from \"./runtime-provenance.ts\";\n\nexport const TURN_METRICS_SCHEMA_VERSION = \"omk-turn-metrics-1\" as const;\n/** Rotate once the active file passes this size. */\nexport const DEFAULT_MAX_METRICS_BYTES = 8 * 1024 * 1024;\n/** Cap on a retained error string. Enough to classify, too short to carry a payload. */\nexport const MAX_ERROR_CHARS = 200;\n\nexport interface ToolCallMetric {\n\treadonly name: string;\n\treadonly durationMs: number;\n\treadonly ok: boolean;\n\t/** Truncated failure text, present only when `ok` is false. */\n\treadonly error?: string;\n}\n\nexport interface TurnUsageMetric {\n\treadonly input: number;\n\treadonly output: number;\n\treadonly cacheRead: number;\n\treadonly cacheWrite: number;\n\treadonly costUsd: number;\n}\n\nexport interface TurnMetricInput {\n\treadonly sessionId: string;\n\treadonly turnIndex: number;\n\treadonly provider?: string;\n\treadonly model?: string;\n\treadonly startedAtEpochMs: number;\n\treadonly endedAtEpochMs: number;\n\t/** Time to the first streamed assistant chunk, when observed. */\n\treadonly timeToFirstChunkMs?: number;\n\treadonly usage?: TurnUsageMetric;\n\treadonly stopReason?: string;\n\treadonly toolCalls?: readonly ToolCallMetric[];\n\t/** Whether compaction ran during this turn. */\n\treadonly compacted?: boolean;\n\t/** Provider failover attempts made during this turn. */\n\treadonly failovers?: number;\n\t/** Context-budget cache outcome for the turn's prompt build. */\n\treadonly contextCache?: { readonly planHit: boolean; readonly hits: number; readonly misses: number };\n\t/** Requested/selected/response model and thinking projection. Advisory metadata only. */\n\treadonly runtimeProvenance?: RuntimeProvenance;\n}\n\nexport interface TurnMetricRecord extends TurnMetricInput {\n\treadonly schemaVersion: typeof TURN_METRICS_SCHEMA_VERSION;\n\treadonly durationMs: number;\n\treadonly toolCallCount: number;\n\treadonly toolFailureCount: number;\n}\n\nfunction truncateError(value: string | undefined): string | undefined {\n\tif (value === undefined) return undefined;\n\tconst collapsed = value.replace(/\\s+/gu, \" \").trim();\n\tif (collapsed.length === 0) return undefined;\n\treturn collapsed.length > MAX_ERROR_CHARS ? `${collapsed.slice(0, MAX_ERROR_CHARS)}\\u2026` : collapsed;\n}\n\n/**\n * Build the record written for one turn. Pure: no clock, no filesystem, so the\n * derived fields can be asserted directly.\n */\nexport function buildTurnMetricRecord(input: TurnMetricInput): TurnMetricRecord {\n\tconst toolCalls = (input.toolCalls ?? []).map((call) => ({\n\t\tname: call.name,\n\t\tdurationMs: Math.max(0, Math.round(call.durationMs)),\n\t\tok: call.ok,\n\t\t...(call.ok ? {} : { error: truncateError(call.error) }),\n\t}));\n\tconst runtimeProvenance =\n\t\tinput.runtimeProvenance === undefined ? undefined : parseRuntimeProvenance(input.runtimeProvenance);\n\t// Spread the raw input minus its projection: a validated projection is re-added\n\t// below, an invalid one is dropped rather than persisted.\n\tconst { runtimeProvenance: _rawProvenance, ...rest } = input;\n\treturn {\n\t\t...rest,\n\t\tschemaVersion: TURN_METRICS_SCHEMA_VERSION,\n\t\tdurationMs: Math.max(0, input.endedAtEpochMs - input.startedAtEpochMs),\n\t\ttoolCalls,\n\t\ttoolCallCount: toolCalls.length,\n\t\ttoolFailureCount: toolCalls.filter((call) => !call.ok).length,\n\t\t...(runtimeProvenance === null || runtimeProvenance === undefined ? {} : { runtimeProvenance }),\n\t};\n}\n\nexport interface TurnMetricsSinkOptions {\n\treadonly dir: string;\n\treadonly maxBytes?: number;\n\treadonly fileName?: string;\n}\n\n/**\n * Append-only JSONL sink. Writes are synchronous and best-effort: metrics must\n * never be the reason a turn fails, so every filesystem error is swallowed and\n * counted instead of thrown.\n */\nexport class TurnMetricsSink {\n\tprivate readonly filePath: string;\n\tprivate readonly maxBytes: number;\n\tprivate dropped = 0;\n\tprivate written = 0;\n\n\tconstructor(options: TurnMetricsSinkOptions) {\n\t\tthis.filePath = path.join(options.dir, options.fileName ?? \"turns.jsonl\");\n\t\tthis.maxBytes = Math.max(1024, options.maxBytes ?? DEFAULT_MAX_METRICS_BYTES);\n\t}\n\n\tget path(): string {\n\t\treturn this.filePath;\n\t}\n\n\t/** Records written successfully this process. */\n\tget writtenCount(): number {\n\t\treturn this.written;\n\t}\n\n\t/** Records lost to a filesystem error this process. */\n\tget droppedCount(): number {\n\t\treturn this.dropped;\n\t}\n\n\t/** Append one turn. Returns `true` when the line reached disk. */\n\trecord(input: TurnMetricInput): boolean {\n\t\tlet line: string;\n\t\ttry {\n\t\t\tline = `${JSON.stringify(buildTurnMetricRecord(input))}\\n`;\n\t\t} catch {\n\t\t\tthis.dropped++;\n\t\t\treturn false;\n\t\t}\n\t\ttry {\n\t\t\tfs.mkdirSync(path.dirname(this.filePath), { recursive: true });\n\t\t\tthis.rotateIfNeeded(Buffer.byteLength(line, \"utf8\"));\n\t\t\tfs.appendFileSync(this.filePath, line, { encoding: \"utf8\", mode: 0o600 });\n\t\t\tthis.written++;\n\t\t\treturn true;\n\t\t} catch {\n\t\t\tthis.dropped++;\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tprivate rotateIfNeeded(incomingBytes: number): void {\n\t\tlet size: number;\n\t\ttry {\n\t\t\tsize = fs.statSync(this.filePath).size;\n\t\t} catch {\n\t\t\treturn; // No file yet.\n\t\t}\n\t\tif (size + incomingBytes <= this.maxBytes) return;\n\t\ttry {\n\t\t\t// Single generation: the previous file is replaced, so disk use stays bounded at 2x.\n\t\t\tfs.renameSync(this.filePath, `${this.filePath}.1`);\n\t\t} catch {\n\t\t\t// Rotation failure is not fatal; the next append still succeeds.\n\t\t}\n\t}\n}\n\nexport interface ToolAggregate {\n\treadonly name: string;\n\treadonly calls: number;\n\treadonly failures: number;\n\treadonly failureRate: number;\n\treadonly p50Ms: number;\n\treadonly p95Ms: number;\n\treadonly totalMs: number;\n}\n\nexport interface TurnMetricsSummary {\n\treadonly turns: number;\n\treadonly sessions: number;\n\treadonly models: readonly string[];\n\treadonly totalCostUsd: number;\n\treadonly totals: TurnUsageMetric;\n\treadonly turnDurationP50Ms: number;\n\treadonly turnDurationP95Ms: number;\n\treadonly timeToFirstChunkP50Ms?: number;\n\treadonly cacheReadShare: number;\n\treadonly compactions: number;\n\treadonly failovers: number;\n\treadonly contextCachePlanHitRate?: number;\n\t/** Turns where a valid projection's response model differs from the selected model. */\n\treadonly provenanceMismatchTurns: number;\n\treadonly tools: readonly ToolAggregate[];\n\t/** Lines that could not be parsed as a metric record. */\n\treadonly malformedLines: number;\n}\n\nfunction percentile(sorted: readonly number[], fraction: number): number {\n\tif (sorted.length === 0) return 0;\n\tconst index = Math.min(sorted.length - 1, Math.max(0, Math.ceil(fraction * sorted.length) - 1));\n\treturn sorted[index];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseRecord(line: string): TurnMetricRecord | undefined {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(line);\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (!isRecord(parsed) || parsed.schemaVersion !== TURN_METRICS_SCHEMA_VERSION) return undefined;\n\tif (typeof parsed.turnIndex !== \"number\" || typeof parsed.durationMs !== \"number\") return undefined;\n\treturn parsed as unknown as TurnMetricRecord;\n}\n\n/**\n * Aggregate JSONL lines into a summary. Malformed lines are counted rather than\n * discarded silently, so a truncated tail is visible instead of pretending the\n * data is complete.\n */\nexport function summarizeTurnMetrics(lines: readonly string[]): TurnMetricsSummary {\n\tconst records: TurnMetricRecord[] = [];\n\tlet malformedLines = 0;\n\tfor (const line of lines) {\n\t\tconst trimmed = line.trim();\n\t\tif (trimmed.length === 0) continue;\n\t\tconst record = parseRecord(trimmed);\n\t\tif (record) records.push(record);\n\t\telse malformedLines++;\n\t}\n\n\tconst sessions = new Set<string>();\n\tconst models = new Set<string>();\n\tconst totals = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, costUsd: 0 };\n\tconst turnDurations: number[] = [];\n\tconst firstChunkTimes: number[] = [];\n\tconst toolStats = new Map<string, { durations: number[]; failures: number }>();\n\tlet compactions = 0;\n\tlet failovers = 0;\n\tlet planHits = 0;\n\tlet planObservations = 0;\n\tlet provenanceMismatchTurns = 0;\n\n\tfor (const record of records) {\n\t\tsessions.add(record.sessionId);\n\t\tif (record.model) models.add(record.provider ? `${record.provider}/${record.model}` : record.model);\n\t\tif (record.usage) {\n\t\t\ttotals.input += record.usage.input;\n\t\t\ttotals.output += record.usage.output;\n\t\t\ttotals.cacheRead += record.usage.cacheRead;\n\t\t\ttotals.cacheWrite += record.usage.cacheWrite;\n\t\t\ttotals.costUsd += record.usage.costUsd;\n\t\t}\n\t\tturnDurations.push(record.durationMs);\n\t\tif (typeof record.timeToFirstChunkMs === \"number\") firstChunkTimes.push(record.timeToFirstChunkMs);\n\t\tif (record.compacted) compactions++;\n\t\tfailovers += record.failovers ?? 0;\n\t\tif (record.contextCache) {\n\t\t\tplanObservations++;\n\t\t\tif (record.contextCache.planHit) planHits++;\n\t\t}\n\t\t// Re-validate provenance at read time: a tampered projection never counts.\n\t\tconst provenance =\n\t\t\trecord.runtimeProvenance === undefined ? undefined : parseRuntimeProvenance(record.runtimeProvenance);\n\t\tif (\n\t\t\tprovenance !== undefined &&\n\t\t\tprovenance !== null &&\n\t\t\tprovenance.responseModel !== null &&\n\t\t\tprovenance.responseModel !== provenance.selectedModel\n\t\t) {\n\t\t\tprovenanceMismatchTurns++;\n\t\t}\n\t\tfor (const call of record.toolCalls ?? []) {\n\t\t\tconst stats = toolStats.get(call.name) ?? { durations: [], failures: 0 };\n\t\t\tstats.durations.push(call.durationMs);\n\t\t\tif (!call.ok) stats.failures++;\n\t\t\ttoolStats.set(call.name, stats);\n\t\t}\n\t}\n\n\tturnDurations.sort((a, b) => a - b);\n\tfirstChunkTimes.sort((a, b) => a - b);\n\n\tconst tools: ToolAggregate[] = [...toolStats.entries()]\n\t\t.map(([name, stats]) => {\n\t\t\tconst sorted = [...stats.durations].sort((a, b) => a - b);\n\t\t\treturn {\n\t\t\t\tname,\n\t\t\t\tcalls: sorted.length,\n\t\t\t\tfailures: stats.failures,\n\t\t\t\tfailureRate: sorted.length === 0 ? 0 : stats.failures / sorted.length,\n\t\t\t\tp50Ms: percentile(sorted, 0.5),\n\t\t\t\tp95Ms: percentile(sorted, 0.95),\n\t\t\t\ttotalMs: sorted.reduce((sum, value) => sum + value, 0),\n\t\t\t};\n\t\t})\n\t\t.sort((a, b) => b.totalMs - a.totalMs || a.name.localeCompare(b.name));\n\n\tconst promptSideTotal = totals.input + totals.cacheRead;\n\treturn {\n\t\tturns: records.length,\n\t\tsessions: sessions.size,\n\t\tmodels: [...models].sort(),\n\t\ttotalCostUsd: totals.costUsd,\n\t\ttotals,\n\t\tturnDurationP50Ms: percentile(turnDurations, 0.5),\n\t\tturnDurationP95Ms: percentile(turnDurations, 0.95),\n\t\ttimeToFirstChunkP50Ms: firstChunkTimes.length > 0 ? percentile(firstChunkTimes, 0.5) : undefined,\n\t\tcacheReadShare: promptSideTotal === 0 ? 0 : totals.cacheRead / promptSideTotal,\n\t\tcompactions,\n\t\tfailovers,\n\t\tcontextCachePlanHitRate: planObservations === 0 ? undefined : planHits / planObservations,\n\t\tprovenanceMismatchTurns,\n\t\ttools,\n\t\tmalformedLines,\n\t};\n}\n\n/** Read and summarize a metrics file. A missing file summarizes as zero turns. */\nexport function summarizeTurnMetricsFile(filePath: string): TurnMetricsSummary {\n\tlet raw: string;\n\ttry {\n\t\traw = fs.readFileSync(filePath, \"utf8\");\n\t} catch {\n\t\treturn summarizeTurnMetrics([]);\n\t}\n\treturn summarizeTurnMetrics(raw.split(\"\\n\"));\n}\n"]}

package/dist/core/verified-bash-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verified-bash-runtime.d.ts","sourceRoot":"","sources":["../../src/core/verified-bash-runtime.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,wBAAgB,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAGvF;AAaD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAUzG","sourcesContent":["/**\n * Default-on gate for the verified bash adapter (opt-out via OMK_VERIFIED_BASH=0).\n *\n * Mirrors ADR-OMP-009: the receipt-bound path is the default experience; the\n * exact legacy unverified path remains available as a byte-identical rollback.\n */\nimport { spawnSync } from \"node:child_process\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\n\nexport function isVerifiedBashEnabled(env?: Record<string, string | undefined>): boolean {\n\tconst source: Record<string, string | undefined> = env ?? process.env;\n\treturn source.OMK_VERIFIED_BASH !== \"0\";\n}\n\n// ---------------------------------------------------------------------------\n// Git-aware session workspace scope (bounded, TTL-cached)\n// ---------------------------------------------------------------------------\n\nconst SCOPE_TTL_MS = 1_000;\nconst SCOPE_CACHE_MAX = 8;\nconst SCOPE_MAX_PATHS = 32;\nconst GIT_TIMEOUT_MS = 1_500;\n\nconst scopeCache = new Map<string, { at: number; scope: WorkspaceScope }>();\n\n/**\n * Workspace scope for session bash receipts. Inside a git worktree the scope\n * root is the toplevel and `artifactPaths` is the current dirty set (staged,\n * modified, untracked; capped and sorted), which lets `captureWorkspaceFingerprint`\n * bind HEAD plus a scope-limited dirty digest. Outside git, falls back to an\n * empty artifact set under `cwd`. Never throws.\n */\nexport function resolveSessionWorkspaceScope(cwd: string, options?: { maxPaths?: number }): WorkspaceScope {\n\tconst cached = scopeCache.get(cwd);\n\tif (cached && Date.now() - cached.at < SCOPE_TTL_MS) return cached.scope;\n\tconst scope = computeSessionWorkspaceScope(cwd, options?.maxPaths ?? SCOPE_MAX_PATHS);\n\tif (scopeCache.size >= SCOPE_CACHE_MAX) {\n\t\tconst oldest = scopeCache.keys().next().value;\n\t\tif (oldest !== undefined) scopeCache.delete(oldest);\n\t}\n\tscopeCache.set(cwd, { at: Date.now(), scope });\n\treturn scope;\n}\n\nfunction computeSessionWorkspaceScope(cwd: string, maxPaths: number): WorkspaceScope {\n\ttry {\n\t\tconst top = spawnSync(\"git\", [\"-C\", cwd, \"rev-parse\", \"--show-toplevel\"], {\n\t\t\tencoding: \"utf8\",\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (top.status !== 0 || typeof top.stdout !== \"string\") return { root: cwd, artifactPaths: [] };\n\t\tconst root = top.stdout.trim();\n\t\tif (root.length === 0) return { root: cwd, artifactPaths: [] };\n\t\tconst status = spawnSync(\"git\", [\"-C\", cwd, \"status\", \"--porcelain=v1\", \"-z\", \"--untracked-files=normal\"], {\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tmaxBuffer: 4 * 1024 * 1024,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (status.status !== 0 || !status.stdout) return { root, artifactPaths: [] };\n\t\tconst fields = status.stdout.toString(\"utf8\").split(\"\\0\");\n\t\tconst paths: string[] = [];\n\t\tfor (let index = 0; index < fields.length; index++) {\n\t\t\tconst field = fields[index];\n\t\t\tif (field.length < 4) continue;\n\t\t\tconst xy = field.slice(0, 2);\n\t\t\tif (xy === \"!!\") continue;\n\t\t\tif (xy.includes(\"R\")) index++; // rename: consume the source path field too\n\t\t\tconst artifact = field.slice(3);\n\t\t\tif (artifact.length > 0) paths.push(artifact);\n\t\t}\n\t\tconst artifactPaths = [...new Set(paths)].sort().slice(0, maxPaths);\n\t\treturn { root, artifactPaths };\n\t} catch {\n\t\treturn { root: cwd, artifactPaths: [] };\n\t}\n}\n"]}
+{"version":3,"file":"verified-bash-runtime.d.ts","sourceRoot":"","sources":["../../src/core/verified-bash-runtime.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,wBAAgB,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAGvF;AAaD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAUzG","sourcesContent":["/**\n * Default-on gate for the verified bash adapter (opt-out via OMK_VERIFIED_BASH=0).\n *\n * Mirrors ADR-OMP-009: the receipt-bound path is the default experience; the\n * exact legacy unverified path remains available as a byte-identical rollback.\n */\nimport { spawnSync } from \"node:child_process\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\n\nexport function isVerifiedBashEnabled(env?: Record<string, string | undefined>): boolean {\n\tconst source: Record<string, string | undefined> = env ?? process.env;\n\treturn source.OMK_VERIFIED_BASH !== \"0\";\n}\n\n// ---------------------------------------------------------------------------\n// Git-aware session workspace scope (bounded, TTL-cached)\n// ---------------------------------------------------------------------------\n\nconst SCOPE_TTL_MS = 1_000;\nconst SCOPE_CACHE_MAX = 8;\nconst SCOPE_MAX_PATHS = 32;\nconst GIT_TIMEOUT_MS = 1_500;\n\nconst scopeCache = new Map<string, { at: number; scope: WorkspaceScope }>();\n\n/**\n * Workspace scope for session bash receipts. Inside a git worktree the scope\n * root is the toplevel and `artifactPaths` is the current dirty set (staged,\n * modified, untracked; capped and sorted), which lets `captureWorkspaceFingerprint`\n * bind HEAD plus a scope-limited dirty digest. Outside git, falls back to an\n * empty artifact set under `cwd`. Never throws.\n */\nexport function resolveSessionWorkspaceScope(cwd: string, options?: { maxPaths?: number }): WorkspaceScope {\n\tconst cached = scopeCache.get(cwd);\n\tif (cached && Date.now() - cached.at < SCOPE_TTL_MS) return cached.scope;\n\tconst scope = computeSessionWorkspaceScope(cwd, options?.maxPaths ?? SCOPE_MAX_PATHS);\n\tif (scopeCache.size >= SCOPE_CACHE_MAX) {\n\t\tconst oldest = scopeCache.keys().next().value;\n\t\tif (oldest !== undefined) scopeCache.delete(oldest);\n\t}\n\tscopeCache.set(cwd, { at: Date.now(), scope });\n\treturn scope;\n}\n\nfunction computeSessionWorkspaceScope(cwd: string, maxPaths: number): WorkspaceScope {\n\ttry {\n\t\tconst top = spawnSync(\"git\", [\"-C\", cwd, \"rev-parse\", \"--show-toplevel\"], {\n\t\t\tencoding: \"utf8\",\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (top.status !== 0 || typeof top.stdout !== \"string\") return { root: cwd, artifactPaths: [] };\n\t\tconst root = top.stdout.trim();\n\t\tif (root.length === 0) return { root: cwd, artifactPaths: [] };\n\t\t// File-granular untracked listing: -unormal emits untracked directories as\n\t\t// `dir/`, whose trailing slash fails assertNormalizedArtifactPath downstream\n\t\t// and kills every verified bash call in the session.\n\t\tconst status = spawnSync(\"git\", [\"-C\", cwd, \"status\", \"--porcelain=v1\", \"-z\", \"--untracked-files=all\"], {\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tmaxBuffer: 4 * 1024 * 1024,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (status.status !== 0 || !status.stdout) return { root, artifactPaths: [] };\n\t\tconst fields = status.stdout.toString(\"utf8\").split(\"\\0\");\n\t\tconst paths: string[] = [];\n\t\tfor (let index = 0; index < fields.length; index++) {\n\t\t\tconst field = fields[index];\n\t\t\tif (field.length < 4) continue;\n\t\t\tconst xy = field.slice(0, 2);\n\t\t\tif (xy === \"!!\") continue;\n\t\t\tif (xy.includes(\"R\") || xy.includes(\"C\")) index++; // rename/copy: consume the source path field too\n\t\t\tconst artifact = field.slice(3);\n\t\t\t// Trailing-slash entries survive -uall only for untracked nested\n\t\t\t// repositories; their contents are outside the parent's dirty digest\n\t\t\t// and cannot be file-hashed, so exclude them from the scope.\n\t\t\tif (artifact.length > 0 && !artifact.endsWith(\"/\")) paths.push(artifact);\n\t\t}\n\t\tconst artifactPaths = [...new Set(paths)].sort().slice(0, maxPaths);\n\t\treturn { root, artifactPaths };\n\t} catch {\n\t\treturn { root: cwd, artifactPaths: [] };\n\t}\n}\n"]}

package/dist/core/verified-bash-runtime.js

@@ -49,7 +49,10 @@ function computeSessionWorkspaceScope(cwd, maxPaths) {
         const root = top.stdout.trim();
         if (root.length === 0)
             return { root: cwd, artifactPaths: [] };
-        const status = spawnSync("git", ["-C", cwd, "status", "--porcelain=v1", "-z", "--untracked-files=normal"], {
+        // File-granular untracked listing: -unormal emits untracked directories as
+        // `dir/`, whose trailing slash fails assertNormalizedArtifactPath downstream
+        // and kills every verified bash call in the session.
+        const status = spawnSync("git", ["-C", cwd, "status", "--porcelain=v1", "-z", "--untracked-files=all"], {
             timeout: GIT_TIMEOUT_MS,
             maxBuffer: 4 * 1024 * 1024,
             stdio: ["ignore", "pipe", "ignore"],
@@ -65,10 +68,13 @@ function computeSessionWorkspaceScope(cwd, maxPaths) {
             const xy = field.slice(0, 2);
             if (xy === "!!")
                 continue;
-            if (xy.includes("R"))
-                index++; // rename: consume the source path field too
+            if (xy.includes("R") || xy.includes("C"))
+                index++; // rename/copy: consume the source path field too
             const artifact = field.slice(3);
-            if (artifact.length > 0)
+            // Trailing-slash entries survive -uall only for untracked nested
+            // repositories; their contents are outside the parent's dirty digest
+            // and cannot be file-hashed, so exclude them from the scope.
+            if (artifact.length > 0 && !artifact.endsWith("/"))
                 paths.push(artifact);
         }
         const artifactPaths = [...new Set(paths)].sort().slice(0, maxPaths);

package/dist/core/verified-bash-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"verified-bash-runtime.js","sourceRoot":"","sources":["../../src/core/verified-bash-runtime.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,UAAU,qBAAqB,CAAC,GAAwC,EAAW;IACxF,MAAM,MAAM,GAAuC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtE,OAAO,MAAM,CAAC,iBAAiB,KAAK,GAAG,CAAC;AAAA,CACxC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,OAA+B,EAAkB;IAC1G,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACzE,MAAM,KAAK,GAAG,4BAA4B,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,eAAe,CAAC,CAAC;IACtF,IAAI,UAAU,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,4BAA4B,CAAC,GAAW,EAAE,QAAgB,EAAkB;IACpF,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE;YACzE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE;YAC1G,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,IAAI,EAAE,KAAK,IAAI;gBAAE,SAAS;YAC1B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC,CAAC,4CAA4C;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;AAAA,CACD","sourcesContent":["/**\n * Default-on gate for the verified bash adapter (opt-out via OMK_VERIFIED_BASH=0).\n *\n * Mirrors ADR-OMP-009: the receipt-bound path is the default experience; the\n * exact legacy unverified path remains available as a byte-identical rollback.\n */\nimport { spawnSync } from \"node:child_process\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\n\nexport function isVerifiedBashEnabled(env?: Record<string, string | undefined>): boolean {\n\tconst source: Record<string, string | undefined> = env ?? process.env;\n\treturn source.OMK_VERIFIED_BASH !== \"0\";\n}\n\n// ---------------------------------------------------------------------------\n// Git-aware session workspace scope (bounded, TTL-cached)\n// ---------------------------------------------------------------------------\n\nconst SCOPE_TTL_MS = 1_000;\nconst SCOPE_CACHE_MAX = 8;\nconst SCOPE_MAX_PATHS = 32;\nconst GIT_TIMEOUT_MS = 1_500;\n\nconst scopeCache = new Map<string, { at: number; scope: WorkspaceScope }>();\n\n/**\n * Workspace scope for session bash receipts. Inside a git worktree the scope\n * root is the toplevel and `artifactPaths` is the current dirty set (staged,\n * modified, untracked; capped and sorted), which lets `captureWorkspaceFingerprint`\n * bind HEAD plus a scope-limited dirty digest. Outside git, falls back to an\n * empty artifact set under `cwd`. Never throws.\n */\nexport function resolveSessionWorkspaceScope(cwd: string, options?: { maxPaths?: number }): WorkspaceScope {\n\tconst cached = scopeCache.get(cwd);\n\tif (cached && Date.now() - cached.at < SCOPE_TTL_MS) return cached.scope;\n\tconst scope = computeSessionWorkspaceScope(cwd, options?.maxPaths ?? SCOPE_MAX_PATHS);\n\tif (scopeCache.size >= SCOPE_CACHE_MAX) {\n\t\tconst oldest = scopeCache.keys().next().value;\n\t\tif (oldest !== undefined) scopeCache.delete(oldest);\n\t}\n\tscopeCache.set(cwd, { at: Date.now(), scope });\n\treturn scope;\n}\n\nfunction computeSessionWorkspaceScope(cwd: string, maxPaths: number): WorkspaceScope {\n\ttry {\n\t\tconst top = spawnSync(\"git\", [\"-C\", cwd, \"rev-parse\", \"--show-toplevel\"], {\n\t\t\tencoding: \"utf8\",\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (top.status !== 0 || typeof top.stdout !== \"string\") return { root: cwd, artifactPaths: [] };\n\t\tconst root = top.stdout.trim();\n\t\tif (root.length === 0) return { root: cwd, artifactPaths: [] };\n\t\tconst status = spawnSync(\"git\", [\"-C\", cwd, \"status\", \"--porcelain=v1\", \"-z\", \"--untracked-files=normal\"], {\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tmaxBuffer: 4 * 1024 * 1024,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (status.status !== 0 || !status.stdout) return { root, artifactPaths: [] };\n\t\tconst fields = status.stdout.toString(\"utf8\").split(\"\\0\");\n\t\tconst paths: string[] = [];\n\t\tfor (let index = 0; index < fields.length; index++) {\n\t\t\tconst field = fields[index];\n\t\t\tif (field.length < 4) continue;\n\t\t\tconst xy = field.slice(0, 2);\n\t\t\tif (xy === \"!!\") continue;\n\t\t\tif (xy.includes(\"R\")) index++; // rename: consume the source path field too\n\t\t\tconst artifact = field.slice(3);\n\t\t\tif (artifact.length > 0) paths.push(artifact);\n\t\t}\n\t\tconst artifactPaths = [...new Set(paths)].sort().slice(0, maxPaths);\n\t\treturn { root, artifactPaths };\n\t} catch {\n\t\treturn { root: cwd, artifactPaths: [] };\n\t}\n}\n"]}
+{"version":3,"file":"verified-bash-runtime.js","sourceRoot":"","sources":["../../src/core/verified-bash-runtime.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,UAAU,qBAAqB,CAAC,GAAwC,EAAW;IACxF,MAAM,MAAM,GAAuC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtE,OAAO,MAAM,CAAC,iBAAiB,KAAK,GAAG,CAAC;AAAA,CACxC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,OAA+B,EAAkB;IAC1G,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACzE,MAAM,KAAK,GAAG,4BAA4B,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,eAAe,CAAC,CAAC;IACtF,IAAI,UAAU,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,4BAA4B,CAAC,GAAW,EAAE,QAAgB,EAAkB;IACpF,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE;YACzE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC/D,2EAA2E;QAC3E,6EAA6E;QAC7E,qDAAqD;QACrD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,uBAAuB,CAAC,EAAE;YACvG,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,IAAI,EAAE,KAAK,IAAI;gBAAE,SAAS;YAC1B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC,CAAC,iDAAiD;YACpG,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,iEAAiE;YACjE,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;AAAA,CACD","sourcesContent":["/**\n * Default-on gate for the verified bash adapter (opt-out via OMK_VERIFIED_BASH=0).\n *\n * Mirrors ADR-OMP-009: the receipt-bound path is the default experience; the\n * exact legacy unverified path remains available as a byte-identical rollback.\n */\nimport { spawnSync } from \"node:child_process\";\nimport type { WorkspaceScope } from \"../types/evidence.ts\";\n\nexport function isVerifiedBashEnabled(env?: Record<string, string | undefined>): boolean {\n\tconst source: Record<string, string | undefined> = env ?? process.env;\n\treturn source.OMK_VERIFIED_BASH !== \"0\";\n}\n\n// ---------------------------------------------------------------------------\n// Git-aware session workspace scope (bounded, TTL-cached)\n// ---------------------------------------------------------------------------\n\nconst SCOPE_TTL_MS = 1_000;\nconst SCOPE_CACHE_MAX = 8;\nconst SCOPE_MAX_PATHS = 32;\nconst GIT_TIMEOUT_MS = 1_500;\n\nconst scopeCache = new Map<string, { at: number; scope: WorkspaceScope }>();\n\n/**\n * Workspace scope for session bash receipts. Inside a git worktree the scope\n * root is the toplevel and `artifactPaths` is the current dirty set (staged,\n * modified, untracked; capped and sorted), which lets `captureWorkspaceFingerprint`\n * bind HEAD plus a scope-limited dirty digest. Outside git, falls back to an\n * empty artifact set under `cwd`. Never throws.\n */\nexport function resolveSessionWorkspaceScope(cwd: string, options?: { maxPaths?: number }): WorkspaceScope {\n\tconst cached = scopeCache.get(cwd);\n\tif (cached && Date.now() - cached.at < SCOPE_TTL_MS) return cached.scope;\n\tconst scope = computeSessionWorkspaceScope(cwd, options?.maxPaths ?? SCOPE_MAX_PATHS);\n\tif (scopeCache.size >= SCOPE_CACHE_MAX) {\n\t\tconst oldest = scopeCache.keys().next().value;\n\t\tif (oldest !== undefined) scopeCache.delete(oldest);\n\t}\n\tscopeCache.set(cwd, { at: Date.now(), scope });\n\treturn scope;\n}\n\nfunction computeSessionWorkspaceScope(cwd: string, maxPaths: number): WorkspaceScope {\n\ttry {\n\t\tconst top = spawnSync(\"git\", [\"-C\", cwd, \"rev-parse\", \"--show-toplevel\"], {\n\t\t\tencoding: \"utf8\",\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (top.status !== 0 || typeof top.stdout !== \"string\") return { root: cwd, artifactPaths: [] };\n\t\tconst root = top.stdout.trim();\n\t\tif (root.length === 0) return { root: cwd, artifactPaths: [] };\n\t\t// File-granular untracked listing: -unormal emits untracked directories as\n\t\t// `dir/`, whose trailing slash fails assertNormalizedArtifactPath downstream\n\t\t// and kills every verified bash call in the session.\n\t\tconst status = spawnSync(\"git\", [\"-C\", cwd, \"status\", \"--porcelain=v1\", \"-z\", \"--untracked-files=all\"], {\n\t\t\ttimeout: GIT_TIMEOUT_MS,\n\t\t\tmaxBuffer: 4 * 1024 * 1024,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"ignore\"],\n\t\t});\n\t\tif (status.status !== 0 || !status.stdout) return { root, artifactPaths: [] };\n\t\tconst fields = status.stdout.toString(\"utf8\").split(\"\\0\");\n\t\tconst paths: string[] = [];\n\t\tfor (let index = 0; index < fields.length; index++) {\n\t\t\tconst field = fields[index];\n\t\t\tif (field.length < 4) continue;\n\t\t\tconst xy = field.slice(0, 2);\n\t\t\tif (xy === \"!!\") continue;\n\t\t\tif (xy.includes(\"R\") || xy.includes(\"C\")) index++; // rename/copy: consume the source path field too\n\t\t\tconst artifact = field.slice(3);\n\t\t\t// Trailing-slash entries survive -uall only for untracked nested\n\t\t\t// repositories; their contents are outside the parent's dirty digest\n\t\t\t// and cannot be file-hashed, so exclude them from the scope.\n\t\t\tif (artifact.length > 0 && !artifact.endsWith(\"/\")) paths.push(artifact);\n\t\t}\n\t\tconst artifactPaths = [...new Set(paths)].sort().slice(0, maxPaths);\n\t\treturn { root, artifactPaths };\n\t} catch {\n\t\treturn { root: cwd, artifactPaths: [] };\n\t}\n}\n"]}

package/dist/guardrails/replay-ledger-lock-owner.d.ts

@@ -28,5 +28,12 @@ export declare function lockOwnersEqual(left: LockOwnerSnapshot, right: LockOwne
 export declare function createLockOwner(processIdentity: ReplayLedgerProcessIdentityReader): LockOwner;
 export declare function lockOwnerIsDead(owner: LockOwner, processIdentity: ReplayLedgerProcessIdentityReader): boolean;
 export declare function parseLinuxProcessIdentityStat(stat: string): ReplayLedgerProcessIdentity;
+/**
+ * Parses BSD `ps -o lstart=` output (e.g. `Wed Aug 12 14:30:00 2026`).
+ * lstart is fixed for the lifetime of a pid, so `darwin:<epochMs>` is a
+ * stable per-process-instance token accepted by PROCESS_START_TOKEN.
+ * Empty output means ps matched no process; anything unparseable fails closed.
+ */
+export declare function parseDarwinProcessIdentityLstart(lstart: string): ReplayLedgerProcessIdentity;
 export declare function inspectProcessIdentity(pid: number): ReplayLedgerProcessIdentity;
 //# sourceMappingURL=replay-ledger-lock-owner.d.ts.map

package/dist/guardrails/replay-ledger-lock-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replay-ledger-lock-owner.d.ts","sourceRoot":"","sources":["../../src/guardrails/replay-ledger-lock-owner.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,SAAS,GAAG;IACvB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GACpC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAErC,MAAM,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,2BAA2B,CAAC;AAE7F,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,2BAA2B;CACxC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG5D;AA6CD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAqB7D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAS1F;AAED,wBAAgB,eAAe,CAAC,eAAe,EAAE,iCAAiC,GAAG,SAAS,CAY7F;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,iCAAiC,GAAG,OAAO,CAU7G;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAavF;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,2BAA2B,CAQ/E","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { closeSync, constants as fsConstants, fstatSync, openSync, readFileSync } from \"node:fs\";\n\nconst MAX_LOCK_RECORD_BYTES = 512;\nconst MAX_CLOCK_SKEW_MS = 60_000;\nconst OWNER_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst PROCESS_START_TOKEN = /^[A-Za-z0-9._:-]{1,128}$/;\n\nexport type LockOwner = {\n\treadonly schemaVersion: 2;\n\treadonly pid: number;\n\treadonly processStartToken: string | null;\n\treadonly acquiredAtMs: number;\n\treadonly ownerId: string;\n};\n\nexport type LockOwnerSnapshot = {\n\treadonly owner: LockOwner;\n\treadonly dev: string;\n\treadonly ino: string;\n};\n\nexport type ReplayLedgerProcessIdentity =\n\t| { readonly state: \"present\"; readonly startToken: string }\n\t| { readonly state: \"absent\" }\n\t| { readonly state: \"unavailable\" };\n\nexport type ReplayLedgerProcessIdentityReader = (pid: number) => ReplayLedgerProcessIdentity;\n\nexport class ReplayLedgerLockError extends Error {\n\treadonly name = \"ReplayLedgerLockError\";\n}\n\nexport function errorCode(error: unknown): string | undefined {\n\tif (typeof error !== \"object\" || error === null || !(\"code\" in error)) return undefined;\n\treturn typeof error.code === \"string\" ? error.code : undefined;\n}\n\nfunction ownerInteger(value: unknown): number {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value <= 0) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is invalid\");\n\t}\n\treturn value;\n}\n\nfunction parseOwner(bytes: Buffer): LockOwner {\n\tif (bytes.byteLength === 0 || bytes.byteLength > MAX_LOCK_RECORD_BYTES) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is outside its size bound\");\n\t}\n\tlet value: unknown;\n\ttry {\n\t\tvalue = JSON.parse(bytes.toString(\"utf8\"));\n\t} catch (error) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is malformed\", { cause: error });\n\t}\n\tif (\n\t\ttypeof value !== \"object\" ||\n\t\tvalue === null ||\n\t\tArray.isArray(value) ||\n\t\tObject.keys(value).sort().join(\",\") !== \"acquiredAtMs,ownerId,pid,processStartToken,schemaVersion\" ||\n\t\t!(\"schemaVersion\" in value) ||\n\t\tvalue.schemaVersion !== 2 ||\n\t\t!(\"pid\" in value) ||\n\t\t!(\"processStartToken\" in value) ||\n\t\t!(\"acquiredAtMs\" in value) ||\n\t\t!(\"ownerId\" in value) ||\n\t\ttypeof value.ownerId !== \"string\" ||\n\t\t!OWNER_ID.test(value.ownerId) ||\n\t\t(value.processStartToken !== null &&\n\t\t\t(typeof value.processStartToken !== \"string\" || !PROCESS_START_TOKEN.test(value.processStartToken)))\n\t) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is invalid\");\n\t}\n\tconst pid = ownerInteger(value.pid);\n\tconst acquiredAtMs = ownerInteger(value.acquiredAtMs);\n\tif (acquiredAtMs > Date.now() + MAX_CLOCK_SKEW_MS) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is invalid\");\n\t}\n\treturn { schemaVersion: 2, pid, processStartToken: value.processStartToken, acquiredAtMs, ownerId: value.ownerId };\n}\n\nexport function readLockOwner(path: string): LockOwnerSnapshot {\n\tconst fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));\n\ttry {\n\t\tconst before = fstatSync(fd, { bigint: true });\n\t\tif (!before.isFile() || before.size <= 0n || before.size > BigInt(MAX_LOCK_RECORD_BYTES)) {\n\t\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is outside its size bound\");\n\t\t}\n\t\tconst bytes = readFileSync(fd);\n\t\tconst after = fstatSync(fd, { bigint: true });\n\t\tif (\n\t\t\tbefore.dev !== after.dev ||\n\t\t\tbefore.ino !== after.ino ||\n\t\t\tbefore.size !== after.size ||\n\t\t\tafter.size !== BigInt(bytes.length)\n\t\t) {\n\t\t\tthrow new ReplayLedgerLockError(\"replay lock owner record changed during inspection\");\n\t\t}\n\t\treturn { owner: parseOwner(bytes), dev: String(after.dev), ino: String(after.ino) };\n\t} finally {\n\t\tcloseSync(fd);\n\t}\n}\n\nexport function lockOwnersEqual(left: LockOwnerSnapshot, right: LockOwnerSnapshot): boolean {\n\treturn (\n\t\tleft.dev === right.dev &&\n\t\tleft.ino === right.ino &&\n\t\tleft.owner.ownerId === right.owner.ownerId &&\n\t\tleft.owner.pid === right.owner.pid &&\n\t\tleft.owner.processStartToken === right.owner.processStartToken &&\n\t\tleft.owner.acquiredAtMs === right.owner.acquiredAtMs\n\t);\n}\n\nexport function createLockOwner(processIdentity: ReplayLedgerProcessIdentityReader): LockOwner {\n\tconst identity = processIdentity(process.pid);\n\tif (identity.state !== \"present\" || !PROCESS_START_TOKEN.test(identity.startToken)) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock acquisition requires process-start identity\");\n\t}\n\treturn {\n\t\tschemaVersion: 2,\n\t\tpid: process.pid,\n\t\tprocessStartToken: identity.startToken,\n\t\tacquiredAtMs: Date.now(),\n\t\townerId: randomUUID(),\n\t};\n}\n\nexport function lockOwnerIsDead(owner: LockOwner, processIdentity: ReplayLedgerProcessIdentityReader): boolean {\n\tconst current = processIdentity(owner.pid);\n\tif (current.state === \"unavailable\") {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner liveness could not be established\");\n\t}\n\tif (current.state === \"absent\") return true;\n\tif (owner.processStartToken === null) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock recovery requires process-start identity\");\n\t}\n\treturn current.startToken !== owner.processStartToken;\n}\n\nexport function parseLinuxProcessIdentityStat(stat: string): ReplayLedgerProcessIdentity {\n\tif (stat.length > 4_096) return { state: \"unavailable\" };\n\tconst close = stat.lastIndexOf(\")\");\n\tif (close < 0) return { state: \"unavailable\" };\n\tconst fields = stat\n\t\t.slice(close + 2)\n\t\t.trim()\n\t\t.split(/\\s+/);\n\tif ([\"Z\", \"X\", \"x\"].includes(fields[0] ?? \"\")) return { state: \"absent\" };\n\tconst startTime = fields[19];\n\treturn startTime !== undefined && /^\\d+$/.test(startTime)\n\t\t? { state: \"present\", startToken: `linux:${startTime}` }\n\t\t: { state: \"unavailable\" };\n}\n\nexport function inspectProcessIdentity(pid: number): ReplayLedgerProcessIdentity {\n\tif (process.platform !== \"linux\") return { state: \"unavailable\" };\n\ttry {\n\t\treturn parseLinuxProcessIdentityStat(readFileSync(`/proc/${pid}/stat`, \"utf8\"));\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\treturn errorCode(error) === \"ENOENT\" ? { state: \"absent\" } : { state: \"unavailable\" };\n\t}\n}\n"]}
+{"version":3,"file":"replay-ledger-lock-owner.d.ts","sourceRoot":"","sources":["../../src/guardrails/replay-ledger-lock-owner.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,SAAS,GAAG;IACvB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GACpC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAErC,MAAM,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,2BAA2B,CAAC;AAE7F,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,2BAA2B;CACxC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG5D;AA6CD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAqB7D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAS1F;AAED,wBAAgB,eAAe,CAAC,eAAe,EAAE,iCAAiC,GAAG,SAAS,CAY7F;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,iCAAiC,GAAG,OAAO,CAU7G;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAavF;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAM5F;AAgBD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,2BAA2B,CAS/E","sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { closeSync, constants as fsConstants, fstatSync, openSync, readFileSync } from \"node:fs\";\n\nconst MAX_LOCK_RECORD_BYTES = 512;\nconst MAX_CLOCK_SKEW_MS = 60_000;\n/** Hard bounds on what one `ps` child process may contribute on Darwin. */\nconst DARWIN_PS_TIMEOUT_MS = 5_000;\nconst DARWIN_PS_MAX_OUTPUT_BYTES = 4_096;\nconst MAX_DARWIN_LSTART_CHARS = 512;\nconst OWNER_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst PROCESS_START_TOKEN = /^[A-Za-z0-9._:-]{1,128}$/;\n\nexport type LockOwner = {\n\treadonly schemaVersion: 2;\n\treadonly pid: number;\n\treadonly processStartToken: string | null;\n\treadonly acquiredAtMs: number;\n\treadonly ownerId: string;\n};\n\nexport type LockOwnerSnapshot = {\n\treadonly owner: LockOwner;\n\treadonly dev: string;\n\treadonly ino: string;\n};\n\nexport type ReplayLedgerProcessIdentity =\n\t| { readonly state: \"present\"; readonly startToken: string }\n\t| { readonly state: \"absent\" }\n\t| { readonly state: \"unavailable\" };\n\nexport type ReplayLedgerProcessIdentityReader = (pid: number) => ReplayLedgerProcessIdentity;\n\nexport class ReplayLedgerLockError extends Error {\n\treadonly name = \"ReplayLedgerLockError\";\n}\n\nexport function errorCode(error: unknown): string | undefined {\n\tif (typeof error !== \"object\" || error === null || !(\"code\" in error)) return undefined;\n\treturn typeof error.code === \"string\" ? error.code : undefined;\n}\n\nfunction ownerInteger(value: unknown): number {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value <= 0) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is invalid\");\n\t}\n\treturn value;\n}\n\nfunction parseOwner(bytes: Buffer): LockOwner {\n\tif (bytes.byteLength === 0 || bytes.byteLength > MAX_LOCK_RECORD_BYTES) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is outside its size bound\");\n\t}\n\tlet value: unknown;\n\ttry {\n\t\tvalue = JSON.parse(bytes.toString(\"utf8\"));\n\t} catch (error) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is malformed\", { cause: error });\n\t}\n\tif (\n\t\ttypeof value !== \"object\" ||\n\t\tvalue === null ||\n\t\tArray.isArray(value) ||\n\t\tObject.keys(value).sort().join(\",\") !== \"acquiredAtMs,ownerId,pid,processStartToken,schemaVersion\" ||\n\t\t!(\"schemaVersion\" in value) ||\n\t\tvalue.schemaVersion !== 2 ||\n\t\t!(\"pid\" in value) ||\n\t\t!(\"processStartToken\" in value) ||\n\t\t!(\"acquiredAtMs\" in value) ||\n\t\t!(\"ownerId\" in value) ||\n\t\ttypeof value.ownerId !== \"string\" ||\n\t\t!OWNER_ID.test(value.ownerId) ||\n\t\t(value.processStartToken !== null &&\n\t\t\t(typeof value.processStartToken !== \"string\" || !PROCESS_START_TOKEN.test(value.processStartToken)))\n\t) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is invalid\");\n\t}\n\tconst pid = ownerInteger(value.pid);\n\tconst acquiredAtMs = ownerInteger(value.acquiredAtMs);\n\tif (acquiredAtMs > Date.now() + MAX_CLOCK_SKEW_MS) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is invalid\");\n\t}\n\treturn { schemaVersion: 2, pid, processStartToken: value.processStartToken, acquiredAtMs, ownerId: value.ownerId };\n}\n\nexport function readLockOwner(path: string): LockOwnerSnapshot {\n\tconst fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));\n\ttry {\n\t\tconst before = fstatSync(fd, { bigint: true });\n\t\tif (!before.isFile() || before.size <= 0n || before.size > BigInt(MAX_LOCK_RECORD_BYTES)) {\n\t\t\tthrow new ReplayLedgerLockError(\"replay lock owner record is outside its size bound\");\n\t\t}\n\t\tconst bytes = readFileSync(fd);\n\t\tconst after = fstatSync(fd, { bigint: true });\n\t\tif (\n\t\t\tbefore.dev !== after.dev ||\n\t\t\tbefore.ino !== after.ino ||\n\t\t\tbefore.size !== after.size ||\n\t\t\tafter.size !== BigInt(bytes.length)\n\t\t) {\n\t\t\tthrow new ReplayLedgerLockError(\"replay lock owner record changed during inspection\");\n\t\t}\n\t\treturn { owner: parseOwner(bytes), dev: String(after.dev), ino: String(after.ino) };\n\t} finally {\n\t\tcloseSync(fd);\n\t}\n}\n\nexport function lockOwnersEqual(left: LockOwnerSnapshot, right: LockOwnerSnapshot): boolean {\n\treturn (\n\t\tleft.dev === right.dev &&\n\t\tleft.ino === right.ino &&\n\t\tleft.owner.ownerId === right.owner.ownerId &&\n\t\tleft.owner.pid === right.owner.pid &&\n\t\tleft.owner.processStartToken === right.owner.processStartToken &&\n\t\tleft.owner.acquiredAtMs === right.owner.acquiredAtMs\n\t);\n}\n\nexport function createLockOwner(processIdentity: ReplayLedgerProcessIdentityReader): LockOwner {\n\tconst identity = processIdentity(process.pid);\n\tif (identity.state !== \"present\" || !PROCESS_START_TOKEN.test(identity.startToken)) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock acquisition requires process-start identity\");\n\t}\n\treturn {\n\t\tschemaVersion: 2,\n\t\tpid: process.pid,\n\t\tprocessStartToken: identity.startToken,\n\t\tacquiredAtMs: Date.now(),\n\t\townerId: randomUUID(),\n\t};\n}\n\nexport function lockOwnerIsDead(owner: LockOwner, processIdentity: ReplayLedgerProcessIdentityReader): boolean {\n\tconst current = processIdentity(owner.pid);\n\tif (current.state === \"unavailable\") {\n\t\tthrow new ReplayLedgerLockError(\"replay lock owner liveness could not be established\");\n\t}\n\tif (current.state === \"absent\") return true;\n\tif (owner.processStartToken === null) {\n\t\tthrow new ReplayLedgerLockError(\"replay lock recovery requires process-start identity\");\n\t}\n\treturn current.startToken !== owner.processStartToken;\n}\n\nexport function parseLinuxProcessIdentityStat(stat: string): ReplayLedgerProcessIdentity {\n\tif (stat.length > 4_096) return { state: \"unavailable\" };\n\tconst close = stat.lastIndexOf(\")\");\n\tif (close < 0) return { state: \"unavailable\" };\n\tconst fields = stat\n\t\t.slice(close + 2)\n\t\t.trim()\n\t\t.split(/\\s+/);\n\tif ([\"Z\", \"X\", \"x\"].includes(fields[0] ?? \"\")) return { state: \"absent\" };\n\tconst startTime = fields[19];\n\treturn startTime !== undefined && /^\\d+$/.test(startTime)\n\t\t? { state: \"present\", startToken: `linux:${startTime}` }\n\t\t: { state: \"unavailable\" };\n}\n\n/**\n * Parses BSD `ps -o lstart=` output (e.g. `Wed Aug 12 14:30:00 2026`).\n * lstart is fixed for the lifetime of a pid, so `darwin:<epochMs>` is a\n * stable per-process-instance token accepted by PROCESS_START_TOKEN.\n * Empty output means ps matched no process; anything unparseable fails closed.\n */\nexport function parseDarwinProcessIdentityLstart(lstart: string): ReplayLedgerProcessIdentity {\n\tconst trimmed = lstart.trim();\n\tif (trimmed === \"\") return { state: \"absent\" };\n\tif (trimmed.length > MAX_DARWIN_LSTART_CHARS) return { state: \"unavailable\" };\n\tconst epochMs = Date.parse(trimmed);\n\treturn Number.isFinite(epochMs) ? { state: \"present\", startToken: `darwin:${epochMs}` } : { state: \"unavailable\" };\n}\n\nfunction inspectDarwinProcessIdentity(pid: number): ReplayLedgerProcessIdentity {\n\tif (!Number.isSafeInteger(pid) || pid <= 0) return { state: \"unavailable\" };\n\tconst result = spawnSync(\"ps\", [\"-o\", \"lstart=\", \"-p\", String(pid)], {\n\t\tencoding: \"utf8\",\n\t\ttimeout: DARWIN_PS_TIMEOUT_MS,\n\t\tmaxBuffer: DARWIN_PS_MAX_OUTPUT_BYTES,\n\t});\n\tif (result.error) return { state: \"unavailable\" };\n\t// BSD ps exits 1 when no process matches the pid; other non-zero is fail-closed.\n\tif (result.status === 1) return { state: \"absent\" };\n\tif (result.status !== 0) return { state: \"unavailable\" };\n\treturn parseDarwinProcessIdentityLstart(result.stdout ?? \"\");\n}\n\nexport function inspectProcessIdentity(pid: number): ReplayLedgerProcessIdentity {\n\tif (process.platform === \"darwin\") return inspectDarwinProcessIdentity(pid);\n\tif (process.platform !== \"linux\") return { state: \"unavailable\" };\n\ttry {\n\t\treturn parseLinuxProcessIdentityStat(readFileSync(`/proc/${pid}/stat`, \"utf8\"));\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\treturn errorCode(error) === \"ENOENT\" ? { state: \"absent\" } : { state: \"unavailable\" };\n\t}\n}\n"]}