patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/dist/recipes/pricing/priceTable.js

@@ -0,0 +1,144 @@
+/**
+ * Model price table — cost-aware routing Phase 2 (dormant data).
+ *
+ * A `(model id) → USD-per-million-tokens` table plus a loader. Nothing
+ * consumes it yet; Phase 3 wires `costUsd()` into RunBudget so `budget.usdMax`
+ * can be enforced for *measured* (API) drivers. Lands separately so the price
+ * data can be reviewed for accuracy on its own.
+ *
+ * Design notes (docs/design/cost-aware-routing.md):
+ *   - Prices are DATA, not code, and OVERRIDABLE without a release:
+ *       precedence  env `PATCHWORK_PRICE_TABLE` (path)  >
+ *                   `~/.patchwork/prices.json`          >
+ *                   the built-in table below.
+ *   - FAIL-OPEN everywhere: an unknown model, a malformed override, or a
+ *     missing file never throws — `costUsd` just returns `undefined` (and the
+ *     budget layer treats that as "unpriceable → don't enforce").
+ *   - The built-in default lives here as a TS const (compiled into dist, so it
+ *     is always available at runtime); overrides are JSON read from disk.
+ *   - NO runtime network calls. Prices drift; refresh the const below and bump
+ *     `_generatedAt`. `isPriceTableStale()` is provided for a scheduled check.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * Built-in default prices. **Approximate public list prices** (USD / 1M tokens)
+ * as of `_generatedAt` — VERIFY before relying on a USD cap; they drift, and a
+ * subscription/CLI driver's spend is notional, not real money out. Override via
+ * `~/.patchwork/prices.json` or `PATCHWORK_PRICE_TABLE`.
+ */
+export const BUILTIN_PRICE_TABLE = {
+    _meta: {
+        _generatedAt: "2026-06-03",
+        _unit: "usd_per_million_tokens",
+        _source: "provider public list prices",
+        _note: "Approximate list prices (USD per 1M tokens). Review before relying on budget.usdMax; override via ~/.patchwork/prices.json or PATCHWORK_PRICE_TABLE.",
+    },
+    prices: {
+        // Anthropic (Claude 4.x)
+        "claude-opus-4-8": { input: 15, output: 75 },
+        "claude-sonnet-4-6": { input: 3, output: 15 },
+        "claude-haiku-4-5-20251001": { input: 1, output: 5 },
+        // OpenAI
+        "gpt-4o": { input: 2.5, output: 10 },
+        "gpt-4o-mini": { input: 0.15, output: 0.6 },
+        // xAI (Grok)
+        "grok-2-latest": { input: 2, output: 10 },
+        // Google (Gemini, API-keyed)
+        "gemini-2.5-pro": { input: 1.25, output: 10 },
+        "gemini-2.5-flash": { input: 0.3, output: 2.5 },
+    },
+};
+const MS_PER_DAY = 86_400_000;
+/** Resolve the override file path per the precedence rule (or undefined). */
+function resolveOverridePath(env, homeDir) {
+    const envPath = env.PATCHWORK_PRICE_TABLE;
+    if (typeof envPath === "string" && envPath.trim())
+        return envPath.trim();
+    const filePath = join(homeDir, ".patchwork", "prices.json");
+    return existsSync(filePath) ? filePath : undefined;
+}
+/** Extract a valid `{input, output}` price from an unknown override entry. */
+function coercePrice(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const v = value;
+    if (typeof v.input === "number" && typeof v.output === "number") {
+        return { input: v.input, output: v.output };
+    }
+    return undefined;
+}
+/**
+ * Load the effective price table: the built-in default with any override file
+ * merged over its `prices`. Fail-open — an unreadable / malformed override is
+ * ignored and the built-in is returned unchanged.
+ *
+ * Override file shape: `{ "prices": { "<model>": { "input": N, "output": N } } }`
+ * (a bare `{ "<model>": { ... } }` map is also accepted for convenience).
+ */
+export function loadPriceTable(opts = {}) {
+    const env = opts.env ?? process.env;
+    const homeDir = opts.homeDir ?? homedir();
+    const overridePath = resolveOverridePath(env, homeDir);
+    if (!overridePath)
+        return BUILTIN_PRICE_TABLE;
+    try {
+        const parsed = JSON.parse(readFileSync(overridePath, "utf8"));
+        const root = (parsed ?? {});
+        const rawPrices = root.prices && typeof root.prices === "object" ? root.prices : root;
+        // Null-prototype base so a user override keyed "__proto__" creates an own
+        // property instead of mutating the prototype (bracket-assign pollution).
+        const merged = Object.create(null);
+        Object.assign(merged, BUILTIN_PRICE_TABLE.prices);
+        for (const [model, entry] of Object.entries(rawPrices)) {
+            const price = coercePrice(entry);
+            if (price)
+                merged[model] = price;
+        }
+        return {
+            _meta: { ...BUILTIN_PRICE_TABLE._meta, _override: overridePath },
+            prices: merged,
+        };
+    }
+    catch {
+        // Malformed / unreadable override → fail open to the built-in table.
+        return BUILTIN_PRICE_TABLE;
+    }
+}
+/** Price for one model, or undefined if the table does not list it. */
+export function priceFor(model, table = loadPriceTable()) {
+    // Own-property lookup only. A user-controlled model id that collides with an
+    // Object.prototype key ("__proto__", "constructor", "valueOf", "toString", …)
+    // must resolve to undefined (unpriced → fail open), NOT to an inherited
+    // prototype member — otherwise costUsd would compute on a function and return
+    // NaN, silently poisoning the USD budget (a prototype-walk bug class this
+    // codebase has been bitten by before — use Object.hasOwn, never `in`/bracket).
+    return Object.hasOwn(table.prices, model) ? table.prices[model] : undefined;
+}
+/**
+ * USD cost of a call given its token usage, or `undefined` when the model is
+ * not priced (fail-open: the budget layer then declines to enforce on it).
+ */
+export function costUsd(model, usage, table = loadPriceTable()) {
+    const price = priceFor(model, table);
+    if (!price)
+        return undefined;
+    return ((usage.inputTokens / 1_000_000) * price.input +
+        (usage.outputTokens / 1_000_000) * price.output);
+}
+/**
+ * True when the table's `_generatedAt` is unparseable, in the future, or older
+ * than `maxAgeDays` (default 548 ≈ 18 months). Pure — caller supplies `now` —
+ * so a scheduled job can fail loudly without baking a wall-clock time-bomb into
+ * every PR's test run.
+ */
+export function isPriceTableStale(generatedAt, now, maxAgeDays = 548) {
+    const t = Date.parse(generatedAt);
+    if (Number.isNaN(t))
+        return true;
+    if (t > now)
+        return true;
+    return now - t > maxAgeDays * MS_PER_DAY;
+}
+//# sourceMappingURL=priceTable.js.map

package/dist/recipes/pricing/priceTable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"priceTable.js","sourceRoot":"","sources":["../../../src/recipes/pricing/priceTable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAwBjC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,KAAK,EAAE;QACL,YAAY,EAAE,YAAY;QAC1B,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EAAE,6BAA6B;QACtC,KAAK,EACH,sJAAsJ;KACzJ;IACD,MAAM,EAAE;QACN,yBAAyB;QACzB,iBAAiB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC5C,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7C,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;QACpD,SAAS;QACT,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QACpC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;QAC3C,aAAa;QACb,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,6BAA6B;QAC7B,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7C,kBAAkB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE;KAChD;CACF,CAAC;AAEF,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,6EAA6E;AAC7E,SAAS,mBAAmB,CAC1B,GAAsB,EACtB,OAAe;IAEf,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAsD,EAAE;IAExD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY;QAAE,OAAO,mBAAmB,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;QACvD,MAAM,SAAS,GACb,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAEtE,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,MAAM,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACzC,SAAoC,CACrC,EAAE,CAAC;YACF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;QACD,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE;YAChE,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CACtB,KAAa,EACb,QAAoB,cAAc,EAAE;IAEpC,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,+EAA+E;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CACrB,KAAa,EACb,KAAoD,EACpD,QAAoB,cAAc,EAAE;IAEpC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,CACL,CAAC,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK;QAC7C,CAAC,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,CAChD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAmB,EACnB,GAAW,EACX,UAAU,GAAG,GAAG;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,GAAG,GAAG,CAAC,GAAG,UAAU,GAAG,UAAU,CAAC;AAC3C,CAAC"}

package/dist/recipes/replayRun.js

@@ -16,7 +16,7 @@
  * after explicit user approval.
  */
 import { runChainedRecipe } from "./chainedRunner.js";
-import { buildChainedDeps } from "./yamlRunner.js";
+import { buildChainedDeps, declaredRecipeEnv } from "./yamlRunner.js";
 /**
  * Build the `mockedOutputs` map. Truncated captures (>8 KB envelope from
  * VD-2's `captureForRunlog`) are excluded — replaying with a `[truncated]`
@@ -59,7 +59,10 @@ export async function replayMockedRun(opts) {
             return "";
         }));
     const runOptions = {
-        env: { ...process.env },
+        // Audit 2026-06-08 (recipe-support-3): replay must enforce the same
+        // declared-keys env allowlist as the live chained/flat paths — never spread
+        // the full process.env into the template context.
+        env: { ...declaredRecipeEnv(recipe) },
         maxConcurrency: Math.max(1, recipe.maxConcurrency ?? 4),
         maxDepth: recipe.maxDepth ?? 3,
         dryRun: false,

package/dist/recipes/replayRun.js.map

@@ -1 +1 @@
-{"version":3,"file":"replayRun.js","sourceRoot":"","sources":["../../src/recipes/replayRun.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAwBnD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAsB;IAIvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,gEAAgE;QAChE,uBAAuB;QACvB,IACE,GAAG,KAAK,IAAI;YACZ,OAAO,GAAG,KAAK,QAAQ;YACtB,GAA+B,CAAC,aAAa,CAAC,KAAK,IAAI,EACxD,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAKrC;IACC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAkB,gBAAgB,CACjD,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,CAAC,YAAY;QAC1B,CAAC,KAAK,IAAI,EAAE;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,UAAU,GAAe;QAC7B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAwC;QAC7D,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;QAC9B,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,aAAa,EAAE,OAAO;QACtB,qEAAqE;QACrE,2DAA2D;QAC3D,YAAY,EAAE,UAAU,WAAW,CAAC,GAAG,EAAE;KAC1C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACvE,kEAAkE;QAClE,kEAAkE;QAClE,oCAAoC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,OAAO;YAClB,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YACxD,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;YACxE,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"replayRun.js","sourceRoot":"","sources":["../../src/recipes/replayRun.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAwBtE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAsB;IAIvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,gEAAgE;QAChE,uBAAuB;QACvB,IACE,GAAG,KAAK,IAAI;YACZ,OAAO,GAAG,KAAK,QAAQ;YACtB,GAA+B,CAAC,aAAa,CAAC,KAAK,IAAI,EACxD,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAKrC;IACC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAkB,gBAAgB,CACjD,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,CAAC,YAAY;QAC1B,CAAC,KAAK,IAAI,EAAE;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,UAAU,GAAe;QAC7B,oEAAoE;QACpE,4EAA4E;QAC5E,kDAAkD;QAClD,GAAG,EAAE,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAwC;QAC3E,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;QAC9B,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,aAAa,EAAE,OAAO;QACtB,qEAAqE;QACrE,2DAA2D;QAC3D,YAAY,EAAE,UAAU,WAAW,CAAC,GAAG,EAAE;KAC1C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACvE,kEAAkE;QAClE,kEAAkE;QAClE,oCAAoC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,OAAO;YAClB,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YACxD,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;YACxE,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/recipes/resolveRecipePath.js

@@ -32,6 +32,20 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+// TTL cache for jail-root realpaths. Each resolveRecipePath call resolves
+// 3-4 roots; on Windows each hits GetFinalPathNameByHandle + Defender scan.
+// Roots change only on bridge restart — 30 s TTL is safe.
+const _rootRealpathCache = new Map();
+const _ROOT_REALPATH_TTL_MS = 30_000;
+function cachedRootRealpathSync(p) {
+    const now = Date.now();
+    const cached = _rootRealpathCache.get(p);
+    if (cached && now < cached.expires)
+        return cached.resolved;
+    const resolved = fs.realpathSync(p);
+    _rootRealpathCache.set(p, { resolved, expires: now + _ROOT_REALPATH_TTL_MS });
+    return resolved;
+}
 /** Build a jail error with the canonical code. Never expose internals via message-matching. */
 function jailError(message) {
     const err = new Error(message);
@@ -147,7 +161,7 @@ export function resolveRecipePath(rawPath, opts = {}) {
     const realRoots = [];
     for (const root of roots) {
         try {
-            realRoots.push(fs.realpathSync(root));
+            realRoots.push(cachedRootRealpathSync(root));
         }
         catch {
             // Root does not exist yet (e.g. ~/.patchwork on a fresh install).

package/dist/recipes/resolveRecipePath.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveRecipePath.js","sourceRoot":"","sources":["../../src/recipes/resolveRecipePath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,+FAA+F;AAC/F,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAwB,CAAC;IACtD,GAAG,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACrC,OAAO,GAAG,CAAC;AACb,CAAC;AAqBD,iFAAiF;AACjF,SAAS,UAAU,CAAC,CAAS,EAAE,OAAe;IAC5C,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAS,SAAS,CAAC,IAA8B;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,GAAG,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,EAAE,CAAC;QACb,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,yCAAyC;QACzC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,uEAAuE;IACvE,iDAAiD;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CAAC,MAAc,EAAE,KAAe;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,qEAAqE;QACrE,mEAAmE;QACnE,qBAAqB;QACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAiC,EAAE;IAEnC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAE5D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE9B,uEAAuE;IACvE,8CAA8C;IAC9C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,CACb,gBAAgB,OAAO,2CAA2C,CACnE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CACb,gBAAgB,OAAO,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,kEAAkE;YAClE,iEAAiE;YACjE,8DAA8D;YAC9D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,CACb,gBAAgB,OAAO,4CAA4C,IAAI,IAAI,CAC5E,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,kEAAkE;IAClE,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,SAAS,CACb,gBAAgB,OAAO,0BAA0B,GAAG,CAAC,KAAK,yCAAyC,CACpG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,iDAAiD;YACjD,IACE,GAAG,YAAY,KAAK;gBACnB,GAAyB,CAAC,IAAI,KAAK,yBAAyB,EAC7D,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,qEAAqE;YACrE,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAiC,EAAE;IAEnC,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"resolveRecipePath.js","sourceRoot":"","sources":["../../src/recipes/resolveRecipePath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,0EAA0E;AAC1E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAG/B,CAAC;AACJ,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,SAAS,sBAAsB,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IAC3D,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpC,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAID,+FAA+F;AAC/F,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAwB,CAAC;IACtD,GAAG,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACrC,OAAO,GAAG,CAAC;AACb,CAAC;AAqBD,iFAAiF;AACjF,SAAS,UAAU,CAAC,CAAS,EAAE,OAAe;IAC5C,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAS,SAAS,CAAC,IAA8B;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,GAAG,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,EAAE,CAAC;QACb,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,yCAAyC;QACzC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,uEAAuE;IACvE,iDAAiD;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CAAC,MAAc,EAAE,KAAe;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,qEAAqE;QACrE,mEAAmE;QACnE,qBAAqB;QACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAiC,EAAE;IAEnC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAE5D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE9B,uEAAuE;IACvE,8CAA8C;IAC9C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,CACb,gBAAgB,OAAO,2CAA2C,CACnE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CACb,gBAAgB,OAAO,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,kEAAkE;YAClE,iEAAiE;YACjE,8DAA8D;YAC9D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,CACb,gBAAgB,OAAO,4CAA4C,IAAI,IAAI,CAC5E,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,kEAAkE;IAClE,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,SAAS,CACb,gBAAgB,OAAO,0BAA0B,GAAG,CAAC,KAAK,yCAAyC,CACpG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,iDAAiD;YACjD,IACE,GAAG,YAAY,KAAK;gBACnB,GAAyB,CAAC,IAAI,KAAK,yBAAyB,EAC7D,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,qEAAqE;YACrE,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAiC,EAAE;IAEnC,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/recipes/runBudget.d.ts

@@ -1,30 +1,29 @@
 /**
- * Per-recipe token budget — PR2b.
+ * Per-recipe budget — PR2b (tokens) + cost-routing Phase 3 (USD).
  *
- * Built on PR2a's `AgentResult.usage` plumbing. The runner constructs
- * one `RunBudget` per recipe execution; agent steps consult it before
- * dispatch (admission) and reconcile actual consumption after the call
- * returns. On breach the run halts at the *next* admission check (we
- * never retroactively fail a step that succeeded — the user's tokens
- * are already spent, halting after-the-fact would just confuse the
- * audit trail).
+ * Built on PR2a's `AgentResult.usage` plumbing. The runner constructs one
+ * `RunBudget` per recipe execution; agent steps consult it before dispatch
+ * (admission) and reconcile actual consumption after the call returns. On
+ * breach the run halts at the *next* admission check (we never retroactively
+ * fail a step that succeeded — the user's tokens/dollars are already spent;
+ * halting after-the-fact would just confuse the audit trail).
  *
- * Subscription drivers (Claude CLI, provider subprocess CLIs) don't
- * surface per-call token counts. `RunBudget` tracks which drivers were
- * unmeasured and exposes a deduped warnings list — fail-open with a
- * single notice per driver per run, never block.
+ * Two independent caps, either or both:
+ *   - `tokensMax` — cumulative input + output tokens.
+ *   - `usdMax`    — cumulative USD, priced from token usage via the Phase 2
+ *                   price table (`costUsd`).
  *
- * Scope (PR2b only):
- *   - cumulative token enforcement (input + output)
- *   - halt-on-breach OR warn-on-breach via `BudgetPolicy.onBreach`
- *   - subscription-driver fail-open with warning
- *
- * Out of scope (future):
- *   - per-step caps (extend `BudgetPolicy` or add `AgentStep.tokensMax`)
- *   - `usdMax` (needs a price table; subscription drivers complicate)
- *   - `wallClockMs` (orthogonal to tokens, separate accounting)
+ * Subscription drivers (Claude CLI, provider subprocess CLIs) don't surface
+ * per-call token counts, and a model with no price-table entry can't be
+ * costed. Both cases FAIL OPEN: `RunBudget` records a deduped one-time
+ * warning and never blocks. So a USD cap enforces for *measured + priced*
+ * (API) drivers and is a no-op-with-notice for everything else — never a
+ * silent or a surprise halt on the token-blind default driver. (The opt-in
+ * estimate-the-unmeasured path is a planned follow-up; absent it, unmeasured
+ * = fail-open, which is the conservative default the design calls for.)
  */
-import type { AgentUsage } from "./agentExecutor.js";
+import { type AgentUsage } from "./agentExecutor.js";
+import { type PriceTable } from "./pricing/priceTable.js";
 import type { BudgetPolicy } from "./schema.js";
 export interface BudgetAdmission {
     /** True = step may proceed. False = budget exhausted. */
@@ -36,35 +35,97 @@ export interface BudgetTotals {
     inputTokens: number;
     outputTokens: number;
     total: number;
-    /** Remaining tokens before breach. Undefined when no limit is set. */
+    /** Remaining tokens before breach. Undefined when no token limit is set. */
     remaining?: number;
-    /** True once total >= tokensMax. */
+    /** Cumulative measured USD. Undefined when no USD limit is set. */
+    usd?: number;
+    /** Remaining USD before breach. Undefined when no USD limit is set. */
+    usdRemaining?: number;
+    /**
+     * Notional list-price USD estimated for unmeasured (subscription) calls when
+     * `estimateUnmeasured` is on. A label ONLY — never counted toward `usd` or
+     * `usdMax`, never halts. Present only when > 0.
+     */
+    usdEstimated?: number;
+    /** True once total tokens >= tokensMax (false when no token limit). */
     breached: boolean;
+    /** True once measured usd >= usdMax (false when no USD limit). */
+    usdBreached: boolean;
     /** Whether the configured policy halts on breach (vs warn). */
     haltOnBreach: boolean;
 }
 export declare class RunBudget {
     private readonly tokensMax?;
+    private readonly usdMax?;
     private readonly haltOnBreach;
+    private readonly estimateUnmeasured;
+    /** Mutable so refreshPrices() can swap in an updated table mid-run. */
+    private priceTable?;
     private inputTokens;
     private outputTokens;
-    /** Drivers that returned `usage: undefined` during this run, deduped. */
-    private readonly unmeasuredDrivers;
+    private usdSpent;
+    /** Notional list-price USD for unmeasured calls (warn-only; never enforced). */
+    private usdEstimated;
+    /** Dedup keys for one-time warnings (unmeasured driver, breach, etc.). */
+    private readonly warnedKeys;
     /** Free-form warnings surfaced via the run log. */
     private readonly warningList;
-    constructor(policy?: BudgetPolicy);
+    /**
+     * @param policy   recipe budget block.
+     * @param priceTable  optional injected table (tests); otherwise loaded once
+     *                    here when a USD cap is set (file/env override aware).
+     */
+    constructor(policy?: BudgetPolicy, priceTable?: PriceTable);
+    /**
+     * Replace the live price table. Call this at the start of each step (or
+     * once per hour) for long-running recipes so that an updated
+     * `~/.patchwork/prices.json` is picked up without restarting the run.
+     *
+     * Only meaningful when a `usdMax` cap is set; a no-op otherwise.
+     * Injected tables (unit tests) are also replaced by this call — tests that
+     * want stable prices should not call `refreshPrices()`.
+     */
+    refreshPrices(table?: PriceTable): void;
+    /** True when neither cap is configured — reconcile/admit are no-ops. */
+    private get hasBudget();
     /** Cheap admission check before dispatching an agent step. */
     admit(): BudgetAdmission;
     /**
-     * Record the actual usage reported by an agent call. `usage` may be
-     * undefined when the driver doesn't surface token counts — we record
-     * the driver name once per run and continue (fail-open).
+     * Record the actual usage reported by an agent call. `usage` is undefined
+     * when the driver doesn't surface token counts — record the driver once and
+     * continue (fail-open). `model` is the resolved model (from `servedBy`) used
+     * to price USD; an unpriced model fails open with a one-time notice.
      */
-    reconcile(driver: string, usage: AgentUsage | undefined): void;
+    reconcile(driver: string, usage: AgentUsage | undefined, model?: string, estimate?: {
+        inputChars: number;
+        outputChars: number;
+    }): void;
     /** Snapshot of current totals + breach state. */
     totals(): BudgetTotals;
     /** Warnings collected so the runner can surface them in the run log. */
     warnings(): string[];
+    /**
+     * Run-completion warnings: the live `warnings()` plus a one-line ≈$ summary
+     * of the notional cost estimated for unmeasured calls (only when
+     * `estimateUnmeasured` produced one). Use at run end; `warnings()` is the
+     * live per-driver list without the (end-of-run-only) summary.
+     */
+    finalWarnings(): string[];
+    /**
+     * USD remaining before the cap, or undefined when no USD cap is set.
+     * Cost-aware routing (Phase 4) uses this to decide when to downshift.
+     */
+    remainingUsd(): number | undefined;
+    /**
+     * Pre-dispatch USD estimate for a prospective (driver, model) call, or
+     * undefined when it would NOT be USD-enforced: no USD cap, a non-billable
+     * driver (local / subscription), or an unpriced model. Mirrors exactly the
+     * enforcement rule in `reconcile`, so a candidate the router treats as
+     * "free" is precisely one `reconcile` would not charge.
+     */
+    quoteUsd(driver: string | undefined, model: string | undefined, inputTokens: number, outputTokens: number): number | undefined;
+    private pushOnce;
     private totalTokens;
-    private breached;
+    private tokenBreached;
+    private usdMaxBreached;
 }