podwatch 1.0.2 → 1.1.0

package/dist/config-monitor.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Config monitor — snapshots and diffs the gateway config for drift/tampering detection.
+ *
+ * Monitors security-relevant config fields and emits config_change events
+ * when drift is detected. Called on startup, every pulse, and gateway_start.
+ *
+ * Replaces the single-field model tracking that was in lifecycle.ts.
+ */
+export interface MonitoredPath {
+    /** Dot-separated path into api.config (e.g. "agents.defaults.model") */
+    path: string;
+    /** Human-readable label used as prefix in change events */
+    label: string;
+    /** Keys to redact from snapshots (e.g. apiKey) — prevents secrets in events */
+    redactKeys?: string[];
+}
+export declare const MONITORED_PATHS: MonitoredPath[];
+/**
+ * Get a nested value from an object by dot-separated path.
+ */
+export declare function deepGet(obj: unknown, path: string): unknown;
+/**
+ * Deep clone a value, replacing values at sensitive keys with "***".
+ */
+export declare function deepClone(value: unknown, redactKeys?: string[]): unknown;
+/**
+ * Deep equality check for two values.
+ */
+export declare function deepEqual(a: unknown, b: unknown): boolean;
+export interface ConfigChange {
+    field: string;
+    oldValue: unknown;
+    newValue: unknown;
+}
+/**
+ * Diff two values recursively. Returns a list of changes with dot-path field names.
+ * For arrays, reports the whole array as changed (no element-level diff).
+ */
+export declare function diffValues(oldVal: unknown, newVal: unknown, prefix: string): ConfigChange[];
+/**
+ * Extract monitored config sections from the full gateway config.
+ * Redacts sensitive keys (apiKey, etc.) so they don't appear in events.
+ */
+export declare function extractMonitoredConfig(config: Record<string, unknown>, paths?: MonitoredPath[]): Record<string, unknown>;
+/**
+ * Initialize the config snapshot. Called once on register().
+ * Does NOT emit events (baseline capture).
+ */
+export declare function initSnapshot(config: Record<string, unknown>): void;
+/**
+ * Check for config changes against the stored snapshot.
+ * Emits config_change events for each changed field, then updates snapshot.
+ *
+ * If no snapshot exists yet, initializes one (no events emitted).
+ */
+export declare function checkConfigChanges(config: Record<string, unknown>): ConfigChange[];
+/**
+ * Reset the snapshot (for testing or re-register).
+ */
+export declare function resetSnapshot(): void;
+/**
+ * Get the current snapshot (for testing/diagnostics).
+ */
+export declare function getSnapshot(): Record<string, unknown> | null;
+//# sourceMappingURL=config-monitor.d.ts.map

package/dist/config-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-monitor.d.ts","sourceRoot":"","sources":["../src/config-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,EAQ1C,CAAC;AAMF;;GAEG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAS3D;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAcxE;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAsBzD;AAMD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,EAAE,CA6C3F;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,GAAE,aAAa,EAAoB,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB;AAQD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAgClF;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE5D"}

package/dist/config-monitor.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * Config monitor — snapshots and diffs the gateway config for drift/tampering detection.
+ *
+ * Monitors security-relevant config fields and emits config_change events
+ * when drift is detected. Called on startup, every pulse, and gateway_start.
+ *
+ * Replaces the single-field model tracking that was in lifecycle.ts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MONITORED_PATHS = void 0;
+exports.deepGet = deepGet;
+exports.deepClone = deepClone;
+exports.deepEqual = deepEqual;
+exports.diffValues = diffValues;
+exports.extractMonitoredConfig = extractMonitoredConfig;
+exports.initSnapshot = initSnapshot;
+exports.checkConfigChanges = checkConfigChanges;
+exports.resetSnapshot = resetSnapshot;
+exports.getSnapshot = getSnapshot;
+const transmitter_js_1 = require("./transmitter.js");
+exports.MONITORED_PATHS = [
+    { path: "agents.defaults.model", label: "model" },
+    { path: "agents.defaults.models", label: "models" },
+    { path: "tools.exec", label: "tools.exec" },
+    { path: "tools.elevated", label: "tools.elevated" },
+    { path: "models.providers", label: "providers", redactKeys: ["apiKey", "apiSecret", "secret", "token"] },
+    { path: "plugins", label: "plugins" },
+    { path: "session", label: "session" },
+];
+// ---------------------------------------------------------------------------
+// Pure utility functions (exported for testing)
+// ---------------------------------------------------------------------------
+/**
+ * Get a nested value from an object by dot-separated path.
+ */
+function deepGet(obj, path) {
+    if (obj == null || typeof obj !== "object")
+        return undefined;
+    const parts = path.split(".");
+    let current = obj;
+    for (const part of parts) {
+        if (current == null || typeof current !== "object")
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+/**
+ * Deep clone a value, replacing values at sensitive keys with "***".
+ */
+function deepClone(value, redactKeys) {
+    if (value == null)
+        return value;
+    if (typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => deepClone(v, redactKeys));
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (redactKeys?.includes(k) && v != null && v !== "") {
+            result[k] = "***";
+        }
+        else {
+            result[k] = deepClone(v, redactKeys);
+        }
+    }
+    return result;
+}
+/**
+ * Deep equality check for two values.
+ */
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (a == null && b == null)
+        return true;
+    if (a == null || b == null)
+        return false;
+    if (typeof a !== typeof b)
+        return false;
+    if (typeof a !== "object")
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    if (Array.isArray(a)) {
+        const arrB = b;
+        if (a.length !== arrB.length)
+            return false;
+        return a.every((v, i) => deepEqual(v, arrB[i]));
+    }
+    const objA = a;
+    const objB = b;
+    const keysA = Object.keys(objA).sort();
+    const keysB = Object.keys(objB).sort();
+    if (keysA.length !== keysB.length)
+        return false;
+    if (!keysA.every((k, i) => k === keysB[i]))
+        return false;
+    return keysA.every((k) => deepEqual(objA[k], objB[k]));
+}
+/**
+ * Diff two values recursively. Returns a list of changes with dot-path field names.
+ * For arrays, reports the whole array as changed (no element-level diff).
+ */
+function diffValues(oldVal, newVal, prefix) {
+    const changes = [];
+    // Both null/undefined — no change
+    if (oldVal == null && newVal == null)
+        return changes;
+    // One is null/undefined — whole path changed
+    if (oldVal == null || newVal == null) {
+        changes.push({ field: prefix, oldValue: oldVal ?? null, newValue: newVal ?? null });
+        return changes;
+    }
+    // Different types
+    if (typeof oldVal !== typeof newVal) {
+        changes.push({ field: prefix, oldValue: oldVal, newValue: newVal });
+        return changes;
+    }
+    // Primitives
+    if (typeof oldVal !== "object") {
+        if (oldVal !== newVal) {
+            changes.push({ field: prefix, oldValue: oldVal, newValue: newVal });
+        }
+        return changes;
+    }
+    // Arrays — report as whole if different
+    if (Array.isArray(oldVal) || Array.isArray(newVal)) {
+        if (!deepEqual(oldVal, newVal)) {
+            changes.push({ field: prefix, oldValue: oldVal, newValue: newVal });
+        }
+        return changes;
+    }
+    // Objects — recurse into each key
+    const oldRecord = oldVal;
+    const newRecord = newVal;
+    const allKeys = new Set([...Object.keys(oldRecord), ...Object.keys(newRecord)]);
+    for (const key of allKeys) {
+        const childPath = prefix ? `${prefix}.${key}` : key;
+        changes.push(...diffValues(oldRecord[key], newRecord[key], childPath));
+    }
+    return changes;
+}
+// ---------------------------------------------------------------------------
+// Snapshot extraction
+// ---------------------------------------------------------------------------
+/**
+ * Extract monitored config sections from the full gateway config.
+ * Redacts sensitive keys (apiKey, etc.) so they don't appear in events.
+ */
+function extractMonitoredConfig(config, paths = exports.MONITORED_PATHS) {
+    const result = {};
+    for (const { path, label, redactKeys } of paths) {
+        const value = deepGet(config, path);
+        result[label] = deepClone(value, redactKeys);
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Stateful config monitor
+// ---------------------------------------------------------------------------
+let snapshot = null;
+/**
+ * Initialize the config snapshot. Called once on register().
+ * Does NOT emit events (baseline capture).
+ */
+function initSnapshot(config) {
+    snapshot = extractMonitoredConfig(config);
+}
+/**
+ * Check for config changes against the stored snapshot.
+ * Emits config_change events for each changed field, then updates snapshot.
+ *
+ * If no snapshot exists yet, initializes one (no events emitted).
+ */
+function checkConfigChanges(config) {
+    if (!snapshot) {
+        initSnapshot(config);
+        return [];
+    }
+    const current = extractMonitoredConfig(config);
+    const allChanges = [];
+    for (const { label } of exports.MONITORED_PATHS) {
+        const changes = diffValues(snapshot[label], current[label], label);
+        for (const change of changes) {
+            allChanges.push(change);
+            transmitter_js_1.transmitter.enqueue({
+                type: "config_change",
+                ts: Date.now(),
+                field: change.field,
+                value: change.newValue,
+                previousValue: change.oldValue,
+                params: {
+                    field: change.field,
+                    value: change.newValue,
+                    previousValue: change.oldValue,
+                },
+            });
+        }
+    }
+    // Update snapshot after emitting
+    snapshot = current;
+    return allChanges;
+}
+/**
+ * Reset the snapshot (for testing or re-register).
+ */
+function resetSnapshot() {
+    snapshot = null;
+}
+/**
+ * Get the current snapshot (for testing/diagnostics).
+ */
+function getSnapshot() {
+    return snapshot ? { ...snapshot } : null;
+}
+//# sourceMappingURL=config-monitor.js.map

package/dist/config-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-monitor.js","sourceRoot":"","sources":["../src/config-monitor.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAkCH,0BASC;AAKD,8BAcC;AAKD,8BAsBC;AAgBD,gCA6CC;AAUD,wDAUC;AAYD,oCAEC;AAQD,gDAgCC;AAKD,sCAEC;AAKD,kCAEC;AA5OD,qDAA+C;AAelC,QAAA,eAAe,GAAoB;IAC9C,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE;IACjD,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnD,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;IAC3C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACnD,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;IACxG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;IACrC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;CACtC,CAAC;AAEF,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;GAEG;AACH,SAAgB,OAAO,CAAC,GAAY,EAAE,IAAY;IAChD,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,KAAc,EAAE,UAAqB;IAC7D,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAE5E,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,CAAU,EAAE,CAAU;IAC9C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,CAAc,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,CAA4B,CAAC;IAC1C,MAAM,IAAI,GAAG,CAA4B,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAYD;;;GAGG;AACH,SAAgB,UAAU,CAAC,MAAe,EAAE,MAAe,EAAE,MAAc;IACzE,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,kCAAkC;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC;IAErD,6CAA6C;IAC7C,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACpF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kBAAkB;IAClB,IAAI,OAAO,MAAM,KAAK,OAAO,MAAM,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,aAAa;IACb,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,wCAAwC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kCAAkC;IAClC,MAAM,SAAS,GAAG,MAAiC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAiC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAEhF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,MAA+B,EAC/B,QAAyB,uBAAe;IAExC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,IAAI,QAAQ,GAAmC,IAAI,CAAC;AAEpD;;;GAGG;AACH,SAAgB,YAAY,CAAC,MAA+B;IAC1D,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAA+B;IAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAmB,EAAE,CAAC;IAEtC,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,uBAAe,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACnE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,4BAAW,CAAC,OAAO,CAAC;gBAClB,IAAI,EAAE,eAAe;gBACrB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,QAAQ;gBACtB,aAAa,EAAE,MAAM,CAAC,QAAQ;gBAC9B,MAAM,EAAE;oBACN,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,KAAK,EAAE,MAAM,CAAC,QAAQ;oBACtB,aAAa,EAAE,MAAM,CAAC,QAAQ;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,QAAQ,GAAG,OAAO,CAAC;IAEnB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa;IAC3B,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW;IACzB,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC"}

package/dist/hooks/budget.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Budget hard stop hooks — before_model_resolve and before_prompt_build.
+ *
+ * When the server signals a hard stop (budget exceeded + hard stop enabled),
+ * these hooks:
+ * 1. Try to downgrade to a cheaper model (best-effort)
+ * 2. Prepend context telling the LLM to inform the user about the budget limit
+ */
+import type { PodwatchConfig } from "../index.js";
+import type { PluginApi } from "../types.js";
+/**
+ * Find the cheapest available model from the gateway config.
+ * Returns { model, provider } or null if only one model is configured.
+ */
+export declare function findCheapestModel(config: Record<string, unknown>): {
+    model: string;
+    provider: string;
+} | null;
+export declare function registerBudgetHooks(api: PluginApi, config: PodwatchConfig): void;
+//# sourceMappingURL=budget.d.ts.map

package/dist/hooks/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../src/hooks/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA6B7C;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA0D5C;AAMD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CA6ChF"}

package/dist/hooks/budget.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Budget hard stop hooks — before_model_resolve and before_prompt_build.
+ *
+ * When the server signals a hard stop (budget exceeded + hard stop enabled),
+ * these hooks:
+ * 1. Try to downgrade to a cheaper model (best-effort)
+ * 2. Prepend context telling the LLM to inform the user about the budget limit
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findCheapestModel = findCheapestModel;
+exports.registerBudgetHooks = registerBudgetHooks;
+const transmitter_js_1 = require("../transmitter.js");
+// ---------------------------------------------------------------------------
+// Model cost heuristic — cheaper models first
+// ---------------------------------------------------------------------------
+/** Known cheap model patterns (ordered cheapest first). */
+const CHEAP_MODEL_PATTERNS = [
+    "haiku",
+    "flash",
+    "mini",
+    "nano",
+    "lite",
+    "sonnet",
+];
+/**
+ * Score a model name by cost (lower = cheaper).
+ * Known cheap patterns get low scores, unknown models get a high default.
+ */
+function modelCostScore(modelName) {
+    const lower = modelName.toLowerCase();
+    for (let i = 0; i < CHEAP_MODEL_PATTERNS.length; i++) {
+        if (lower.includes(CHEAP_MODEL_PATTERNS[i]))
+            return i;
+    }
+    return 100; // unknown = expensive
+}
+/**
+ * Find the cheapest available model from the gateway config.
+ * Returns { model, provider } or null if only one model is configured.
+ */
+function findCheapestModel(config) {
+    const candidates = [];
+    // Check models.providers for available models
+    const providers = config?.models?.providers;
+    if (providers && typeof providers === "object") {
+        for (const [providerName, providerCfg] of Object.entries(providers)) {
+            const cfg = providerCfg;
+            const models = cfg.models;
+            if (Array.isArray(models)) {
+                for (const m of models) {
+                    if (typeof m === "string") {
+                        candidates.push({
+                            model: `${providerName}/${m}`,
+                            provider: providerName,
+                            score: modelCostScore(m),
+                        });
+                    }
+                }
+            }
+        }
+    }
+    // Also check agents.defaults.models for configured model aliases
+    const agentModels = config?.agents?.defaults?.models;
+    if (agentModels && typeof agentModels === "object") {
+        for (const modelId of Object.keys(agentModels)) {
+            if (typeof modelId === "string") {
+                const parts = modelId.split("/");
+                const modelName = parts[parts.length - 1] ?? modelId;
+                const provider = parts.length > 1 ? parts[0] : "";
+                candidates.push({
+                    model: modelId,
+                    provider,
+                    score: modelCostScore(modelName),
+                });
+            }
+        }
+    }
+    // Deduplicate by model name
+    const seen = new Set();
+    const unique = candidates.filter((c) => {
+        if (seen.has(c.model))
+            return false;
+        seen.add(c.model);
+        return true;
+    });
+    if (unique.length <= 1)
+        return null;
+    // Sort by score (cheapest first) and pick the cheapest
+    unique.sort((a, b) => a.score - b.score);
+    // Get the current primary model to avoid returning the same one
+    const primaryModel = config?.agents?.defaults?.model?.primary;
+    const cheapest = unique.find((c) => c.model !== primaryModel) ?? unique[0];
+    return { model: cheapest.model, provider: cheapest.provider };
+}
+// ---------------------------------------------------------------------------
+// Hook registration
+// ---------------------------------------------------------------------------
+function registerBudgetHooks(api, config) {
+    // -----------------------------------------------------------------------
+    // before_model_resolve — downgrade to cheaper model on hard stop
+    // -----------------------------------------------------------------------
+    api.registerHook("before_model_resolve", async () => {
+        if (!config.enableBudgetEnforcement)
+            return;
+        const budget = transmitter_js_1.transmitter.getCachedBudget();
+        if (!budget?.hardStopActive)
+            return;
+        const cheaper = findCheapestModel(api.config);
+        if (!cheaper)
+            return; // only one model configured, skip
+        return {
+            modelOverride: cheaper.model,
+            providerOverride: cheaper.provider,
+        };
+    }, { name: "podwatch-budget-model-resolve" });
+    // -----------------------------------------------------------------------
+    // before_prompt_build — inject budget warning into prompt
+    // -----------------------------------------------------------------------
+    api.registerHook("before_prompt_build", async () => {
+        if (!config.enableBudgetEnforcement)
+            return;
+        const budget = transmitter_js_1.transmitter.getCachedBudget();
+        if (!budget?.hardStopActive)
+            return;
+        return {
+            prependContext: "BUDGET HARD STOP ACTIVE. Your spending limit has been reached. " +
+                "Reply ONLY with a brief message telling the user their budget is exceeded " +
+                "and to visit podwatch.app/costs to resume. Do not use any tools. Do not perform any analysis.",
+        };
+    }, { name: "podwatch-budget-prompt-build" });
+    api.logger.info("[podwatch/budget] Hard stop hooks registered");
+}
+//# sourceMappingURL=budget.js.map

package/dist/hooks/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../../src/hooks/budget.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAoCH,8CA4DC;AAMD,kDA6CC;AA/ID,sDAAgD;AAEhD,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG;IAC3B,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;GAGG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,sBAAsB;AACpC,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,MAA+B;IAE/B,MAAM,UAAU,GAAyD,EAAE,CAAC;IAE5E,8CAA8C;IAC9C,MAAM,SAAS,GAAI,MAAc,EAAE,MAAM,EAAE,SAAS,CAAC;IACrD,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,KAAK,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACpE,MAAM,GAAG,GAAG,WAAsC,CAAC;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,MAA8B,CAAC;YAClD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC1B,UAAU,CAAC,IAAI,CAAC;4BACd,KAAK,EAAE,GAAG,YAAY,IAAI,CAAC,EAAE;4BAC7B,QAAQ,EAAE,YAAY;4BACtB,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;yBACzB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,MAAM,WAAW,GAAI,MAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;IAC9D,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACnD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;gBACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,UAAU,CAAC,IAAI,CAAC;oBACd,KAAK,EAAE,OAAO;oBACd,QAAQ;oBACR,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,uDAAuD;IACvD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAEzC,gEAAgE;IAChE,MAAM,YAAY,GAAI,MAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC;IAE5E,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAgB,mBAAmB,CAAC,GAAc,EAAE,MAAsB;IACxE,0EAA0E;IAC1E,iEAAiE;IACjE,0EAA0E;IAC1E,GAAG,CAAC,YAAY,CACd,sBAAsB,EACtB,KAAK,IAA2E,EAAE;QAChF,IAAI,CAAC,MAAM,CAAC,uBAAuB;YAAE,OAAO;QAE5C,MAAM,MAAM,GAAG,4BAAW,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,cAAc;YAAE,OAAO;QAEpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,kCAAkC;QAExD,OAAO;YACL,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,gBAAgB,EAAE,OAAO,CAAC,QAAQ;SACnC,CAAC;IACJ,CAAC,EACD,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAC1C,CAAC;IAEF,0EAA0E;IAC1E,0DAA0D;IAC1D,0EAA0E;IAC1E,GAAG,CAAC,YAAY,CACd,qBAAqB,EACrB,KAAK,IAAiD,EAAE;QACtD,IAAI,CAAC,MAAM,CAAC,uBAAuB;YAAE,OAAO;QAE5C,MAAM,MAAM,GAAG,4BAAW,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,cAAc;YAAE,OAAO;QAEpC,OAAO;YACL,cAAc,EACZ,iEAAiE;gBACjE,4EAA4E;gBAC5E,+FAA+F;SAClG,CAAC;IACJ,CAAC,EACD,EAAE,IAAI,EAAE,8BAA8B,EAAE,CACzC,CAAC;IAEF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;AAClE,CAAC"}

package/dist/hooks/cost.d.ts

@@ -9,6 +9,8 @@
  * Dedup strategy: lastSeenIndex tracks how far we've read into event.messages.
  * Each invocation only processes messages from lastSeenIndex onwards, then
  * advances the pointer. Zero memory growth, O(1) bookkeeping.
+ *
+ * Cost events are correlated per LLM turn (not per tool call) using turn_id.
  */
 import type { PodwatchConfig } from "../index.js";
 /**

package/dist/hooks/cost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cost.d.ts","sourceRoot":"","sources":["../../src/hooks/cost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMlD;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,cAAc,EACtB,kBAAkB,EAAE,OAAO,GAC1B,IAAI,CA4EN"}
+{"version":3,"file":"cost.d.ts","sourceRoot":"","sources":["../../src/hooks/cost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAclD;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,cAAc,EACtB,kBAAkB,EAAE,OAAO,GAC1B,IAAI,CAiFN"}

package/dist/hooks/cost.js

@@ -10,6 +10,8 @@
  * Dedup strategy: lastSeenIndex tracks how far we've read into event.messages.
  * Each invocation only processes messages from lastSeenIndex onwards, then
  * advances the pointer. Zero memory growth, O(1) bookkeeping.
+ *
+ * Cost events are correlated per LLM turn (not per tool call) using turn_id.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports._resetCostState = _resetCostState;
@@ -18,6 +20,13 @@ exports.registerCostHandler = registerCostHandler;
 const transmitter_js_1 = require("../transmitter.js");
 // Track how far into event.messages we've already processed — per session
 const lastSeenIndexMap = new Map();
+/**
+ * Generate a turn-based correlation ID for cost events.
+ * Cost events correlate to LLM turns, not individual tool calls.
+ */
+function generateTurnId() {
+    return `turn_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+}
 /**
  * Reset all dedup state (exported for testing).
  */
@@ -63,6 +72,9 @@ function registerCostHandler(api, config, diagnosticsEnabled) {
                 break; // only check the last user message
             }
         }
+        // Generate a turn_id for this batch of cost events (per before_agent_start invocation)
+        // This links all cost events from the same LLM turn together
+        const turnId = generateTurnId();
         for (const msg of newMessages) {
             // Only assistant messages have usage data
             if (msg.role !== "assistant")
@@ -90,6 +102,7 @@ function registerCostHandler(api, config, diagnosticsEnabled) {
                 costUsd: costTotal,
                 costBreakdown: msg.usage.cost, // full {input, output, cacheRead, cacheWrite, total} object
                 durationMs: undefined,
+                correlationId: turnId, // Link cost events per turn
                 // Tag heartbeat-triggered cost events so the dashboard can distinguish them
                 ...(isHeartbeat ? { sessionType: "heartbeat" } : {}),
             });

package/dist/hooks/cost.js.map

@@ -1 +1 @@
-{"version":3,"file":"cost.js","sourceRoot":"","sources":["../../src/hooks/cost.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAWH,0CAEC;AAKD,gDAEC;AAKD,kDAgFC;AAtGD,sDAAgD;AAEhD,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEnD;;GAEG;AACH,SAAgB,eAAe;IAC7B,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,UAAkB;IACnD,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CACjC,GAAQ,EACR,MAAsB,EACtB,kBAA2B;IAE3B,wFAAwF;IACxF,GAAG,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAU,EAAE,GAAQ,EAAE,EAAE;QAC1D,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QAE/D,MAAM,UAAU,GAAW,GAAG,EAAE,UAAU,IAAI,aAAa,CAAC;QAE5D,yDAAyD;QACzD,IAAI,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE1D,uDAAuD;QACvD,IAAI,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC1C,aAAa,GAAG,CAAC,CAAC;QACpB,CAAC;QAED,kDAAkD;QAClD,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxD,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,qEAAqE;QACrE,mFAAmF;QACnF,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;gBACzF,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;gBACD,MAAM,CAAC,mCAAmC;YAC5C,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,0CAA0C;YAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YACvC,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,SAAS;YAEzB,2DAA2D;YAC3D,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;gBAAE,SAAS;YAC7E,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAEnF,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS,CAAC;YAErD,4BAAW,CAAC,OAAO,CAAC;gBAClB,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC/B,UAAU,EAAE,GAAG,EAAE,UAAU;gBAC3B,OAAO,EAAE,GAAG,EAAE,OAAO;gBACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;gBACjC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;gBACnC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC;gBACzC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC;gBAC3C,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;gBACxF,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,4DAA4D;gBAC3F,UAAU,EAAE,SAAS;gBACrB,4EAA4E;gBAC5E,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAE9B,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,MAAW,EAAE,GAAQ,EAAE,EAAE;QACpD,MAAM,UAAU,GAAW,GAAG,EAAE,UAAU,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAEtC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;AAC1F,CAAC"}
+{"version":3,"file":"cost.js","sourceRoot":"","sources":["../../src/hooks/cost.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAmBH,0CAEC;AAKD,gDAEC;AAKD,kDAqFC;AAnHD,sDAAgD;AAEhD,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEnD;;;GAGG;AACH,SAAS,cAAc;IACrB,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe;IAC7B,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,UAAkB;IACnD,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CACjC,GAAQ,EACR,MAAsB,EACtB,kBAA2B;IAE3B,wFAAwF;IACxF,GAAG,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAU,EAAE,GAAQ,EAAE,EAAE;QAC1D,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QAE/D,MAAM,UAAU,GAAW,GAAG,EAAE,UAAU,IAAI,aAAa,CAAC;QAE5D,yDAAyD;QACzD,IAAI,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE1D,uDAAuD;QACvD,IAAI,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC1C,aAAa,GAAG,CAAC,CAAC;QACpB,CAAC;QAED,kDAAkD;QAClD,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxD,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,qEAAqE;QACrE,mFAAmF;QACnF,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;gBACzF,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;gBACD,MAAM,CAAC,mCAAmC;YAC5C,CAAC;QACH,CAAC;QAED,uFAAuF;QACvF,6DAA6D;QAC7D,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,0CAA0C;YAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YACvC,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,SAAS;YAEzB,2DAA2D;YAC3D,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;gBAAE,SAAS;YAC7E,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAEnF,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS,CAAC;YAErD,4BAAW,CAAC,OAAO,CAAC;gBAClB,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC/B,UAAU,EAAE,GAAG,EAAE,UAAU;gBAC3B,OAAO,EAAE,GAAG,EAAE,OAAO;gBACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;gBACjC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;gBACnC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC;gBACzC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC;gBAC3C,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;gBACxF,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,4DAA4D;gBAC3F,UAAU,EAAE,SAAS;gBACrB,aAAa,EAAE,MAAM,EAAE,4BAA4B;gBACnD,4EAA4E;gBAC5E,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAE9B,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,MAAW,EAAE,GAAQ,EAAE,EAAE;QACpD,MAAM,UAAU,GAAW,GAAG,EAAE,UAAU,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAEtC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;AAC1F,CAAC"}

package/dist/hooks/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/hooks/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAwElD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAwHhF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/hooks/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA4BlD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CA4HhF"}

package/dist/hooks/lifecycle.js

@@ -46,6 +46,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerLifecycleHandlers = registerLifecycleHandlers;
 const transmitter_js_1 = require("../transmitter.js");
 const scanner_js_1 = require("../scanner.js");
+const config_monitor_js_1 = require("../config-monitor.js");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const PLUGIN_VERSION = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "..", "package.json"), "utf-8")).version;
@@ -55,53 +56,7 @@ let scanTimer = null;
 let pulseFailureCount = 0;
 const PULSE_FAILURE_THRESHOLD = 3; // Start backoff after N consecutive failures
 const PULSE_MAX_INTERVAL_MS = 3_600_000; // 60 min cap
-// Config change detection state
-let knownPrimaryModel = null;
-/**
- * Read the primary model from the OpenClaw gateway config.
- * Handles both string and object shapes for `agents.defaults.model`.
- */
-function readPrimaryModel(api) {
-    try {
-        const modelCfg = api.config?.agents?.defaults?.model;
-        if (!modelCfg)
-            return null;
-        if (typeof modelCfg === "string")
-            return modelCfg;
-        if (typeof modelCfg === "object" && modelCfg.primary)
-            return String(modelCfg.primary);
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Check if the primary model changed and emit a config_change event if so.
- */
-function checkModelConfigChange(api) {
-    const currentModel = readPrimaryModel(api);
-    if (currentModel === knownPrimaryModel)
-        return;
-    const previousValue = knownPrimaryModel;
-    knownPrimaryModel = currentModel;
-    // Don't emit on first read if null
-    if (currentModel === null && previousValue === null)
-        return;
-    transmitter_js_1.transmitter.enqueue({
-        type: "config_change",
-        ts: Date.now(),
-        field: "model.primary",
-        value: currentModel,
-        previousValue,
-        // Pass as params so they appear in toolArgs on the server
-        params: {
-            field: "model.primary",
-            value: currentModel,
-            previousValue,
-        },
-    });
-}
+// Config change detection is now handled by config-monitor.ts
 /**
  * Register lifecycle hook handlers.
  */
@@ -115,9 +70,9 @@ function registerLifecycleHandlers(api, config) {
     const basePulseIntervalMs = config.pulseIntervalMs ?? 300_000;
     // Reset pulse backoff state
     pulseFailureCount = 0;
-    // Read initial primary model config and send config_change event
-    knownPrimaryModel = null; // Reset on re-register
-    checkModelConfigChange(api);
+    // Initialize config monitor snapshot (baseline — no events emitted)
+    (0, config_monitor_js_1.resetSnapshot)();
+    (0, config_monitor_js_1.initSnapshot)(api.config ?? {});
     // Send initial pulse right now
     void sendPulseWithBackoff(endpoint, apiKey, basePulseIntervalMs, api);
     // Initial skill/plugin scan — delayed 30s to let gateway fully settle
@@ -135,6 +90,10 @@ function registerLifecycleHandlers(api, config) {
     // gateway_start — best-effort re-scan (in case it ever fires)
     // -----------------------------------------------------------------------
     api.on("gateway_start", async (event) => {
+        // Check config changes on gateway restart (config may have changed)
+        if (api.config) {
+            (0, config_monitor_js_1.checkConfigChanges)(api.config);
+        }
         // Re-run scan as best-effort; pulse is already running
         void runScan(api.config?.agents?.defaults?.workspace);
     }, { name: "podwatch-gateway-start" });
@@ -206,8 +165,8 @@ function registerLifecycleHandlers(api, config) {
  */
 async function sendPulseWithBackoff(endpoint, apiKey, baseIntervalMs, api) {
     // Check for config changes on each pulse
-    if (api) {
-        checkModelConfigChange(api);
+    if (api?.config) {
+        (0, config_monitor_js_1.checkConfigChanges)(api.config);
     }
     let success = false;
     try {