0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-2SANI5RH.js

@@ -0,0 +1,4728 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  VERSION,
+  homeStateDir
+} from "./chunk-KKGE5RQE.js";
+
+// packages/core/dist/agent/feature-presets.js
+var FP_MOAT_FLAGS = [
+  "0SEC_FEATURE_REACHABILITY_GATE",
+  "0SEC_FEATURE_MULTIMODAL",
+  "0SEC_FEATURE_PUBLISHABILITY_GATE",
+  "0SEC_FEATURE_POV_GATE",
+  "0SEC_FEATURE_POC_GEN_STATIC",
+  "0SEC_FEATURE_CONSENSUS_VERIFY"
+];
+var FEATURE_PRESETS = Object.freeze({
+  "fp-moat": FP_MOAT_FLAGS
+});
+var PRESET_ALIASES = Object.freeze({
+  "fp-moat": "fp-moat",
+  fp_moat: "fp-moat",
+  fpmoat: "fp-moat",
+  moat: "fp-moat"
+});
+function resolveFeaturePreset(token) {
+  return PRESET_ALIASES[token.trim().toLowerCase()];
+}
+function applyFeaturePreset(preset, env2 = process.env) {
+  const applied = [];
+  const preserved = [];
+  for (const flag of FEATURE_PRESETS[preset]) {
+    if (env2[flag] !== void 0) {
+      preserved.push(flag);
+      continue;
+    }
+    env2[flag] = "1";
+    applied.push(flag);
+  }
+  return { preset, applied, preserved };
+}
+function applyFeaturePresetFromEnv(env2 = process.env) {
+  const raw = env2["0SEC_FEATURE_PRESET"];
+  if (!raw)
+    return void 0;
+  const preset = resolveFeaturePreset(raw);
+  if (!preset)
+    return void 0;
+  return applyFeaturePreset(preset, env2);
+}
+
+// packages/core/dist/agent/features.js
+var features = {
+  /**
+   * Early-stop at 50% budget if no findings, retry with a different strategy.
+   *
+   * OPT-IN (default OFF). It reads "no finding saved by the halfway turn" as
+   * "making no progress", which is wrong for the analysis it most often
+   * interrupts: a deep source audit legitimately spends its first half reading
+   * and narrowing before it has anything worth saving. Stopping there discards
+   * that work and reports it as a failure to the operator.
+   *
+   * Turn count is also a cost PROXY, and cost is already bounded directly by
+   * the token budget, so this never was the control that kept spend in check.
+   * Enable with `0SEC_FEATURE_EARLY_STOP=1` for benchmark or A/B runs where a
+   * fixed turn budget per attempt is the point.
+   */
+  get earlyStopRetry() {
+    return env("0SEC_FEATURE_EARLY_STOP", false);
+  },
+  /** Detect A-A-A and A-B-A-B loop patterns, inject warning */
+  get loopDetection() {
+    return env("0SEC_FEATURE_LOOP_DETECTION", true);
+  },
+  /** Compress middle messages when context exceeds 30k tokens */
+  get contextCompaction() {
+    return env("0SEC_FEATURE_CONTEXT_COMPACTION", true);
+  },
+  /**
+   * Re-send the opaque, model-bound Responses output item array on the next
+   * turn. Default ON; set to 0 only for matched retained-reasoning A/B runs.
+   */
+  get retainedReasoning() {
+    return env("0SEC_FEATURE_RETAINED_REASONING", true);
+  },
+  /** Exploit script templates in shell prompt (blind SQLi, SSTI, auth chain) */
+  get scriptTemplates() {
+    return env("0SEC_FEATURE_SCRIPT_TEMPLATES", true);
+  },
+  /** Dynamic vulnerability playbooks injected after recon phase */
+  get dynamicPlaybooks() {
+    return env("0SEC_FEATURE_DYNAMIC_PLAYBOOKS", false);
+  },
+  /** Just-in-time atomic DO/DON'T rules injected on a matching tool action */
+  get ruleInjection() {
+    return env("0SEC_FEATURE_RULE_INJECTION", false);
+  },
+  /** Agent writes plan/creds to disk, injected at reflection checkpoints */
+  get externalMemory() {
+    return env("0SEC_FEATURE_EXTERNAL_MEMORY", false);
+  },
+  /** Inject prior attempt findings when retrying (LLM-summarized progress handoff) */
+  get progressHandoff() {
+    return env("0SEC_FEATURE_PROGRESS_HANDOFF", true);
+  },
+  /** Allow the agent to search the web for CVE details, docs, and technique references */
+  get webSearch() {
+    return env("0SEC_FEATURE_WEB_SEARCH", false);
+  },
+  /** Interactive PTY sessions for exploits requiring interactivity (reverse shells, DB clients, SSH) */
+  get ptySession() {
+    return env("0SEC_FEATURE_PTY_SESSION", false);
+  },
+  /**
+   * Persistent, COMPUTE-ONLY Python REPL (`python_exec`, Phase-0). A framed
+   * python3 kernel keeps state across calls for payload/parse/crypto/encode
+   * work; networking is blocked at the socket source whenever an engagement is
+   * active. Default OFF — opt in via 0SEC_FEATURE_PYTHON_EXEC=1. Getter so
+   * the CLI `--features` flag (set after this module is imported) is honored at
+   * tool-dispatch time.
+   */
+  get pythonExec() {
+    return env("0SEC_FEATURE_PYTHON_EXEC", false);
+  },
+  /**
+   * Expose the path-confined `analyze_binary` bridge to 0verse. Default OFF:
+   * a model may request a long-running binary analysis only after an operator
+   * opts in with 0SEC_FEATURE_ZEROVERSE=1.
+   */
+  get zeroverse() {
+    return env("0SEC_FEATURE_ZEROVERSE", false);
+  },
+  /**
+   * EGATS specialist routing (#557, HPTSA-inspired). When ON, an EGATS branch
+   * whose hypothesis names a concrete vuln class (SQLi/XSS/SSRF/SSTI/IDOR/
+   * auth-bypass) runs as a per-class SPECIALIST: a class system prompt built
+   * from the technique sections in prompts.ts, the matching methodology skill
+   * auto-loaded into context, and a class-tuned tool subset. Hypotheses that
+   * are ambiguous (zero or multiple classes) fall back to the generic branch
+   * agent — beam search / scoring are untouched. Emits an `egats_specialist`
+   * event per routed node.
+   *
+   * Default OFF: this changes how branch mini-loops are configured, so it must
+   * be explicitly opted into before any A/B / multiplier claim on the
+   * benchmark harness. Implemented as a getter so the CLI `--features` flag
+   * (which sets the env var inside the command action, AFTER this module has
+   * been imported) is honored at routing time. Enable via
+   * 0SEC_FEATURE_SPECIALIST_ROUTING=1.
+   */
+  get specialistRouting() {
+    return env("0SEC_FEATURE_SPECIALIST_ROUTING", false);
+  },
+  /** Self-consistency voting: run the structured verify pipeline N times and take the majority vote */
+  get selfConsistencyVerify() {
+    return env("0SEC_FEATURE_CONSENSUS_VERIFY", false);
+  },
+  /** Multi-modal agreement: cross-validate findings against foxguard (Rust pattern scanner) */
+  get multiModalAgreement() {
+    return env("0SEC_FEATURE_MULTIMODAL", false);
+  },
+  /** Reachability gate: suppress findings whose sink is not reachable from an application entry point */
+  get reachabilityGate() {
+    return env("0SEC_FEATURE_REACHABILITY_GATE", false);
+  },
+  /**
+   * Publishability / in-scope gate (issue #537 / #539). Decides
+   * disclosure-worthiness per finding: SECURITY.md threat-model exclusion
+   * (by_design), global advisory dedup (duplicate) with the fix-bypass
+   * exception, latest-version (fixed), and public-API reachability
+   * (unreachable). Never auto-drops high-severity/high-impact findings — those
+   * are routed to needs_verify + human review via canAutoSuppress.
+   *
+   * Default OFF: this gate can suppress reproducible findings, so it must be
+   * explicitly opted into before any A/B claim. Disable/enable via
+   * 0SEC_FEATURE_PUBLISHABILITY_GATE.
+   */
+  get publishabilityGate() {
+    return env("0SEC_FEATURE_PUBLISHABILITY_GATE", false);
+  },
+  /** PoV gate: require a working, executable PoC per finding or downgrade to info */
+  get povGate() {
+    return env("0SEC_FEATURE_POV_GATE", false);
+  },
+  /**
+   * Intra-scan semantic dedupe post-pass (anchored incremental LLM
+   * clustering over the final finding set, `triage/semantic-dedupe.ts`).
+   * Marks duplicates with a canonical mapping + cluster reason instead of
+   * dropping them. Default OFF: it spends an LLM call per ≤50-finding batch
+   * after the scan, so it must be explicitly opted into before any A/B
+   * claim. Toggle via 0SEC_FEATURE_SEMANTIC_DEDUPE.
+   */
+  get semanticDedupe() {
+    return env("0SEC_FEATURE_SEMANTIC_DEDUPE", false);
+  },
+  /**
+   * Finding-specific remediation written by the model
+   * (`generateRemediationWithLLM`) instead of the static category knowledge
+   * base. Default OFF: it spends one extra LLM call per non-false-positive
+   * finding at report-assembly time, which is real money on a noisy scan and
+   * buys nothing on a scan with no findings.
+   *
+   * Worth turning on for disclosure-bound work: the static KB emits the same
+   * generic snippet for every finding in a category, whereas the model sees
+   * this finding's evidence and can name the actual sink. The call is
+   * fail-open — any error falls back to the KB answer — so enabling it can
+   * degrade cost, never correctness.
+   */
+  get llmRemediation() {
+    return env("0SEC_FEATURE_LLM_REMEDIATION", false);
+  },
+  /**
+   * Per-finding impact assessment (`assessImpact`, `triage/impact-assessment.ts`)
+   * written by the model: reachability tier, weaponizability, blast radius,
+   * business-impact tier. Default OFF — one extra LLM call per non-false-positive
+   * finding at report time.
+   *
+   * When on, the assessment feeds three things it is otherwise absent from:
+   * a real CVSS exploitability vector (AV/PR/UI from the reachability tier
+   * rather than the AV:N/severity-floor guess), the advisory's Impact +
+   * attack-prerequisites section, and the vendor-notification impact line. When
+   * off, all three fall back to today's category/severity heuristics — so this
+   * flag strictly adds fidelity, never changes the no-assessment output.
+   */
+  get impactAssessment() {
+    return env("0SEC_FEATURE_IMPACT_ASSESSMENT", false);
+  },
+  /**
+   * Incremental finding ranking post-pass (decimal-insertion between ranked
+   * anchors, `triage/incremental-rank.ts`). Orders the report by comparative
+   * promise (exploitability × impact × evidence strength). Default OFF: it
+   * spends an LLM call per ≤50-finding batch; opt in before any A/B claim.
+   * Toggle via 0SEC_FEATURE_INCREMENTAL_RANK.
+   */
+  get incrementalRank() {
+    return env("0SEC_FEATURE_INCREMENTAL_RANK", false);
+  },
+  /**
+   * Static-finding PoC generation (#666 / EPIC #674 Part A). For findings that
+   * ship with NO executable PoC (`pocSteps` empty — the static / code-analysis
+   * path), run an agentic PoC-gen pass that builds + runs a minimal PoC in the
+   * scan substrate (reuses the PoV mini-loop). On reproduce it synthesizes a
+   * runnable `pocSteps` graph so the verify runner stops skipping the finding;
+   * on no-repro it flags the finding `poc:none` for manual / inconclusive
+   * review instead of silently dropping it. Root cause: 112 high/crit findings
+   * with `poc_steps IS NULL` were silently `skipped` by the verify fan-out.
+   *
+   * Default OFF: it spends LLM + execution budget per static finding and must
+   * be explicitly opted into before any A/B claim (A/B-able via the #656
+   * harness). Toggle via 0SEC_FEATURE_POC_GEN_STATIC.
+   */
+  get pocGenStatic() {
+    return env("0SEC_FEATURE_POC_GEN_STATIC", false);
+  },
+  /**
+   * Inline validation / validate-on-save (#554). When ON, the native attack
+   * loop runs a fast deterministic category oracle the moment a high/critical
+   * finding is saved (`onFindingSaved` hook → `verifyOracleByCategory`, the
+   * cheap end of the #553 PoV-gate→oracle delegation). The verdict is injected
+   * back into the loop as a context note (confirmed → stop piling on;
+   * unconfirmed → "do not assume success"), stamped on `finding.inlineValidation`
+   * so EGATS `scoreEvidence` lets a confirmed finding dominate the regex signals
+   * and the batch oracle/PoV gate can skip the redundant re-run. Inline errors
+   * are inconclusive, never false-positive. Emits `inline_validation` events.
+   *
+   * Default OFF: it adds a per-finding network probe inside the attack loop and
+   * changes EGATS scoring, so it must be explicitly opted into before any A/B /
+   * cost_per_flag claim. Implemented as a getter so the CLI `--features` flag
+   * (which sets the env var inside the command action, AFTER this module is
+   * imported) is honored at loop time. Enable via
+   * 0SEC_FEATURE_INLINE_VALIDATION=1.
+   */
+  get inlineValidation() {
+    return env("0SEC_FEATURE_INLINE_VALIDATION", false);
+  },
+  /**
+   * WordPress plugin/theme fingerprinter + OSV CVE lookup.
+   * Exposes the `wp_fingerprint` tool to the attack agent. Off by default —
+   * can be disabled via `--features no-wp_fingerprint` / env if needed.
+   * WordPress detection is cheap and the resulting plugin/CVE hints are
+   * broadly useful on real web targets, so the default is ON. See
+   * packages/core/src/agent/wp-fingerprint.ts for the implementation.
+   *
+   * Implemented as a getter so the CLI `--features` flag — which sets the env
+   * var inside the command action, AFTER this module has been imported — is
+   * still honored at tool-dispatch time.
+   */
+  get wpFingerprint() {
+    return env("0SEC_FEATURE_WP_FINGERPRINT", true);
+  },
+  /**
+   * MongoDB ObjectID forge tool. Exposes the `mongo_objectid` tool to the
+   * attack agent so it can compute valid 24-char hex ObjectIds with arbitrary
+   * timestamps + counters (e.g. forge the "first user" ObjectId in an IDOR
+   * challenge by setting timestamp = appStartTimestamp and counter = 0).
+   *
+   * Default ON — this is a pure-computation utility with no network or
+   * filesystem side effects, so there's no reason to gate it off. Disable
+   * via 0SEC_FEATURE_MONGO_OBJECTID_FORGE=0 or `--no-mongo-objectid-forge`
+   * for ablation. Implemented as a getter so the CLI `--features` flag
+   * (which sets the env var inside the command action, AFTER this module
+   * has been imported) is still honored at tool-dispatch time. Matches
+   * the wpFingerprint pattern above. See packages/core/src/agent/objectid-forge.ts.
+   */
+  get mongoObjectIdForge() {
+    return env("0SEC_FEATURE_MONGO_OBJECTID_FORGE", true);
+  },
+  /**
+   * Live cloud-surface testing (0sec#925). Exposes `cloud_s3_probe` and
+   * `cloud_validate_credentials` to the attack agent so it can test S3 buckets
+   * for public access + orphaned-bucket takeover and safely validate harvested
+   * AWS credentials (read-only). All probes are anonymous or read/verify-only —
+   * no writes, no data exfiltration beyond minimal proof.
+   *
+   * Default OFF (opt-in via 0SEC_FEATURE_CLOUD_SURFACE=1). Probing a target
+   * org's bucket-name space or validating its harvested credentials is recon
+   * AGAINST THAT ORG, so it is deny-by-default at two layers: this enablement
+   * flag, AND an engagement-scope check in the tool handlers (a configured
+   * ScopePolicy that authorizes the bucket endpoint — see cloud-surface.ts
+   * `bucketInScope`). The read-only action allowlist (`assertReadOnlyAction`)
+   * stays on top of both. Getter so the CLI `--features` flag (set AFTER this
+   * module loads) is honored at dispatch time — matches the wpFingerprint /
+   * mongoObjectIdForge pattern above. See packages/core/src/agent/cloud-surface.ts.
+   */
+  get cloudSurface() {
+    return env("0SEC_FEATURE_CLOUD_SURFACE", false);
+  },
+  /**
+   * #978 (ADR-060) — agent fan-out. When ON, the agent gets the `start_scan`
+   * tool: it can dispatch CHILD scans (via the same POST /scans the UI uses)
+   * that run independently and report up the scan tree — the recursive
+   * sub-agent orchestration. Default OFF: fan-out multiplies scans/cost, so it
+   * stays opt-in even though the orchestrator enforces budget + a tree-level
+   * cap (max children/depth). Enable with 0SEC_FEATURE_AGENT_FANOUT=1.
+   * Getter so the CLI `--features` flag is honored at dispatch time.
+   */
+  get agentFanout() {
+    return env("0SEC_FEATURE_AGENT_FANOUT", false);
+  },
+  // ── Phase-2 offensive-engine feature flags (dev-live-engine-recovery) ──
+  // Each gates a tool that RUNS/BUILDS untrusted code or WEAPONIZES. They are
+  // deny-by-default and mirror `cloudSurface` exactly: the env flag is only one
+  // of two layers — the tool is ALSO engagement-scope gated in getToolsForRole,
+  // and the highest-risk ones add their own runtime precondition (kernel-VM
+  // artifacts present). Getters so the CLI `--features` flag (set AFTER this
+  // module loads) is honored at dispatch time.
+  /**
+   * `memsafety_fuzz` — clones/builds/fuzzes a source tree (sanitizer builds +
+   * a fuzz harness), executing attacker-adjacent build scripts and native
+   * fuzz targets. Default OFF; opt in via 0SEC_FEATURE_MEMSAFETY=1. Building
+   * and running an untrusted tree is code execution, so it is deny-by-default
+   * behind this flag AND an engagement scope.
+   */
+  get memsafetyFuzz() {
+    return env("0SEC_FEATURE_MEMSAFETY", false);
+  },
+  /**
+   * `npm_dynamic_discovery` — installs and RUNS untrusted npm packages under
+   * instrumentation to observe malicious install/runtime behaviour. Executing
+   * arbitrary package code is the whole point, so it is deny-by-default behind
+   * this flag AND an engagement scope. Opt in via 0SEC_FEATURE_NPM_DISCOVERY=1.
+   */
+  get npmDynamicDiscovery() {
+    return env("0SEC_FEATURE_NPM_DISCOVERY", false);
+  },
+  /**
+   * `weaponize_kernel` — the kernel-exploit weaponization ladder. It only ever
+   * runs inside a DISPOSABLE kernel VM and requires kernel-VM artifacts to be
+   * present. Highest-caution capability: deny-by-default behind this flag AND
+   * an engagement scope AND a runtime artifact-presence check (the handler
+   * refuses when the kernel-VM assets are absent). Opt in via
+   * 0SEC_FEATURE_KERNEL_WEAPONIZE=1.
+   */
+  get kernelWeaponize() {
+    return env("0SEC_FEATURE_KERNEL_WEAPONIZE", false);
+  },
+  /**
+   * `cve_adapt` — adapts a public CVE PoC to the target and RUNS it to confirm
+   * exploitability. Running an adapted exploit is code execution against the
+   * target, so it is deny-by-default behind this flag AND an engagement scope.
+   * Opt in via 0SEC_FEATURE_CVE_ADAPT=1.
+   */
+  get cveAdapt() {
+    return env("0SEC_FEATURE_CVE_ADAPT", false);
+  },
+  /**
+   * Anti-honeypot flag-shape validator. When the agent calls the `done`
+   * tool with a proposed `FLAG{...}`, the tool runs `validateFlagShape`
+   * first; low-confidence ("looks like a decoy") flags are rejected once
+   * with a hint to keep exploring. The agent can override by retrying the
+   * same flag — the heuristic is a speed bump, not a hard wall.
+   *
+   * Default ON because legitimate flags pass the shape check trivially
+   * and the false-positive rate on real flags should be near zero. Turn
+   * off via `0SEC_FEATURE_DECOY_DETECTION=0` or the CLI flag
+   * `--no-decoy-detection` for ablation/testing.
+   *
+   * Implemented as a getter so the CLI flag (which flips the env var
+   * inside the command action, AFTER this module has been imported) is
+   * still honored at tool-dispatch time. Matches the wpFingerprint
+   * pattern above. See GitHub issue #82 and
+   * packages/core/src/agent/flag-validator.ts.
+   */
+  get decoyDetection() {
+    return env("0SEC_FEATURE_DECOY_DETECTION", true);
+  },
+  // ── Always-on triage filters (default ON, ablatable for A/B testing) ──
+  /**
+   * `holding-it-wrong` regex blocklist (`packages/core/src/triage/holding-it-wrong.ts`).
+   * Matches finding text against documented I/O / eval / compile / persistence
+   * sink names and rejects findings that look like "the function did its job".
+   *
+   * Default ON because that's the existing v0.6.0 behavior. Can be disabled
+   * via 0SEC_FEATURE_HOLDING_IT_WRONG=0 to test whether this filter is
+   * suppressing real signal — the ceiling-analysis from 2026-04-06 identified
+   * this as the strongest candidate for the unexplained XBOW finding-density
+   * collapse from 14 → 4 between `features=none` and `features=all`.
+   */
+  get holdingItWrong() {
+    return env("0SEC_FEATURE_HOLDING_IT_WRONG", true);
+  },
+  /**
+   * `evidence_completeness <= 0.5` reject (`packages/core/src/agentic-scanner.ts:591`).
+   * Drops findings whose extracted feature vector says the agent didn't
+   * gather enough cross-source evidence (request + response + analysis + ...).
+   *
+   * Default ON because that's the existing v0.6.0 behavior. Can be disabled
+   * via 0SEC_FEATURE_EVIDENCE_GATE=0 for ablation.
+   */
+  get evidenceGate() {
+    return env("0SEC_FEATURE_EVIDENCE_GATE", true);
+  },
+  /**
+   * Learned per-finding triage router (`packages/core/src/triage/learned-router.ts`).
+   * When enabled, findings are scored by hand-coded rules derived from the
+   * XGBoost model trained on triage-dataset-v2.jsonl (1514 rows). High-confidence
+   * findings auto-accept (skipping expensive layers); low-confidence findings
+   * auto-reject; the middle band gets routed to a subset of layers based on
+   * the scan's slice type (xbow-wb, xbow-bb, npm).
+   *
+   * Default OFF until the router is validated via A/B testing on xbow-bench
+   * and npm-bench. See 0sec#113 for the design doc.
+   */
+  get learnedRouter() {
+    return env("0SEC_FEATURE_LEARNED_ROUTER", false);
+  },
+  /**
+   * Dynamic per-finding triage routing (`packages/core/src/triage/router/`).
+   * When enabled, every finding is sent through a `RouterModel` that
+   * decides which subset of the 11 triage layers to invoke for that
+   * specific finding. v0 ships an explicit-rule router encoded from the
+   * 0sec#72 per-profile ablation; a learned classifier replaces the
+   * rules in a follow-up PR without touching the dispatch site.
+   *
+   * Distinct from `learnedRouter` above: `learnedRouter` is the XGBoost
+   * TP/FP score model that decides accept/reject; `dynamicTriageRouting`
+   * is the per-layer dispatch decision. Both can be on at the same time;
+   * the dispatch router gates which layers run AFTER the TP/FP score
+   * model has spoken.
+   *
+   * Default OFF — opt in via 0SEC_FEATURE_DYNAMIC_TRIAGE=1. See
+   * 0sec#113 for the design doc and 0sec#67 for the joint paper plan.
+   */
+  get dynamicTriageRouting() {
+    return env("0SEC_FEATURE_DYNAMIC_TRIAGE", false);
+  },
+  /**
+   * Opt-in cloud-sink webhook integration (`packages/core/src/cloud-sink.ts`).
+   * When enabled AND the user has set 0SEC_CLOUD_SINK + 0SEC_CLOUD_SCAN_ID,
+   * every finding and the final scan report are POSTed to the configured
+   * remote endpoint in real time.
+   *
+   * Default ON so the env-var trio is sufficient to enable streaming, but the
+   * flag exists so operators can force-disable the integration in environments
+   * where outbound HTTP from the scanner is not desired (e.g. air-gapped CI).
+   * Disable via 0SEC_FEATURE_CLOUD_SINK=0.
+   */
+  get cloudSink() {
+    return env("0SEC_FEATURE_CLOUD_SINK", true);
+  },
+  /**
+   * Pre-recon CVE check (`packages/core/src/pre-recon-cve.ts`).
+   * In white-box mode (`--repo` set), runs `npm audit` / `pip-audit`
+   * against the source tree before the attack agent starts and injects
+   * any high/critical advisories into the system prompt as priority
+   * leads. Defends against expensive thrash on CVE-tagged challenges
+   * where the agent has source access but no concrete leads.
+   *
+   * Default ON in white-box mode (no-op in black-box). Disable via
+   * 0SEC_FEATURE_PRE_RECON_CVE=0 for ablation.
+   */
+  get preReconCve() {
+    return env("0SEC_FEATURE_PRE_RECON_CVE", true);
+  },
+  /**
+   * Deterministic web-recon pre-pass (`packages/core/src/stages/web-recon-prepass.ts`).
+   * On web scans, runs cheap non-destructive HTTP/DNS probes before the attack
+   * agent's first turn: baseline web checks, stack fingerprint → version→CVE
+   * lookup, JS source-map/secret scan, DNS/email posture, passive subdomain
+   * enumeration, and (Next.js only, on positive proof) framework-CVE active
+   * checks. It EMITS findings directly for what it can prove and injects a
+   * "pursue these leads" block into the system prompt for what it can only hint.
+   *
+   * Default ON (no-op in non-web modes). Gated behind 0SEC_FEATURE_WEB_RECON
+   * so it can be disabled for ablation or offline runs. Implemented as a getter
+   * so the CLI `--features` flag (which sets the env var inside the command
+   * action, AFTER this module has been imported) is honored at stage time.
+   */
+  get webRecon() {
+    return env("0SEC_FEATURE_WEB_RECON", true);
+  },
+  /**
+   * Best-effort target-history preflight for source review. When a local repo
+   * path is known, 0sec infers repository/package/product hints, queries live
+   * prior-vulnerability intel, and injects a compact audit-graph summary into
+   * the review prompt before the agent starts.
+   *
+   * Default ON for white-box/source-review modes. Disable via
+   * 0SEC_FEATURE_TARGET_HISTORY_PRESEED=0 for offline or ablation runs.
+   */
+  get targetHistoryPreseed() {
+    return env("0SEC_FEATURE_TARGET_HISTORY_PRESEED", true);
+  },
+  /**
+   * Preserve credential / exploit-bearing messages verbatim during
+   * `compactMessagesWithLLM` (`packages/core/src/agent/native-loop.ts`).
+   * When the conversation is compacted, middle messages whose serialized
+   * text matches the critical-message regex (passwords, credentials,
+   * shells, exploits, login/auth tokens, etc.) are appended verbatim
+   * after the LLM summary block, instead of being replaced by a paraphrase.
+   *
+   * Default ON: the win on long-tail challenges where a credential is
+   * recovered in turn 12 and needed in turn 38 is large, and the cost
+   * (a handful of extra messages preserved verbatim in the user
+   * compaction-summary block) is small. BoxPwnr-inspired: see
+   * `src/boxpwnr/solvers/single_loop_compactation.py` in 0ca/BoxPwnr,
+   * and 0sec#229 for the design discussion.
+   *
+   * Implemented as a getter so the CLI `--features` flag — which sets
+   * the env var inside the command action AFTER this module is imported
+   * — is still honored at compaction time. Disable via
+   * 0SEC_FEATURE_PRESERVE_CRITICAL_MESSAGES=0 for ablation.
+   */
+  get preserveCriticalMessages() {
+    return env("0SEC_FEATURE_PRESERVE_CRITICAL_MESSAGES", true);
+  },
+  /**
+   * Two-stage budget-warning injection in the agent loop (#408).
+   *
+   * Strix's `base_agent.py:186-211` injects a soft warning at 85% of the
+   * turn budget and a sharper warning at `maxTurns − 3` so the model gets
+   * a clean signal to call `done` (or `save_finding`+`done`) instead of
+   * being cut off mid-thought when the hard turn limit triggers. Each
+   * warning fires AT MOST ONCE per run; the small turn-state field
+   * `budgetWarningsFired` lives on the loop's local closure.
+   *
+   * Default ON per the issue acceptance criteria — the warnings are a
+   * single short user-message injection at two specific turn boundaries,
+   * and the win on long benchmarks (clean handoff instead of stray
+   * exploration on the last turn) is well-documented in Strix's
+   * implementation. Disable via 0SEC_FEATURE_BUDGET_WARNINGS=0 for
+   * ablation. Implemented as a getter so the CLI `--features` flag —
+   * which sets the env var inside the command action AFTER this module
+   * is imported — is still honored at injection time (matches the
+   * wpFingerprint / preserveCriticalMessages pattern).
+   */
+  get budgetWarnings() {
+    return env("0SEC_FEATURE_BUDGET_WARNINGS", true);
+  },
+  /**
+   * Per-file orchestration for the research and audit stages (#285).
+   *
+   * When enabled (default), the research and audit stages call the agent
+   * once per source file with a focused per-file system prompt rather than
+   * one shared session that nominally walks all files but in practice
+   * skips, dedupes, or condenses past the first ~30. Mirrors the
+   * per-finding verify loop pattern from pov-gate.ts.
+   *
+   * Trade-off: total token spend grows roughly N × per-file budget instead
+   * of capped at a single session's budget. For a 50-file package, that
+   * could be a 5-10× cost increase on research. Disable via
+   * `0SEC_FEATURE_PER_ITEM_ORCHESTRATION=0` to revert to the shared-session
+   * behavior — useful for cost-bounded benchmarks.
+   *
+   * Implemented as a getter so the env var is honored at orchestration time
+   * (matches the wpFingerprint / mongoObjectIdForge pattern).
+   */
+  get perItemOrchestration() {
+    return env("0SEC_FEATURE_PER_ITEM_ORCHESTRATION", true);
+  },
+  /**
+   * JIT skill loading (`packages/core/src/agent/skills/`).
+   * When enabled, the agent gains `list_skills` and `load_skill` tools
+   * that let it browse a registry of focused methodology guides and load
+   * them into working context mid-scan. Skills replace the monolithic
+   * playbook injection with targeted, on-demand knowledge (#410, #457).
+   *
+   * Default OFF until the skill registry is validated via A/B testing.
+   * Implemented as a getter so the CLI `--features` flag — which sets
+   * the env var inside the command action, AFTER this module has been
+   * imported — is still honored at tool-dispatch time.
+   */
+  get jitSkills() {
+    return env("0SEC_FEATURE_JIT_SKILLS", false);
+  },
+  /**
+   * Execution-journal shadow mode (#494, first additive slice).
+   *
+   * When ON, the live agent loop ALSO writes append-only journal entries
+   * (`tool_call`, `tool_result`, `finding`, `done`) to
+   * `~/.0sec/runs/<scanId>/journal.jsonl` as it runs — a durable,
+   * replayable trace alongside the existing in-memory conversation window.
+   * This is strictly additive: the loop continues to drive off its own
+   * conversation state, the journal is write-only here, and a failed
+   * journal write is swallowed so it can never abort a scan. The journal is
+   * NOT yet the source of truth — routing the loop off `rehydrateContext`
+   * is the next slice (see docs/research/agent-execution-journal-design.md).
+   *
+   * Default OFF: shadow writes add a small per-turn fsync cost and the
+   * format is still settling, so it must be explicitly opted into for the
+   * moat-ablation harness before any A/B claim. Implemented as a getter so
+   * the CLI `--features` flag (which sets the env var inside the command
+   * action, AFTER this module has been imported) is honored at loop time.
+   * Enable via 0SEC_FEATURE_EXECUTION_JOURNAL=1 or `--features
+   * execution-journal`.
+   */
+  get executionJournal() {
+    return env("0SEC_FEATURE_EXECUTION_JOURNAL", false);
+  },
+  /**
+   * Execution-journal context routing (#494, slice 2).
+   *
+   * When ON, the native agent loop seeds its initial/resume conversation
+   * context from the on-disk execution journal via
+   * `rehydrateContext(loadJournal(...))` instead of (or fronting) the
+   * truncated 40-message DB session blob. This is the slice that finally
+   * routes the loop's context OFF the journal — the IronCurtain "every
+   * agent begins with a fresh context window and rehydrates from disk"
+   * primitive becomes load-bearing.
+   *
+   * Independent of `executionJournal` (the shadow-WRITE flag) on purpose so
+   * the moat-ablation harness can toggle write and route separately for a
+   * clean A/B. Rehydrate is a READER, though, so it only does anything when
+   * a journal was written for the run — it reads `~/.0sec/runs/<scanId>/
+   * journal.jsonl` regardless of how it got there (shadow mode this slice,
+   * or specialists in a later slice). When the journal is missing, empty, or
+   * corrupt the loop falls back to the existing DB-blob / fresh-prompt
+   * seeding and never crashes; the fallback is logged. A FRESH run (no
+   * journal yet) rehydrates to empty state, which is byte-equivalent to
+   * today's initial-prompt seeding — so `journalRehydrate` only changes
+   * behaviour on RESUME of an already-journaled run.
+   *
+   * Default OFF: this changes the loop's source of truth for resume, so it
+   * must be explicitly opted into before any A/B claim. Implemented as a
+   * getter so the CLI `--features` flag (which sets the env var inside the
+   * command action, AFTER this module has been imported) is honored at loop
+   * time. Enable via 0SEC_FEATURE_JOURNAL_REHYDRATE=1 or `--features
+   * journal-rehydrate`.
+   */
+  get journalRehydrate() {
+    return env("0SEC_FEATURE_JOURNAL_REHYDRATE", false);
+  },
+  /**
+   * Loot / foothold ledger for opportunistic exploit chaining (#567).
+   *
+   * When ON, the attack/discovery/verify agents maintain a typed `LootLedger`
+   * (credential | token | path | endpoint | hash | cookie) populated from
+   * `save_finding` evidence AND from evidence-bearing tool results
+   * (http_request / crawl / submit_form / send_prompt / browser / read_file /
+   * bash). A compact "known footholds" block is re-injected into the agent's
+   * context each turn (re-rendered from structured state, so it survives
+   * compaction), and a `use_loot` tool lets the agent retrieve full artifact
+   * values on demand to replay them in follow-up requests. This is the cheap,
+   * deterministic alternative to EGATS tree-search (which is disabled) — it
+   * stays inside the existing single agent loop, adds no new search layer.
+   *
+   * Default ON: it's purely additive (extra context awareness + one read-only
+   * tool), matches the `preserveCriticalMessages` rationale — recovering a
+   * credential in turn 12 that's needed in turn 38 is a large win on long-tail
+   * challenges — and the cost (a short, size-capped block per turn) is small.
+   * Disable via 0SEC_FEATURE_LOOT_LEDGER=0 or `--no-loot-ledger` for
+   * ablation. Implemented as a getter so the CLI `--features` flag (which sets
+   * the env var inside the command action, AFTER this module has been
+   * imported) is honored at tool-dispatch / injection time — matches the
+   * wpFingerprint / preserveCriticalMessages pattern.
+   */
+  get lootLedger() {
+    return env("0SEC_FEATURE_LOOT_LEDGER", true);
+  },
+  /**
+   * Typed TODO / plan ledger (`packages/core/src/agent/task-ledger.ts`).
+   *
+   * When ON, the agent gets a `plan` tool that maintains a typed, validated
+   * task list (add / start / complete / drop / note / list), and the loop
+   * re-injects a compact plan block re-rendered from that structured state —
+   * so the plan survives `compactMessagesWithLLM` eating the message that
+   * carried it. Prior art: Tencent Xuanwu's Atuin moved 68.7% → 84.0% on
+   * CyberGym holding the model fixed, and agent-maintained TODO lists are a
+   * named component of that harness design.
+   *
+   * Default ON, on the same reasoning as `lootLedger` above: it is additive
+   * (one tool schema plus a size-capped block), it is structured state
+   * re-rendered per turn rather than a new search or reasoning layer, and the
+   * failure mode of an unused tool is a few hundred wasted schema tokens
+   * rather than wrong behavior. Note for whoever publishes benchmark numbers
+   * next: this DOES change the default tool list, so re-baseline before
+   * quoting a figure across this change. Disable via 0SEC_FEATURE_AGENT_PLAN=0
+   * or `--features no-agent-plan` for ablation. Getter so the CLI `--features`
+   * flag (which sets the env var AFTER this module is imported) is honored at
+   * tool-dispatch time.
+   */
+  get agentPlan() {
+    return env("0SEC_FEATURE_AGENT_PLAN", false);
+  },
+  /**
+   * Task-drift detection (`packages/core/src/agent/drift.ts`).
+   *
+   * When ON, the loop tracks lexical "anchor contact" between each turn's
+   * activity and the objective + open plan tasks, and injects a re-anchoring
+   * message when contact has been absent for several consecutive turns. It is
+   * a pure function of the trajectory — no LLM call, no network, no per-turn
+   * cost. Complements `loopDetection`, which catches an agent repeating itself;
+   * drift is the opposite shape (novel activity every turn, none of it on-task)
+   * and is invisible to the loop detector.
+   *
+   * Default OFF, unlike `agentPlan` above, and the asymmetry is deliberate: the
+   * plan tool is a capability the model chooses to use, whereas this INJECTS
+   * unsolicited steering into a running agent based on a lexical heuristic
+   * whose false-positive rate has not been measured. The measurement needs
+   * labelled trajectories (replay stored benchmark runs, human-mark which fires
+   * were genuine derails) and that corpus does not exist yet — see the honest
+   * limitations section in the module doc, particularly that a legitimate pivot
+   * to a newly-discovered lead is lexically indistinguishable from a derail.
+   * Repo convention is explicit that behavior-steering features stay opt-in
+   * until A/B'd, and this is squarely one. Enable via
+   * 0SEC_FEATURE_DRIFT_DETECTION=1 or `--features drift-detection`.
+   */
+  get driftDetection() {
+    return env("0SEC_FEATURE_DRIFT_DETECTION", false);
+  },
+  /**
+   * OAST out-of-band interaction collaborator + oracle (#659).
+   *
+   * When ON, the attack/verify agents get `oast_register` / `oast_poll` to
+   * confirm blind/out-of-band classes (blind SSRF/XSS, OOB RCE/SQLi, XXE-OOB,
+   * JNDI) via a hosted DNS+HTTP callback server we control, with
+   * correlation-token matching. A confirmed callback is disclosure-grade
+   * evidence and feeds the loot ledger.
+   *
+   * Default OFF — the tools are inert without a deployed collaborator. Enable
+   * with 0SEC_FEATURE_OAST=1 AND point 0SEC_OAST_URL at the self-hosted
+   * collaborator server (see packages/core/src/oast/server.ts). Getter (not a
+   * const) so the CLI `--features` flag is honored at tool-dispatch time.
+   */
+  get oastCollaborator() {
+    return env("0SEC_FEATURE_OAST", false);
+  },
+  /**
+   * Anthropic prompt caching (`cache_control: {type: "ephemeral"}`) over the
+   * stable request prefix — tool schemas, system prompt, and the settled part
+   * of the conversation. See `runtime/prompt-cache.ts` for the placement
+   * strategy and the wire contract it encodes.
+   *
+   * Default ON — and unlike every other flag in this file, that default is not
+   * an A/B judgement call. Where a moat layer trades cost for recall, caching
+   * is strictly dominant on the axes we care about: the same prompt, the same
+   * tokens, the same model output, at ~0.1x input price and materially lower
+   * per-turn prefill latency on every turn after the first. The engine
+   * re-sends the entire transcript each turn (stateless Messages API), so the
+   * saving compounds with conversation length — precisely where the pain is.
+   * There is no recall or behaviour dimension to ablate here, which is why
+   * this ships enabled rather than waiting on a benchmark.
+   *
+   * It is also gated on provider support and fails closed: only providers
+   * verified to honour `cache_control` receive it, so a non-Anthropic wire can
+   * never see an Anthropic-shaped field regardless of this flag (see
+   * `providerSupportsPromptCache`).
+   *
+   * Disable via 0SEC_FEATURE_PROMPT_CACHE=0 — worth doing only to isolate a
+   * suspected provider-side caching bug, or to measure the uncached baseline.
+   * Implemented as a getter so a late env mutation (CLI `--features`, which
+   * runs after this module is imported) is honoured at request-build time.
+   */
+  get promptCache() {
+    return env("0SEC_FEATURE_PROMPT_CACHE", true);
+  }
+};
+function presetRaisesDefault(key) {
+  const raw = process.env["0SEC_FEATURE_PRESET"];
+  if (!raw)
+    return false;
+  const preset = resolveFeaturePreset(raw);
+  if (!preset)
+    return false;
+  return FEATURE_PRESETS[preset].includes(key);
+}
+function env(key, defaultValue) {
+  const val = process.env[key];
+  if (val === void 0)
+    return defaultValue || presetRaisesDefault(key);
+  return val !== "0" && val !== "false";
+}
+
+// packages/core/dist/diagnostics/channel.js
+var MAX_MESSAGE_LENGTH = 512;
+var MAX_FIELD_VALUE_LENGTH = 256;
+var MAX_CODE_LENGTH = 64;
+var MAX_FIELDS = 32;
+var MAX_BUFFERED = 200;
+var UNKNOWN_CODE = "unknown";
+var ANSI_PATTERN = /[\u001B\u009B][[\]()#;?]*(?:(?:(?:[a-zA-Z\d]*(?:;[-a-zA-Z\d/#&.:=?%@~_]*)*)?\u0007)|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\dA-PR-TZcf-nq-uy=><~]))/g;
+var CONTROL_PATTERN = /[\u0000-\u001F\u007F-\u009F]/g;
+var UNICODE_BREAK_PATTERN = /[\u2028\u2029]/g;
+function sanitizeText(input, maxLength) {
+  let out = input.replace(ANSI_PATTERN, "");
+  out = out.replace(CONTROL_PATTERN, " ");
+  out = out.replace(UNICODE_BREAK_PATTERN, " ");
+  out = out.replace(/\s+/g, " ").trim();
+  if (out.length > maxLength) {
+    out = out.slice(0, Math.max(0, maxLength - 1)).trimEnd() + "\u2026";
+  }
+  return out;
+}
+function sanitizeCode(input) {
+  const raw = typeof input === "string" ? input : String(input ?? "");
+  const slug = raw.toLowerCase().replace(ANSI_PATTERN, "").replace(/[^a-z0-9_.-]+/g, "_").replace(/^[_.-]+|[_.-]+$/g, "").slice(0, MAX_CODE_LENGTH);
+  return slug.length > 0 ? slug : UNKNOWN_CODE;
+}
+function sanitizeFieldValue(value) {
+  if (value === null)
+    return null;
+  switch (typeof value) {
+    case "undefined":
+      return void 0;
+    case "boolean":
+      return value;
+    case "number":
+      return Number.isFinite(value) ? value : String(value);
+    case "bigint":
+      return `${value}n`;
+    case "string":
+      return sanitizeText(value, MAX_FIELD_VALUE_LENGTH);
+    case "function":
+      return "[function]";
+    case "symbol":
+      return sanitizeText(String(value), MAX_FIELD_VALUE_LENGTH);
+    default:
+      break;
+  }
+  if (value instanceof Error) {
+    return sanitizeText(`${value.name}: ${value.message}`, MAX_FIELD_VALUE_LENGTH);
+  }
+  if (value instanceof Date) {
+    const t = value.getTime();
+    return Number.isFinite(t) ? value.toISOString() : "[invalid date]";
+  }
+  try {
+    const json = JSON.stringify(value);
+    return json === void 0 ? "[unserializable]" : sanitizeText(json, MAX_FIELD_VALUE_LENGTH);
+  } catch {
+    return "[unserializable]";
+  }
+}
+var EMPTY_FIELDS = Object.freeze({});
+function sanitizeFields(input) {
+  if (input == null || typeof input !== "object")
+    return EMPTY_FIELDS;
+  const out = {};
+  let count = 0;
+  for (const key of Object.keys(input)) {
+    if (count >= MAX_FIELDS)
+      break;
+    const safeKey = sanitizeCode(key);
+    if (Object.prototype.hasOwnProperty.call(out, safeKey))
+      continue;
+    const value = sanitizeFieldValue(input[key]);
+    if (value === void 0)
+      continue;
+    out[safeKey] = value;
+    count++;
+  }
+  return Object.freeze(out);
+}
+var LEVEL_RANK = { info: 10, warn: 20, error: 30 };
+var OFF_RANK = Number.POSITIVE_INFINITY;
+function minimumRank() {
+  const raw = process.env["0SEC_DIAG_LEVEL"];
+  if (!raw)
+    return LEVEL_RANK.info;
+  switch (raw.trim().toLowerCase()) {
+    case "off":
+    case "none":
+    case "silent":
+      return OFF_RANK;
+    case "error":
+      return LEVEL_RANK.error;
+    case "warn":
+    case "warning":
+      return LEVEL_RANK.warn;
+    default:
+      return LEVEL_RANK.info;
+  }
+}
+function formatDiagnosticLine(event) {
+  const keys = Object.keys(event.fields);
+  if (keys.length === 0)
+    return `[0sec] ${event.message}`;
+  const rendered = keys.map((k) => `${k}=${event.fields[k]}`).join(" ");
+  return `[0sec] ${event.message} (${rendered})`;
+}
+var stderrDiagnosticSink = {
+  emit(event) {
+    try {
+      process.stderr.write(formatDiagnosticLine(event) + "\n");
+    } catch {
+    }
+  }
+};
+function tryEmit(sink, event) {
+  try {
+    sink.emit(event);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var DiagnosticsChannel = class {
+  /** Exclusive owner of delivery. When set, the stderr sink is bypassed. */
+  claimed = null;
+  /** Additive observers. Always receive, claimed or not. */
+  observers = [];
+  /** Bounded replay ring. */
+  buffer = [];
+  dropped = 0;
+  // ── Emit ────────────────────────────────────────────────────────────────
+  info(code, message, fields) {
+    this.emit("info", code, message, fields);
+  }
+  warn(code, message, fields) {
+    this.emit("warn", code, message, fields);
+  }
+  error(code, message, fields) {
+    this.emit("error", code, message, fields);
+  }
+  /**
+   * Build, sanitize and deliver one diagnostic.
+   *
+   * The entire body sits inside a `try` with an empty `catch`: this is called
+   * from retry loops, stream readers and `catch` blocks deep inside a scan, and
+   * no diagnostic is important enough to justify aborting the work it is
+   * describing.
+   */
+  emit(level, code, message, fields) {
+    try {
+      if (LEVEL_RANK[level] < minimumRank())
+        return;
+      const event = Object.freeze({
+        level,
+        code: sanitizeCode(code),
+        message: sanitizeText(typeof message === "string" ? message : String(message ?? ""), MAX_MESSAGE_LENGTH),
+        fields: sanitizeFields(fields),
+        ts: Date.now()
+      });
+      this.remember(event);
+      this.deliver(event);
+    } catch {
+    }
+  }
+  remember(event) {
+    this.buffer.push(event);
+    while (this.buffer.length > MAX_BUFFERED) {
+      this.buffer.shift();
+      this.dropped++;
+    }
+  }
+  deliver(event) {
+    const claimed = this.claimed;
+    if (claimed) {
+      if (!tryEmit(claimed, event))
+        stderrDiagnosticSink.emit(event);
+    } else {
+      stderrDiagnosticSink.emit(event);
+    }
+    for (const observer of this.observers.slice())
+      tryEmit(observer, event);
+  }
+  // ── Subscription ────────────────────────────────────────────────────────
+  /**
+   * Take exclusive ownership of delivery. While claimed, the built-in stderr
+   * sink is bypassed — this is how the TUI stops core from writing to the
+   * terminal it is painting.
+   *
+   * Claims nest: a second claim supersedes the first, and releasing it restores
+   * the previous owner. Release is idempotent and only un-claims while this
+   * claim is still the live one, so an out-of-order teardown cannot resurrect a
+   * dead sink.
+   */
+  claim(sink, options = {}) {
+    const previous = this.claimed;
+    this.claimed = sink;
+    if (options.replay) {
+      for (const event of this.buffer.slice())
+        tryEmit(sink, event);
+    }
+    let released = false;
+    return () => {
+      if (released)
+        return;
+      released = true;
+      if (this.claimed === sink)
+        this.claimed = previous;
+    };
+  }
+  /**
+   * Add an observer that receives every diagnostic regardless of who holds the
+   * claim. For tracing exporters, test spies, and audit logs — anything that
+   * wants a copy but must not silence stderr.
+   */
+  subscribe(sink) {
+    this.observers.push(sink);
+    return () => {
+      const idx = this.observers.indexOf(sink);
+      if (idx >= 0)
+        this.observers.splice(idx, 1);
+    };
+  }
+  /** True when some sink holds the exclusive claim (stderr is bypassed). */
+  get isClaimed() {
+    return this.claimed !== null;
+  }
+  /** Number of additive observers. */
+  get observerCount() {
+    return this.observers.length;
+  }
+  /** Recent diagnostics, oldest first. Bounded by `MAX_BUFFERED`. */
+  recent() {
+    return this.buffer.slice();
+  }
+  /** How many buffered diagnostics were evicted to stay within the bound. */
+  droppedCount() {
+    return this.dropped;
+  }
+  /** Test-only: drop all sinks, the replay buffer, and the drop counter. */
+  resetForTests() {
+    this.claimed = null;
+    this.observers = [];
+    this.buffer = [];
+    this.dropped = 0;
+  }
+};
+var diag = new DiagnosticsChannel();
+function claimDiagnostics(sink, options) {
+  return diag.claim(sink, options);
+}
+function subscribeDiagnostics(sink) {
+  return diag.subscribe(sink);
+}
+function isDiagnosticsClaimed() {
+  return diag.isClaimed;
+}
+function recentDiagnostics() {
+  return diag.recent();
+}
+function _resetDiagnosticsForTests() {
+  diag.resetForTests();
+}
+
+// packages/core/dist/cloud/credentials.js
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+var DEFAULT_CLOUD_HOST = "https://cloud.0.security";
+var CloudAuthMissingError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CloudAuthMissingError";
+  }
+};
+var CloudAuthError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "CloudAuthError";
+  }
+};
+function loadCloudCredentials(opts = {}) {
+  const env2 = opts.env ?? process.env;
+  const warn = opts.warn ?? ((m) => process.stderr.write(`${m}
+`));
+  const envTok = env2["0SEC_CLOUD_TOKEN"]?.trim();
+  if (envTok) {
+    const envHost = normaliseHost(env2["0SEC_CLOUD_HOST"]?.trim() ?? DEFAULT_CLOUD_HOST);
+    return { host: envHost, token: envTok, source: "env" };
+  }
+  const path = join(homeStateDir(opts.homeDir), "cloud.env");
+  let raw;
+  try {
+    raw = readFileSync(path, "utf-8");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      throw new CloudAuthMissingError(`0sec-cloud credentials not found. Run \`0sec auth login\` or set 0SEC_CLOUD_TOKEN in env, or create ${path} (chmod 600) with 0SEC_CLOUD_TOKEN=\u2026 (optionally 0SEC_CLOUD_HOST=\u2026).`);
+    }
+    throw err;
+  }
+  try {
+    const st = statSync(path);
+    const mode = st.mode & 511;
+    if (mode !== 384) {
+      warn(`[0sec cloud] WARNING: ${path} mode is ${mode.toString(8).padStart(3, "0")} (expected 600). Run: chmod 600 ${path}`);
+    }
+  } catch {
+  }
+  const parsed = parseEnvFile(raw);
+  const fileTok = parsed["0SEC_CLOUD_TOKEN"]?.trim();
+  if (!fileTok) {
+    throw new CloudAuthMissingError(`0sec-cloud credentials in ${path} are incomplete: 0SEC_CLOUD_TOKEN is required.`);
+  }
+  const fileHost = normaliseHost(parsed["0SEC_CLOUD_HOST"]?.trim() ?? DEFAULT_CLOUD_HOST);
+  return { host: fileHost, token: fileTok, source: "file" };
+}
+function normaliseHost(host) {
+  let h = host;
+  if (!/^https?:\/\//.test(h)) {
+    throw new CloudAuthMissingError(`0SEC_CLOUD_HOST must be an http(s) URL (got ${JSON.stringify(host)}).`);
+  }
+  while (h.endsWith("/"))
+    h = h.slice(0, -1);
+  return h;
+}
+function parseEnvFile(raw) {
+  const out = {};
+  const lines = raw.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+      continue;
+    if (trimmed.startsWith("#"))
+      continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) {
+      throw new CloudAuthMissingError(`Malformed cloud.env at line ${i + 1}: expected KEY=VALUE, got ${JSON.stringify(line)}`);
+    }
+    const key = trimmed.slice(0, eq).trim();
+    const value = trimmed.slice(eq + 1).trim();
+    if (!/^[A-Z0-9_]+$/.test(key)) {
+      throw new CloudAuthMissingError(`Malformed cloud.env at line ${i + 1}: invalid key ${JSON.stringify(key)}`);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+// packages/core/dist/cloud/client.js
+var CloudError = class extends Error {
+  status;
+  path;
+  code;
+  constructor(message, status, path, code) {
+    super(message);
+    this.status = status;
+    this.path = path;
+    this.code = code;
+    this.name = "CloudError";
+  }
+};
+var CloudUnauthorizedError = class extends CloudError {
+  constructor(path) {
+    super(`0sec-cloud auth rejected (HTTP 401) on ${path}. Run \`0sec auth login\` to refresh.`, 401, path);
+    this.name = "CloudUnauthorizedError";
+  }
+};
+var CloudForbiddenError = class extends CloudError {
+  constructor(path) {
+    super(`0sec-cloud forbidden (HTTP 403) on ${path}. Token lacks scope for this resource.`, 403, path);
+    this.name = "CloudForbiddenError";
+  }
+};
+var CloudNetworkError = class extends CloudError {
+  constructor(message, path) {
+    super(`0sec-cloud network error on ${path}: ${message}`, void 0, path);
+    this.name = "CloudNetworkError";
+  }
+};
+function healthPath(host) {
+  try {
+    const hostname = new URL(host).hostname.toLowerCase();
+    if (hostname === "cloud.0sec.ai" || hostname === "cloud.0.security") {
+      return "/api/health";
+    }
+  } catch {
+  }
+  return "/health";
+}
+var CloudClient = class {
+  host;
+  token;
+  fetchImpl;
+  constructor(opts) {
+    this.host = opts.host;
+    this.token = opts.token;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+  }
+  /**
+   * Verify cloud reachability through its health route. The hosted dashboard
+   * uses `/api/health`; a self-hosted receiver uses `/health`.
+   */
+  async pingHealth() {
+    return this.getJson(healthPath(this.host));
+  }
+  /**
+   * Fetch the hosted inference model catalog — available models, pricing,
+   * wire API protocol, and context limits. Used at runtime for model
+   * selection and by the hosted provider to determine per-model capabilities.
+   * Returns the raw list response; the caller caches/filters as needed.
+   */
+  async getInferenceModels() {
+    return this.getJson("/api/inference/v1/models");
+  }
+  /**
+   * Fetch the organization's hosted inference credit availability. The service
+   * calculates the percentage from Autumn's current pool; holds reduce availability.
+   * Older gateways without percentage metadata remain explicitly unavailable.
+   */
+  async getInferenceAccount() {
+    const account = await this.getJson("/api/inference/account");
+    const credits = account.credits;
+    if (!credits || typeof credits !== "object" || typeof credits.featureId !== "string" || !credits.featureId.trim() || typeof credits.remaining !== "number" || !Number.isFinite(credits.remaining) || credits.remaining < 0 || credits.granted !== null && (typeof credits.granted !== "number" || !Number.isFinite(credits.granted) || credits.granted < 0)) {
+      return { ...account, credits: null };
+    }
+    const remainingPercent = typeof credits.remainingPercent === "number" && Number.isFinite(credits.remainingPercent) && credits.remainingPercent >= 0 && credits.remainingPercent <= 100 && credits.granted !== null && credits.granted > 0 && credits.remaining <= credits.granted ? credits.remainingPercent : null;
+    const nextResetAt = typeof credits.nextResetAt === "number" && Number.isSafeInteger(credits.nextResetAt) && credits.nextResetAt > 0 && credits.nextResetAt <= 864e13 ? credits.nextResetAt : null;
+    return { ...account, credits: {
+      featureId: credits.featureId,
+      granted: credits.granted,
+      remaining: credits.remaining,
+      remainingPercent,
+      nextResetAt
+    } };
+  }
+  /**
+   * Fetch request-level usage metadata for the operator's hosted
+   * inference sessions. Returns lightweight metadata records (model,
+   * tokens, provider, timestamp) — no prompt/response payload.
+   */
+  async getInferenceUsage() {
+    return this.getJson("/api/inference/usage");
+  }
+  /**
+   * Generic JSON GET helper. Public so future modules (scans, findings)
+   * can reuse the same error mapping without duplicating it. Not exported
+   * past the package boundary — see ./index.ts.
+   */
+  async getJson(path) {
+    const url = `${this.host}${path}`;
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: "GET",
+        headers: this.headers()
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new CloudNetworkError(this.scrub(msg), path);
+    }
+    if (!res.ok) {
+      let code;
+      try {
+        const body = await res.json();
+        const raw = body?.error?.code;
+        if (typeof raw === "string" && raw.length > 0)
+          code = raw;
+      } catch {
+      }
+      this.throwForStatus(res.status, path, code);
+    }
+    return await res.json();
+  }
+  /** Throw a typed error for a non-2xx status, carrying the gateway's body `code`. */
+  throwForStatus(status, path, code) {
+    if (status === 401)
+      throw new CloudUnauthorizedError(path);
+    if (status === 403)
+      throw new CloudForbiddenError(path);
+    throw new CloudError(`0sec-cloud request failed (HTTP ${status}${code ? ` ${code}` : ""}) on ${path}.`, status, path, code);
+  }
+  /**
+   * Throw a typed error for non-2xx responses. Public so direct callers
+   * (e.g. an integration test driving raw fetch) can reuse the mapping.
+   */
+  assertOk(res, path) {
+    if (res.ok)
+      return;
+    if (res.status === 401)
+      throw new CloudUnauthorizedError(path);
+    if (res.status === 403)
+      throw new CloudForbiddenError(path);
+    throw new CloudError(`0sec-cloud request failed (HTTP ${res.status}) on ${path}.`, res.status, path);
+  }
+  // ── internals ──
+  headers() {
+    return {
+      Authorization: `Bearer ${this.token}`,
+      Accept: "application/json",
+      "User-Agent": `0sec-cli/${VERSION}`
+    };
+  }
+  /**
+   * Strip anything that looks like our own token from a string. The
+   * cloud token may be interpolated into a TLS-layer error message in
+   * exotic failure modes — we redact it to keep the no-leak invariant
+   * local to this module.
+   */
+  scrub(s) {
+    if (!this.token)
+      return s;
+    return s.split(this.token).join("[REDACTED]");
+  }
+};
+
+// packages/core/dist/runtime/llm-api.js
+import { randomUUID } from "node:crypto";
+import { appendFileSync, existsSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+
+// packages/core/dist/runtime/prompt-cache.js
+var MAX_CACHE_BREAKPOINTS = 4;
+var MESSAGE_CACHE_BREAKPOINTS = MAX_CACHE_BREAKPOINTS - 1;
+var BREAKPOINT_SPACING_BLOCKS = 15;
+var NATIVE_CACHE_PROVIDERS = /* @__PURE__ */ new Set(["anthropic"]);
+var OPT_IN_CACHE_PROVIDERS = /* @__PURE__ */ new Set(["z-ai", "kimi"]);
+function providerSupportsPromptCache(provider) {
+  if (NATIVE_CACHE_PROVIDERS.has(provider))
+    return true;
+  if (!OPT_IN_CACHE_PROVIDERS.has(provider))
+    return false;
+  return readExtraCacheProviders().has(provider);
+}
+function readExtraCacheProviders() {
+  const raw = process.env["0SEC_PROMPT_CACHE_EXTRA_PROVIDERS"];
+  if (!raw)
+    return /* @__PURE__ */ new Set();
+  return new Set(raw.split(",").map((entry) => entry.trim().toLowerCase()).filter((entry) => entry.length > 0));
+}
+function planMessageBreakpoints(messages, budget = MESSAGE_CACHE_BREAKPOINTS) {
+  if (messages.length === 0 || budget <= 0)
+    return [];
+  const lastIndex = messages.length - 1;
+  const picks = /* @__PURE__ */ new Set([lastIndex]);
+  const rollingBudget = Math.max(1, budget - 1);
+  let blocksSincePick = blockCount(messages[lastIndex]);
+  for (let i = lastIndex - 1; i >= 0 && picks.size < rollingBudget; i--) {
+    if (blocksSincePick >= BREAKPOINT_SPACING_BLOCKS) {
+      picks.add(i);
+      blocksSincePick = 0;
+    }
+    blocksSincePick += blockCount(messages[i]);
+  }
+  if (picks.size < budget)
+    picks.add(0);
+  return [...picks].sort((a, b) => a - b).slice(0, budget);
+}
+function blockCount(message) {
+  return message?.content.length ?? 0;
+}
+function withCacheControl(block) {
+  return { ...block, cache_control: { type: "ephemeral" } };
+}
+function readCacheUsage(raw) {
+  if (typeof raw !== "object" || raw === null)
+    return void 0;
+  const usage = raw;
+  const uncachedInput = numberOr(usage.input_tokens, 0);
+  const outputTokens = numberOr(usage.output_tokens, 0);
+  const cacheRead = numberOr(usage.cache_read_input_tokens, void 0);
+  const cacheWrite = numberOr(usage.cache_creation_input_tokens, void 0);
+  return {
+    inputTokens: uncachedInput + (cacheRead ?? 0) + (cacheWrite ?? 0),
+    outputTokens,
+    ...cacheRead !== void 0 ? { cachedInputTokens: cacheRead } : {},
+    ...cacheWrite !== void 0 ? { cacheWriteTokens: cacheWrite } : {}
+  };
+}
+function numberOr(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+
+// packages/core/dist/runtime/llm-api.js
+var NATIVE_COMPLETION_TOKEN_LIMIT = 8192;
+function readResponsesCachedTokens(usage) {
+  const details = usage.input_tokens_details;
+  const cached = Number(details?.cached_tokens ?? 0);
+  return Number.isFinite(cached) && cached > 0 ? { cachedInputTokens: cached } : {};
+}
+function safeParseJson(raw) {
+  if (!raw)
+    return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return { _raw: raw };
+  }
+}
+function isWireBlockArray(blocks) {
+  return blocks.every((block) => block !== null && typeof block === "object" && !Array.isArray(block) && typeof block.type === "string");
+}
+var azureRegionCache = /* @__PURE__ */ new Map();
+async function probeAzureRegion(baseUrl, apiKey, fetchImpl = fetch) {
+  const override = process.env["0SEC_REGION_OVERRIDE"];
+  if (override && override.trim().length > 0) {
+    return override.trim();
+  }
+  const cached = azureRegionCache.get(baseUrl);
+  if (cached)
+    return cached;
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 5e3);
+    const res = await fetchImpl(`${baseUrl.replace(/\/+$/, "")}/models`, {
+      method: "GET",
+      headers: { "api-key": apiKey },
+      signal: controller.signal
+    }).finally(() => clearTimeout(timer));
+    const region = res.headers.get("x-ms-region");
+    const resolved = region && region.trim().length > 0 ? prettyRegion(region.trim()) : "unknown";
+    azureRegionCache.set(baseUrl, resolved);
+    return resolved;
+  } catch {
+    azureRegionCache.set(baseUrl, "unknown");
+    return "unknown";
+  }
+}
+function prettyRegion(code) {
+  const map = {
+    eastus: "East US",
+    eastus2: "East US 2",
+    westus: "West US",
+    westus2: "West US 2",
+    westus3: "West US 3",
+    centralus: "Central US",
+    northcentralus: "North Central US",
+    southcentralus: "South Central US",
+    westcentralus: "West Central US",
+    canadaeast: "Canada East",
+    canadacentral: "Canada Central",
+    brazilsouth: "Brazil South",
+    northeurope: "North Europe",
+    westeurope: "West Europe",
+    uksouth: "UK South",
+    ukwest: "UK West",
+    francecentral: "France Central",
+    germanywestcentral: "Germany West Central",
+    switzerlandnorth: "Switzerland North",
+    norwayeast: "Norway East",
+    swedencentral: "Sweden Central",
+    polandcentral: "Poland Central",
+    italynorth: "Italy North",
+    eastasia: "East Asia",
+    southeastasia: "Southeast Asia",
+    japaneast: "Japan East",
+    japanwest: "Japan West",
+    koreacentral: "Korea Central",
+    australiaeast: "Australia East",
+    centralindia: "Central India",
+    southindia: "South India",
+    uaenorth: "UAE North",
+    southafricanorth: "South Africa North"
+  };
+  return map[code.toLowerCase()] ?? code;
+}
+var PROVIDER_BANNER_KEY = /* @__PURE__ */ Symbol.for("0sec.core.loggedProviderStartup");
+var loggedProviderStartup = (() => {
+  const g = globalThis;
+  if (!g[PROVIDER_BANNER_KEY])
+    g[PROVIDER_BANNER_KEY] = /* @__PURE__ */ new Set();
+  return g[PROVIDER_BANNER_KEY];
+})();
+function appendNativeTrace(record) {
+  const file = process.env["0SEC_TRACE_NATIVE_RESPONSES"];
+  if (!file)
+    return;
+  try {
+    appendFileSync(file, `${JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...record })}
+`, "utf8");
+  } catch {
+  }
+}
+function shouldLogProviderStartup() {
+  return process.env["0SEC_SUPPRESS_PROVIDER_STARTUP_LOG"] !== "1";
+}
+function isRetryableHttpStatus(status) {
+  return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+var TRANSIENT_STREAM_ERROR_PATTERNS = [
+  "stream completed without final response",
+  "response stream failed"
+];
+function llmStreamMaxAttempts() {
+  const raw = process.env["0SEC_LLM_STREAM_MAX_ATTEMPTS"];
+  if (raw == null || raw.trim() === "")
+    return 3;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 1 ? Math.min(n, 5) : 3;
+}
+function streamRetryBackoffMs(retry) {
+  return retry <= 1 ? 500 : 1e3;
+}
+function delayWithAbort(ms, signal) {
+  if (signal?.aborted)
+    return Promise.resolve();
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function shouldRetryNativeStream(result) {
+  if (result.stopReason !== "error")
+    return false;
+  if (result.cancelled)
+    return false;
+  const error = result.error ?? "";
+  if (!TRANSIENT_STREAM_ERROR_PATTERNS.some((pattern) => error.includes(pattern)))
+    return false;
+  if (result.content.some((block) => block.type === "tool_use"))
+    return false;
+  return true;
+}
+function isRetryableTransportCode(code) {
+  return [
+    "EAI_AGAIN",
+    "ECONNRESET",
+    "ENOTFOUND",
+    "ETIMEDOUT",
+    "UND_ERR_CONNECT_TIMEOUT",
+    "UND_ERR_SOCKET"
+  ].includes(code);
+}
+function llmMaxRetries() {
+  const raw = process.env["0SEC_LLM_MAX_RETRIES"];
+  if (raw == null || raw.trim() === "")
+    return 6;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : 6;
+}
+function llmMaxRetryWaitMs() {
+  const raw = process.env["0SEC_LLM_MAX_RETRY_WAIT_MS"];
+  if (raw == null || raw.trim() === "")
+    return 6e4;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : 6e4;
+}
+function llm429MaxRetries() {
+  const raw = process.env["0SEC_LLM_429_MAX_RETRIES"] ?? process.env["0SEC_LLM_MAX_RETRIES"];
+  if (raw == null || raw.trim() === "")
+    return 12;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : 12;
+}
+function llm429MaxRetryWaitMs() {
+  const raw = process.env["0SEC_LLM_429_MAX_RETRY_WAIT_MS"] ?? process.env["0SEC_LLM_MAX_RETRY_WAIT_MS"];
+  if (raw == null || raw.trim() === "")
+    return 3e5;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : 3e5;
+}
+var QuotaExhaustedError = class extends Error {
+  name = "QuotaExhaustedError";
+  quotaKind;
+  planType;
+  resetsAtMs;
+  resetsInSeconds;
+  constructor(message, details) {
+    super(message);
+    this.quotaKind = details.quotaKind;
+    this.planType = details.planType;
+    this.resetsAtMs = details.resetsAtMs;
+    this.resetsInSeconds = details.resetsInSeconds;
+  }
+};
+var OperatorAbortError = class extends Error {
+  name = "OperatorAbortError";
+  constructor(message = "request cancelled by operator") {
+    super(message);
+  }
+};
+var NO_OPERATOR_ABORT = {
+  operatorAborted: () => false,
+  throwIfCancelled: () => {
+  },
+  dispose: () => {
+  }
+};
+function manualAnySignal(sources, detach) {
+  const merged = new AbortController();
+  for (const source of sources) {
+    if (source.aborted) {
+      merged.abort(source.reason);
+      return merged.signal;
+    }
+    source.addEventListener("abort", () => merged.abort(source.reason), {
+      once: true,
+      signal: detach
+    });
+  }
+  return merged.signal;
+}
+function composeCallAbort(timeout, operator) {
+  if (!operator)
+    return { signal: timeout, ...NO_OPERATOR_ABORT };
+  let operatorFired = operator.aborted;
+  const detach = new AbortController();
+  operator.addEventListener("abort", () => {
+    if (!timeout.aborted)
+      operatorFired = true;
+  }, { once: true, signal: detach.signal });
+  const signal = typeof AbortSignal.any === "function" ? AbortSignal.any([timeout, operator]) : manualAnySignal([timeout, operator], detach.signal);
+  return {
+    signal,
+    operator,
+    operatorAborted: () => operatorFired,
+    throwIfCancelled: () => {
+      if (operatorFired)
+        throw new OperatorAbortError();
+    },
+    dispose: () => detach.abort()
+  };
+}
+function parseUsageLimitReached(body) {
+  let json;
+  try {
+    json = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  const root = typeof json === "object" && json !== null ? json : void 0;
+  const err = typeof root?.error === "object" && root.error !== null ? root.error : root;
+  const errorType = typeof err?.type === "string" ? err.type : void 0;
+  const errorCode = typeof err?.code === "string" ? err.code : void 0;
+  const quotaKind = errorType === "usage_limit_reached" ? "usage_limit_reached" : errorType === "insufficient_quota" || errorCode === "insufficient_quota" ? "insufficient_quota" : void 0;
+  if (!quotaKind || !err)
+    return void 0;
+  const details = { quotaKind };
+  if (typeof err.plan_type === "string") {
+    details.planType = err.plan_type;
+  } else if (quotaKind === "insufficient_quota") {
+    details.planType = "token-plan";
+  }
+  if (typeof err.resets_in_seconds === "number" && Number.isFinite(err.resets_in_seconds)) {
+    details.resetsInSeconds = err.resets_in_seconds;
+  }
+  if (typeof err.resets_at === "number" && Number.isFinite(err.resets_at)) {
+    details.resetsAtMs = err.resets_at > 1e12 ? err.resets_at : err.resets_at * 1e3;
+  }
+  if (details.resetsAtMs == null && details.resetsInSeconds != null) {
+    details.resetsAtMs = Date.now() + details.resetsInSeconds * 1e3;
+  }
+  if (details.resetsAtMs == null && quotaKind === "insufficient_quota") {
+    const message = typeof err.message === "string" ? err.message : "";
+    const m = message.match(/resets? at (\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(?:\s*UTC)?/);
+    if (m) {
+      const now = Date.now();
+      const year = new Date(now).getUTCFullYear();
+      const at = (y) => Date.UTC(y, Number(m[1]) - 1, Number(m[2]), Number(m[3]), Number(m[4]), Number(m[5]));
+      const ts = at(year);
+      details.resetsAtMs = ts > now ? ts : at(year + 1);
+    }
+  }
+  return details;
+}
+function llmStreamIdleTimeoutMs() {
+  const raw = process.env["0SEC_LLM_STREAM_IDLE_TIMEOUT_MS"];
+  if (raw == null || raw.trim() === "")
+    return 12e4;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : 12e4;
+}
+function parseRetryAfterMs(headerValue) {
+  if (!headerValue)
+    return void 0;
+  const trimmed = headerValue.trim();
+  if (trimmed === "")
+    return void 0;
+  if (/^\d+$/.test(trimmed))
+    return Number.parseInt(trimmed, 10) * 1e3;
+  const dateMs = Date.parse(trimmed);
+  if (Number.isFinite(dateMs)) {
+    const delta = dateMs - Date.now();
+    return delta > 0 ? delta : 0;
+  }
+  return void 0;
+}
+function retryBackoffMs(attempt, ceilingMs = 2e4) {
+  const ceiling = Math.min(ceilingMs, 500 * 2 ** attempt);
+  return Math.floor(Math.random() * ceiling) + 250;
+}
+var RETRY_AFTER_CAP_MS = 12e4;
+function retryAfterMsFromHeaders(headers) {
+  const msHeader = headers?.get?.("retry-after-ms");
+  if (msHeader != null) {
+    const n = Number.parseInt(msHeader.trim(), 10);
+    if (Number.isFinite(n) && n >= 0)
+      return Math.min(n, RETRY_AFTER_CAP_MS);
+  }
+  const parsed = parseRetryAfterMs(headers?.get?.("retry-after"));
+  return parsed != null ? Math.min(parsed, RETRY_AFTER_CAP_MS) : void 0;
+}
+function sleepWithAbort(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(new DOMException("Aborted during retry backoff", "AbortError"));
+      return;
+    }
+    const t = setTimeout(resolve, ms);
+    signal.addEventListener("abort", () => {
+      clearTimeout(t);
+      reject(new DOMException("Aborted during retry backoff", "AbortError"));
+    }, { once: true });
+  });
+}
+function defaultReasoningEffort(model) {
+  const lower = model.toLowerCase();
+  if (/gpt-[56](?:[-.]|$)/.test(lower) || /^o[134]/.test(lower))
+    return "medium";
+  return void 0;
+}
+async function logProviderStartup(provider, providerLabel, baseUrl, model, wireApi, apiKey, fetchImpl = fetch) {
+  const key = `${provider}:${baseUrl}`;
+  if (loggedProviderStartup.has(key))
+    return;
+  loggedProviderStartup.add(key);
+  if (!shouldLogProviderStartup())
+    return;
+  if (provider !== "azure") {
+    diag.info("provider_initialized", `${providerLabel} provider initialized`, {
+      provider,
+      endpoint: baseUrl,
+      model
+    });
+    return;
+  }
+  const region = await probeAzureRegion(baseUrl, apiKey, fetchImpl);
+  diag.info("provider_initialized", "Azure OpenAI provider initialized", {
+    provider,
+    endpoint: baseUrl,
+    model,
+    region,
+    // Distinguishes "the header said westeurope" from "the probe could not
+    // tell us", which matters when someone is debugging a data-residency
+    // requirement and `region=unknown` is not the same as `region` missing.
+    region_source: region === "unknown" ? "probe-failed" : "x-ms-region",
+    wire_api: wireApi
+  });
+}
+var DEFAULT_ANTHROPIC_MODEL = "claude-sonnet-4-6";
+var DEFAULT_OPENROUTER_MODEL = "anthropic/claude-sonnet-4.6";
+var FREE_OPENROUTER_MODEL = "nvidia/nemotron-3-super-120b-a12b:free";
+var DEFAULT_OPENAI_MODEL = "gpt-4o";
+var DEEPSEEK_DEFAULT_BASE_URL = "https://api.deepseek.com";
+var DEEPSEEK_DEFAULT_MODEL = "deepseek-flash";
+var QWEN_TOKEN_PLAN_DEEPSEEK_MODEL = "deepseek-v4-flash-0731";
+var XAI_DEFAULT_BASE_URL = "https://api.x.ai/v1";
+var XAI_DEFAULT_MODEL = "grok-4.6";
+var OPENCODE_DEFAULT_BASE_URL = "https://opencode.ai/zen/v1";
+var OPENCODE_DEFAULT_MODEL = "muse-spark-1.3-contributor-free";
+function openAICompatibleWireApi(env2, variable, fallback = "chat_completions") {
+  const value = env2[variable];
+  if (value === void 0)
+    return fallback;
+  if (value === "chat_completions" || value === "responses")
+    return value;
+  throw new Error(`${variable} must be "chat_completions" or "responses"`);
+}
+var googleFunctionCallSequence = 0;
+function opencodeModelId(model) {
+  return model.replace(/^opencode\//i, "");
+}
+function opencodeWireApiForModel(model) {
+  const bare = opencodeModelId(model ?? OPENCODE_DEFAULT_MODEL).toLowerCase();
+  if (/^(muse-spark|gpt-|o[1-4](?:[-_]|$)|grok)/.test(bare))
+    return "responses";
+  if (/^(claude|qwen)/.test(bare))
+    return "anthropic_messages";
+  if (/^gemini/.test(bare))
+    return "google_generate_content";
+  if (/^(deepseek|mimo|ling|big-pickle|nemotron|minimax|glm|kimi|k3)/.test(bare)) {
+    return "chat_completions";
+  }
+  throw new Error(`OpenCode Zen has no wire mapping for model "${bare}"`);
+}
+var COPILOT_API_BASE = "https://api.githubcopilot.com";
+var COPILOT_DEFAULT_MODEL = "gpt-4o";
+var COPILOT_STATIC_HEADERS = {
+  "Copilot-Integration-Id": "vscode-chat",
+  "Editor-Version": "vscode/1.99.3",
+  "Editor-Plugin-Version": "copilot-chat/0.26.7",
+  "X-GitHub-Api-Version": "2026-06-01",
+  "Openai-Intent": "conversation-edits",
+  "X-Initiator": "user"
+};
+function copilotModelId(model) {
+  return model.replace(/^copilot\//i, "");
+}
+var GEMINI_OAUTH_CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com";
+var GEMINI_OAUTH_CLIENT_SECRET = "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";
+var GEMINI_OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+var CODE_ASSIST_API_VERSION = "v1internal";
+var GEMINI_DEFAULT_MODEL = "gemini-2.5-pro";
+var GEMINI_CLI_VERSION = "0.1.0";
+var AZURE_FOUNDRY_DEPLOYMENT_IDS = {
+  "deepseek-v4-flash": true,
+  "deepseek-v4-pro": true,
+  "kimi-k2.7-code": true,
+  "gpt-oss-120b": true,
+  "gpt-5.4": true,
+  "gpt-5.6-sol": true,
+  "gpt-5.6-luna": true,
+  "gpt-5.6-terra": true
+};
+function parseLlmFallbackChain(env2 = process.env) {
+  const raw = env2["0SEC_LLM_FALLBACK"];
+  if (!raw || raw.trim().length === 0)
+    return [];
+  const entries = [];
+  const VALID_PROVIDERS = {
+    openrouter: true,
+    anthropic: true,
+    openai: true,
+    azure: true,
+    deepseek: true,
+    "chatgpt-codex": true,
+    "z-ai": true,
+    kimi: true,
+    qwen: true,
+    xai: true,
+    opencode: true,
+    copilot: true,
+    google: true,
+    hosted: true
+  };
+  for (const part of raw.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed)
+      continue;
+    const colonIdx = trimmed.indexOf(":");
+    if (colonIdx < 1 || colonIdx === trimmed.length - 1) {
+      diag.warn("fallback_chain_malformed_entry", `0SEC_LLM_FALLBACK: malformed entry "${trimmed}" (expected provider:model)`, { entry: trimmed, expected: "provider:model" });
+      continue;
+    }
+    const provider = trimmed.slice(0, colonIdx);
+    const model = trimmed.slice(colonIdx + 1).trim();
+    if (!VALID_PROVIDERS[provider]) {
+      diag.warn("fallback_chain_unknown_provider", `0SEC_LLM_FALLBACK: unknown provider "${provider}" in "${trimmed}"`, { entry: trimmed, provider });
+      continue;
+    }
+    if (!model) {
+      diag.warn("fallback_chain_empty_model", `0SEC_LLM_FALLBACK: empty model in "${trimmed}"`, { entry: trimmed, provider });
+      continue;
+    }
+    entries.push({ provider, model });
+  }
+  return entries;
+}
+function resolveFailoverProvider(provider, model, env2 = process.env, apiKey) {
+  switch (provider) {
+    case "deepseek": {
+      const key = apiKey ?? env2.DEEPSEEK_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.DEEPSEEK_BASE_URL ?? DEEPSEEK_DEFAULT_BASE_URL, wireApi: "responses" };
+    }
+    case "openrouter": {
+      const key = apiKey ?? env2.OPENROUTER_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: "https://openrouter.ai/api/v1", wireApi: openAICompatibleWireApi(env2, "OPENROUTER_WIRE_API") };
+    }
+    case "azure": {
+      const key = apiKey ?? env2.AZURE_OPENAI_API_KEY;
+      if (!key)
+        return void 0;
+      const url = env2.AZURE_OPENAI_BASE_URL ?? env2.OPENAI_BASE_URL;
+      if (!url)
+        return void 0;
+      return { apiKey: key, baseUrl: url, wireApi: openAICompatibleWireApi(env2, "AZURE_OPENAI_WIRE_API") };
+    }
+    case "openai": {
+      const key = apiKey ?? env2.OPENAI_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.OPENAI_BASE_URL ?? "https://api.openai.com/v1", wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API") };
+    }
+    case "anthropic": {
+      const key = apiKey ?? env2.ANTHROPIC_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com", wireApi: "chat_completions" };
+    }
+    case "chatgpt-codex": {
+      if (!env2["0SEC_CHATGPT_ACCESS_TOKEN"] && !env2["0SEC_CHATGPT_OAUTH_REFRESH_TOKEN"] && !readChatGptCodexAuthFile(env2))
+        return void 0;
+      return { apiKey: "", baseUrl: CODEX_API_ENDPOINT, wireApi: "responses" };
+    }
+    case "z-ai": {
+      const key = apiKey ?? env2.Z_AI_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.Z_AI_BASE_URL ?? ZAI_DEFAULT_BASE_URL, wireApi: "chat_completions" };
+    }
+    case "kimi": {
+      const key = apiKey ?? env2.KIMI_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.KIMI_BASE_URL ?? KIMI_DEFAULT_BASE_URL, wireApi: "chat_completions" };
+    }
+    case "qwen": {
+      const key = apiKey ?? env2.QWEN_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.QWEN_BASE_URL ?? QWEN_DEFAULT_BASE_URL, wireApi: "chat_completions" };
+    }
+    case "xai": {
+      const key = apiKey ?? env2.XAI_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.XAI_BASE_URL ?? XAI_DEFAULT_BASE_URL, wireApi: openAICompatibleWireApi(env2, "XAI_WIRE_API") };
+    }
+    case "opencode": {
+      const key = apiKey ?? env2.OPENCODE_API_KEY;
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.OPENCODE_BASE_URL ?? OPENCODE_DEFAULT_BASE_URL, wireApi: opencodeWireApiForModel(model) };
+    }
+    case "copilot": {
+      const key = apiKey ?? env2["0SEC_COPILOT_GITHUB_TOKEN"];
+      if (!key)
+        return void 0;
+      return { apiKey: key, baseUrl: env2.COPILOT_BASE_URL ?? COPILOT_API_BASE, wireApi: "chat_completions" };
+    }
+    case "google": {
+      if (!env2["0SEC_GEMINI_ACCESS_TOKEN"] && !env2["0SEC_GEMINI_OAUTH_REFRESH_TOKEN"])
+        return void 0;
+      return { apiKey: "", baseUrl: CODE_ASSIST_ENDPOINT, wireApi: "google_generate_content" };
+    }
+    case "hosted": {
+      try {
+        const creds = loadCloudCredentials({
+          env: env2,
+          warn: () => {
+          }
+        });
+        return {
+          apiKey: creds.token,
+          baseUrl: `${creds.host}/api/inference/v1`,
+          wireApi: "chat_completions"
+        };
+      } catch (err) {
+        if (err instanceof CloudAuthMissingError)
+          return void 0;
+        throw err;
+      }
+    }
+  }
+}
+var fallbackChainCache;
+function getFallbackChain(env2) {
+  const raw = env2["0SEC_LLM_FALLBACK"];
+  if (!fallbackChainCache || fallbackChainCache.raw !== raw) {
+    fallbackChainCache = { raw, entries: parseLlmFallbackChain(env2) };
+  }
+  return fallbackChainCache.entries;
+}
+var ZAI_DEFAULT_BASE_URL = "https://api.z.ai/api/anthropic";
+var ZAI_DEFAULT_MODEL = "glm-5.3";
+var ZAI_DEFAULT_THINKING_BUDGET = 2048;
+function zaiThinkingBudget() {
+  const raw = process.env["0SEC_ZAI_THINKING_BUDGET"];
+  if (raw == null || raw.trim().length === 0)
+    return ZAI_DEFAULT_THINKING_BUDGET;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : ZAI_DEFAULT_THINKING_BUDGET;
+}
+var KIMI_DEFAULT_BASE_URL = "https://api.kimi.com/coding/v1";
+var KIMI_DEFAULT_MODEL = "k3";
+var QWEN_DEFAULT_BASE_URL = "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1";
+var QWEN_DEFAULT_MODEL = "qwen3.8-max";
+var CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
+var CODEX_OAUTH_ISSUER = "https://auth.openai.com";
+var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+var CODEX_DEFAULT_MODEL = "gpt-5.5";
+var LOOP_SERVER_COMPACTION_TOKENS = 15e4;
+var PROCESS_SESSION_ID = `0sec-${Math.random().toString(36).slice(2, 10)}-${Date.now().toString(36)}`;
+var chatGptCodexAuthStates = /* @__PURE__ */ new Map();
+function codexAuthStateKey(state) {
+  return JSON.stringify([state.authFilePath, state.accountId, state.refreshToken || state.accessToken]);
+}
+function readChatGptCodexEnv(env2 = process.env) {
+  const access = env2["0SEC_CHATGPT_ACCESS_TOKEN"];
+  const refresh = env2["0SEC_CHATGPT_OAUTH_REFRESH_TOKEN"];
+  if ((!access || access.length === 0) && (!refresh || refresh.length === 0)) {
+    return void 0;
+  }
+  const accountId = env2["0SEC_CHATGPT_ACCOUNT_ID"];
+  return {
+    accessToken: access && access.length > 0 ? access : void 0,
+    refreshToken: refresh && refresh.length > 0 ? refresh : void 0,
+    accountId
+  };
+}
+function resolveChatGptCodexAuthPath(env2 = process.env) {
+  return env2["0SEC_CHATGPT_AUTH_FILE"] ?? join2(env2.HOME ?? homedir(), ".codex", "auth.json");
+}
+function persistChatGptCodexAuthFile(authPath, tokens, usedRefreshToken) {
+  try {
+    let existing = {};
+    try {
+      existing = JSON.parse(readFileSync2(authPath, "utf8"));
+    } catch {
+      existing = {};
+    }
+    const prevTokens = existing.tokens ?? {};
+    if (prevTokens.refresh_token !== usedRefreshToken)
+      return;
+    const nextTokens = {
+      ...prevTokens,
+      access_token: tokens.access_token,
+      ...tokens.refresh_token ? { refresh_token: tokens.refresh_token } : {},
+      ...tokens.id_token ? { id_token: tokens.id_token } : {}
+    };
+    const merged = {
+      ...existing,
+      tokens: nextTokens,
+      last_refresh: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const tmp = `${authPath}.tmp-${process.pid}`;
+    writeFileSync(tmp, `${JSON.stringify(merged, null, 2)}
+`, { mode: 384 });
+    renameSync(tmp, authPath);
+  } catch (err) {
+    process.stderr.write(`[0sec] warning: could not persist rotated Codex refresh token to ${authPath}: ${err instanceof Error ? err.message : String(err)}
+`);
+  }
+}
+function readChatGptCodexAuthFile(env2 = process.env) {
+  const authPath = resolveChatGptCodexAuthPath(env2);
+  if (!existsSync(authPath))
+    return void 0;
+  try {
+    const auth = JSON.parse(readFileSync2(authPath, "utf8"));
+    const tokens = auth.tokens;
+    if (!tokens)
+      return void 0;
+    const accessToken = typeof tokens.access_token === "string" && tokens.access_token.length > 0 ? tokens.access_token : void 0;
+    const refreshToken = typeof tokens.refresh_token === "string" && tokens.refresh_token.length > 0 ? tokens.refresh_token : void 0;
+    if (!accessToken && !refreshToken)
+      return void 0;
+    return {
+      ...accessToken ? { accessToken } : {},
+      ...refreshToken ? { refreshToken } : {},
+      ...typeof tokens.account_id === "string" && tokens.account_id.length > 0 ? { accountId: tokens.account_id } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function accessTokenExpiryMs(accessToken) {
+  const claims = parseJwtPayload(accessToken);
+  const exp = claims?.exp;
+  if (typeof exp === "number" && Number.isFinite(exp)) {
+    return exp * 1e3;
+  }
+  return Date.now() + 36e5;
+}
+async function refreshChatGptCodexAccessToken(refreshToken) {
+  const res = await fetch(`${CODEX_OAUTH_ISSUER}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CODEX_OAUTH_CLIENT_ID
+    }).toString()
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`ChatGPT Codex token refresh failed: ${res.status} ${body.slice(0, 200)}`);
+  }
+  return await res.json();
+}
+function parseJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    return void 0;
+  try {
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function extractChatGptAccountId(tokens) {
+  const checkClaims = (claims) => {
+    if (typeof claims.chatgpt_account_id === "string")
+      return claims.chatgpt_account_id;
+    const authClaim = claims["https://api.openai.com/auth"] ?? {};
+    if (typeof authClaim.chatgpt_account_id === "string")
+      return authClaim.chatgpt_account_id;
+    const orgs = claims.organizations;
+    if (Array.isArray(orgs) && orgs.length > 0 && orgs[0] && typeof orgs[0] === "object") {
+      const id = orgs[0].id;
+      if (typeof id === "string")
+        return id;
+    }
+    return void 0;
+  };
+  for (const tok of [tokens.id_token, tokens.access_token]) {
+    if (!tok)
+      continue;
+    const claims = parseJwtPayload(tok);
+    if (claims) {
+      const id = checkClaims(claims);
+      if (id)
+        return id;
+    }
+  }
+  return void 0;
+}
+function resolveChatGptCodexAuthState(env2) {
+  const fromEnvOnly = readChatGptCodexEnv(env2);
+  const fromFile = fromEnvOnly ? void 0 : readChatGptCodexAuthFile(env2);
+  const tokens = fromEnvOnly ?? fromFile;
+  if (!tokens) {
+    throw new Error("ChatGPT Codex auth: neither 0SEC_CHATGPT_ACCESS_TOKEN nor 0SEC_CHATGPT_OAUTH_REFRESH_TOKEN is set. Run `codex login` and either forward the access token via worker-controller (preferred for multi-sandbox dispatch \u2014 avoids the OAuth refresh-token rotation race) or keep a valid ~/.codex/auth.json on this host.");
+  }
+  const identity = {
+    refreshToken: tokens.refreshToken ?? "",
+    accessToken: tokens.accessToken,
+    accountId: tokens.accountId ?? (tokens.accessToken ? extractChatGptAccountId({ access_token: tokens.accessToken }) : void 0),
+    ...fromFile ? { authFilePath: resolveChatGptCodexAuthPath(env2) } : {}
+  };
+  const key = codexAuthStateKey(identity);
+  const existing = chatGptCodexAuthStates.get(key);
+  if (existing)
+    return existing;
+  const state = {
+    ...identity,
+    accessTokenExpiresAt: tokens.accessToken ? accessTokenExpiryMs(tokens.accessToken) : 0
+  };
+  chatGptCodexAuthStates.set(key, state);
+  return state;
+}
+async function refreshChatGptCodexAuthState(state) {
+  const now = Date.now();
+  const needsRefresh = !state.accessToken || state.accessTokenExpiresAt - 6e4 <= now;
+  if (needsRefresh && !state.refreshToken) {
+    throw new Error("ChatGPT Codex access token expired and no refresh token is available. The worker-controller should forward a fresh access token at sandbox dispatch.");
+  }
+  if (needsRefresh) {
+    if (!state.inflightRefresh) {
+      const usedRefresh = state.refreshToken;
+      state.inflightRefresh = (async () => {
+        try {
+          const tokens = await refreshChatGptCodexAccessToken(usedRefresh);
+          state.accessToken = tokens.access_token;
+          state.accessTokenExpiresAt = Date.now() + (tokens.expires_in ?? 3600) * 1e3;
+          if (tokens.refresh_token) {
+            state.refreshToken = tokens.refresh_token;
+            if (state.authFilePath) {
+              persistChatGptCodexAuthFile(state.authFilePath, tokens, usedRefresh);
+            }
+          }
+          if (!state.accountId) {
+            state.accountId = extractChatGptAccountId(tokens);
+          }
+          chatGptCodexAuthStates.set(codexAuthStateKey(state), state);
+        } finally {
+          state.inflightRefresh = void 0;
+        }
+      })();
+    }
+    await state.inflightRefresh;
+  }
+  if (!state.accessToken) {
+    throw new Error("ChatGPT Codex auth: access token still unset after refresh \u2014 refresh must have failed.");
+  }
+  return { accessToken: state.accessToken, accountId: state.accountId };
+}
+var geminiCodeAssistAuthStates = /* @__PURE__ */ new Map();
+function geminiAuthStateKey(refreshToken, accessToken) {
+  return JSON.stringify([refreshToken, refreshToken ? void 0 : accessToken]);
+}
+function readGeminiCodeAssistEnv(env2 = process.env) {
+  const access = env2["0SEC_GEMINI_ACCESS_TOKEN"];
+  const refresh = env2["0SEC_GEMINI_OAUTH_REFRESH_TOKEN"];
+  if ((!access || access.length === 0) && (!refresh || refresh.length === 0))
+    return void 0;
+  return {
+    accessToken: access && access.length > 0 ? access : void 0,
+    refreshToken: refresh && refresh.length > 0 ? refresh : void 0
+  };
+}
+function resolveGeminiCodeAssistAuthState(env2) {
+  const tokens = readGeminiCodeAssistEnv(env2);
+  if (!tokens) {
+    throw new Error("Google Gemini Code Assist auth: neither 0SEC_GEMINI_ACCESS_TOKEN nor 0SEC_GEMINI_OAUTH_REFRESH_TOKEN is set. Sign in with your Google account (0sec connect) or forward a fresh access token.");
+  }
+  const key = geminiAuthStateKey(tokens.refreshToken ?? "", tokens.accessToken);
+  const existing = geminiCodeAssistAuthStates.get(key);
+  if (existing)
+    return existing;
+  const state = {
+    refreshToken: tokens.refreshToken ?? "",
+    accessToken: tokens.accessToken,
+    // A forwarded access token with no `exp` we can read: treat as immediately
+    // stale so the first call refreshes (when a refresh token is available).
+    accessTokenExpiresAt: tokens.accessToken && tokens.refreshToken ? 0 : tokens.accessToken ? Date.now() + 36e5 : 0
+  };
+  geminiCodeAssistAuthStates.set(key, state);
+  return state;
+}
+async function refreshGoogleAccessToken(refreshToken) {
+  const res = await fetch(GEMINI_OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: GEMINI_OAUTH_CLIENT_ID,
+      client_secret: GEMINI_OAUTH_CLIENT_SECRET
+    }).toString()
+  });
+  const bodyText = await res.text().catch(() => "");
+  let parsed = {};
+  try {
+    parsed = bodyText ? JSON.parse(bodyText) : {};
+  } catch {
+    parsed = {};
+  }
+  if (!res.ok) {
+    const err = new Error(`Google token refresh failed: ${res.status} ${bodyText.slice(0, 200)}`);
+    err.invalidGrant = parsed.error === "invalid_grant";
+    throw err;
+  }
+  return parsed;
+}
+async function refreshGeminiCodeAssistAuthState(state) {
+  const now = Date.now();
+  const needsRefresh = !state.accessToken || state.accessTokenExpiresAt - 3e5 <= now;
+  if (needsRefresh && !state.refreshToken) {
+    if (state.accessToken)
+      return state.accessToken;
+    throw new Error("Google Gemini Code Assist auth: no access or refresh token available.");
+  }
+  if (needsRefresh) {
+    if (!state.inflightRefresh) {
+      const usedRefresh = state.refreshToken;
+      state.inflightRefresh = (async () => {
+        try {
+          const tokens = await refreshGoogleAccessToken(usedRefresh);
+          if (!tokens.access_token)
+            throw new Error("Google token refresh returned no access_token.");
+          state.accessToken = tokens.access_token;
+          state.accessTokenExpiresAt = Date.now() + (tokens.expires_in ?? 3600) * 1e3;
+          if (tokens.refresh_token)
+            state.refreshToken = tokens.refresh_token;
+        } catch (err) {
+          if (err.invalidGrant) {
+            state.accessToken = void 0;
+            state.accessTokenExpiresAt = 0;
+            geminiCodeAssistAuthStates.delete(geminiAuthStateKey(state.refreshToken, state.accessToken));
+          }
+          throw err;
+        } finally {
+          state.inflightRefresh = void 0;
+        }
+      })();
+    }
+    await state.inflightRefresh;
+  }
+  if (!state.accessToken) {
+    throw new Error("Google Gemini Code Assist auth: access token unset after refresh.");
+  }
+  return state.accessToken;
+}
+var GEMINI_CODE_ASSIST_METADATA = {
+  ideType: "IDE_UNSPECIFIED",
+  platform: "PLATFORM_UNSPECIFIED",
+  pluginType: "GEMINI"
+};
+async function codeAssistPost(method, accessToken, body) {
+  const res = await fetch(`${CODE_ASSIST_ENDPOINT}/${CODE_ASSIST_API_VERSION}:${method}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`
+    },
+    body: JSON.stringify(body)
+  });
+  const text = await res.text().catch(() => "");
+  if (!res.ok) {
+    const err = new Error(`Code Assist ${method} failed: ${res.status} ${text.slice(0, 200)}`);
+    err.securityPolicyViolated = text.includes("SECURITY_POLICY_VIOLATED");
+    throw err;
+  }
+  try {
+    return text ? JSON.parse(text) : {};
+  } catch {
+    return {};
+  }
+}
+async function resolveGeminiCodeAssistProject(state, env2, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+  if (state.projectId !== void 0)
+    return state.projectId;
+  if (state.inflightProjectResolve)
+    return state.inflightProjectResolve;
+  state.inflightProjectResolve = (async () => {
+    try {
+      const override = firstNonEmptyEnv(env2, "GOOGLE_CLOUD_PROJECT", "0SEC_GEMINI_PROJECT");
+      const accessToken = await refreshGeminiCodeAssistAuthState(state);
+      let load;
+      try {
+        load = await codeAssistPost("loadCodeAssist", accessToken, {
+          ...override ? { cloudaicompanionProject: override } : {},
+          metadata: GEMINI_CODE_ASSIST_METADATA
+        });
+      } catch (err) {
+        if (err.securityPolicyViolated) {
+          if (override)
+            return override;
+          throw new Error("Google Gemini Code Assist: this account is behind a VPC Service Controls perimeter \u2014 set GOOGLE_CLOUD_PROJECT (or 0SEC_GEMINI_PROJECT).");
+        }
+        throw err;
+      }
+      const bound = load.cloudaicompanionProject;
+      if (typeof bound === "string" && bound.length > 0)
+        return bound;
+      const tiers = Array.isArray(load.allowedTiers) ? load.allowedTiers : [];
+      const defaultTier = tiers.find((tier) => tier.isDefault === true);
+      const currentTier = load.currentTier;
+      const tierId = currentTier?.id ?? defaultTier?.id ?? "free-tier";
+      const tierForProject = currentTier ?? defaultTier;
+      const isFreeTier = tierForProject?.userDefinedCloudaicompanionProject === false || tierId === "free-tier";
+      const onboardProject = isFreeTier ? void 0 : override;
+      let op = await codeAssistPost("onboardUser", accessToken, {
+        tierId,
+        ...onboardProject ? { cloudaicompanionProject: onboardProject } : {},
+        metadata: GEMINI_CODE_ASSIST_METADATA
+      });
+      let guard = 0;
+      while (op.done !== true && guard < 60) {
+        const opName = typeof op.name === "string" ? op.name : void 0;
+        if (!opName)
+          break;
+        await sleep(5e3);
+        const opRes = await fetch(`${CODE_ASSIST_ENDPOINT}/${CODE_ASSIST_API_VERSION}/${opName}`, {
+          headers: { Authorization: `Bearer ${await refreshGeminiCodeAssistAuthState(state)}` }
+        });
+        const opText = await opRes.text().catch(() => "");
+        if (!opRes.ok)
+          throw new Error(`Code Assist onboard poll failed: ${opRes.status} ${opText.slice(0, 200)}`);
+        op = opText ? JSON.parse(opText) : {};
+        guard += 1;
+      }
+      const response = op.response;
+      const project = response?.cloudaicompanionProject;
+      const resolved2 = typeof project === "string" ? project : typeof project?.id === "string" ? project.id : void 0;
+      return resolved2 && resolved2.length > 0 ? resolved2 : override ?? "";
+    } finally {
+      state.inflightProjectResolve = void 0;
+    }
+  })();
+  const resolved = await state.inflightProjectResolve;
+  state.projectId = resolved;
+  return resolved;
+}
+function firstNonEmptyEnv(env2, ...names) {
+  for (const name of names) {
+    const value = env2[name];
+    if (typeof value === "string" && value.trim().length > 0)
+      return value.trim();
+  }
+  return void 0;
+}
+function geminiUserAgent(model) {
+  return `GeminiCLI/${GEMINI_CLI_VERSION} (${process.platform}; ${process.arch}) ${model}`;
+}
+function parseCodexAzureConfig(env2 = process.env) {
+  const configPath = `${env2.HOME ?? ""}/.codex/config.toml`;
+  if (!existsSync(configPath))
+    return {};
+  try {
+    const content = readFileSync2(configPath, "utf8");
+    const azureSectionMatch = content.match(/\[model_providers\.azure\]([\s\S]*?)(?:\n\[|$)/);
+    const activeProviderMatch = content.match(/^\s*model_provider\s*=\s*"([^"]+)"/m);
+    const baseUrlMatch = azureSectionMatch?.[1]?.match(/base_url\s*=\s*"([^"]+)"/);
+    const wireApiMatch = azureSectionMatch?.[1]?.match(/wire_api\s*=\s*"([^"]+)"/);
+    const azureModelMatch = azureSectionMatch?.[1]?.match(/model\s*=\s*"([^"]+)"/);
+    const topLevelModelMatch = content.match(/^\s*model\s*=\s*"([^"]+)"/m);
+    const topLevelSection = content.split(/^\[/m)[0] ?? "";
+    const reasoningMatch = azureSectionMatch?.[1]?.match(/model_reasoning_effort\s*=\s*"([^"]+)"/) ?? topLevelSection.match(/^\s*model_reasoning_effort\s*=\s*"([^"]+)"/m);
+    return {
+      baseUrl: baseUrlMatch?.[1],
+      model: azureModelMatch?.[1] ?? (activeProviderMatch?.[1] === "azure" ? topLevelModelMatch?.[1] : void 0),
+      wireApi: wireApiMatch?.[1] === "responses" ? "responses" : "chat_completions",
+      reasoningEffort: reasoningMatch?.[1]
+    };
+  } catch {
+    return {};
+  }
+}
+function providerForModel(model, env2) {
+  if (!model)
+    return void 0;
+  const m = model.toLowerCase();
+  if (model === DEEPSEEK_DEFAULT_MODEL || model === "deepseek-v4-flash") {
+    return env2.DEEPSEEK_API_KEY ? "deepseek" : void 0;
+  }
+  if (AZURE_FOUNDRY_DEPLOYMENT_IDS[m]) {
+    return env2.AZURE_OPENAI_API_KEY ? "azure" : void 0;
+  }
+  if (m === QWEN_TOKEN_PLAN_DEEPSEEK_MODEL) {
+    return env2.QWEN_API_KEY ? "qwen" : void 0;
+  }
+  if (m.startsWith("openrouter/"))
+    return env2.OPENROUTER_API_KEY ? "openrouter" : void 0;
+  if (m.startsWith("glm-") || m.startsWith("z-ai/") || m.includes("glm")) {
+    return env2.Z_AI_API_KEY ? "z-ai" : void 0;
+  }
+  if (m.startsWith("k3") || m.startsWith("kimi")) {
+    return env2.KIMI_API_KEY ? "kimi" : void 0;
+  }
+  if (m.startsWith("qwen")) {
+    return env2.QWEN_API_KEY ? "qwen" : void 0;
+  }
+  if (m.startsWith("grok") || m.startsWith("xai/") || m.startsWith("x-ai/")) {
+    return env2.XAI_API_KEY ? "xai" : void 0;
+  }
+  if (/^(opencode\/|muse-spark|mimo|ling|big-pickle|nemotron|minimax)/.test(m)) {
+    return env2.OPENCODE_API_KEY ? "opencode" : void 0;
+  }
+  if (m.startsWith("copilot/")) {
+    return env2["0SEC_COPILOT_GITHUB_TOKEN"] ? "copilot" : void 0;
+  }
+  if (m.startsWith("gemini") || m.startsWith("google/")) {
+    return env2["0SEC_GEMINI_ACCESS_TOKEN"] || env2["0SEC_GEMINI_OAUTH_REFRESH_TOKEN"] ? "google" : void 0;
+  }
+  if (/^gpt-|^o[1-4](?:[-_]|$)/.test(m)) {
+    if (env2["0SEC_CHATGPT_ACCESS_TOKEN"] || env2["0SEC_CHATGPT_OAUTH_REFRESH_TOKEN"])
+      return "chatgpt-codex";
+    if (env2.OPENAI_API_KEY)
+      return "openai";
+    return void 0;
+  }
+  if (m.startsWith("claude") || m.startsWith("anthropic/") || m.includes("sonnet") || m.includes("opus") || m.includes("haiku")) {
+    if (env2.ANTHROPIC_API_KEY)
+      return "anthropic";
+    if (env2.OPENROUTER_API_KEY)
+      return "openrouter";
+    return void 0;
+  }
+  return void 0;
+}
+var DEFAULT_PROVIDER_MODELS = {
+  openrouter: DEFAULT_OPENROUTER_MODEL,
+  anthropic: DEFAULT_ANTHROPIC_MODEL,
+  openai: DEFAULT_OPENAI_MODEL,
+  azure: void 0,
+  deepseek: DEEPSEEK_DEFAULT_MODEL,
+  "chatgpt-codex": CODEX_DEFAULT_MODEL,
+  "z-ai": ZAI_DEFAULT_MODEL,
+  kimi: KIMI_DEFAULT_MODEL,
+  qwen: QWEN_DEFAULT_MODEL,
+  xai: XAI_DEFAULT_MODEL,
+  opencode: OPENCODE_DEFAULT_MODEL,
+  copilot: COPILOT_DEFAULT_MODEL,
+  google: GEMINI_DEFAULT_MODEL,
+  hosted: ""
+};
+var AUTO_MODEL_SENTINEL = "auto";
+function detectProvider(configApiKey, preferredModel, env2, configProvider) {
+  if (configProvider !== void 0 && !Object.hasOwn(DEFAULT_PROVIDER_MODELS, configProvider)) {
+    throw new Error(`RuntimeConfig.provider is unsupported: ${configProvider}`);
+  }
+  const selectedProviderRaw = configProvider ?? env2["0SEC_SELECTED_PROVIDER"]?.trim();
+  const forcedProviderRaw = env2["0SEC_FORCE_PROVIDER"]?.trim() || void 0;
+  if (selectedProviderRaw && forcedProviderRaw && selectedProviderRaw !== forcedProviderRaw) {
+    throw new Error(`${configProvider !== void 0 ? "RuntimeConfig.provider" : "0SEC_SELECTED_PROVIDER"} conflicts with 0SEC_FORCE_PROVIDER`);
+  }
+  const primaryModel = env2["0SEC_MODEL"]?.trim();
+  const selectedProviderApplies = configProvider !== void 0 || !preferredModel || !primaryModel || preferredModel === primaryModel;
+  const pinnedProviderRaw = forcedProviderRaw ?? (selectedProviderApplies ? selectedProviderRaw : void 0);
+  if (pinnedProviderRaw) {
+    const source = pinnedProviderRaw === forcedProviderRaw ? "0SEC_FORCE_PROVIDER" : configProvider !== void 0 ? "RuntimeConfig.provider" : "0SEC_SELECTED_PROVIDER";
+    if (!Object.hasOwn(DEFAULT_PROVIDER_MODELS, pinnedProviderRaw)) {
+      throw new Error(`${source} is unsupported: ${pinnedProviderRaw}`);
+    }
+    const provider = pinnedProviderRaw;
+    const model = preferredModel ?? env2["0SEC_MODEL"] ?? (configProvider !== void 0 || provider === "hosted" ? DEFAULT_PROVIDER_MODELS[provider] : void 0);
+    if (model === void 0 || model === "" && provider !== "hosted") {
+      throw new Error(`${source} requires an explicit model`);
+    }
+    if (configApiKey && (provider === "hosted" || provider === "chatgpt-codex")) {
+      throw new Error(`${source}=${provider} requires its own authentication, not RuntimeConfig.apiKey`);
+    }
+    const resolved = resolveFailoverProvider(provider, model, env2, configApiKey);
+    if (!resolved) {
+      throw new Error(`${source}=${provider} has no configured credentials`);
+    }
+    return { provider, ...resolved, defaultModel: model };
+  }
+  if (configApiKey) {
+    if (configApiKey.startsWith("sk-or-")) {
+      return {
+        provider: "openrouter",
+        apiKey: configApiKey,
+        baseUrl: "https://openrouter.ai/api/v1",
+        defaultModel: DEFAULT_OPENROUTER_MODEL,
+        wireApi: openAICompatibleWireApi(env2, "OPENROUTER_WIRE_API")
+      };
+    }
+    if (configApiKey.startsWith("sk-ant-")) {
+      return {
+        provider: "anthropic",
+        apiKey: configApiKey,
+        baseUrl: "https://api.anthropic.com",
+        defaultModel: DEFAULT_ANTHROPIC_MODEL,
+        wireApi: "chat_completions"
+      };
+    }
+    return {
+      provider: "openai",
+      apiKey: configApiKey,
+      baseUrl: "https://api.openai.com/v1",
+      defaultModel: DEFAULT_OPENAI_MODEL,
+      wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
+    };
+  }
+  switch (providerForModel(preferredModel, env2)) {
+    case "deepseek":
+      return {
+        provider: "deepseek",
+        apiKey: env2.DEEPSEEK_API_KEY,
+        baseUrl: env2.DEEPSEEK_BASE_URL ?? DEEPSEEK_DEFAULT_BASE_URL,
+        defaultModel: DEEPSEEK_DEFAULT_MODEL,
+        wireApi: "responses"
+      };
+    case "azure": {
+      const azureKey2 = env2.AZURE_OPENAI_API_KEY;
+      if (!azureKey2)
+        break;
+      const azureConfig = parseCodexAzureConfig(env2);
+      return {
+        provider: "azure",
+        apiKey: azureKey2,
+        baseUrl: env2.AZURE_OPENAI_BASE_URL ?? env2.OPENAI_BASE_URL ?? azureConfig.baseUrl ?? "https://api.openai.com/v1",
+        defaultModel: preferredModel ?? env2.AZURE_OPENAI_MODEL ?? azureConfig.model ?? DEFAULT_OPENAI_MODEL,
+        wireApi: openAICompatibleWireApi(env2, "AZURE_OPENAI_WIRE_API", azureConfig.wireApi),
+        reasoningEffort: azureConfig.reasoningEffort
+      };
+    }
+    // z-ai (GLM) and kimi (Moonshot) ride the Anthropic Messages wire (routed by
+    // LlmApiRuntime.isAnthropicWire — NOT by this `wireApi` field). The
+    // "chat_completions" below is an inert default that is intentionally UNUSED
+    // for these two providers; do NOT add them to isOpenAICompat.
+    case "z-ai":
+      return {
+        provider: "z-ai",
+        apiKey: env2.Z_AI_API_KEY,
+        baseUrl: env2.Z_AI_BASE_URL ?? ZAI_DEFAULT_BASE_URL,
+        defaultModel: ZAI_DEFAULT_MODEL,
+        wireApi: "chat_completions"
+      };
+    case "kimi":
+      return {
+        provider: "kimi",
+        apiKey: env2.KIMI_API_KEY,
+        baseUrl: env2.KIMI_BASE_URL ?? KIMI_DEFAULT_BASE_URL,
+        defaultModel: KIMI_DEFAULT_MODEL,
+        wireApi: "chat_completions"
+      };
+    case "qwen":
+      return {
+        provider: "qwen",
+        apiKey: env2.QWEN_API_KEY,
+        baseUrl: env2.QWEN_BASE_URL ?? QWEN_DEFAULT_BASE_URL,
+        defaultModel: QWEN_DEFAULT_MODEL,
+        wireApi: "chat_completions"
+      };
+    case "xai":
+      return {
+        provider: "xai",
+        apiKey: env2.XAI_API_KEY,
+        baseUrl: env2.XAI_BASE_URL ?? XAI_DEFAULT_BASE_URL,
+        defaultModel: XAI_DEFAULT_MODEL,
+        wireApi: openAICompatibleWireApi(env2, "XAI_WIRE_API")
+      };
+    case "opencode":
+      return {
+        provider: "opencode",
+        apiKey: env2.OPENCODE_API_KEY,
+        baseUrl: env2.OPENCODE_BASE_URL ?? OPENCODE_DEFAULT_BASE_URL,
+        defaultModel: OPENCODE_DEFAULT_MODEL,
+        wireApi: opencodeWireApiForModel(preferredModel)
+      };
+    case "copilot":
+      return {
+        provider: "copilot",
+        apiKey: env2["0SEC_COPILOT_GITHUB_TOKEN"],
+        baseUrl: env2.COPILOT_BASE_URL ?? COPILOT_API_BASE,
+        defaultModel: preferredModel ?? COPILOT_DEFAULT_MODEL,
+        wireApi: "chat_completions"
+      };
+    case "google":
+      return {
+        provider: "google",
+        apiKey: "",
+        baseUrl: CODE_ASSIST_ENDPOINT,
+        defaultModel: preferredModel ?? GEMINI_DEFAULT_MODEL,
+        wireApi: "google_generate_content"
+      };
+    case "chatgpt-codex":
+      return {
+        provider: "chatgpt-codex",
+        apiKey: "",
+        baseUrl: CODEX_API_ENDPOINT,
+        defaultModel: env2["0SEC_MODEL"] ?? CODEX_DEFAULT_MODEL,
+        wireApi: "responses"
+      };
+    case "anthropic":
+      return {
+        provider: "anthropic",
+        apiKey: env2.ANTHROPIC_API_KEY,
+        baseUrl: env2.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com",
+        defaultModel: DEFAULT_ANTHROPIC_MODEL,
+        wireApi: "chat_completions"
+      };
+    case "openrouter":
+      return {
+        provider: "openrouter",
+        apiKey: env2.OPENROUTER_API_KEY,
+        baseUrl: "https://openrouter.ai/api/v1",
+        defaultModel: DEFAULT_OPENROUTER_MODEL,
+        wireApi: openAICompatibleWireApi(env2, "OPENROUTER_WIRE_API")
+      };
+    case "openai":
+      return {
+        provider: "openai",
+        apiKey: env2.OPENAI_API_KEY,
+        baseUrl: env2.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
+        defaultModel: DEFAULT_OPENAI_MODEL,
+        wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
+      };
+    default:
+      break;
+  }
+  const chatGptAccess = env2["0SEC_CHATGPT_ACCESS_TOKEN"];
+  const chatGptRefresh = env2["0SEC_CHATGPT_OAUTH_REFRESH_TOKEN"];
+  const chatGptAuthFile = !chatGptAccess && !chatGptRefresh ? readChatGptCodexAuthFile(env2) : void 0;
+  if (chatGptAccess && chatGptAccess.length > 0 || chatGptRefresh && chatGptRefresh.length > 0 || !!chatGptAuthFile) {
+    return {
+      provider: "chatgpt-codex",
+      // No api key — auth flows via OAuth bearer that's refreshed on
+      // demand by getChatGptCodexAccessToken(). Empty string keeps the
+      // existing apiKey-required diagnostics from firing (those check
+      // for empty strings; we want "valid but bearer-not-key").
+      apiKey: "",
+      // baseUrl is informational only — the runtime hardcodes
+      // CODEX_API_ENDPOINT for this provider.
+      baseUrl: CODEX_API_ENDPOINT,
+      defaultModel: env2["0SEC_MODEL"] ?? CODEX_DEFAULT_MODEL,
+      wireApi: "responses"
+    };
+  }
+  const deepseekKey = env2.DEEPSEEK_API_KEY;
+  if (deepseekKey) {
+    return {
+      provider: "deepseek",
+      apiKey: deepseekKey,
+      baseUrl: env2.DEEPSEEK_BASE_URL ?? DEEPSEEK_DEFAULT_BASE_URL,
+      defaultModel: DEEPSEEK_DEFAULT_MODEL,
+      wireApi: "responses"
+    };
+  }
+  const openrouterKey = env2.OPENROUTER_API_KEY;
+  if (openrouterKey) {
+    return {
+      provider: "openrouter",
+      apiKey: openrouterKey,
+      baseUrl: "https://openrouter.ai/api/v1",
+      defaultModel: DEFAULT_OPENROUTER_MODEL,
+      wireApi: openAICompatibleWireApi(env2, "OPENROUTER_WIRE_API")
+    };
+  }
+  const azureKey = env2.AZURE_OPENAI_API_KEY;
+  if (azureKey) {
+    const azureConfig = parseCodexAzureConfig(env2);
+    return {
+      provider: "azure",
+      apiKey: azureKey,
+      baseUrl: env2.AZURE_OPENAI_BASE_URL ?? env2.OPENAI_BASE_URL ?? azureConfig.baseUrl ?? "https://api.openai.com/v1",
+      defaultModel: env2.AZURE_OPENAI_MODEL ?? azureConfig.model ?? DEFAULT_OPENAI_MODEL,
+      wireApi: openAICompatibleWireApi(env2, "AZURE_OPENAI_WIRE_API", azureConfig.wireApi),
+      reasoningEffort: azureConfig.reasoningEffort
+    };
+  }
+  const openaiKey = env2.OPENAI_API_KEY;
+  if (openaiKey) {
+    return {
+      provider: "openai",
+      apiKey: openaiKey,
+      baseUrl: env2.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
+      defaultModel: DEFAULT_OPENAI_MODEL,
+      wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
+    };
+  }
+  const zaiKey = env2.Z_AI_API_KEY;
+  if (zaiKey) {
+    return {
+      provider: "z-ai",
+      apiKey: zaiKey,
+      baseUrl: env2.Z_AI_BASE_URL ?? ZAI_DEFAULT_BASE_URL,
+      defaultModel: ZAI_DEFAULT_MODEL,
+      wireApi: "chat_completions"
+    };
+  }
+  const kimiKey = env2.KIMI_API_KEY;
+  if (kimiKey) {
+    return {
+      provider: "kimi",
+      apiKey: kimiKey,
+      baseUrl: env2.KIMI_BASE_URL ?? KIMI_DEFAULT_BASE_URL,
+      defaultModel: KIMI_DEFAULT_MODEL,
+      wireApi: "chat_completions"
+    };
+  }
+  const qwenKey = env2.QWEN_API_KEY;
+  if (qwenKey) {
+    return {
+      provider: "qwen",
+      apiKey: qwenKey,
+      baseUrl: env2.QWEN_BASE_URL ?? QWEN_DEFAULT_BASE_URL,
+      defaultModel: QWEN_DEFAULT_MODEL,
+      wireApi: "chat_completions"
+    };
+  }
+  const xaiKey = env2.XAI_API_KEY;
+  if (xaiKey) {
+    return {
+      provider: "xai",
+      apiKey: xaiKey,
+      baseUrl: env2.XAI_BASE_URL ?? XAI_DEFAULT_BASE_URL,
+      defaultModel: XAI_DEFAULT_MODEL,
+      wireApi: openAICompatibleWireApi(env2, "XAI_WIRE_API")
+    };
+  }
+  const opencodeKey = env2.OPENCODE_API_KEY;
+  if (opencodeKey) {
+    return {
+      provider: "opencode",
+      apiKey: opencodeKey,
+      baseUrl: env2.OPENCODE_BASE_URL ?? OPENCODE_DEFAULT_BASE_URL,
+      defaultModel: OPENCODE_DEFAULT_MODEL,
+      wireApi: opencodeWireApiForModel(preferredModel)
+    };
+  }
+  const copilotToken = env2["0SEC_COPILOT_GITHUB_TOKEN"];
+  if (copilotToken) {
+    return {
+      provider: "copilot",
+      apiKey: copilotToken,
+      baseUrl: env2.COPILOT_BASE_URL ?? COPILOT_API_BASE,
+      defaultModel: preferredModel ?? COPILOT_DEFAULT_MODEL,
+      wireApi: "chat_completions"
+    };
+  }
+  const geminiAccess = env2["0SEC_GEMINI_ACCESS_TOKEN"];
+  const geminiRefresh = env2["0SEC_GEMINI_OAUTH_REFRESH_TOKEN"];
+  if (geminiAccess && geminiAccess.length > 0 || geminiRefresh && geminiRefresh.length > 0) {
+    return {
+      provider: "google",
+      apiKey: "",
+      baseUrl: CODE_ASSIST_ENDPOINT,
+      defaultModel: env2["0SEC_MODEL"] ?? GEMINI_DEFAULT_MODEL,
+      wireApi: "google_generate_content"
+    };
+  }
+  const anthropicKey = env2.ANTHROPIC_API_KEY;
+  if (anthropicKey) {
+    return {
+      provider: "anthropic",
+      apiKey: anthropicKey,
+      baseUrl: env2.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com",
+      defaultModel: DEFAULT_ANTHROPIC_MODEL,
+      wireApi: "chat_completions"
+    };
+  }
+  try {
+    const hostedCreds = loadCloudCredentials({
+      env: env2,
+      warn: () => {
+      }
+    });
+    return {
+      provider: "hosted",
+      apiKey: hostedCreds.token,
+      baseUrl: `${hostedCreds.host}/api/inference/v1`,
+      defaultModel: "",
+      wireApi: "chat_completions"
+    };
+  } catch {
+  }
+  return {
+    provider: "anthropic",
+    apiKey: "",
+    baseUrl: env2.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com",
+    defaultModel: DEFAULT_ANTHROPIC_MODEL,
+    wireApi: "chat_completions"
+  };
+}
+var LlmApiRuntime = class _LlmApiRuntime {
+  type = "api";
+  // These are set by the constructor via applyConfiguration() (root) or the
+  // inherited fork branch; the `!` records that a fork sets them directly while
+  // the root path assigns them through the shared applyConfiguration() helper.
+  config;
+  // Not readonly: a live provider switch re-freezes env from the new account.
+  env;
+  codexAuthState;
+  geminiAuthState;
+  provider;
+  apiKey;
+  baseUrl;
+  model;
+  wireApi;
+  reasoningEffort;
+  azureConfig;
+  serverCompactionTokens;
+  /** Ordered fallback chain (0SEC_LLM_FALLBACK). Empty = no failover. */
+  fallbackChain;
+  /** Index into fallbackChain — which entry to try next. */
+  fallbackIndex;
+  /** Resolve and validate the hosted model and wire protocol once per runtime. */
+  hostedCatalogPromise = null;
+  /** Catalog ceiling, resolved before hosted inference is submitted. */
+  hostedMaxOutputTokens;
+  constructor(config, inherited) {
+    if (inherited) {
+      const timeout = config.timeout ?? inherited.config.timeout ?? 12e4;
+      if (!Number.isFinite(timeout) || timeout <= 0) {
+        throw new Error("Subagent timeout must be a positive finite number");
+      }
+      if (inherited.provider === "hosted" && inherited.hostedMaxOutputTokens === void 0) {
+        throw new Error("Hosted model catalog must resolve before creating a subagent");
+      }
+      const model = config.model ?? inherited.model;
+      const modelChanged = model !== inherited.model;
+      this.config = {
+        type: "api",
+        model,
+        agentModels: inherited.config.agentModels,
+        singleModel: inherited.config.singleModel,
+        timeout: Math.min(timeout, inherited.config.timeout || 12e4)
+      };
+      this.env = inherited.env;
+      this.provider = inherited.provider;
+      this.apiKey = inherited.apiKey;
+      this.baseUrl = inherited.baseUrl;
+      this.model = model;
+      this.wireApi = inherited.wireApi;
+      if (modelChanged) {
+        if (this.provider === "opencode")
+          this.wireApi = opencodeWireApiForModel(model);
+        if (this.provider === "openai")
+          this.wireApi = openAICompatibleWireApi(this.env, "OPENAI_WIRE_API");
+        if (this.provider === "azure")
+          this.wireApi = openAICompatibleWireApi(this.env, "AZURE_OPENAI_WIRE_API", inherited.azureConfig.wireApi);
+        this.applyModelWireApi();
+      }
+      this.reasoningEffort = modelChanged ? void 0 : inherited.reasoningEffort;
+      this.azureConfig = { ...inherited.azureConfig };
+      this.serverCompactionTokens = inherited.serverCompactionTokens;
+      if (inherited.codexAuthState)
+        this.codexAuthState = inherited.codexAuthState;
+      if (inherited.geminiAuthState)
+        this.geminiAuthState = inherited.geminiAuthState;
+      this.fallbackChain = [];
+      this.fallbackIndex = 0;
+      if (!modelChanged) {
+        this.hostedMaxOutputTokens = inherited.hostedMaxOutputTokens;
+        this.hostedCatalogPromise = inherited.hostedCatalogPromise;
+      }
+      return;
+    }
+    this.applyConfiguration(config);
+  }
+  /**
+   * Root provider/model detection. Shared by the constructor and
+   * {@link reconfigure} so a live provider switch re-resolves the account,
+   * endpoint, wire protocol and default model with the SAME logic the
+   * constructor uses — never a second, drifting code path.
+   */
+  applyConfiguration(config) {
+    this.config = {
+      ...config,
+      ...config.agentModels ? { agentModels: Object.freeze({ ...config.agentModels }) } : {}
+    };
+    this.env = Object.freeze({ ...process.env, ...config.env });
+    this.azureConfig = parseCodexAzureConfig(this.env);
+    this.fallbackChain = getFallbackChain(this.env).map((entry) => ({
+      ...entry,
+      credentials: resolveFailoverProvider(entry.provider, entry.model, this.env)
+    }));
+    this.fallbackIndex = 0;
+    const detected = detectProvider(config.apiKey, config.model ?? this.env["0SEC_MODEL"], this.env, config.provider);
+    this.provider = detected.provider;
+    this.apiKey = detected.apiKey;
+    this.baseUrl = detected.baseUrl;
+    this.wireApi = detected.wireApi;
+    this.codexAuthState = void 0;
+    if (this.provider === "chatgpt-codex" || this.fallbackChain.some((entry) => entry.provider === "chatgpt-codex")) {
+      if (readChatGptCodexEnv(this.env) || readChatGptCodexAuthFile(this.env)) {
+        this.codexAuthState = resolveChatGptCodexAuthState(this.env);
+      }
+    }
+    this.geminiAuthState = void 0;
+    if (this.provider === "google" || this.fallbackChain.some((entry) => entry.provider === "google")) {
+      if (readGeminiCodeAssistEnv(this.env)) {
+        this.geminiAuthState = resolveGeminiCodeAssistAuthState(this.env);
+      }
+    }
+    this.reasoningEffort = this.env["0SEC_REASONING_EFFORT"] ?? detected.reasoningEffort;
+    this.serverCompactionTokens = config.serverCompactionTokens !== void 0 ? Math.max(1e3, config.serverCompactionTokens) : void 0;
+    const requestedModel = config.model ?? this.env["0SEC_MODEL"];
+    if (requestedModel === "free" && this.provider === "openrouter") {
+      this.model = FREE_OPENROUTER_MODEL;
+    } else {
+      this.model = requestedModel ?? detected.defaultModel;
+    }
+    if (this.provider === "opencode") {
+      this.model = opencodeModelId(this.model);
+    }
+    if (this.provider === "copilot") {
+      this.model = copilotModelId(this.model);
+    }
+    this.applyModelWireApi();
+    if (this.apiKey && !this.env["0SEC_SKIP_PROVIDER_BANNER"]) {
+      void logProviderStartup(this.provider, this.providerLabel, this.baseUrl, this.model, this.wireApi, this.apiKey).catch(() => {
+      });
+    }
+  }
+  /**
+   * Mutate the live selection in place so the NEXT turn (the engine reads
+   * `config.runtime` per turn) and the NEXT `forkForSubagent` pick up the new
+   * model / provider / role map with zero session teardown. No-op-safe:
+   * undefined fields leave the corresponding state unchanged.
+   */
+  reconfigure(sel) {
+    const providerChanged = sel.provider !== void 0 && sel.provider !== this.provider;
+    if (providerChanged) {
+      const merged = {
+        ...this.config,
+        apiKey: void 0,
+        provider: sel.provider,
+        ...sel.model !== void 0 ? { model: sel.model } : {},
+        ...sel.agentModels !== void 0 ? { agentModels: sel.agentModels } : {},
+        ...sel.singleModel !== void 0 ? { singleModel: sel.singleModel } : {},
+        ...sel.env !== void 0 ? { env: sel.env } : {}
+      };
+      this.hostedCatalogPromise = null;
+      this.hostedMaxOutputTokens = void 0;
+      this.applyConfiguration(merged);
+      return;
+    }
+    if (sel.agentModels !== void 0) {
+      this.config = { ...this.config, agentModels: Object.freeze({ ...sel.agentModels }) };
+    }
+    if (sel.singleModel !== void 0) {
+      this.config = { ...this.config, singleModel: sel.singleModel };
+    }
+    if (sel.model !== void 0) {
+      const model = this.provider === "opencode" ? opencodeModelId(sel.model) : this.provider === "copilot" ? copilotModelId(sel.model) : sel.model;
+      if (model !== this.model) {
+        this.model = model;
+        this.config = { ...this.config, model };
+        if (this.provider === "opencode")
+          this.wireApi = opencodeWireApiForModel(model);
+        if (this.provider === "openai")
+          this.wireApi = openAICompatibleWireApi(this.env, "OPENAI_WIRE_API");
+        if (this.provider === "azure")
+          this.wireApi = openAICompatibleWireApi(this.env, "AZURE_OPENAI_WIRE_API", this.azureConfig.wireApi);
+        this.applyModelWireApi();
+        this.reasoningEffort = void 0;
+      }
+    }
+  }
+  /** Exact deployments requiring Responses for tools, shared by roots and forks. */
+  applyModelWireApi() {
+    const normalizedModel = this.model.toLowerCase();
+    if (this.wireApi === "chat_completions" && (this.provider === "azure" && normalizedModel === "gpt-5.6-sol" || this.provider === "openai" && normalizedModel === "gpt-5.6-luna")) {
+      this.wireApi = "responses";
+    }
+  }
+  /** Isolated child inference, bound to this runtime's resolved account and route. */
+  /**
+   * Providers whose credentials are present in THIS runtime's environment
+   * (`this.env`, never process-global). A provider counts as accessible iff
+   * `resolveFailoverProvider` — the same auth-presence check the cross-provider
+   * failover chain uses — can build a connection for it, so auth-only providers
+   * (chatgpt-codex OAuth) and cloud-hosted are covered by the identical rule.
+   */
+  accessibleProviders() {
+    const out = [];
+    for (const provider of Object.keys(DEFAULT_PROVIDER_MODELS)) {
+      const probeModel = DEFAULT_PROVIDER_MODELS[provider] || "probe";
+      try {
+        if (resolveFailoverProvider(provider, probeModel, this.env))
+          out.push(provider);
+      } catch {
+      }
+    }
+    return out;
+  }
+  /**
+   * A concrete, reachable model id per accessible provider (its catalog default)
+   * plus the currently-resolved model. This is the read-only roster the
+   * orchestrator can be shown so it names a model under an "auto" role that is
+   * actually reachable; the fork guard independently accepts any model whose
+   * provider has creds, so this is a helpful starting set, not the whole bound.
+   */
+  accessibleModels() {
+    const models = /* @__PURE__ */ new Set();
+    if (this.model)
+      models.add(this.model);
+    for (const provider of this.accessibleProviders()) {
+      const def = DEFAULT_PROVIDER_MODELS[provider];
+      if (def)
+        models.add(def);
+    }
+    return [...models];
+  }
+  /**
+   * Whether `model` routes to a provider whose credentials are present. Uses the
+   * same per-call `providerForModel` routing the runtime uses everywhere (which
+   * returns a provider only when its key is present), with the concrete
+   * accessible defaults as a fallback for ids the router does not pattern-match.
+   */
+  isModelAccessible(model) {
+    if (providerForModel(model, this.env) !== void 0)
+      return true;
+    return this.accessibleModels().includes(model);
+  }
+  async forkForSubagent(timeoutMs, selection) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+      throw new Error("Subagent timeout must be a positive finite number");
+    }
+    await this.ensureHostedModel();
+    const roleModel = selection?.role !== void 0 && this.config.agentModels && Object.hasOwn(this.config.agentModels, selection.role) ? this.config.agentModels[selection.role] : void 0;
+    const autoInEffect = roleModel === AUTO_MODEL_SENTINEL || this.config.autoRoute === true && roleModel === void 0;
+    const configuredModel = roleModel === AUTO_MODEL_SENTINEL ? void 0 : roleModel;
+    const selectedModel = this.config.singleModel ? this.model : selection?.model ?? configuredModel ?? this.model;
+    if (typeof selectedModel !== "string" || !selectedModel.trim()) {
+      throw new Error("Subagent model must be a non-empty model ID");
+    }
+    const stripProviderPrefix = (id) => this.provider === "opencode" ? opencodeModelId(id) : this.provider === "copilot" ? copilotModelId(id) : id;
+    const model = stripProviderPrefix(selectedModel);
+    const approvedByAllowlist = model === this.model || Object.values(this.config.agentModels ?? {}).some((id) => id !== AUTO_MODEL_SENTINEL && stripProviderPrefix(id) === model);
+    const approved = approvedByAllowlist || autoInEffect && this.isModelAccessible(selectedModel);
+    if (!approved) {
+      throw new Error(autoInEffect ? `Subagent model "${selectedModel}" is not reachable: its provider has no configured credentials.` : `Subagent model "${selectedModel}" is not operator-approved. Configure agentModels before selecting it.`);
+    }
+    const child = new _LlmApiRuntime({ type: "api", timeout: timeoutMs, model }, this);
+    await child.ensureHostedModel();
+    return child;
+  }
+  /** The server catalog is authoritative even when a model was selected explicitly. */
+  async ensureHostedModel() {
+    if (this.provider !== "hosted")
+      return;
+    if (!this.hostedCatalogPromise) {
+      this.hostedCatalogPromise = (async () => {
+        const client = new CloudClient({
+          host: this.baseUrl.replace(/\/api\/inference\/v1$/, ""),
+          token: this.apiKey
+        });
+        const catalog = await client.getInferenceModels();
+        const selected = this.model ? catalog.data.find((model) => model.id === this.model) : catalog.data[0];
+        if (!selected) {
+          throw new Error(this.model ? `Hosted model "${this.model}" is unavailable. Run \`0sec models\` for available models.` : "No hosted models are available. Run `0sec models` to check service availability.");
+        }
+        this.model = selected.id;
+        this.wireApi = selected.wire_api;
+        this.hostedMaxOutputTokens = selected.max_output_tokens;
+      })();
+    }
+    await this.hostedCatalogPromise;
+  }
+  /**
+   * A hard dollar ceiling needs a provider-enforced bound on the next response.
+   * ChatGPT Codex OAuth rejects `max_output_tokens`, so it cannot support that
+   * contract; callers must fail closed before making a metered comparison call.
+   */
+  get outputTokenLimit() {
+    return this.provider === "chatgpt-codex" ? void 0 : this.effectiveOutputTokens;
+  }
+  /** Hosted requests honor both the catalog ceiling and the local hard cap. */
+  get effectiveOutputTokens() {
+    if (this.provider === "hosted" && this.hostedMaxOutputTokens !== void 0) {
+      return Math.min(NATIVE_COMPLETION_TOKEN_LIMIT, this.hostedMaxOutputTokens);
+    }
+    return NATIVE_COMPLETION_TOKEN_LIMIT;
+  }
+  /**
+   * Whether this provider uses OpenAI-compatible chat/completions format.
+   *
+   * DO NOT add "z-ai" or "kimi" here. They speak the Anthropic Messages wire
+   * (see `isAnthropicWire`); adding them to this getter would silently route
+   * them to `/chat/completions` with a Bearer header and break them. Their
+   * `wireApi` field is set to "chat_completions" by detectProvider only as an
+   * inert default — it is intentionally unused for these two providers.
+   */
+  get isOpenAICompat() {
+    return this.provider === "openrouter" || this.provider === "openai" || this.provider === "azure" || this.provider === "deepseek" || this.provider === "qwen" || this.provider === "xai" || this.provider === "copilot" || this.provider === "hosted" || this.provider === "opencode" && (this.wireApi === "chat_completions" || this.wireApi === "responses") || // chatgpt-codex always speaks Responses API; treat it as
+    // OpenAI-compat for body-shape branching purposes (the Responses
+    // wire-API code paths below already key on `wireApi === "responses"`
+    // and produce a body codex's backend accepts as-is).
+    this.provider === "chatgpt-codex";
+  }
+  /**
+   * Whether this provider speaks the Anthropic Messages wire (`/v1/messages`
+   * with `x-api-key` + `anthropic-version`, Anthropic-shaped body + response).
+   *
+   * z-ai (GLM) and kimi (Moonshot) are Anthropic-compatible endpoints, so they
+   * ride this wire alongside real Anthropic. This is the POSITIVE predicate
+   * that drives buildUrl / buildHeaders and the Anthropic branches of
+   * execute() / executeNative() — replacing the old implicit "everything that
+   * isn't isOpenAICompat" else-fallthrough, which was a footgun: adding a
+   * provider to isOpenAICompat, or trusting these two's `wireApi` field, would
+   * have silently mis-routed them off the Anthropic wire.
+   */
+  get isAnthropicWire() {
+    return this.provider === "anthropic" || this.provider === "z-ai" || this.provider === "kimi" || this.provider === "opencode" && this.wireApi === "anthropic_messages";
+  }
+  /** Whether this OpenCode Zen model uses the Google generateContent wire. */
+  get isGoogleWire() {
+    return this.provider === "opencode" && this.wireApi === "google_generate_content";
+  }
+  /**
+   * Whether this is the Google Gemini Code Assist backend. It reuses the Google
+   * generateContent request/response SHAPE (googleContents + the isGoogleWire
+   * parser) but wraps the body in a `{ model, project, request }` envelope,
+   * unwraps `{ response }`, authenticates with a refreshed OAuth Bearer, and
+   * posts to a fixed Code Assist endpoint — so it is a distinct predicate from
+   * `isGoogleWire`, checked BEFORE it wherever the body/parse branches.
+   */
+  get isGeminiCodeAssist() {
+    return this.provider === "google";
+  }
+  /**
+   * The resolved model id this runtime will actually call — the requested
+   * model when one was picked, otherwise the provider's detected default.
+   * Surfaced so the pipeline can stamp the engine-resolved model on
+   * `scan_completed` (CI review scans are dispatched with no model pick, so
+   * this is the only place the concrete id exists).
+   */
+  resolvedModel() {
+    return this.model;
+  }
+  /** Build the appropriate headers for the configured provider. */
+  buildHeaders() {
+    if (this.provider === "chatgpt-codex") {
+      return {
+        "Content-Type": "application/json",
+        originator: "0sec",
+        "User-Agent": `0sec/${VERSION}`
+      };
+    }
+    if (this.isGeminiCodeAssist) {
+      return {
+        "Content-Type": "application/json",
+        "User-Agent": geminiUserAgent(this.model)
+      };
+    }
+    if (this.isGoogleWire) {
+      return {
+        "Content-Type": "application/json",
+        "x-goog-api-key": this.apiKey
+      };
+    }
+    if (this.provider === "copilot") {
+      return {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.apiKey}`,
+        ...COPILOT_STATIC_HEADERS
+      };
+    }
+    if (this.isOpenAICompat) {
+      const headers = {
+        "Content-Type": "application/json"
+      };
+      if (this.provider === "azure") {
+        headers["api-key"] = this.apiKey;
+      } else {
+        headers["Authorization"] = `Bearer ${this.apiKey}`;
+      }
+      if (this.provider === "openrouter") {
+        headers["HTTP-Referer"] = "https://0sec.ai";
+        headers["X-Title"] = "0sec Security Scanner";
+      }
+      return headers;
+    }
+    if (this.isAnthropicWire) {
+      return {
+        "Content-Type": "application/json",
+        "x-api-key": this.apiKey,
+        "anthropic-version": "2023-06-01"
+      };
+    }
+    throw new Error(`buildHeaders: provider ${this.provider} is not mapped to a wire`);
+  }
+  /**
+   * For the chatgpt-codex provider, decorate the headers with the
+   * freshly-refreshed OAuth bearer + `ChatGPT-Account-Id` + a
+   * stable `session_id` (opencode codex.ts:614 — used by Codex
+   * backend for request correlation + rate-limit attribution +
+   * prompt-cache affinity). For every other provider it's a no-op
+   * that returns the stock headers unchanged. Caller MUST await
+   * this before the fetch — that's where token refresh actually
+   * happens.
+   *
+   * session_id is process-stable (PROCESS_SESSION_ID, randomised
+   * once at module load). A 0sec-cli invocation = one scan = one
+   * session, so the process-lifetime constant is the right
+   * granularity. If we ever want per-scan ids inside a long-lived
+   * controller process, add a setter on the runtime; for now this
+   * matches how the CLI is actually invoked.
+   */
+  async ensureFreshHeaders() {
+    const base = this.buildHeaders();
+    if (this.provider === "google") {
+      if (!this.geminiAuthState)
+        throw new Error("Google Gemini Code Assist auth: no credential captured for this runtime");
+      const accessToken2 = await refreshGeminiCodeAssistAuthState(this.geminiAuthState);
+      base["Authorization"] = `Bearer ${accessToken2}`;
+      return base;
+    }
+    if (this.provider !== "chatgpt-codex")
+      return base;
+    if (!this.codexAuthState)
+      throw new Error("ChatGPT Codex auth: no credential captured for this runtime");
+    const { accessToken, accountId } = await refreshChatGptCodexAuthState(this.codexAuthState);
+    base["Authorization"] = `Bearer ${accessToken}`;
+    if (accountId)
+      base["ChatGPT-Account-Id"] = accountId;
+    base["session_id"] = PROCESS_SESSION_ID;
+    base["Accept"] = "text/event-stream";
+    return base;
+  }
+  /** Build the API endpoint URL. */
+  buildUrl() {
+    if (this.provider === "chatgpt-codex") {
+      return CODEX_API_ENDPOINT;
+    }
+    if (this.isGeminiCodeAssist) {
+      return `${CODE_ASSIST_ENDPOINT}/${CODE_ASSIST_API_VERSION}:generateContent`;
+    }
+    if (this.isGoogleWire) {
+      return `${this.baseUrl}/models/${this.model}:generateContent`;
+    }
+    if (this.isOpenAICompat) {
+      return `${this.baseUrl}/${this.wireApi === "responses" ? "responses" : "chat/completions"}`;
+    }
+    if (this.isAnthropicWire) {
+      return this.provider === "opencode" ? `${this.baseUrl}/messages` : `${this.baseUrl}/v1/messages`;
+    }
+    throw new Error(`buildUrl: provider ${this.provider} is not mapped to a wire`);
+  }
+  /**
+   * Chat-completions param name for the token cap. Newer OpenAI model
+   * families (gpt-5/6, o1/o2/o3) reject the legacy `max_tokens` field
+   * and require `max_completion_tokens`. Older models still accept the
+   * legacy name, so we flip based on model prefix.
+   */
+  get maxTokensParamKey() {
+    return /^gpt-[56](?:[-.]|$)|^o[1-3](?:[-_]|$)/i.test(this.model) ? "max_completion_tokens" : "max_tokens";
+  }
+  /**
+   * Anthropic `thinking` body fragment. Real Anthropic Claude uses adaptive
+   * thinking when retained reasoning is enabled. Z.ai GLM-5.3 requires
+   * enabled thinking plus reasoning_effort; earlier GLM models use a
+   * budget_tokens field. Kimi reasons natively and accepts neither field.
+   */
+  anthropicThinkingField() {
+    if (this.provider === "anthropic") {
+      return features.retainedReasoning ? { thinking: { type: "adaptive" } } : {};
+    }
+    if (this.provider !== "z-ai")
+      return {};
+    const budget = zaiThinkingBudget();
+    if (this.model.startsWith("glm-5.3")) {
+      const reasoningEffort = this.reasoningEffort ?? (budget <= 2048 ? "low" : budget <= 4096 ? "high" : "max");
+      return {
+        thinking: { type: "enabled" },
+        reasoning_effort: reasoningEffort
+      };
+    }
+    if (budget <= 0)
+      return {};
+    return { thinking: { type: "enabled", budget_tokens: budget } };
+  }
+  /** Convert the unified transcript into Gemini generateContent contents. */
+  googleContents(messages) {
+    const toolNames = /* @__PURE__ */ new Map();
+    const upstreamCallIds = /* @__PURE__ */ new Map();
+    const contents = [];
+    for (const message of messages) {
+      const parts = [];
+      const rawParts = message.role === "assistant" && message.providerRaw?.provider === this.provider && message.providerRaw.model === this.model && message.providerRaw.wireApi === this.wireApi && Array.isArray(message.providerRaw.output) ? message.providerRaw.output : void 0;
+      if (rawParts) {
+        const toolUses = message.content.filter((block) => block.type === "tool_use");
+        let toolUseIndex = 0;
+        for (const part of rawParts) {
+          const call = part.functionCall && typeof part.functionCall === "object" ? part.functionCall : void 0;
+          const toolUse = call ? toolUses[toolUseIndex++] : void 0;
+          const name = typeof call?.name === "string" ? call.name : toolUse?.name;
+          if (toolUse && name) {
+            toolNames.set(toolUse.id, name);
+            if (typeof call?.id === "string")
+              upstreamCallIds.set(toolUse.id, call.id);
+          }
+          parts.push(part);
+        }
+      } else {
+        for (const block of message.content) {
+          if (block.type === "text") {
+            parts.push({ text: block.text });
+          } else if (block.type === "tool_use") {
+            toolNames.set(block.id, block.name);
+            upstreamCallIds.set(block.id, block.id);
+            parts.push({ functionCall: { id: block.id, name: block.name, args: block.input } });
+          } else if (block.type === "tool_result") {
+            const name = toolNames.get(block.tool_use_id);
+            if (!name) {
+              throw new Error(`Google tool result ${block.tool_use_id} has no matching tool call`);
+            }
+            const upstreamId = upstreamCallIds.get(block.tool_use_id);
+            parts.push({
+              functionResponse: {
+                ...upstreamId ? { id: upstreamId } : {},
+                name,
+                response: {
+                  name,
+                  content: block.is_error ? `Error: ${block.content}` : block.content
+                }
+              }
+            });
+          }
+        }
+      }
+      if (parts.length > 0) {
+        contents.push({ role: message.role === "assistant" ? "model" : "user", parts });
+      }
+    }
+    return contents;
+  }
+  /**
+   * Wrap a standard Gemini generateContent request body in the Code Assist
+   * envelope `{ model, project, user_prompt_id, request }`. Resolves (and
+   * caches, via a singleflight) the account's project id first; the FREE tier
+   * resolves to `""` and the `project` field is then omitted entirely.
+   */
+  async wrapGeminiCodeAssistBody(request) {
+    if (!this.geminiAuthState)
+      throw new Error("Google Gemini Code Assist auth: no credential captured for this runtime");
+    const project = await resolveGeminiCodeAssistProject(this.geminiAuthState, this.env);
+    return {
+      model: this.model,
+      ...project ? { project } : {},
+      user_prompt_id: randomUUID(),
+      request
+    };
+  }
+  /**
+   * Per-turn prompt-cache accounting line, so a run can be shown to actually
+   * be hitting cache rather than assumed to be. Off unless
+   * `0SEC_DEBUG_PROMPT_CACHE` is set — this fires once per agent turn, and an
+   * unconditional line would interleave with the TUI on every scan.
+   *
+   * The same numbers reach the cloud without this flag: `cachedInputTokens`
+   * flows into `ScanCostLedger` and the `scan_completed` cost breakdown, which
+   * is the durable, queryable proof. This is the local fast path.
+   */
+  logCacheUsage(usage) {
+    if (!usage || !process.env["0SEC_DEBUG_PROMPT_CACHE"])
+      return;
+    const read = usage.cachedInputTokens ?? 0;
+    const write = usage.cacheWriteTokens ?? 0;
+    const hitRate = usage.inputTokens > 0 ? Math.round(read / usage.inputTokens * 100) : 0;
+    diag.info("prompt_cache_usage", `prompt-cache ${this.providerLabel}`, {
+      provider: this.providerLabel,
+      read,
+      write,
+      uncached: usage.inputTokens - read - write,
+      total_in: usage.inputTokens,
+      hit_pct: hitRate
+    });
+  }
+  /** Friendly provider name for error messages. */
+  get providerLabel() {
+    switch (this.provider) {
+      case "openrouter":
+        return "OpenRouter";
+      case "anthropic":
+        return "Anthropic";
+      case "openai":
+        return "OpenAI";
+      case "azure":
+        return "Azure OpenAI";
+      case "deepseek":
+        return "DeepSeek";
+      case "chatgpt-codex":
+        return "ChatGPT (Codex backend)";
+      case "z-ai":
+        return "Z.ai (GLM)";
+      case "kimi":
+        return "Kimi (Moonshot)";
+      case "qwen":
+        return "Qwen (Alibaba Model Studio)";
+      case "xai":
+        return "xAI (Grok)";
+      case "opencode":
+        return "OpenCode Zen";
+      case "copilot":
+        return "GitHub Copilot";
+      case "google":
+        return "Google Gemini (Code Assist)";
+      case "hosted":
+        return "0sec Cloud";
+    }
+  }
+  noKeyError() {
+    return "No provider credential found. Set one of:\n  env 0SEC_CHATGPT_OAUTH_REFRESH_TOKEN=... 0sec <command> (ChatGPT Codex subscription auth)\n  export OPENROUTER_API_KEY=sk-or-...   (OpenRouter \u2014 many models, one key)\n  export DEEPSEEK_API_KEY=...           (DeepSeek \u2014 direct Flash 0731 inference)\n  export ANTHROPIC_API_KEY=sk-ant-...    (Anthropic \u2014 direct Claude access)\n  export AZURE_OPENAI_API_KEY=...        (Azure OpenAI \u2014 reuse your Codex Azure provider)\n  export OPENAI_API_KEY=sk-...           (OpenAI \u2014 direct GPT access)\n  export Z_AI_API_KEY=...                (Z.ai GLM \u2014 flat-rate Coding Plan, Anthropic-compatible)\n  export KIMI_API_KEY=...                (Moonshot Kimi K3 \u2014 flat-rate coding, Anthropic-compatible)\n  export QWEN_API_KEY=...                (Alibaba Qwen \u2014 Token Plan sub, OpenAI-compatible)\n  export XAI_API_KEY=...                 (xAI Grok \u2014 OpenAI-compatible)\n  export OPENCODE_API_KEY=...            (OpenCode Zen \u2014 multi-wire gateway)\n  export 0SEC_COPILOT_GITHUB_TOKEN=...   (GitHub Copilot \u2014 device-code OAuth token)\n  Run `0sec login`                     (0sec hosted inference)";
+  }
+  getConfigurationDiagnostics() {
+    if (!this.apiKey && this.provider !== "chatgpt-codex") {
+      return {
+        valid: false,
+        provider: this.provider,
+        providerLabel: this.providerLabel,
+        reason: "missing_key",
+        fatalError: this.noKeyError()
+      };
+    }
+    if (this.provider !== "azure") {
+      return {
+        valid: true,
+        provider: this.provider,
+        providerLabel: this.providerLabel
+      };
+    }
+    const hasConfiguredBaseUrl = !!(this.env.AZURE_OPENAI_BASE_URL || this.env.OPENAI_BASE_URL || this.azureConfig.baseUrl);
+    const hasConfiguredModel = !!(this.config.model || this.env["0SEC_MODEL"] || this.env.AZURE_OPENAI_MODEL || this.azureConfig.model);
+    const missing = [];
+    if (!hasConfiguredBaseUrl) {
+      missing.push("AZURE_OPENAI_BASE_URL (or [model_providers.azure].base_url in ~/.codex/config.toml)");
+    }
+    if (!hasConfiguredModel) {
+      missing.push('AZURE_OPENAI_MODEL or an Azure-backed `model = "..."` in ~/.codex/config.toml');
+    }
+    if (missing.length > 0) {
+      return {
+        valid: false,
+        provider: this.provider,
+        providerLabel: this.providerLabel,
+        reason: "invalid_config",
+        fatalError: `Azure OpenAI runtime is selected, but the configuration is incomplete.
+Missing: ${missing.join("; ")}
+0sec will not guess Azure defaults because that can silently route to the wrong endpoint or deployment.`
+      };
+    }
+    return {
+      valid: true,
+      provider: this.provider,
+      providerLabel: this.providerLabel
+    };
+  }
+  /**
+   * POST to the provider endpoint and, on a retryable HTTP status
+   * (429 rate-limit / transient 5xx), back off and retry — honoring a
+   * `Retry-After` header when present, otherwise exponential backoff with
+   * full jitter (so a burst of concurrent scans desynchronises instead of
+   * hammering the limit in lockstep).
+   *
+   * Two 429 classes are handled differently:
+   * - per-minute rate limit → retry with the wider 429 budget
+   *   (0SEC_LLM_429_MAX_RETRIES attempts / 0SEC_LLM_429_MAX_RETRY_WAIT_MS
+   *   cumulative, defaults 12 / 5min) since the limiter resets every ~60s;
+   *   `Retry-After` / `retry-after-ms` headers are honored up to a 120s cap.
+   * - plan-quota exhaustion (`usage_limit_reached`, resets in hours/days) →
+   *   skips retries and immediately advances `0SEC_LLM_FALLBACK`; if no
+   *   configured fallback has credentials, it throws QuotaExhaustedError.
+   *
+   * Other retryable statuses (transient 5xx) keep the generic budget:
+   * 0SEC_LLM_MAX_RETRIES (attempts) and 0SEC_LLM_MAX_RETRY_WAIT_MS
+   * (cumulative backoff). On exhaustion it returns the last still-failing
+   * Response with its body intact, so the caller's existing `!res.ok` branch
+   * surfaces the clear "API error <status>" message — a rate-limit never
+   * masquerades as silent no-work.
+   *
+   * Headers are re-resolved per attempt (via ensureFreshHeaders → OAuth
+   * refresh) so a token that rotated during the wait is picked up. The body
+   * is fixed across attempts.
+   */
+  /**
+   * Try the next fallback provider in the chain (0SEC_LLM_FALLBACK).
+   * Updates `this.provider`, `this.model`, `this.apiKey`, `this.baseUrl`,
+   * `this.wireApi` to match the next valid provider. Returns `true` when a
+   * valid next provider was found and switched to, `false` when the chain is
+   * exhausted.
+   */
+  _tryFailover(reason) {
+    while (this.fallbackIndex < this.fallbackChain.length) {
+      const entry = this.fallbackChain[this.fallbackIndex];
+      this.fallbackIndex++;
+      const cfg = entry.credentials;
+      if (!cfg) {
+        diag.warn("failover_provider_skipped", `0SEC_LLM_FALLBACK: skipping ${entry.provider} (auth env missing)`, { provider: entry.provider, model: entry.model, cause: "auth-env-missing" });
+        continue;
+      }
+      this.provider = entry.provider;
+      this.model = entry.provider === "opencode" ? opencodeModelId(entry.model) : entry.provider === "copilot" ? copilotModelId(entry.model) : entry.model;
+      this.apiKey = cfg.apiKey;
+      this.baseUrl = cfg.baseUrl;
+      this.wireApi = cfg.wireApi;
+      this.hostedCatalogPromise = null;
+      diag.warn("failover_engaged", `${reason} \u2014 failover to ${entry.provider} (${entry.model})`, { reason, provider: entry.provider, model: entry.model });
+      return true;
+    }
+    return false;
+  }
+  /**
+   * POST to the provider endpoint and, on a retryable HTTP status
+   * (429 rate-limit / transient 5xx), back off and retry — honoring a
+   * `Retry-After` header when present, otherwise exponential backoff with
+   * full jitter (so a burst of concurrent scans desynchronises instead of
+   * hammering the limit in lockstep).
+   *
+   * The body factory is valid only for the current provider and wire protocol.
+   * A null result signals failover: the caller resolves the hosted catalog and
+   * rebuilds the complete request under its existing timeout/cancellation signal.
+   *
+   * Retry + failover caps documented on `retryBackoffMs` / `llm429MaxRetries`.
+   *
+   * Headers are re-resolved per attempt (via ensureFreshHeaders → OAuth
+   * refresh) so a token that rotated during the wait is picked up.
+   */
+  async postWithRetry(bodyFactory, signal, abort) {
+    let waited429Ms = 0;
+    let waitedOtherMs = 0;
+    for (let attempt = 0; ; attempt++) {
+      abort?.throwIfCancelled();
+      let res;
+      try {
+        res = await fetch(this.buildUrl(), {
+          method: "POST",
+          headers: await this.ensureFreshHeaders(),
+          body: bodyFactory(),
+          signal
+        });
+      } catch (error) {
+        abort?.throwIfCancelled();
+        if (this.provider === "hosted") {
+          throw new Error("0sec hosted request outcome is unknown. Automatic replay is disabled; check your inference usage before retrying.", { cause: error });
+        }
+        const cause = error instanceof Error ? error.cause : void 0;
+        const causeCode = cause && typeof cause === "object" && "code" in cause && typeof cause.code === "string" ? cause.code : "unknown";
+        const causeHost = cause && typeof cause === "object" && "hostname" in cause && typeof cause.hostname === "string" ? `@${cause.hostname}` : "";
+        const message = error instanceof Error ? error.message : String(error);
+        const maxRetries2 = llmMaxRetries();
+        const maxWaitMs2 = llmMaxRetryWaitMs();
+        const delay2 = retryBackoffMs(attempt);
+        if (isRetryableTransportCode(causeCode) && attempt < maxRetries2 && waitedOtherMs + delay2 <= maxWaitMs2) {
+          diag.warn("transport_retry", `${this.providerLabel} transport ${causeCode} \u2014 backoff ${delay2}ms`, {
+            provider: this.providerLabel,
+            cause_code: causeCode,
+            delay_ms: delay2,
+            attempt: attempt + 1,
+            max_retries: maxRetries2
+          });
+          waitedOtherMs += delay2;
+          await sleepWithAbort(delay2, signal);
+          continue;
+        }
+        throw new Error(`${this.providerLabel} transport failure [${causeCode}${causeHost}]: ${message}`, {
+          cause: error
+        });
+      }
+      if (res.ok || !isRetryableHttpStatus(res.status)) {
+        return res;
+      }
+      if (this.provider === "hosted" && res.status === 429 && res.headers.get("x-0sec-retry-safe") !== "1") {
+        return res;
+      }
+      if (this.provider === "hosted" && res.status >= 500) {
+        await res.body?.cancel();
+        throw new Error(`0sec hosted request returned HTTP ${res.status}; its outcome may be unknown. Automatic replay is disabled; check your inference usage before retrying.`);
+      }
+      abort?.throwIfCancelled();
+      const is429 = res.status === 429;
+      let bodyText;
+      if (is429) {
+        try {
+          bodyText = await res.text?.();
+        } catch {
+          bodyText = void 0;
+        }
+        const quota = bodyText != null ? parseUsageLimitReached(bodyText) : void 0;
+        if (quota) {
+          const resetsAtIso = quota.resetsAtMs != null ? new Date(quota.resetsAtMs).toISOString() : "unknown";
+          appendNativeTrace({
+            kind: "quota-exhausted",
+            provider: this.providerLabel,
+            status: res.status,
+            planType: quota.planType ?? null,
+            resetsAtMs: quota.resetsAtMs ?? null
+          });
+          const quotaKind = quota.quotaKind ?? "quota_exhausted";
+          diag.error("quota_exhausted", `${this.providerLabel} ${quotaKind} \u2014 plan quota exhausted; skipping retry`, {
+            provider: this.providerLabel,
+            quota_kind: quotaKind,
+            plan: quota.planType ?? "unknown",
+            resets_at: resetsAtIso,
+            status: res.status
+          });
+          const quotaError = new QuotaExhaustedError(`${this.providerLabel} ${quotaKind}: plan quota exhausted (plan=${quota.planType ?? "unknown"}, resets_at=${resetsAtIso}) \u2014 reschedulable after reset`, quota);
+          if (this._tryFailover("plan quota exhausted")) {
+            return null;
+          }
+          throw quotaError;
+        }
+      }
+      const maxRetries = is429 ? llm429MaxRetries() : llmMaxRetries();
+      const maxWaitMs = is429 ? llm429MaxRetryWaitMs() : llmMaxRetryWaitMs();
+      const waitedMs = is429 ? waited429Ms : waitedOtherMs;
+      const handBack = () => is429 && bodyText != null ? new Response(bodyText, {
+        status: res.status,
+        statusText: res.statusText,
+        headers: res.headers
+      }) : res;
+      if (attempt >= maxRetries) {
+        if (is429 && this._tryFailover("429 retry budget exhausted")) {
+          return null;
+        }
+        return handBack();
+      }
+      const retryAfter = is429 ? retryAfterMsFromHeaders(res.headers) : parseRetryAfterMs(res.headers?.get?.("retry-after"));
+      const delay = retryAfter ?? retryBackoffMs(attempt, is429 ? 3e4 : 2e4);
+      if (waitedMs + delay > maxWaitMs) {
+        if (is429 && this._tryFailover("429 retry budget exhausted")) {
+          return null;
+        }
+        return handBack();
+      }
+      if (!is429) {
+        try {
+          await res.text?.();
+        } catch {
+        }
+      }
+      appendNativeTrace({
+        kind: "retry",
+        provider: this.providerLabel,
+        status: res.status,
+        attempt: attempt + 1,
+        delayMs: delay,
+        retryAfterHonored: retryAfter != null
+      });
+      diag.warn("retry_backoff", `${this.providerLabel} HTTP ${res.status} \u2014 backoff ${delay}ms`, {
+        provider: this.providerLabel,
+        status: res.status,
+        delay_ms: delay,
+        attempt: attempt + 1,
+        max_retries: maxRetries,
+        budget_used_ms: waitedMs,
+        budget_max_ms: maxWaitMs,
+        retry_after_honored: retryAfter != null
+      });
+      if (is429) {
+        waited429Ms += delay;
+      } else {
+        waitedOtherMs += delay;
+      }
+      await sleepWithAbort(delay, signal);
+    }
+  }
+  // ── Legacy Runtime interface (single-prompt) ──
+  async execute(prompt, context) {
+    await this.ensureHostedModel();
+    const start = Date.now();
+    if (!this.apiKey && this.provider !== "chatgpt-codex" && this.provider !== "google") {
+      return {
+        output: "",
+        exitCode: 1,
+        timedOut: false,
+        durationMs: Date.now() - start,
+        error: this.noKeyError()
+      };
+    }
+    const systemPrompt = context?.systemPrompt ?? "";
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.config.timeout || 12e4);
+    try {
+      let res;
+      do {
+        if (this.isOpenAICompat && this.wireApi === "chat_completions") {
+          const messages = [];
+          if (systemPrompt) {
+            messages.push({ role: "system", content: systemPrompt });
+          }
+          messages.push({ role: "user", content: prompt });
+          res = await this.postWithRetry(() => JSON.stringify({
+            model: this.model,
+            [this.maxTokensParamKey]: this.effectiveOutputTokens,
+            messages,
+            // See executeNative: explicit reasoning_effort passthrough only.
+            ...this.reasoningEffort ? { reasoning_effort: this.reasoningEffort } : {}
+          }), controller.signal);
+        } else if (this.isOpenAICompat && this.wireApi === "responses") {
+          const input = [];
+          if (systemPrompt) {
+            input.push({
+              role: "system",
+              content: [{ type: "input_text", text: systemPrompt }]
+            });
+          }
+          input.push({
+            role: "user",
+            content: [{ type: "input_text", text: prompt }]
+          });
+          const isCodex = this.provider === "chatgpt-codex";
+          res = await this.postWithRetry(() => JSON.stringify({
+            model: this.model,
+            input,
+            ...isCodex ? { store: false } : { max_output_tokens: this.effectiveOutputTokens }
+          }), controller.signal);
+        } else if (this.isGeminiCodeAssist) {
+          const request = {
+            ...systemPrompt ? { systemInstruction: { parts: [{ text: systemPrompt }] } } : {},
+            contents: [{ role: "user", parts: [{ text: prompt }] }],
+            generationConfig: { maxOutputTokens: NATIVE_COMPLETION_TOKEN_LIMIT }
+          };
+          const geminiBody = await this.wrapGeminiCodeAssistBody(request);
+          res = await this.postWithRetry(() => JSON.stringify(geminiBody), controller.signal);
+        } else if (this.isGoogleWire) {
+          res = await this.postWithRetry(() => JSON.stringify({
+            ...systemPrompt ? { systemInstruction: { parts: [{ text: systemPrompt }] } } : {},
+            contents: [{ role: "user", parts: [{ text: prompt }] }],
+            generationConfig: { maxOutputTokens: NATIVE_COMPLETION_TOKEN_LIMIT }
+          }), controller.signal);
+        } else if (this.isAnthropicWire) {
+          res = await this.postWithRetry(() => JSON.stringify({
+            model: this.model,
+            max_tokens: NATIVE_COMPLETION_TOKEN_LIMIT,
+            ...this.anthropicThinkingField(),
+            ...systemPrompt ? { system: systemPrompt } : {},
+            messages: [{ role: "user", content: prompt }]
+          }), controller.signal);
+        } else {
+          throw new Error(`execute: provider ${this.provider} is not mapped to a wire`);
+        }
+        if (!res)
+          await this.ensureHostedModel();
+      } while (!res);
+      clearTimeout(timer);
+      const body = await res.text();
+      if (!res.ok) {
+        appendNativeTrace({
+          kind: "error-response",
+          provider: this.providerLabel,
+          status: res.status,
+          body: body.slice(0, 2e3)
+        });
+        return {
+          output: "",
+          exitCode: 1,
+          timedOut: false,
+          durationMs: Date.now() - start,
+          error: `${this.providerLabel} API error ${res.status}: ${body.slice(0, 500)}`
+        };
+      }
+      const parsedBody = JSON.parse(body);
+      const json = this.isGeminiCodeAssist ? parsedBody.response ?? parsedBody : parsedBody;
+      let text;
+      if (this.isOpenAICompat && this.wireApi === "chat_completions") {
+        const msg = json.choices?.[0]?.message;
+        text = msg?.content ?? msg?.reasoning ?? "";
+      } else if (this.isOpenAICompat && this.wireApi === "responses") {
+        text = typeof json.output_text === "string" && json.output_text.trim() ? json.output_text : Array.isArray(json.output) ? json.output.flatMap((item) => Array.isArray(item.content) ? item.content : []).filter((block) => block.type === "output_text").map((block) => String(block.text ?? "")).join("\n") : "";
+      } else if (this.isGoogleWire || this.isGeminiCodeAssist) {
+        text = json.candidates?.[0]?.content?.parts?.filter((part) => typeof part.text === "string").map((part) => part.text).join("\n") ?? "";
+      } else {
+        text = json.content?.filter((b) => b.type === "text").map((b) => b.text).join("\n") ?? "";
+      }
+      let usage;
+      if (this.isAnthropicWire) {
+        usage = readCacheUsage(json.usage);
+      } else if ((this.isGoogleWire || this.isGeminiCodeAssist) && json.usageMetadata) {
+        usage = {
+          inputTokens: json.usageMetadata.promptTokenCount ?? 0,
+          outputTokens: json.usageMetadata.candidatesTokenCount ?? 0
+        };
+      } else if (this.isOpenAICompat && json.usage) {
+        usage = this.wireApi === "chat_completions" ? { inputTokens: json.usage.prompt_tokens ?? 0, outputTokens: json.usage.completion_tokens ?? 0 } : { inputTokens: json.usage.input_tokens ?? 0, outputTokens: json.usage.output_tokens ?? 0 };
+      }
+      return {
+        output: text,
+        exitCode: 0,
+        timedOut: false,
+        durationMs: Date.now() - start,
+        ...usage ? { usage } : {}
+      };
+    } catch (err) {
+      clearTimeout(timer);
+      if (err instanceof QuotaExhaustedError) {
+        return {
+          output: "",
+          exitCode: 1,
+          timedOut: false,
+          durationMs: Date.now() - start,
+          error: err.message
+        };
+      }
+      const msg = err instanceof Error ? err.message : String(err);
+      const timedOut = msg.includes("abort") || msg.includes("timeout");
+      return {
+        output: "",
+        exitCode: 1,
+        timedOut,
+        durationMs: Date.now() - start,
+        error: timedOut ? `${this.providerLabel} API request timed out` : `${this.providerLabel} API error: ${msg}`
+      };
+    }
+  }
+  // ── Native Runtime interface (structured messages + tool_use) ──
+  /** Terminal result for an operator cancellation — `stopReason:"error"` for compatibility, `cancelled:true` for consumers that can tell the difference. */
+  cancelledResult(start) {
+    return {
+      content: [{ type: "text", text: "" }],
+      stopReason: "error",
+      cancelled: true,
+      durationMs: Date.now() - start,
+      error: `${this.providerLabel} request cancelled by operator`
+    };
+  }
+  /**
+   * Public entry point. Runs {@link executeNativeAttempt} and, ONLY for a
+   * transient empty stream (see {@link shouldRetryNativeStream}), re-issues the
+   * whole request up to {@link llmStreamMaxAttempts} times with a short backoff.
+   * Every other outcome — success, a real API error, a timeout, an operator
+   * cancellation — is returned from the first attempt untouched, preserving the
+   * existing behaviour exactly.
+   */
+  async executeNative(system, messages, tools, callbacks, signal) {
+    const maxAttempts = llmStreamMaxAttempts();
+    let result;
+    let attempt = 0;
+    for (attempt = 1; attempt <= maxAttempts; attempt++) {
+      result = await this.executeNativeAttempt(system, messages, tools, callbacks, signal);
+      if (attempt >= maxAttempts || !shouldRetryNativeStream(result) || signal?.aborted)
+        break;
+      const backoff = streamRetryBackoffMs(attempt);
+      diag.warn("stream_retry", `${this.providerLabel} stream ended without a final response \u2014 retrying (attempt ${attempt + 1}/${maxAttempts}) after ${backoff}ms`, { provider: this.providerLabel, attempt: attempt + 1, max_attempts: maxAttempts, backoff_ms: backoff });
+      await delayWithAbort(backoff, signal);
+      if (signal?.aborted)
+        break;
+    }
+    if (attempt >= maxAttempts && maxAttempts > 1 && shouldRetryNativeStream(result)) {
+      return { ...result, error: `${result.error} (retried ${maxAttempts} times)` };
+    }
+    return result;
+  }
+  async executeNativeAttempt(system, messages, tools, callbacks, signal) {
+    await this.ensureHostedModel();
+    const start = Date.now();
+    if (!this.apiKey && this.provider !== "chatgpt-codex" && this.provider !== "google") {
+      return {
+        content: [{ type: "text", text: "" }],
+        stopReason: "error",
+        durationMs: Date.now() - start,
+        error: this.noKeyError()
+      };
+    }
+    if (signal?.aborted)
+      return this.cancelledResult(start);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.config.timeout || 12e4);
+    const call = composeCallAbort(controller.signal, signal);
+    try {
+      let res;
+      do {
+        if (this.isOpenAICompat && this.wireApi === "chat_completions") {
+          const chatMessages = [];
+          chatMessages.push({ role: "system", content: system });
+          for (const m of messages) {
+            const pendingToolCalls = [];
+            let pendingAssistantText = null;
+            const flushAssistant = () => {
+              if (pendingToolCalls.length === 0 && pendingAssistantText === null)
+                return;
+              const msg = { role: "assistant" };
+              if (pendingAssistantText !== null)
+                msg.content = pendingAssistantText;
+              else
+                msg.content = null;
+              if (pendingToolCalls.length > 0)
+                msg.tool_calls = pendingToolCalls.slice();
+              chatMessages.push(msg);
+              pendingToolCalls.length = 0;
+              pendingAssistantText = null;
+            };
+            for (const block of m.content) {
+              if (block.type === "text") {
+                if (m.role === "assistant") {
+                  pendingAssistantText = (pendingAssistantText ?? "") + block.text;
+                } else {
+                  flushAssistant();
+                  chatMessages.push({ role: m.role, content: block.text });
+                }
+              } else if (block.type === "tool_use") {
+                pendingToolCalls.push({
+                  id: block.id,
+                  type: "function",
+                  function: { name: block.name, arguments: JSON.stringify(block.input) }
+                });
+              } else if (block.type === "tool_result") {
+                flushAssistant();
+                chatMessages.push({
+                  role: "tool",
+                  tool_call_id: block.tool_use_id,
+                  content: block.content
+                });
+              }
+            }
+            flushAssistant();
+          }
+          const body = {
+            model: this.model,
+            [this.maxTokensParamKey]: this.effectiveOutputTokens,
+            messages: chatMessages
+          };
+          if (this.reasoningEffort) {
+            body.reasoning_effort = this.reasoningEffort;
+          }
+          if (tools.length > 0) {
+            body.tools = tools.map((t) => ({
+              type: "function",
+              function: {
+                name: t.name,
+                description: t.description,
+                parameters: t.input_schema
+              }
+            }));
+          }
+          res = await this.postWithRetry(() => JSON.stringify({ ...body, model: this.model }), call.signal, call);
+        } else if (this.isOpenAICompat && this.wireApi === "responses") {
+          const isCodexProvider = this.provider === "chatgpt-codex";
+          const input = isCodexProvider ? [] : [
+            {
+              role: "system",
+              content: [{ type: "input_text", text: system }]
+            }
+          ];
+          for (const m of messages) {
+            if (features.retainedReasoning && m.role === "assistant" && m.providerRaw && m.providerRaw.provider === this.provider && m.providerRaw.model === this.model && m.providerRaw.wireApi === this.wireApi && m.providerRaw.output.length > 0) {
+              input.push(...m.providerRaw.output);
+              continue;
+            }
+            const assistantText = m.role === "assistant";
+            const textType = assistantText ? "output_text" : "input_text";
+            const textBlocks = [];
+            for (const block of m.content) {
+              if (block.type === "text") {
+                textBlocks.push({ type: textType, text: block.text });
+              } else if (block.type === "tool_use") {
+                if (textBlocks.length > 0) {
+                  input.push({ role: m.role, content: [...textBlocks] });
+                  textBlocks.length = 0;
+                }
+                input.push({
+                  type: "function_call",
+                  call_id: block.id,
+                  name: block.name,
+                  arguments: JSON.stringify(block.input)
+                });
+              } else if (block.type === "tool_result") {
+                if (textBlocks.length > 0) {
+                  input.push({ role: m.role, content: [...textBlocks] });
+                  textBlocks.length = 0;
+                }
+                input.push({
+                  type: "function_call_output",
+                  call_id: block.tool_use_id,
+                  output: block.content
+                });
+              }
+            }
+            if (textBlocks.length > 0) {
+              input.push({ role: m.role, content: textBlocks });
+            }
+          }
+          const reasoningEffort = this.reasoningEffort ?? defaultReasoningEffort(this.model);
+          const isCodex = this.provider === "chatgpt-codex";
+          const body = {
+            model: this.model,
+            input,
+            ...isCodex ? { store: false, instructions: system } : { max_output_tokens: this.effectiveOutputTokens },
+            ...reasoningEffort ? {
+              reasoning: {
+                effort: reasoningEffort,
+                summary: "auto"
+              },
+              include: ["reasoning.encrypted_content"]
+            } : {},
+            // Server-side compaction, opt-in per runtime. ZDR-friendly: it works
+            // with `store: false`, so nothing is retained server-side between
+            // requests. Only the loops with no context strategy of their own ask
+            // for it — the native loop compacts client-side and must not be
+            // compacted twice.
+            //
+            // SHAPE IS LOAD-BEARING and was verified live against
+            // chatgpt.com/backend-api/codex/responses, because this backend
+            // rejects unknown and mis-typed body fields rather than ignoring
+            // them (a bogus field returns
+            // `400 Unsupported parameter: <name>`):
+            //   [{"type":"compaction","compact_threshold":N}]  → 200
+            //   {"compaction":{"compact_threshold":N}}         → 400 expected an
+            //                                                    array of objects
+            //   [{"compaction":{...}}]                         → 400 missing
+            //                                                    'context_management[0].type'
+            //   []                                             → 400 minimum
+            //                                                    length 1
+            // The object form is what the public Responses docs show; it is not
+            // what this backend takes. Never emit the key with an empty array —
+            // that is a hard 400, hence the guard rather than a `.filter()`.
+            //
+            // Only the two stages that opt in send this, and they run on the
+            // Codex backend. The shape is UNVERIFIED on plain OpenAI / Azure
+            // Responses; if a caller ever enables it there, verify with a live
+            // request before trusting it.
+            ...this.serverCompactionTokens ? {
+              context_management: [
+                { type: "compaction", compact_threshold: this.serverCompactionTokens }
+              ]
+            } : {}
+          };
+          if (tools.length > 0) {
+            body.tools = tools.map((t) => ({
+              type: "function",
+              name: t.name,
+              description: t.description,
+              // Codex backend's Responses API expects `strict` alongside
+              // parameters. `false` keeps schema enforcement off so a model
+              // that drifts on argument shape still emits the call instead
+              // of failing it server-side. The public OpenAI Responses
+              // schema tolerates the extra field.
+              strict: false,
+              parameters: t.input_schema
+            }));
+            if (isCodex) {
+              body.tool_choice = "auto";
+              body.parallel_tool_calls = true;
+            }
+          }
+          res = await this.postWithRetry(() => JSON.stringify({ ...body, stream: true, model: this.model }), call.signal, call);
+          if (!res) {
+            await this.ensureHostedModel();
+            continue;
+          }
+          if (!res.ok) {
+            const responseText2 = await res.text();
+            clearTimeout(timer);
+            return {
+              content: [{ type: "text", text: "" }],
+              stopReason: "error",
+              durationMs: Date.now() - start,
+              error: `${this.providerLabel} API error ${res.status}: ${responseText2.slice(0, 500)}`
+            };
+          }
+          const streamed = await this.consumeResponsesStream(res, start, callbacks, {
+            idleTimeoutMs: llmStreamIdleTimeoutMs(),
+            abort: call
+          });
+          clearTimeout(timer);
+          return streamed;
+        } else if (this.isGeminiCodeAssist) {
+          const request = {
+            ...system ? { systemInstruction: { parts: [{ text: system }] } } : {},
+            contents: this.googleContents(messages),
+            generationConfig: { maxOutputTokens: NATIVE_COMPLETION_TOKEN_LIMIT }
+          };
+          if (tools.length > 0) {
+            request.tools = [{
+              functionDeclarations: tools.map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                parametersJsonSchema: tool.input_schema
+              }))
+            }];
+          }
+          const geminiBody = await this.wrapGeminiCodeAssistBody(request);
+          res = await this.postWithRetry(() => JSON.stringify(geminiBody), call.signal, call);
+        } else if (this.isGoogleWire) {
+          const body = {
+            ...system ? { systemInstruction: { parts: [{ text: system }] } } : {},
+            contents: this.googleContents(messages),
+            generationConfig: { maxOutputTokens: NATIVE_COMPLETION_TOKEN_LIMIT }
+          };
+          if (tools.length > 0) {
+            body.tools = [{
+              functionDeclarations: tools.map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                parametersJsonSchema: tool.input_schema
+              }))
+            }];
+          }
+          res = await this.postWithRetry(() => JSON.stringify(body), call.signal, call);
+        } else if (this.isAnthropicWire) {
+          const replayedRawMessageIndexes = /* @__PURE__ */ new Set();
+          const apiMessages = messages.map((m, index) => {
+            if (features.retainedReasoning && m.role === "assistant" && m.providerRaw && m.providerRaw.provider === this.provider && m.providerRaw.model === this.model && m.providerRaw.wireApi === this.wireApi && m.providerRaw.output.length > 0 && isWireBlockArray(m.providerRaw.output)) {
+              replayedRawMessageIndexes.add(index);
+              return { role: m.role, content: m.providerRaw.output };
+            }
+            return {
+              role: m.role,
+              content: m.content.map((block) => {
+                if (block.type === "text")
+                  return { type: "text", text: block.text };
+                if (block.type === "tool_use") {
+                  return { type: "tool_use", id: block.id, name: block.name, input: block.input };
+                }
+                if (block.type === "tool_result") {
+                  return {
+                    type: "tool_result",
+                    tool_use_id: block.tool_use_id,
+                    content: block.content,
+                    ...block.is_error ? { is_error: true } : {}
+                  };
+                }
+                return block;
+              })
+            };
+          });
+          const cacheEnabled = features.promptCache && providerSupportsPromptCache(this.provider);
+          for (const index of cacheEnabled ? planMessageBreakpoints(apiMessages, MESSAGE_CACHE_BREAKPOINTS) : []) {
+            if (replayedRawMessageIndexes.has(index))
+              continue;
+            const blocks = apiMessages[index]?.content;
+            const lastBlock = blocks?.length ? blocks[blocks.length - 1] : void 0;
+            if (blocks && lastBlock)
+              blocks[blocks.length - 1] = withCacheControl(lastBlock);
+          }
+          const body = {
+            model: this.model,
+            max_tokens: NATIVE_COMPLETION_TOKEN_LIMIT,
+            ...this.anthropicThinkingField(),
+            // The remaining breakpoint goes on the system prompt. Because the
+            // wire renders `tools` → `system` → `messages`, one marker here
+            // caches the tool schemas AND the system prompt together — the
+            // largest, most static span in the request, and the one that never
+            // changes for the lifetime of an agent session. Sent as a block array
+            // (the only shape that accepts `cache_control`) when caching is on,
+            // and left as a plain string otherwise so non-caching providers see a
+            // byte-identical body to before this change.
+            system: cacheEnabled ? [withCacheControl({ type: "text", text: system })] : system,
+            messages: apiMessages
+          };
+          if (tools.length > 0) {
+            body.tools = tools;
+          }
+          res = await this.postWithRetry(() => JSON.stringify({ ...body, model: this.model }), call.signal, call);
+        } else {
+          throw new Error(`executeNative: provider ${this.provider} is not mapped to a wire`);
+        }
+        if (!res)
+          await this.ensureHostedModel();
+      } while (!res);
+      const responseText = await res.text();
+      clearTimeout(timer);
+      if (!res.ok) {
+        return {
+          content: [{ type: "text", text: "" }],
+          stopReason: "error",
+          durationMs: Date.now() - start,
+          error: `${this.providerLabel} API error ${res.status}: ${responseText.slice(0, 500)}`
+        };
+      }
+      const parsedResponse = JSON.parse(responseText);
+      const json = this.isGeminiCodeAssist ? parsedResponse.response ?? parsedResponse : parsedResponse;
+      appendNativeTrace({
+        kind: "native-response",
+        provider: this.providerLabel,
+        wireApi: this.wireApi,
+        usage: json.usage ?? null,
+        outputPreview: Array.isArray(json.output) ? json.output.slice(0, 10).map((item) => ({
+          type: item.type,
+          summary: item.summary,
+          content: item.content,
+          name: item.name
+        })) : null,
+        topLevelKeys: Object.keys(json)
+      });
+      let content;
+      let stopReason;
+      let usage;
+      let providerRaw;
+      if (this.isOpenAICompat && this.wireApi === "chat_completions") {
+        const choice = json.choices?.[0];
+        const msg = choice?.message;
+        content = [];
+        const textContent = msg?.content ?? msg?.reasoning;
+        if (textContent) {
+          content.push({ type: "text", text: textContent });
+        }
+        if (msg?.tool_calls) {
+          for (const tc of msg.tool_calls) {
+            content.push({
+              type: "tool_use",
+              id: tc.id,
+              name: tc.function.name,
+              input: safeParseJson(tc.function.arguments)
+            });
+          }
+        }
+        const finishReason = choice?.finish_reason;
+        stopReason = finishReason === "tool_calls" || finishReason === "function_call" ? "tool_use" : finishReason === "length" ? "max_tokens" : "end_turn";
+        if (json.usage) {
+          usage = {
+            inputTokens: json.usage.prompt_tokens ?? 0,
+            outputTokens: json.usage.completion_tokens ?? 0
+          };
+        }
+      } else if (this.isOpenAICompat && this.wireApi === "responses") {
+        content = [];
+        const reasoningSummaries = [];
+        const rawOutput = json.output ?? [];
+        if (rawOutput.length > 0) {
+          providerRaw = {
+            provider: this.provider,
+            model: this.model,
+            wireApi: this.wireApi,
+            output: rawOutput
+          };
+        }
+        for (const item of json.output ?? []) {
+          if (item.type === "function_call") {
+            content.push({
+              type: "tool_use",
+              id: item.call_id,
+              name: item.name,
+              input: safeParseJson(item.arguments)
+            });
+            continue;
+          }
+          if (item.type === "reasoning") {
+            const summaryParts = Array.isArray(item.summary) ? item.summary.map((block) => typeof block.text === "string" ? block.text : "").filter((text) => text.trim().length > 0) : [];
+            const reasoningText = summaryParts.join("\n").trim();
+            if (reasoningText)
+              reasoningSummaries.push(reasoningText);
+            continue;
+          }
+          for (const block of item.content ?? []) {
+            if (block.type === "output_text") {
+              content.push({ type: "text", text: block.text });
+            } else if (block.type === "summary_text" || block.type === "reasoning_text") {
+              const text = typeof block.text === "string" ? block.text : "";
+              if (text.trim())
+                reasoningSummaries.push(text);
+            }
+          }
+        }
+        if (callbacks?.onThinking && reasoningSummaries.length > 0) {
+          callbacks.onThinking(reasoningSummaries.join("\n"));
+        }
+        stopReason = content.some((block) => block.type === "tool_use") ? "tool_use" : "end_turn";
+        if (json.usage) {
+          usage = {
+            inputTokens: json.usage.input_tokens ?? 0,
+            outputTokens: json.usage.output_tokens ?? 0,
+            // Responses `input_tokens` already includes the cached span, so
+            // this is instrumentation only — see the streaming path.
+            ...readResponsesCachedTokens(json.usage)
+          };
+        }
+      } else if (this.isGoogleWire || this.isGeminiCodeAssist) {
+        const candidate = json.candidates?.[0];
+        const rawParts = Array.isArray(candidate?.content?.parts) ? candidate.content.parts : [];
+        content = [];
+        if (rawParts.length > 0) {
+          providerRaw = {
+            provider: this.provider,
+            model: this.model,
+            wireApi: this.wireApi,
+            output: rawParts
+          };
+        }
+        for (const part of rawParts) {
+          if (typeof part.text === "string") {
+            content.push({ type: "text", text: part.text });
+            continue;
+          }
+          const call2 = part.functionCall && typeof part.functionCall === "object" ? part.functionCall : void 0;
+          if (call2 && typeof call2.name === "string") {
+            content.push({
+              type: "tool_use",
+              id: typeof call2.id === "string" ? call2.id : `google-call-${++googleFunctionCallSequence}`,
+              name: call2.name,
+              input: call2.args && typeof call2.args === "object" && !Array.isArray(call2.args) ? call2.args : {}
+            });
+          }
+        }
+        const finishReason = String(candidate?.finishReason ?? "").toUpperCase();
+        stopReason = content.some((block) => block.type === "tool_use") ? "tool_use" : finishReason === "MAX_TOKENS" ? "max_tokens" : "end_turn";
+        if (json.usageMetadata) {
+          usage = {
+            inputTokens: json.usageMetadata.promptTokenCount ?? 0,
+            outputTokens: json.usageMetadata.candidatesTokenCount ?? 0
+          };
+        }
+      } else {
+        const rawBlocks = json.content ?? [];
+        const hasAnthropicThinking = rawBlocks.some((block) => block.type === "thinking" || block.type === "redacted_thinking");
+        if (features.retainedReasoning && this.provider === "anthropic" && hasAnthropicThinking) {
+          providerRaw = {
+            provider: this.provider,
+            model: this.model,
+            wireApi: this.wireApi,
+            output: rawBlocks
+          };
+        }
+        if (callbacks?.onThinking) {
+          const thinkingText = rawBlocks.filter((b) => b.type === "thinking").map((b) => typeof b.thinking === "string" ? b.thinking : "").join("").trim();
+          if (thinkingText)
+            callbacks.onThinking(thinkingText);
+        }
+        content = rawBlocks.filter((block) => block.type !== "thinking" && block.type !== "redacted_thinking").map((block) => {
+          if (block.type === "text") {
+            return { type: "text", text: block.text };
+          }
+          if (block.type === "tool_use") {
+            return {
+              type: "tool_use",
+              id: block.id,
+              name: block.name,
+              input: block.input
+            };
+          }
+          return { type: "text", text: JSON.stringify(block) };
+        });
+        stopReason = json.stop_reason === "tool_use" ? "tool_use" : json.stop_reason === "max_tokens" ? "max_tokens" : "end_turn";
+        if (json.usage) {
+          usage = readCacheUsage(json.usage);
+          this.logCacheUsage(usage);
+        }
+      }
+      if (usage)
+        callbacks?.onUsage?.(usage);
+      return {
+        content,
+        stopReason,
+        usage,
+        durationMs: Date.now() - start,
+        ...providerRaw ? { providerRaw } : {}
+      };
+    } catch (err) {
+      clearTimeout(timer);
+      if (err instanceof OperatorAbortError || call.operatorAborted()) {
+        return this.cancelledResult(start);
+      }
+      if (err instanceof QuotaExhaustedError) {
+        return {
+          content: [{ type: "text", text: "" }],
+          stopReason: "error",
+          durationMs: Date.now() - start,
+          error: err.message
+        };
+      }
+      const msg = err instanceof Error ? err.message : String(err);
+      const timedOut = msg.includes("abort") || msg.includes("timeout");
+      return {
+        content: [{ type: "text", text: "" }],
+        stopReason: "error",
+        durationMs: Date.now() - start,
+        error: timedOut ? `${this.providerLabel} API request timed out` : `${this.providerLabel} API error: ${msg}`
+      };
+    } finally {
+      call.dispose();
+    }
+  }
+  async consumeResponsesStream(res, start, callbacks, opts) {
+    const reader = res.body?.getReader();
+    if (!reader) {
+      return {
+        content: [{ type: "text", text: "" }],
+        stopReason: "error",
+        durationMs: Date.now() - start,
+        error: `${this.providerLabel} API error: missing response body`
+      };
+    }
+    const idleTimeoutMs = opts?.idleTimeoutMs ?? llmStreamIdleTimeoutMs();
+    const operatorSignal = opts?.abort?.operator;
+    let stalled = false;
+    const readBounded = async () => {
+      let timer;
+      const detach = operatorSignal ? new AbortController() : void 0;
+      try {
+        return await Promise.race([
+          reader.read(),
+          new Promise((_resolve, reject) => {
+            timer = setTimeout(() => {
+              stalled = true;
+              reject(new Error("stream stalled"));
+            }, idleTimeoutMs);
+          }),
+          // A real aborted `fetch` also errors the body stream, so `read()`
+          // would reject on its own — but only for a live socket. This racer
+          // is what makes cancellation immediate and unconditional, including
+          // for a body that is buffered, mocked, or already fully delivered.
+          ...operatorSignal && detach ? [
+            new Promise((_resolve, reject) => {
+              if (operatorSignal.aborted) {
+                reject(new OperatorAbortError());
+                return;
+              }
+              operatorSignal.addEventListener("abort", () => reject(new OperatorAbortError()), { once: true, signal: detach.signal });
+            })
+          ] : []
+        ]);
+      } finally {
+        if (timer)
+          clearTimeout(timer);
+        detach?.abort();
+      }
+    };
+    const decoder = new TextDecoder();
+    let buffer = "";
+    let completedResponse = null;
+    let openRouterStreamFailed = false;
+    let openRouterUsage;
+    const streamedOutputItems = [];
+    let thinkingText = "";
+    let lastThinkingEmit = 0;
+    let lastThinkingLength = 0;
+    const emitThinking = (force = false) => {
+      if (!callbacks?.onThinking || !thinkingText.trim())
+        return;
+      if (force && lastThinkingEmit > 0 && lastThinkingLength === thinkingText.length)
+        return;
+      const now = Date.now();
+      const nextChars = thinkingText.length - lastThinkingLength;
+      const firstEmit = lastThinkingLength === 0;
+      if (!force) {
+        if (firstEmit && thinkingText.length < 96)
+          return;
+        if (nextChars < 96 && now - lastThinkingEmit < 250)
+          return;
+      }
+      lastThinkingEmit = now;
+      lastThinkingLength = thinkingText.length;
+      callbacks.onThinking(thinkingText);
+    };
+    while (true) {
+      let chunk;
+      try {
+        chunk = await readBounded();
+      } catch (err) {
+        if (err instanceof OperatorAbortError || opts?.abort?.operatorAborted()) {
+          try {
+            await reader.cancel();
+          } catch {
+          }
+          throw err instanceof OperatorAbortError ? err : new OperatorAbortError();
+        }
+        if (stalled) {
+          try {
+            await reader.cancel();
+          } catch {
+          }
+          const secs = Math.round(idleTimeoutMs / 1e3);
+          diag.warn("stream_stalled", `${this.providerLabel} stream stalled \u2014 no SSE events for ${secs}s (server hold; aborting call)`, {
+            provider: this.providerLabel,
+            idle_timeout_ms: idleTimeoutMs,
+            idle_timeout_s: secs
+          });
+          return {
+            content: [{ type: "text", text: "" }],
+            stopReason: "error",
+            durationMs: Date.now() - start,
+            error: `${this.providerLabel} stream stalled \u2014 no SSE events for ${secs}s (server accepted but held the stream; transient)`
+          };
+        }
+        throw err;
+      }
+      const { done, value } = chunk;
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      let boundary = buffer.indexOf("\n\n");
+      while (boundary >= 0) {
+        const rawChunk = buffer.slice(0, boundary);
+        buffer = buffer.slice(boundary + 2);
+        boundary = buffer.indexOf("\n\n");
+        const payload = rawChunk.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trim()).join("\n");
+        if (!payload || payload === "[DONE]")
+          continue;
+        let event;
+        try {
+          event = JSON.parse(payload);
+        } catch {
+          continue;
+        }
+        const type = String(event.type ?? "");
+        if (this.provider === "openrouter" && (type === "response.done" || type === "response.failed" || type === "response.completed" || type === "response.incomplete")) {
+          const response = event.response;
+          const usage2 = response?.usage;
+          if (usage2 && typeof usage2.input_tokens === "number" && Number.isFinite(usage2.input_tokens) && usage2.input_tokens >= 0 && typeof usage2.output_tokens === "number" && Number.isFinite(usage2.output_tokens) && usage2.output_tokens >= 0) {
+            openRouterUsage = {
+              inputTokens: usage2.input_tokens,
+              outputTokens: usage2.output_tokens,
+              ...readResponsesCachedTokens(usage2)
+            };
+            callbacks?.onUsage?.(openRouterUsage);
+          }
+        }
+        if (this.provider === "openrouter" && (type === "error" || type === "response.failed" || type === "response.incomplete")) {
+          openRouterStreamFailed = true;
+          continue;
+        }
+        if (type === "response.output_text.delta" || this.provider === "openrouter" && type === "response.content_part.delta") {
+          const delta = typeof event.delta === "string" ? event.delta : "";
+          if (delta) {
+            callbacks?.onDelta?.("assistant_response", delta);
+          }
+          continue;
+        }
+        if (type === "response.reasoning_summary_text.delta") {
+          const delta = typeof event.delta === "string" ? event.delta : "";
+          if (delta) {
+            thinkingText += delta;
+            callbacks?.onDelta?.("reasoning", delta);
+            emitThinking(false);
+          }
+          continue;
+        }
+        if (type === "response.reasoning_summary_text.done") {
+          const text = typeof event.text === "string" ? event.text : typeof event.part === "object" && event.part && typeof event.part.text === "string" ? String(event.part.text) : "";
+          if (text.trim()) {
+            thinkingText = text;
+            emitThinking(true);
+          }
+          continue;
+        }
+        if (type === "response.output_item.done") {
+          const item = event.item;
+          if (item && typeof item.type === "string") {
+            streamedOutputItems.push(item);
+          }
+          continue;
+        }
+        if (type === "response.completed" || type === "response.incomplete" || this.provider === "openrouter" && type === "response.done") {
+          const response = event.response;
+          if (response) {
+            if (this.provider === "openrouter" && (openRouterStreamFailed || response.error != null || (type === "response.done" || response.status !== void 0) && response.status !== "completed")) {
+              openRouterStreamFailed = true;
+              continue;
+            }
+            completedResponse = response;
+            const usage2 = response.usage;
+            if (usage2 && this.provider !== "openrouter") {
+              callbacks?.onUsage?.({
+                inputTokens: Number(usage2.input_tokens ?? 0),
+                outputTokens: Number(usage2.output_tokens ?? 0)
+              });
+            }
+          }
+        }
+      }
+    }
+    emitThinking(true);
+    if (!completedResponse || openRouterStreamFailed) {
+      return {
+        content: thinkingText ? [{ type: "text", text: thinkingText }] : [{ type: "text", text: "" }],
+        stopReason: "error",
+        durationMs: Date.now() - start,
+        ...openRouterUsage ? { usage: openRouterUsage } : {},
+        error: `${this.providerLabel} API error: ${openRouterStreamFailed ? "response stream failed" : "stream completed without final response"}`
+      };
+    }
+    appendNativeTrace({
+      kind: "native-response-stream",
+      provider: this.providerLabel,
+      wireApi: this.wireApi,
+      usage: completedResponse.usage ?? null,
+      outputPreview: Array.isArray(completedResponse.output) ? completedResponse.output.slice(0, 10).map((item) => ({
+        type: item.type,
+        summary: item.summary,
+        content: item.content,
+        name: item.name
+      })) : null,
+      streamedItems: streamedOutputItems.slice(0, 10).map((item) => ({
+        type: item.type,
+        name: item.name,
+        call_id: item.call_id,
+        argumentsPreview: typeof item.arguments === "string" ? item.arguments.slice(0, 200) : void 0
+      })),
+      topLevelKeys: Object.keys(completedResponse)
+    });
+    const completedOutput = completedResponse.output ?? [];
+    const outputItems = streamedOutputItems.length > 0 ? streamedOutputItems : completedOutput;
+    const content = [];
+    const reasoningSummaries = [];
+    for (const item of outputItems) {
+      if (item.type === "function_call") {
+        content.push({
+          type: "tool_use",
+          id: String(item.call_id),
+          name: String(item.name),
+          input: safeParseJson(String(item.arguments ?? "{}"))
+        });
+        continue;
+      }
+      if (item.type === "reasoning") {
+        const summaryParts = Array.isArray(item.summary) ? item.summary.map((block) => typeof block.text === "string" ? block.text : "").filter((text) => text.trim().length > 0) : [];
+        const reasoningText = summaryParts.join("\n").trim();
+        if (reasoningText)
+          reasoningSummaries.push(reasoningText);
+        continue;
+      }
+      for (const block of item.content ?? []) {
+        if (block.type === "output_text") {
+          content.push({ type: "text", text: String(block.text ?? "") });
+        }
+      }
+    }
+    if (lastThinkingEmit === 0 && reasoningSummaries.length > 0) {
+      thinkingText = reasoningSummaries.join("\n");
+      emitThinking(true);
+    }
+    const usageRecord = completedResponse.usage;
+    const usage = usageRecord ? {
+      inputTokens: Number(usageRecord.input_tokens ?? 0),
+      outputTokens: Number(usageRecord.output_tokens ?? 0),
+      // Responses `input_tokens` already INCLUDES the cached span (unlike
+      // Anthropic, which subtracts it), so no normalisation is needed —
+      // this is purely so cache behaviour becomes observable. Without it
+      // the Codex cache hit rate is unmeasurable: `prompt-cache.ts`
+      // instruments the Anthropic path only.
+      ...readResponsesCachedTokens(usageRecord)
+    } : void 0;
+    return {
+      content,
+      stopReason: content.some((item) => item.type === "tool_use") ? "tool_use" : "end_turn",
+      usage,
+      durationMs: Date.now() - start,
+      // `outputItems` is the complete, correctly-ordered response array —
+      // reasoning items with their `encrypted_content` still attached, each
+      // immediately followed by the item it produced. Handing it back lets the
+      // next turn replay it verbatim instead of re-deriving the reasoning.
+      ...outputItems.length > 0 ? {
+        providerRaw: {
+          provider: this.provider,
+          model: this.model,
+          wireApi: this.wireApi,
+          output: outputItems
+        }
+      } : {}
+    };
+  }
+  async isAvailable() {
+    if (this.provider === "chatgpt-codex") {
+      return this.codexAuthState !== void 0;
+    }
+    return !!this.apiKey;
+  }
+};
+
+export {
+  FEATURE_PRESETS,
+  resolveFeaturePreset,
+  applyFeaturePreset,
+  applyFeaturePresetFromEnv,
+  features,
+  MAX_MESSAGE_LENGTH,
+  MAX_FIELD_VALUE_LENGTH,
+  MAX_CODE_LENGTH,
+  MAX_FIELDS,
+  MAX_BUFFERED,
+  formatDiagnosticLine,
+  stderrDiagnosticSink,
+  diag,
+  claimDiagnostics,
+  subscribeDiagnostics,
+  isDiagnosticsClaimed,
+  recentDiagnostics,
+  _resetDiagnosticsForTests,
+  DEFAULT_CLOUD_HOST,
+  CloudAuthMissingError,
+  CloudAuthError,
+  loadCloudCredentials,
+  CloudError,
+  CloudUnauthorizedError,
+  CloudForbiddenError,
+  CloudNetworkError,
+  CloudClient,
+  QuotaExhaustedError,
+  OperatorAbortError,
+  parseUsageLimitReached,
+  LOOP_SERVER_COMPACTION_TOKENS,
+  LlmApiRuntime
+};