0sec-cli 0.21.4 → 0.22.1

package/chunks/{chunk-YPOA3W4O.js → chunk-GOEA3NW6.js}

@@ -5,19 +5,21 @@ import {
   ANALYTICS_LEVEL_ENV,
   analyticsPipeline,
   levelAtLeast,
+  loadCloudCredentials,
   resolveAnalyticsLevel
-} from "./chunk-ANDKY54G.js";
+} from "./chunk-OHHCGDJ2.js";
 import {
   DEFAULT_ALLOW_MODEL_SELF_EXTENSION,
   createPresentationEvent,
   homeStateDir
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-KAU6NLGP.js";
 
 // packages/cli/src/tui/settings-store.ts
 import { useSyncExternalStore } from "react";
 
 // packages/cli/src/tui/settings.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { dirname as dirname2, join as join3 } from "node:path";
 
 // packages/cli/src/tui/keybindings.ts
@@ -202,62 +204,15 @@ var KEYBINDINGS = [
   // ── View ────────────────────────────────────────────────────────────────────
   // The only rebindable set: self-contained, stateless toggles that call
   // `updateSetting(...)` and take no part in text entry or modal cycles.
-  {
-    id: "view.left-sidebar",
-    keys: "Ctrl+B",
-    defaultChords: ["ctrl+b"],
-    rebindable: true,
-    description: "Toggle the left sidebar (persists across the session).",
-    category: "View",
-    handler: 'if (matchesBinding(key, "view.left-sidebar", \u2026)) updateSetting("showLeftSidebar", \u2026)'
-  },
-  {
-    id: "view.right-sidebar",
-    keys: "Ctrl+L",
-    defaultChords: ["ctrl+l"],
-    rebindable: true,
-    description: "Toggle the right sidebar (persists across the session).",
-    category: "View",
-    handler: 'if (matchesBinding(key, "view.right-sidebar", \u2026)) updateSetting("showRightSidebar", \u2026)'
-  },
   {
     id: "view.transcript-detail",
     keys: "Ctrl+R",
     defaultChords: ["ctrl+r"],
     rebindable: true,
-    description: "Toggle the whole transcript between collapsed and expanded tool/reasoning detail (persists across the session).",
+    description: "Toggle folded tool/reasoning detail; output previews stay bounded until explicitly disclosed.",
     category: "View",
     handler: 'if (matchesBinding(key, "view.transcript-detail", \u2026)) updateSetting("transcriptDetail", \u2026)'
   },
-  {
-    id: "overlay.review-toggle",
-    keys: "Ctrl+O",
-    defaultChords: ["ctrl+o"],
-    rebindable: true,
-    description: "Open (and close) the full-screen transcript-review overlay.",
-    category: "View",
-    handler: 'if (matchesBinding(key, "overlay.review-toggle", \u2026)) setReviewOpen(true) / (reviewOpen) close'
-  },
-  {
-    id: "overlay.review-top",
-    keys: "Ctrl+Home",
-    defaultChords: ["ctrl+home"],
-    rebindable: false,
-    description: "Jump to the top of the transcript-review overlay.",
-    category: "View",
-    lockReason: "modal",
-    handler: 'if (reviewOpen && key.ctrl && key.name === "home") review.scrollY = 0'
-  },
-  {
-    id: "overlay.review-bottom",
-    keys: "Ctrl+End",
-    defaultChords: ["ctrl+end"],
-    rebindable: false,
-    description: "Jump to the bottom of the transcript-review overlay.",
-    category: "View",
-    lockReason: "modal",
-    handler: 'if (reviewOpen && key.ctrl && key.name === "end") review.scrollY = review.maxScrollY'
-  },
   // ── Autonomy ─────────────────────────────────────────────────────────────────
   {
     id: "autonomy.cycle-mode",
@@ -1387,7 +1342,7 @@ var DEFS = [
   {
     key: "showLogo",
     label: "Logo",
-    description: 'Block "ZEROSECURITY" wordmark shown on an empty transcript.',
+    description: 'Block "0.SECURITY" wordmark shown on an empty transcript.',
     kind: "boolean",
     default: true,
     group: "Display"
@@ -1416,22 +1371,6 @@ var DEFS = [
     default: true,
     group: "Transcript"
   },
-  {
-    key: "showLeftSidebar",
-    label: "Left sidebar",
-    description: "Left sidebar in the chat view: recent sessions to resume, plus this run's findings. Hidden on narrow terminals.",
-    kind: "boolean",
-    default: false,
-    group: "Display"
-  },
-  {
-    key: "showRightSidebar",
-    label: "Right sidebar",
-    description: "Right sidebar: live agents, their activity, the current plan and findings. Hidden on narrow terminals.",
-    kind: "boolean",
-    default: false,
-    group: "Display"
-  },
   {
     key: "showTimestamps",
     label: "Timestamps",
@@ -1511,9 +1450,9 @@ var DEFS = [
   {
     key: "roleLabelStyle",
     label: "Role label",
-    description: 'Speaker name on each message: "You" for your turns, "0" for answers. Full and short add the elapsed age when one is known; glyph shows the name alone; off omits the label entirely. Bubble cards carry it top-left on the card border, with your messages right-aligned and answers left.',
+    description: 'Labels your messages as "You"; assistant replies stay unlabeled. Full and short include the optional age, glyph shows the name alone, and off hides the label.',
     kind: "enum",
-    default: "full",
+    default: "off",
     choices: ["full", "short", "glyph", "off"],
     group: "Display"
   },
@@ -1537,16 +1476,16 @@ var DEFS = [
   {
     key: "transcriptDetail",
     label: "Transcript detail",
-    description: "Expanded shows every step (thinking, tool calls + their output) inline \u2014 the default; collapsed folds each turn's successful steps into one-line summaries (failures always show). Ctrl+R toggles it live.",
+    description: "Fold tool and reasoning steps. Output previews stay within 20 lines; click a card for retained detail.",
     kind: "enum",
-    default: "expanded",
-    choices: ["expanded", "collapsed"],
+    default: "collapsed",
+    choices: ["collapsed", "expanded"],
     group: "Transcript"
   },
   {
     key: "autoCompaction",
     label: "Auto-compaction",
-    description: "Automatically summarise older turns when the conversation nears the model's context window (the recap stays viewable with Ctrl+O).",
+    description: "Automatically summarise older turns when the conversation nears the model's context window.",
     kind: "boolean",
     default: true,
     group: "Context"
@@ -1606,7 +1545,7 @@ var DEFS = [
     label: "Token usage",
     description: 'Per-turn "in\u2192out tok" line under each answer.',
     kind: "boolean",
-    default: true,
+    default: false,
     group: "Telemetry"
   },
   {
@@ -1614,7 +1553,7 @@ var DEFS = [
     label: "Cost",
     description: "Estimated dollar cost, per turn and in the status bar.",
     kind: "boolean",
-    default: true,
+    default: false,
     group: "Telemetry"
   },
   {
@@ -1646,7 +1585,7 @@ var DEFS = [
   {
     key: "logoAnimation",
     label: "Logo animation",
-    description: 'Intro animation for the "ZEROSECURITY" wordmark: glitch (a neon-flecked scramble that resolves \u2014 the default), rainbow (a looping hue sweep), matrix (a green matrix-rain cascade), wave (a rippling cyan wavefront), neon (a neon-sign warm-up flicker), shimmer (a bright comet with a gradient tail), pulse (the slash breathes), strike (an orange slash strikes through the 0), draw (letters draw in behind a pen tip), fade (a centre-out bloom), typein (per-cell reveal), sweep (a bright bar wipes across) or off (static).',
+    description: 'Intro animation for the "0.SECURITY" wordmark: glitch (a neon-flecked scramble that resolves \u2014 the default), rainbow (a looping hue sweep), matrix (a green matrix-rain cascade), wave (a rippling cyan wavefront), neon (a neon-sign warm-up flicker), shimmer (a bright comet with a gradient tail), pulse (the slash breathes), strike (an orange slash strikes through the 0), draw (letters draw in behind a pen tip), fade (a centre-out bloom), typein (per-cell reveal), sweep (a bright bar wipes across) or off (static).',
     kind: "enum",
     default: "glitch",
     choices: [
@@ -1677,19 +1616,19 @@ var DEFS = [
   },
   {
     key: "analyticsLevel",
-    label: "Analytics and training data",
-    description: "Full is the new-install default. Usage shares feature counters and error categories, not tool content. Commands adds tool arguments/results and submitted code for model training and security research; Full also adds scope and findings. Recognized credentials are scrubbed; emails, URLs, identifiers and other content are retained. Sending uses authenticated Cloud storage and is not anonymous. Each tool/code content field is limited to 256 KiB after credential scrubbing; oversized records are reported locally, not silently truncated. Explicit ZERO_ANALYTICS_LEVEL and offline/no-telemetry/DO_NOT_TRACK restrictions win over broader settings. Problem reports are separate. Applies to this computer, not this project.",
+    label: "Data sharing",
+    description: "Usage sends counts, timing, cost and error categories. Commands adds tool inputs/outputs and code; Full adds scope and findings. Credentials are scrubbed, but identifying content may remain. Uploads require an endpoint and are not anonymous. Environment opt-outs take precedence. Applies to this computer.",
     kind: "enum",
-    default: "full",
+    default: "off",
     choices: ["off", "usage", "commands", "full"],
     group: "Privacy"
   },
   {
     key: "diagnosticReporting",
     label: "Problem reports",
-    description: "Send limited diagnostics automatically by default, ask first, or turn reporting off. Uses Cloud sign-in or a configured HTTPS feedback endpoint. Never includes prompts, tool arguments or output. Applies to this computer, not this project.",
+    description: "Review diagnostics before sending, send automatically, or keep reports local. Requires a configured endpoint. Off/Usage sharing sends categories only; Commands/Full can include scrubbed errors, stacks and failure output. Applies to this computer.",
     kind: "enum",
-    default: "automatic",
+    default: "ask",
     choices: ["off", "ask", "automatic"],
     group: "Privacy"
   },
@@ -1702,6 +1641,15 @@ var DEFS = [
     choices: ["off", "notify", "automatic"],
     group: "Updates"
   },
+  {
+    key: "executionProfile",
+    label: "Execution profile",
+    description: "SmolVM runs the whole console, agents, browser and shell in the online Kali workbench. Prepare its approved image and explicit credential grants with 0 workbench setup. Applies to this computer on the next launch; failures never fall back to host execution.",
+    kind: "enum",
+    default: "local",
+    choices: ["local", "smolvm"],
+    group: "Security"
+  },
   {
     key: "symbolPreset",
     label: "Symbols",
@@ -1741,8 +1689,6 @@ var DEFAULT_SETTINGS = {
   showRuntimeNotices: true,
   showTurnSummary: false,
   showSubagents: true,
-  showLeftSidebar: false,
-  showRightSidebar: false,
   showTimestamps: false,
   showObjective: true,
   showScope: true,
@@ -1750,13 +1696,14 @@ var DEFAULT_SETTINGS = {
   composerStyle: "border",
   busyInputMode: "steer",
   onboardingCompleted: false,
+  executionProfile: "local",
   allowSubagentPeerMessaging: true,
   allowSubagentOperatorMessaging: true,
   transcriptStyle: "minimal",
-  roleLabelStyle: "full",
+  roleLabelStyle: "off",
   toolCardStyle: "compact",
   richToolCards: true,
-  transcriptDetail: "expanded",
+  transcriptDetail: "collapsed",
   autoCompaction: true,
   compactionThreshold: "80%",
   theme: DEFAULT_THEME_NAME,
@@ -1764,21 +1711,22 @@ var DEFAULT_SETTINGS = {
   allowDevSourceUpdates: false,
   autoEvolveFinderLenses: false,
   autoPromoteFinderLenses: false,
-  showTokenUsage: true,
-  showCost: true,
+  showTokenUsage: false,
+  showCost: false,
   showContextMeter: true,
   modelDisplay: "statusbar",
   elapsedTimer: "left",
   logoAnimation: "glitch",
   reduceMotion: false,
-  analyticsLevel: "full",
-  diagnosticReporting: "automatic",
+  analyticsLevel: "off",
+  diagnosticReporting: "ask",
   diagnosticReportingPrompted: false,
   updatePolicy: "automatic",
   symbolPreset: "unicode",
   rosterSort: "attention",
   leaderKey: "off",
-  keybindings: {}
+  keybindings: {},
+  modelPreference: null
 };
 var SETTINGS_FILENAME = "tui-settings.json";
 function settingsFilePath(homeDir2) {
@@ -1816,6 +1764,9 @@ function strictValueAt(raw, key) {
   if (key === "keybindings") {
     return typeof value === "object" && value !== null && !Array.isArray(value) ? sanitizeKeybindingOverrides(value) : void 0;
   }
+  if (key === "modelPreference") {
+    return normalizeModelPreference(value);
+  }
   const def = DEF_BY_KEY.get(key);
   if (def?.kind === "boolean") {
     return typeof value === "boolean" ? value : void 0;
@@ -1824,7 +1775,7 @@ function strictValueAt(raw, key) {
   return typeof value === "string" && choices.includes(value) ? value : void 0;
 }
 function isOperatorSetting(key) {
-  return key === "onboardingCompleted" || key === "analyticsLevel" || key === "diagnosticReporting" || key === "diagnosticReportingPrompted" || key === "updatePolicy" || key === "allowDevSourceUpdates";
+  return key === "onboardingCompleted" || key === "analyticsLevel" || key === "diagnosticReporting" || key === "diagnosticReportingPrompted" || key === "updatePolicy" || key === "allowDevSourceUpdates" || key === "executionProfile" || key === "modelPreference";
 }
 function resolveLayeredSettings(globalRaw, projectRaw) {
   const settings = {};
@@ -1862,13 +1813,6 @@ function booleanAt(raw, key) {
   const value = rawValue(raw, key);
   return typeof value === "boolean" ? value : DEFAULT_SETTINGS[key];
 }
-function booleanWithLegacy(raw, key, legacyKey) {
-  const value = rawValue(raw, key);
-  if (typeof value === "boolean") return value;
-  const legacy = rawValue(raw, legacyKey);
-  if (typeof legacy === "boolean") return legacy;
-  return DEFAULT_SETTINGS[key];
-}
 function enumAt(raw, key) {
   const def = DEF_BY_KEY.get(key);
   const value = rawValue(raw, key);
@@ -1882,6 +1826,13 @@ function themeAt(raw) {
 function keybindingsAt(raw) {
   return sanitizeKeybindingOverrides(rawValue(raw, "keybindings"));
 }
+function normalizeModelPreference(raw) {
+  if (raw === null) return null;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
+  const value = raw;
+  if (typeof value.providerId !== "string" || !value.providerId.trim() || typeof value.model !== "string" || !value.model.trim() || typeof value.connectionIdentity !== "string" || !/^[a-f0-9]{64}$/.test(value.connectionIdentity)) return void 0;
+  return { providerId: value.providerId, model: value.model, connectionIdentity: value.connectionIdentity };
+}
 function normalizeSettings(raw) {
   return {
     showStatusBar: booleanAt(raw, "showStatusBar"),
@@ -1892,10 +1843,6 @@ function normalizeSettings(raw) {
     showRuntimeNotices: booleanAt(raw, "showRuntimeNotices"),
     showTurnSummary: booleanAt(raw, "showTurnSummary"),
     showSubagents: booleanAt(raw, "showSubagents"),
-    showLeftSidebar: booleanAt(raw, "showLeftSidebar"),
-    // Back-compat: the right sidebar was `showAgentRail` before it grew a
-    // context strip and a left twin. A pre-rename file keeps its choice.
-    showRightSidebar: booleanWithLegacy(raw, "showRightSidebar", "showAgentRail"),
     showTimestamps: booleanAt(raw, "showTimestamps"),
     showObjective: booleanAt(raw, "showObjective"),
     showScope: booleanAt(raw, "showScope"),
@@ -1903,6 +1850,7 @@ function normalizeSettings(raw) {
     composerStyle: enumAt(raw, "composerStyle"),
     busyInputMode: enumAt(raw, "busyInputMode"),
     onboardingCompleted: booleanAt(raw, "onboardingCompleted"),
+    executionProfile: enumAt(raw, "executionProfile"),
     allowSubagentPeerMessaging: booleanAt(raw, "allowSubagentPeerMessaging"),
     allowSubagentOperatorMessaging: booleanAt(raw, "allowSubagentOperatorMessaging"),
     transcriptStyle: enumAt(raw, "transcriptStyle"),
@@ -1931,25 +1879,37 @@ function normalizeSettings(raw) {
     symbolPreset: enumAt(raw, "symbolPreset"),
     rosterSort: enumAt(raw, "rosterSort"),
     leaderKey: enumAt(raw, "leaderKey"),
-    keybindings: keybindingsAt(raw)
+    keybindings: keybindingsAt(raw),
+    modelPreference: normalizeModelPreference(rawValue(raw, "modelPreference")) ?? null
   };
 }
 function loadSettings(homeDir2, projectDir2) {
   return loadLayeredSettings({ homeDir: homeDir2, projectDir: projectDir2 }).settings;
 }
-function loadGlobalSettings(homeDir2) {
+function loadGlobalSettings(homeDir2, options = {}) {
   syncThemeChoices(homeDir2);
-  return normalizeSettings(readRawSettingsFile(settingsFilePath(homeDir2)));
+  const raw = readRawSettingsFile(settingsFilePath(homeDir2));
+  if (options.requireExecutionProfile && strictValueAt(raw, "executionProfile") === void 0) {
+    throw new Error("Configured workbench execution profile is missing or invalid. Run 0 workbench setup or 0 workbench disable to make an explicit operator choice; host fallback is refused.");
+  }
+  return normalizeSettings(raw);
 }
 function saveSettings(settings, homeDir2) {
+  const path = settingsFilePath(homeDir2);
+  const temporary = `${path}.${randomUUID()}.tmp`;
   try {
-    const path = settingsFilePath(homeDir2);
     mkdirSync2(dirname2(path), { recursive: true });
-    writeFileSync2(path, `${JSON.stringify(normalizeSettings(settings), null, 2)}
-`, "utf8");
+    writeFileSync2(temporary, `${JSON.stringify(normalizeSettings(settings), null, 2)}
+`, { encoding: "utf8", flag: "wx", mode: 384 });
+    renameSync(temporary, path);
     return true;
   } catch {
     return false;
+  } finally {
+    try {
+      rmSync2(temporary, { force: true });
+    } catch {
+    }
   }
 }
 function sanitizeOverrides(raw) {
@@ -2002,6 +1962,10 @@ function getSettings() {
   }
   return cached.settings;
 }
+function getSettingSources() {
+  getSettings();
+  return cached.sources;
+}
 function setSettings(next) {
   const value = normalizeSettings(next);
   const saved = saveSettings(value, homeDir);
@@ -2378,6 +2342,789 @@ function writePresentationLine(text, eventType = "output.stdout") {
 `, eventType);
 }
 
+// packages/cli/src/tui/provider-status.ts
+var PROVIDER_DEFS = [
+  {
+    id: "chatgpt-codex",
+    label: "ChatGPT Codex",
+    methods: ["oauth"],
+    // OAuth, not an API key. Both tokens are accepted and the access token is
+    // read first (llm-api.ts L874-875, L1386-1394), so it leads the list.
+    envVars: ["ZERO_CHATGPT_ACCESS_TOKEN", "ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"],
+    fileSource: "~/.codex/auth.json (override with ZERO_CHATGPT_AUTH_FILE)",
+    hint: "run `codex login` to write ~/.codex/auth.json, or invoke 0 with env ZERO_CHATGPT_OAUTH_REFRESH_TOKEN=..."
+  },
+  {
+    id: "deepseek",
+    label: "DeepSeek",
+    methods: ["api-key"],
+    envVars: ["DEEPSEEK_API_KEY"],
+    hint: "set DEEPSEEK_API_KEY (endpoint override: DEEPSEEK_BASE_URL)"
+  },
+  {
+    id: "openrouter",
+    label: "OpenRouter",
+    // OAuth (PKCE browser sign-in) is preferred; a pasted OPENROUTER_API_KEY
+    // remains a secondary path. The browser flow provisions a durable
+    // `sk-or-...` key and stores it as an api_key record written to
+    // OPENROUTER_API_KEY (envVars[0], which llm-api already reads), so — unlike
+    // the xai/kimi device flows — the credential is a key, not OAuth tokens.
+    methods: ["oauth", "api-key"],
+    envVars: ["OPENROUTER_API_KEY"],
+    hint: "sign in with your OpenRouter account, or set OPENROUTER_API_KEY=sk-or-... from openrouter.ai/keys"
+  },
+  {
+    id: "azure",
+    label: "Azure OpenAI",
+    methods: ["api-key"],
+    // Only the Azure key authenticates; the deployment URL comes from
+    // AZURE_OPENAI_BASE_URL / OPENAI_BASE_URL / ~/.codex/config.toml
+    // (L1435-1445). A key with no reachable base URL still counts as
+    // configured here because detectProvider selects azure on the key alone.
+    envVars: ["AZURE_OPENAI_API_KEY"],
+    hint: "set AZURE_OPENAI_API_KEY plus AZURE_OPENAI_BASE_URL (or [model_providers.azure] in ~/.codex/config.toml)"
+  },
+  {
+    id: "openai",
+    label: "OpenAI",
+    methods: ["api-key"],
+    envVars: ["OPENAI_API_KEY"],
+    hint: "set OPENAI_API_KEY=sk-... from platform.openai.com/api-keys"
+  },
+  {
+    id: "z-ai",
+    label: "Z.ai GLM",
+    methods: ["api-key"],
+    envVars: ["Z_AI_API_KEY"],
+    hint: "set Z_AI_API_KEY from your Z.ai Coding Plan (endpoint override: Z_AI_BASE_URL)"
+  },
+  {
+    id: "kimi",
+    label: "Moonshot Kimi",
+    // OAuth (device sign-in) is preferred; a pasted KIMI_API_KEY remains a
+    // secondary path. The OAuth access token is written to KIMI_API_KEY as a
+    // Bearer (llm-api.ts reads it there, no change needed), and the refresh
+    // token to the 0-owned var so the store can round-trip it.
+    methods: ["oauth", "api-key"],
+    envVars: ["KIMI_API_KEY", "ZERO_KIMI_OAUTH_REFRESH_TOKEN"],
+    hint: "sign in with your Kimi account, or set KIMI_API_KEY from your Kimi coding plan (endpoint override: KIMI_BASE_URL)"
+  },
+  {
+    id: "qwen",
+    label: "Alibaba Qwen",
+    methods: ["api-key"],
+    envVars: ["QWEN_API_KEY"],
+    hint: "set QWEN_API_KEY from Alibaba Model Studio (endpoint override: QWEN_BASE_URL)"
+  },
+  {
+    id: "xai",
+    label: "xAI Grok",
+    // OAuth (device sign-in) is preferred; a pasted XAI_API_KEY remains a
+    // secondary path. The OAuth access token is written to XAI_API_KEY as a
+    // Bearer (llm-api.ts reads it there, no change needed), and the refresh
+    // token to the 0-owned var so the store can round-trip it.
+    methods: ["oauth", "api-key"],
+    envVars: ["XAI_API_KEY", "ZERO_XAI_OAUTH_REFRESH_TOKEN"],
+    hint: "sign in with your xAI account, or set XAI_API_KEY from console.x.ai (endpoint override: XAI_BASE_URL)"
+  },
+  {
+    id: "opencode",
+    label: "OpenCode Zen",
+    methods: ["api-key"],
+    envVars: ["OPENCODE_API_KEY"],
+    hint: "set OPENCODE_API_KEY from opencode.ai/auth (endpoint override: OPENCODE_BASE_URL)"
+  },
+  {
+    id: "copilot",
+    label: "GitHub Copilot",
+    // OAuth only (device-code sign-in). The GitHub device-flow access token is
+    // written to ZERO_COPILOT_GITHUB_TOKEN (envVars[0]) and sent directly as a
+    // Bearer to api.githubcopilot.com — no secondary exchange, no refresh, so
+    // there is no refresh-token env var.
+    methods: ["oauth"],
+    envVars: ["ZERO_COPILOT_GITHUB_TOKEN"],
+    hint: "sign in with your GitHub Copilot account (device sign-in), or set ZERO_COPILOT_GITHUB_TOKEN=... (endpoint override: COPILOT_BASE_URL)"
+  },
+  {
+    id: "google",
+    label: "Google Gemini (Code Assist)",
+    // OAuth only (PKCE browser sign-in — the Gemini CLI flow). The minted
+    // access token is written to ZERO_GEMINI_ACCESS_TOKEN (envVars[0]) and the
+    // refresh token to ZERO_GEMINI_OAUTH_REFRESH_TOKEN (the /REFRESH/i var); the
+    // runtime refreshes on demand against oauth2.googleapis.com. There is no
+    // pasted-key equivalent — Code Assist authenticates only via OAuth.
+    methods: ["oauth"],
+    envVars: ["ZERO_GEMINI_ACCESS_TOKEN", "ZERO_GEMINI_OAUTH_REFRESH_TOKEN"],
+    hint: "sign in with your Google account (browser sign-in), or set ZERO_GEMINI_OAUTH_REFRESH_TOKEN=... for Gemini Code Assist (project override: GOOGLE_CLOUD_PROJECT / ZERO_GEMINI_PROJECT)"
+  },
+  {
+    id: "anthropic",
+    label: "Anthropic",
+    // API key only for now. The schema supports OAuth, but Anthropic/Claude
+    // subscription OAuth is deliberately deferred — do not add "oauth" here
+    // until that workstream lands.
+    methods: ["api-key"],
+    envVars: ["ANTHROPIC_API_KEY"],
+    hint: "set ANTHROPIC_API_KEY=sk-ant-... from console.anthropic.com"
+  }
+];
+function primaryMethod(methods) {
+  return methods[0] ?? "api-key";
+}
+var PROVIDERS = PROVIDER_DEFS.map((def) => ({
+  ...def,
+  auth: primaryMethod(def.methods)
+}));
+function providerSupportsMethod(providerId, method) {
+  const info = PROVIDERS.find((candidate) => candidate.id === providerId);
+  return info !== void 0 && info.methods.includes(method);
+}
+function hasCredential(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function satisfyingVar(info, env) {
+  return info.envVars.find((name) => hasCredential(env[name]));
+}
+function providerStates(env) {
+  return PROVIDERS.map((info) => {
+    const via = satisfyingVar(info, env);
+    return via === void 0 ? { ...info, configured: false } : { ...info, configured: true, via };
+  });
+}
+function isProviderConfigured(providerId, env) {
+  const info = PROVIDERS.find((candidate) => candidate.id === providerId);
+  return info !== void 0 && satisfyingVar(info, env) !== void 0;
+}
+
+// packages/cli/src/tui/credential-store.ts
+import { chmodSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join5 } from "node:path";
+var CREDENTIALS_FILENAME = "credentials.json";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+function credentialsFilePath(homeDir2) {
+  return join5(homeStateDir(homeDir2), CREDENTIALS_FILENAME);
+}
+var STORABLE_PROVIDER_IDS = new Set(
+  PROVIDERS.filter((provider) => provider.methods.includes("api-key")).map((provider) => provider.id)
+);
+function hasCredential2(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function normalizeCredentials(raw) {
+  const out = {};
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return out;
+  for (const [providerId, value] of Object.entries(raw)) {
+    if (!STORABLE_PROVIDER_IDS.has(providerId)) continue;
+    if (typeof value !== "string") continue;
+    const secret = value.trim();
+    if (secret.length === 0) continue;
+    out[providerId] = secret;
+  }
+  return out;
+}
+function loadCredentials(homeDir2) {
+  return projectApiKeys(loadAccountStore(homeDir2));
+}
+function saveCredentials(creds, homeDir2) {
+  const store = loadAccountStore(homeDir2);
+  const desired = normalizeCredentials(creds);
+  return saveAccountStore(replaceApiKeyLayer(store, desired), homeDir2);
+}
+function projectApiKeys(store) {
+  const out = {};
+  for (const providerId of Object.keys(store.providers)) {
+    const record = getActiveAccount(store, providerId);
+    if (record?.kind === "api_key") out[providerId] = record.secret;
+  }
+  return out;
+}
+function replaceApiKeyLayer(store, desired) {
+  const providers = {};
+  for (const [providerId, entry] of Object.entries(store.providers)) {
+    const kept = {};
+    for (const [accountId, record] of Object.entries(entry.accounts)) {
+      if (record.kind !== "api_key") kept[accountId] = record;
+    }
+    const keptIds = Object.keys(kept);
+    if (keptIds.length === 0) continue;
+    const active = entry.activeAccountId !== void 0 && kept[entry.activeAccountId] !== void 0 ? entry.activeAccountId : keptIds[0];
+    providers[providerId] = { activeAccountId: active, accounts: kept };
+  }
+  for (const [providerId, secret] of Object.entries(desired)) {
+    const existing = providers[providerId];
+    const accounts = existing ? { ...existing.accounts } : {};
+    accounts[DEFAULT_ACCOUNT_ID] = { kind: "api_key", secret };
+    providers[providerId] = { activeAccountId: DEFAULT_ACCOUNT_ID, accounts };
+  }
+  return { version: STORE_VERSION, providers };
+}
+function credentialEnvPatch(creds, env) {
+  const stored = normalizeCredentials(creds);
+  const patch = {};
+  for (const info of PROVIDERS) {
+    const secret = stored[info.id];
+    if (secret === void 0) continue;
+    if (info.envVars.some((name) => hasCredential2(env[name]))) continue;
+    const target = info.envVars[0];
+    if (target === void 0) continue;
+    patch[target] = secret;
+  }
+  return patch;
+}
+var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+var TAIL = 4;
+var PREFIX = 6;
+var MIN_LENGTH_FOR_TAIL = 12;
+var MIN_LENGTH_FOR_PREFIX = 20;
+function redactSecret(secret) {
+  const value = typeof secret === "string" ? secret.trim() : "";
+  if (value.length < MIN_LENGTH_FOR_TAIL) return MASK;
+  const tail = value.slice(-TAIL);
+  if (value.length < MIN_LENGTH_FOR_PREFIX) return `${MASK}${tail}`;
+  return `${value.slice(0, PREFIX)}\u2026${tail}`;
+}
+var STORE_VERSION = 2;
+var DEFAULT_ACCOUNT_ID = "default";
+var KNOWN_PROVIDER_IDS = new Set(PROVIDERS.map((provider) => provider.id));
+function emptyStore() {
+  return { version: STORE_VERSION, providers: {} };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeKey(key) {
+  return key.length > 0 && key !== "__proto__" && key !== "constructor" && key !== "prototype";
+}
+function trimmedString(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeTokens(raw) {
+  if (!isPlainObject(raw)) return void 0;
+  const tokens = {};
+  const accessToken = trimmedString(raw.accessToken);
+  const refreshToken = trimmedString(raw.refreshToken);
+  if (accessToken !== void 0) tokens.accessToken = accessToken;
+  if (refreshToken !== void 0) tokens.refreshToken = refreshToken;
+  if (tokens.accessToken === void 0 && tokens.refreshToken === void 0) return void 0;
+  if (typeof raw.expiresAt === "number" && Number.isFinite(raw.expiresAt)) tokens.expiresAt = raw.expiresAt;
+  const tokenType = trimmedString(raw.tokenType);
+  if (tokenType !== void 0) tokens.tokenType = tokenType;
+  const scope = trimmedString(raw.scope);
+  if (scope !== void 0) tokens.scope = scope;
+  return tokens;
+}
+function normalizeIdentity(raw) {
+  if (!isPlainObject(raw)) return void 0;
+  const identity = {};
+  const label = trimmedString(raw.label);
+  const accountId = trimmedString(raw.accountId);
+  const email = trimmedString(raw.email);
+  if (label !== void 0) identity.label = label;
+  if (accountId !== void 0) identity.accountId = accountId;
+  if (email !== void 0) identity.email = email;
+  return Object.keys(identity).length > 0 ? identity : void 0;
+}
+function normalizeRecord(providerId, raw) {
+  if (!isPlainObject(raw)) return void 0;
+  if (raw.kind === "api_key") {
+    if (!providerSupportsMethod(providerId, "api-key")) return void 0;
+    const secret = trimmedString(raw.secret);
+    return secret === void 0 ? void 0 : { kind: "api_key", secret };
+  }
+  if (raw.kind === "oauth") {
+    if (!providerSupportsMethod(providerId, "oauth")) return void 0;
+    const tokens = normalizeTokens(raw.tokens);
+    if (tokens === void 0) return void 0;
+    const identity = normalizeIdentity(raw.identity);
+    return identity === void 0 ? { kind: "oauth", tokens } : { kind: "oauth", tokens, identity };
+  }
+  return void 0;
+}
+function normalizeProviderAccounts(providerId, raw) {
+  if (!isPlainObject(raw)) return void 0;
+  const accountsRaw = isPlainObject(raw.accounts) ? raw.accounts : {};
+  const accounts = {};
+  for (const [accountId, recordRaw] of Object.entries(accountsRaw)) {
+    if (!isSafeKey(accountId)) continue;
+    const record = normalizeRecord(providerId, recordRaw);
+    if (record !== void 0) accounts[accountId] = record;
+  }
+  const ids = Object.keys(accounts);
+  if (ids.length === 0) return void 0;
+  const active = typeof raw.activeAccountId === "string" && accounts[raw.activeAccountId] !== void 0 ? raw.activeAccountId : ids[0];
+  return { activeAccountId: active, accounts };
+}
+function normalizeAccountStore(raw) {
+  if (!isPlainObject(raw)) return emptyStore();
+  const looksV2 = isPlainObject(raw.providers) || raw.version !== void 0;
+  const store = emptyStore();
+  if (looksV2) {
+    const providersRaw = isPlainObject(raw.providers) ? raw.providers : {};
+    for (const [providerId, entry] of Object.entries(providersRaw)) {
+      if (!isSafeKey(providerId) || !KNOWN_PROVIDER_IDS.has(providerId)) continue;
+      const accounts = normalizeProviderAccounts(providerId, entry);
+      if (accounts !== void 0) store.providers[providerId] = accounts;
+    }
+    return store;
+  }
+  for (const [providerId, secret] of Object.entries(normalizeCredentials(raw))) {
+    store.providers[providerId] = {
+      activeAccountId: DEFAULT_ACCOUNT_ID,
+      accounts: { [DEFAULT_ACCOUNT_ID]: { kind: "api_key", secret } }
+    };
+  }
+  return store;
+}
+function loadAccountStore(homeDir2) {
+  try {
+    const text = readFileSync4(credentialsFilePath(homeDir2), "utf8");
+    return normalizeAccountStore(JSON.parse(text));
+  } catch {
+    return emptyStore();
+  }
+}
+function saveAccountStore(store, homeDir2) {
+  try {
+    const path = credentialsFilePath(homeDir2);
+    const dir = dirname3(path);
+    mkdirSync3(dir, { recursive: true, mode: DIR_MODE });
+    chmodSync(dir, DIR_MODE);
+    writeFileSync3(path, `${JSON.stringify(normalizeAccountStore(store), null, 2)}
+`, {
+      encoding: "utf8",
+      mode: FILE_MODE
+    });
+    chmodSync(path, FILE_MODE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getActiveAccount(store, providerId) {
+  const entry = store.providers[providerId];
+  if (entry === void 0) return void 0;
+  const id = entry.activeAccountId;
+  if (id !== void 0 && entry.accounts[id] !== void 0) return entry.accounts[id];
+  const first = Object.keys(entry.accounts)[0];
+  return first === void 0 ? void 0 : entry.accounts[first];
+}
+function chooseAccountId(record, requested) {
+  if (requested !== void 0 && isSafeKey(requested)) return requested;
+  if (record.kind === "oauth" && record.identity?.accountId !== void 0 && isSafeKey(record.identity.accountId)) {
+    return record.identity.accountId;
+  }
+  if (record.kind === "api_key") return DEFAULT_ACCOUNT_ID;
+  return `account-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function addAccount(store, providerId, record, options) {
+  if (!KNOWN_PROVIDER_IDS.has(providerId)) {
+    throw new Error(`unknown provider "${providerId}"`);
+  }
+  const method = record.kind === "api_key" ? "api-key" : "oauth";
+  if (!providerSupportsMethod(providerId, method)) {
+    throw new Error(`provider "${providerId}" does not support ${record.kind} accounts`);
+  }
+  const accountId = chooseAccountId(record, options?.accountId);
+  const existing = store.providers[providerId];
+  const accounts = { ...existing?.accounts ?? {} };
+  accounts[accountId] = record;
+  const makeActive = options?.makeActive ?? true;
+  const activeAccountId = makeActive ? accountId : existing?.activeAccountId !== void 0 && accounts[existing.activeAccountId] !== void 0 ? existing.activeAccountId : accountId;
+  return {
+    store: { version: STORE_VERSION, providers: { ...store.providers, [providerId]: { activeAccountId, accounts } } },
+    accountId
+  };
+}
+function accountEnvPatch(store, env) {
+  const normalized = normalizeAccountStore(store);
+  const patch = {};
+  for (const info of PROVIDERS) {
+    const record = getActiveAccount(normalized, info.id);
+    if (record === void 0) continue;
+    if (info.envVars.some((name) => hasCredential2(env[name]))) continue;
+    if (record.kind === "api_key") {
+      const target = info.envVars[0];
+      if (target !== void 0) patch[target] = record.secret;
+      continue;
+    }
+    const accessVar = info.envVars[0];
+    if (accessVar !== void 0 && record.tokens.accessToken !== void 0) {
+      patch[accessVar] = record.tokens.accessToken;
+    }
+    if (record.tokens.refreshToken !== void 0) {
+      const refreshVar = info.envVars.find((name) => /REFRESH/i.test(name));
+      if (refreshVar !== void 0) patch[refreshVar] = record.tokens.refreshToken;
+    }
+  }
+  return patch;
+}
+
+// packages/cli/src/tui/feedback.ts
+import { appendFileSync, mkdirSync as mkdirSync4 } from "node:fs";
+import { dirname as dirname4, join as join6 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+function feedbackFilePath(homeDir2) {
+  return join6(homeDir2 ?? homedir2(), ".0", "feedback.md");
+}
+function formatFeedbackEntry(entry) {
+  const context = [
+    entry.version ? `version ${entry.version}` : null,
+    entry.model ? `model ${entry.model}` : null,
+    entry.mode ? `mode ${entry.mode}` : null
+  ].filter((part) => part !== null);
+  const lines = [`## ${entry.timestamp}`];
+  if (context.length > 0) lines.push(`_${context.join(" \xB7 ")}_`);
+  lines.push("", entry.message.trim(), "");
+  return `${lines.join("\n")}
+`;
+}
+function appendFeedback(entry, homeDir2) {
+  const path = feedbackFilePath(homeDir2);
+  try {
+    mkdirSync4(dirname4(path), { recursive: true });
+    appendFileSync(path, formatFeedbackEntry(entry), "utf8");
+    return { ok: true, path };
+  } catch (error) {
+    return {
+      ok: false,
+      path,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function parseFeedbackCommand(raw) {
+  const text = raw.trim();
+  if (!text) return { kind: "usage" };
+  const separator = text.search(/\s/);
+  const verb = separator < 0 ? text : text.slice(0, separator);
+  const rest = separator < 0 ? "" : text.slice(separator).trim();
+  if (verb === "submit") return rest ? { kind: "submit", message: rest } : { kind: "usage" };
+  if (verb === "send") return rest ? { kind: "usage" } : { kind: "send" };
+  if (verb === "cancel") return rest ? { kind: "usage" } : { kind: "cancel" };
+  return { kind: "record", message: text };
+}
+var DEFAULT_FEEDBACK_URL = "";
+var FEEDBACK_URL_ENV = "ZERO_FEEDBACK_URL";
+var CLOUD_FEEDBACK_PATH = "/api/cli-feedback";
+function defaultCloudCredentials(env) {
+  try {
+    const credentials = loadCloudCredentials({
+      env,
+      warn: () => {
+      }
+    });
+    return { host: credentials.host, token: credentials.token };
+  } catch {
+    return null;
+  }
+}
+function cloudFeedbackUrl(host) {
+  try {
+    const url = new URL(host);
+    if (url.hostname === "cloud.0.ai") url.hostname = "cloud.0.security";
+    url.pathname = CLOUD_FEEDBACK_PATH;
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+function resolveFeedbackTarget(env = process.env, options = {}) {
+  const configured = env[FEEDBACK_URL_ENV]?.trim();
+  if (configured) return { url: configured };
+  if (DEFAULT_FEEDBACK_URL) return { url: DEFAULT_FEEDBACK_URL };
+  if (options.allowCloud === false) return null;
+  const credentials = (options.cloudCredentials ?? (() => defaultCloudCredentials(env)))();
+  if (!credentials) return null;
+  const url = cloudFeedbackUrl(credentials.host);
+  return url ? { url, authorization: `Bearer ${credentials.token}` } : null;
+}
+var FEEDBACK_OPT_OUT_ENV = ["ZERO_OFFLINE", "ZERO_NO_TELEMETRY", "DO_NOT_TRACK"];
+var FEEDBACK_TIMEOUT_MS = 5e3;
+var MAX_BODY_BYTES = 64 * 1024;
+function isOptOutSet(value) {
+  if (value === void 0) return false;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "") return false;
+  return normalized !== "0" && normalized !== "false" && normalized !== "no";
+}
+function submissionBlockedReason(env = process.env, options = {}) {
+  for (const name of FEEDBACK_OPT_OUT_ENV) {
+    if (isOptOutSet(env[name])) return "opt-out";
+  }
+  return targetBlockedReason(resolveFeedbackTarget(env, options));
+}
+function targetBlockedReason(target) {
+  if (target === null) return "no-endpoint";
+  let parsed;
+  try {
+    parsed = new URL(target.url);
+  } catch {
+    return "insecure-endpoint";
+  }
+  if (parsed.protocol !== "https:") return "insecure-endpoint";
+  return null;
+}
+function describeSkip(reason) {
+  switch (reason) {
+    case "opt-out":
+      return `Submission disabled by ${FEEDBACK_OPT_OUT_ENV.join(" / ")}. Saved locally only.`;
+    case "no-endpoint":
+      return `No feedback endpoint configured (set ${FEEDBACK_URL_ENV}). Saved locally only.`;
+    case "insecure-endpoint":
+      return `Refusing a non-HTTPS ${FEEDBACK_URL_ENV}. Saved locally only.`;
+  }
+}
+var SECRET_RULES = [
+  { label: "an OpenAI/Anthropic-style key (sk-\u2026)", pattern: /\bsk-[A-Za-z0-9_-]{16,}/ },
+  { label: "a GitHub token (ghp_/gho_/ghu_/ghs_/ghr_\u2026)", pattern: /\bgh[pousr]_[A-Za-z0-9]{20,}/ },
+  { label: "an AWS access key id (AKIA\u2026/ASIA\u2026)", pattern: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/ },
+  { label: "a Google API key (AIza\u2026)", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { label: "a Slack token (xox\u2026)", pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/ },
+  {
+    label: "an Authorization header",
+    pattern: /authorization\s*[:=]\s*(?:bearer|basic|token|digest)\s+\S+/i
+  },
+  { label: "a JWT (eyJ\u2026)", pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+/ },
+  {
+    label: "a PEM private key block",
+    pattern: /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/
+  },
+  {
+    label: "a credential-shaped assignment (password=/api_key=/secret=\u2026)",
+    pattern: /\b(?:pass(?:word|wd)?|api[_-]?key|secret|token|credentials?)\s*[:=]\s*\S{6,}/i
+  },
+  {
+    // Long opaque runs. Requires mixed case *and* a digit so ordinary prose,
+    // file paths, and hyphenated identifiers do not trip it.
+    label: "a long high-entropy string (base64-ish)",
+    pattern: /(?=[A-Za-z0-9+/_-]{40,})(?=[A-Za-z0-9+/_-]*[a-z])(?=[A-Za-z0-9+/_-]*[A-Z])(?=[A-Za-z0-9+/_-]*[0-9])[A-Za-z0-9+/_-]{40,}={0,2}/
+  }
+];
+function scanForSecrets(message) {
+  const warnings = [];
+  for (const rule of SECRET_RULES) {
+    if (rule.pattern.test(message)) warnings.push(`Message appears to contain ${rule.label}.`);
+  }
+  return warnings;
+}
+function serializePayload(payload) {
+  const body = {
+    message: payload.message,
+    timestamp: payload.timestamp
+  };
+  if (payload.version !== void 0) body.version = payload.version;
+  if (payload.model !== void 0) body.model = payload.model;
+  if (payload.mode !== void 0) body.mode = payload.mode;
+  return JSON.stringify(body);
+}
+function requestHeaders(target, redactAuthorization = false) {
+  const headers = { "content-type": "application/json" };
+  if (target.authorization) {
+    headers.authorization = redactAuthorization ? "Bearer <redacted>" : target.authorization;
+  }
+  return headers;
+}
+function buildSubmitPreview(payload, env = process.env, options = {}) {
+  if (submissionBlockedReason(env, options) !== null) return null;
+  const target = resolveFeedbackTarget(env, options);
+  if (target === null) return null;
+  return {
+    url: target.url,
+    body: serializePayload(payload),
+    headers: requestHeaders(target, true),
+    warnings: scanForSecrets(payload.message)
+  };
+}
+async function submitFeedback(payload, env = process.env, opts = {}) {
+  const blocked = submissionBlockedReason(env, opts);
+  if (blocked !== null) return { ok: false, skipped: blocked, error: describeSkip(blocked) };
+  const target = resolveFeedbackTarget(env, opts);
+  const targetBlocked = targetBlockedReason(target);
+  if (targetBlocked !== null) return { ok: false, skipped: targetBlocked, error: describeSkip(targetBlocked) };
+  if (target === null) return { ok: false, skipped: "no-endpoint", error: describeSkip("no-endpoint") };
+  const body = serializePayload(payload);
+  if (Buffer.byteLength(body, "utf8") > MAX_BODY_BYTES) {
+    return { ok: false, error: `Message too large to submit (limit ${MAX_BODY_BYTES} bytes).` };
+  }
+  const reviewed = opts.expectedPreview;
+  if (reviewed !== void 0) {
+    const currentHeaders = requestHeaders(target, true);
+    if (target.url !== reviewed.url || body !== reviewed.body || Object.keys(currentHeaders).length !== Object.keys(reviewed.headers).length || !Object.keys(currentHeaders).every((k) => currentHeaders[k] === reviewed.headers[k])) {
+      return {
+        ok: false,
+        error: "Reviewed feedback destination has changed. Preview the updated submission before sending again."
+      };
+    }
+  }
+  const doFetch = opts.fetchImpl ?? fetch;
+  const timeoutMs = opts.timeoutMs ?? FEEDBACK_TIMEOUT_MS;
+  const controller = new AbortController();
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      resolve({ ok: false, error: `Feedback submission timed out after ${timeoutMs}ms.` });
+    }, timeoutMs);
+    timer.unref?.();
+  });
+  const attempt = (async () => {
+    try {
+      const response = await doFetch(target.url, {
+        method: "POST",
+        headers: requestHeaders(target),
+        body,
+        signal: controller.signal,
+        redirect: "error"
+      });
+      return response.ok ? { ok: true, status: response.status } : { ok: false, status: response.status, error: `Endpoint returned ${response.status}.` };
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+  })();
+  try {
+    return await Promise.race([attempt, timeout]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+var DIAGNOSTIC_PLATFORMS = /* @__PURE__ */ new Set(["darwin", "linux", "win32", "aix", "freebsd", "openbsd", "sunos"]);
+var DIAGNOSTIC_ARCHS = /* @__PURE__ */ new Set(["x64", "arm64", "arm", "ia32", "s390", "mips", "ppc64"]);
+var DIAGNOSTIC_RUNTIMES = /* @__PURE__ */ new Set(["node", "bun", "deno"]);
+function classifyFailureText(text) {
+  const t = text.toLowerCase();
+  if (/exited?\s+-?\d+|exit code|non-?zero exit/.test(t)) return "nonzero-exit";
+  if (/enoent|no such file|command not found|not found on path|cannot find (?:module|the )/.test(t)) return "not-found";
+  if (/etimedout|timed out|\btimeout\b|deadline exceeded/.test(t)) return "timeout";
+  if (/econnrefused|econnreset|epipe|network|fetch failed|socket hang up|getaddrinfo|dns|tls|certificate/.test(t)) return "network";
+  if (/eacces|eperm|permission denied|forbidden|unauthor|401|403/.test(t)) return "permission";
+  if (/rate.?limit|too many requests|\b429\b|quota|overloaded/.test(t)) return "rate-limit";
+  if (/unexpected token|json|yaml|parse error|invalid json|malformed/.test(t)) return "parse";
+  if (/out of memory|enomem|heap|maximum call stack/.test(t)) return "resource";
+  if (/stream completed without final response|response stream failed|incomplete/.test(t)) return "stream-incomplete";
+  return null;
+}
+function diagnosticError(error) {
+  try {
+    if (error instanceof TypeError) return "TypeError";
+    if (error instanceof ReferenceError) return "ReferenceError";
+    if (error instanceof SyntaxError) return "SyntaxError";
+    if (error instanceof RangeError) return "RangeError";
+    if (error instanceof URIError) return "URIError";
+    if (error instanceof EvalError) return "EvalError";
+    if (error instanceof Error) {
+      const mode = classifyFailureText(error.message ?? "");
+      return mode ? `Error:${mode}` : "Error";
+    }
+    if (typeof error === "string") {
+      return classifyFailureText(error) ?? "tool-error";
+    }
+  } catch {
+  }
+  return "unknown";
+}
+function diagnosticVersion(raw) {
+  if (typeof raw !== "string" || raw.length > 128) return "unknown";
+  return /^v?(\d{1,6}\.\d{1,6}\.\d{1,6})(?:[-+][a-zA-Z0-9.+-]+)?$/.exec(raw)?.[1] ?? "unknown";
+}
+function buildDiagnosticFeedback(info, env = process.env) {
+  const kind = info.kind === "tool" ? "tool" : info.kind === "runtime" ? "runtime" : "unknown";
+  const platform = DIAGNOSTIC_PLATFORMS.has(info.platform) ? info.platform : "unknown";
+  const arch = DIAGNOSTIC_ARCHS.has(info.arch) ? info.arch : "unknown";
+  const runtime = DIAGNOSTIC_RUNTIMES.has(info.runtime) ? info.runtime : "unknown";
+  const runtimeVersion = diagnosticVersion(info.runtimeVersion);
+  const version = diagnosticVersion(info.version);
+  const timestamp = typeof info.timestamp === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(info.timestamp) && Number.isFinite(Date.parse(info.timestamp)) ? info.timestamp : (/* @__PURE__ */ new Date()).toISOString();
+  let message = `Diagnostic: ${kind} error \u2014 ${platform}/${arch} on ${runtime} ${runtimeVersion}
+Version: ${version}
+Error: ${diagnosticError(info.error)}`;
+  if (diagnosticDetailAllowed(env)) {
+    const detail = redactDiagnosticDetail(buildDiagnosticDetailText(info));
+    if (detail) message = capUtf8Bytes(`${message}
+
+${detail}`, MAX_DIAGNOSTIC_DETAIL_MESSAGE_BYTES);
+  }
+  return { message, timestamp, version };
+}
+var MAX_DIAGNOSTIC_DETAIL_MESSAGE_BYTES = 8192;
+var MAX_DIAGNOSTIC_DETAIL_CHARS = 6e3;
+function diagnosticDetailAllowed(env) {
+  const level = (env["ZERO_ANALYTICS_LEVEL"] ?? "").trim().toLowerCase();
+  return level === "commands" || level === "full";
+}
+function buildDiagnosticDetailText(info) {
+  const parts = [];
+  if (info.toolName) parts.push(`Tool: ${info.toolName}`);
+  const err = info.error;
+  if (err instanceof Error) {
+    parts.push(`${err.name}: ${err.message || "(no message)"}`);
+    if (typeof err.stack === "string" && err.stack.trim()) parts.push(err.stack.trim());
+  } else {
+    const text = diagnosticErrorText(err);
+    if (text) parts.push(text);
+  }
+  const exitOutput = typeof info.exitOutput === "string" ? info.exitOutput.trim() : "";
+  if (exitOutput && !parts.some((p) => p.includes(exitOutput))) parts.push(exitOutput);
+  let detail = parts.join("\n").trim();
+  if (detail.length > MAX_DIAGNOSTIC_DETAIL_CHARS) detail = detail.slice(0, MAX_DIAGNOSTIC_DETAIL_CHARS - 1) + "\u2026";
+  return detail;
+}
+var DETAIL_REDACTIONS = [
+  { re: /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/g, to: "\u2039redacted:private-key\u203A" },
+  { re: /\bsk-[A-Za-z0-9_-]{16,}/g, to: "\u2039redacted:key\u203A" },
+  { re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g, to: "\u2039redacted:gh-token\u203A" },
+  { re: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g, to: "\u2039redacted:aws-key\u203A" },
+  { re: /\bAIza[0-9A-Za-z_-]{35}\b/g, to: "\u2039redacted:gcp-key\u203A" },
+  { re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g, to: "\u2039redacted:slack-token\u203A" },
+  { re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+/g, to: "\u2039redacted:jwt\u203A" },
+  { re: /authorization\s*[:=]\s*(?:bearer|basic|token|digest)\s+\S+/gi, to: "authorization: \u2039redacted\u203A" },
+  { re: /\b((?:pass(?:word|wd)?|api[_-]?key|secret|token|credentials?)\s*[:=]\s*)\S{6,}/gi, to: "$1\u2039redacted\u203A" },
+  // Connection strings: keep the scheme/host shape, drop the inline credentials.
+  // MUST run before the email rule so `user:pass@host` is not mis-read as an
+  // email (which would swallow the host too).
+  { re: /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi, to: "$1\u2039redacted\u203A@" },
+  { re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, to: "\u2039redacted:email\u203A" },
+  // Home-dir usernames in file paths — keep the path shape, anonymise the user.
+  { re: /(\/home\/)[^/\s]+/g, to: "$1\u2039user\u203A" },
+  { re: /(\/Users\/)[^/\s]+/g, to: "$1\u2039user\u203A" },
+  { re: /([A-Za-z]:\\Users\\)[^\\\s]+/g, to: "$1\u2039user\u203A" }
+];
+function redactDiagnosticDetail(text) {
+  if (typeof text !== "string" || text.length === 0) return "";
+  try {
+    let out = text;
+    for (const { re, to } of DETAIL_REDACTIONS) out = out.replace(re, to);
+    return out;
+  } catch {
+    return "";
+  }
+}
+function capUtf8Bytes(text, maxBytes) {
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
+  let lo = 0, hi = text.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(text.slice(0, mid), "utf8") <= maxBytes - 1) lo = mid;
+    else hi = mid - 1;
+  }
+  return text.slice(0, lo) + "\u2026";
+}
+function diagnosticErrorText(error) {
+  if (typeof error === "string") return error.trim();
+  if (error instanceof Error) return (error.message || error.name || "Error").trim();
+  if (error === null || error === void 0) return "";
+  try {
+    const text = String(error).trim();
+    return text === "[object Object]" ? "" : text;
+  } catch {
+    return "";
+  }
+}
+
 export {
   KEYBINDINGS,
   keybindingsByCategory,
@@ -2419,6 +3166,7 @@ export {
   readProjectOverrides,
   saveProjectOverrides,
   getSettings,
+  getSettingSources,
   updateSetting,
   resetSettings,
   previewSetting,
@@ -2435,5 +3183,24 @@ export {
   suspendProcessPresentationStreamBridge,
   resumeProcessPresentationStreamBridge,
   processPresentationOutput,
-  writePresentationLine
+  writePresentationLine,
+  PROVIDERS,
+  providerStates,
+  isProviderConfigured,
+  loadCredentials,
+  saveCredentials,
+  credentialEnvPatch,
+  redactSecret,
+  loadAccountStore,
+  saveAccountStore,
+  addAccount,
+  accountEnvPatch,
+  appendFeedback,
+  parseFeedbackCommand,
+  FEEDBACK_OPT_OUT_ENV,
+  submissionBlockedReason,
+  describeSkip,
+  buildSubmitPreview,
+  submitFeedback,
+  buildDiagnosticFeedback
 };