0sec-cli 0.22.4 → 0.24.0

package/chunks/chunk-62PGWN7Y.js

@@ -0,0 +1,700 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  PROVIDERS,
+  SETTING_DEFS,
+  isOperatorSetting,
+  loadGlobalSettings,
+  loadLayeredSettings,
+  normalizeSettings,
+  projectSettingsExist,
+  providerSupportsMethod,
+  readProjectOverrides,
+  resolveLayeredSettings,
+  saveProjectOverrides,
+  saveSettings
+} from "./chunk-QEA2VHBD.js";
+import {
+  expandHomePath,
+  isExistingLocalTargetPath,
+  isExplicitLocalTargetPath
+} from "./chunk-E42XEJTK.js";
+import {
+  ANALYTICS_LEVEL_ENV,
+  analyticsOptedOut,
+  analyticsPipeline,
+  levelAtLeast,
+  resolveAnalyticsLevel
+} from "./chunk-BIJPMYFA.js";
+import {
+  homeStateDir
+} from "./chunk-RZR2XXAK.js";
+
+// packages/cli/src/tui/settings-store.ts
+import { useSyncExternalStore } from "react";
+var cached = null;
+var globalDraft = null;
+var projectDraft = null;
+var homeDir;
+var projectDir;
+var subscribers = /* @__PURE__ */ new Set();
+function notify(settings) {
+  bridgeAnalyticsLevel(settings);
+  for (const fn of [...subscribers]) {
+    try {
+      fn(settings);
+    } catch {
+    }
+  }
+}
+function loadLayered() {
+  return globalDraft === null && projectDraft === null ? loadLayeredSettings({ homeDir, projectDir }) : resolveLayeredSettings(globalDraft ?? loadGlobalSettings(homeDir), projectDraft ?? readProjectOverrides(projectDir));
+}
+function getSettings() {
+  if (cached === null) {
+    cached = loadLayered();
+    bridgeAnalyticsLevel(cached.settings);
+  }
+  return cached.settings;
+}
+function getSettingSources() {
+  getSettings();
+  return cached.sources;
+}
+function getAnalyticsSetupDraft() {
+  const settings = getSettings();
+  const current = process.env[ANALYTICS_LEVEL_ENV];
+  const shellPreference = current !== void 0 && current !== bridgedAnalyticsEnv;
+  if (analyticsOptedOut() || shellPreference && resolveAnalyticsLevel() === "off") return "off";
+  return cached.sources.analyticsLevel === "default" ? "usage" : settings.analyticsLevel;
+}
+function setSettings(next) {
+  const value = normalizeSettings(next);
+  const saved = saveSettings(value, homeDir);
+  globalDraft = saved ? null : value;
+  cached = loadLayered();
+  notify(cached.settings);
+  return saved;
+}
+function defaultWriteLayer() {
+  return projectSettingsExist(projectDir) ? "project" : "global";
+}
+function updateSetting(key, value, opts = {}) {
+  const operatorOnly = isOperatorSetting(key);
+  if (operatorOnly && opts.scope === "project") return false;
+  const layer = operatorOnly ? "global" : opts.scope ?? defaultWriteLayer();
+  if (layer === "global") {
+    return setSettings({ ...globalDraft ?? loadGlobalSettings(homeDir), [key]: value });
+  }
+  const patch = { ...projectDraft ?? readProjectOverrides(projectDir), [key]: value };
+  const saved = saveProjectOverrides(patch, projectDir);
+  projectDraft = saved ? null : patch;
+  cached = loadLayered();
+  notify(cached.settings);
+  return saved;
+}
+function resetSettings(next, keys) {
+  const selected = keys.filter((key) => SETTING_DEFS.some((def) => def.key === key));
+  if (selected.length === 0) return true;
+  const global = { ...globalDraft ?? loadGlobalSettings(homeDir) };
+  const project = { ...projectDraft ?? readProjectOverrides(projectDir) };
+  let projectChanged = false;
+  for (const key of selected) {
+    global[key] = next[key];
+    if (Object.hasOwn(project, key)) {
+      delete project[key];
+      projectChanged = true;
+    }
+  }
+  const value = normalizeSettings(global);
+  const globalSaved = saveSettings(value, homeDir);
+  globalDraft = globalSaved ? null : value;
+  const projectSaved = !projectChanged || saveProjectOverrides(project, projectDir);
+  if (projectChanged) projectDraft = projectSaved ? null : project;
+  cached = loadLayered();
+  notify(cached.settings);
+  return globalSaved && projectSaved;
+}
+function previewSetting(key, value) {
+  if (cached === null) cached = loadLayered();
+  cached = { settings: { ...cached.settings, [key]: value }, sources: cached.sources };
+  notify(cached.settings);
+}
+function subscribeSettings(fn) {
+  subscribers.add(fn);
+  return () => {
+    subscribers.delete(fn);
+  };
+}
+var bridgedAnalyticsEnv;
+function bridgeAnalyticsLevel(settings) {
+  try {
+    const current = process.env[ANALYTICS_LEVEL_ENV];
+    if (current === void 0 || current === bridgedAnalyticsEnv) {
+      process.env[ANALYTICS_LEVEL_ENV] = settings.analyticsLevel;
+      bridgedAnalyticsEnv = settings.analyticsLevel;
+    } else {
+      bridgedAnalyticsEnv = void 0;
+    }
+    const environmentLevel = resolveAnalyticsLevel();
+    analyticsPipeline.setLevel(levelAtLeast(environmentLevel, settings.analyticsLevel) ? settings.analyticsLevel : environmentLevel);
+  } catch {
+  }
+}
+function reloadSettings() {
+  globalDraft = null;
+  projectDraft = null;
+  cached = loadLayered();
+  notify(cached.settings);
+  return cached.settings;
+}
+function configureSettingsStore(options) {
+  homeDir = options.homeDir;
+  projectDir = options.projectDir;
+  reloadSettings();
+}
+function useSettings() {
+  return useSyncExternalStore(subscribeSettings, getSettings, getSettings);
+}
+
+// packages/cli/src/codex-auth.ts
+import { readFileSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var AUTH_FILE_ENV = "ZERO_CHATGPT_AUTH_FILE";
+var LEGACY_AUTH_FILE_ENV = "ZERO_CODEX_AUTH_JSON_PATH";
+function maybeLoadCodexAuth(options = {}) {
+  const env = options.env ?? process.env;
+  if (!options.force && (env["ZERO_CHATGPT_ACCESS_TOKEN"] || env["ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"])) {
+    return;
+  }
+  const home = options.home ?? homedir();
+  const override = nonEmpty(env[AUTH_FILE_ENV]) ?? nonEmpty(env[LEGACY_AUTH_FILE_ENV]);
+  const path = override ?? join(home, ".codex", "auth.json");
+  if (!existsSync(path)) return;
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    const accessToken = nonEmpty(asString(raw.tokens?.access_token));
+    const refreshToken = nonEmpty(asString(raw.tokens?.refresh_token));
+    if (!accessToken && !refreshToken) return;
+    if (options.force) {
+      delete env["ZERO_CHATGPT_ACCESS_TOKEN"];
+      delete env["ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"];
+    }
+    if (accessToken) {
+      env["ZERO_CHATGPT_ACCESS_TOKEN"] = accessToken;
+    }
+    if (refreshToken) {
+      env["ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"] = refreshToken;
+    }
+  } catch {
+  }
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function asString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+
+// packages/cli/src/engagement-plan.ts
+var PACKAGE_PREFIXES = {
+  "npm:": { ecosystem: "npm", targetType: "npm-package" },
+  "pypi:": { ecosystem: "pypi", targetType: "pypi-package" },
+  "cargo:": { ecosystem: "cargo", targetType: "cargo-package" },
+  "oci:": { ecosystem: "oci", targetType: "oci-image" }
+};
+function resolveEngagement(rawTarget) {
+  const raw = rawTarget.trim();
+  if (raw.length === 0) return { ok: false, message: "Enter a URL, source path, git URL, or ecosystem-prefixed package." };
+  for (const [prefix, packagePlan] of Object.entries(PACKAGE_PREFIXES)) {
+    if (!raw.startsWith(prefix)) continue;
+    const target = raw.slice(prefix.length).trim();
+    if (target.length === 0) return { ok: false, message: `${prefix} requires a package name.` };
+    return {
+      ok: true,
+      plan: {
+        kind: "package",
+        target,
+        targetType: packagePlan.targetType,
+        ecosystem: packagePlan.ecosystem,
+        label: `${packagePlan.ecosystem} package ${target}`
+      }
+    };
+  }
+  if (raw.startsWith("source:")) {
+    const target = raw.slice("source:".length).trim();
+    if (target.length === 0) return { ok: false, message: "source: requires a local path or git URL." };
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target: expandHomePath(target),
+        targetType: "source-code",
+        label: `source review ${target}`
+      }
+    };
+  }
+  if (raw.startsWith("git@") || raw.startsWith("git://") || raw.endsWith(".git") || raw.startsWith("https://github.com/")) {
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target: raw,
+        targetType: "source-code",
+        label: `source review ${raw}`
+      }
+    };
+  }
+  if (raw.startsWith("mcp://") || raw.startsWith("http://") || raw.startsWith("https://")) {
+    return {
+      ok: true,
+      plan: {
+        kind: "web",
+        target: raw,
+        targetType: "url",
+        label: `web target ${raw}`
+      }
+    };
+  }
+  if (isExplicitLocalTargetPath(raw) || isExistingLocalTargetPath(raw)) {
+    const target = expandHomePath(raw);
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target,
+        targetType: "source-code",
+        label: `source review ${target}`
+      }
+    };
+  }
+  return {
+    ok: false,
+    message: "Ambiguous target. Use https://\u2026, ./path, source:\u2026, npm:\u2026, pypi:\u2026, cargo:\u2026, or oci:\u2026."
+  };
+}
+
+// packages/cli/src/tui/credential-store.ts
+import { chmodSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+var CREDENTIALS_FILENAME = "credentials.json";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+function credentialsFilePath(homeDir2) {
+  return join2(homeStateDir(homeDir2), CREDENTIALS_FILENAME);
+}
+var STORABLE_PROVIDER_IDS = new Set(
+  PROVIDERS.filter((provider) => provider.methods.includes("api-key")).map((provider) => provider.id)
+);
+function hasCredential(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function normalizeCredentials(raw) {
+  const out = {};
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return out;
+  for (const [providerId, value] of Object.entries(raw)) {
+    if (!STORABLE_PROVIDER_IDS.has(providerId)) continue;
+    if (typeof value !== "string") continue;
+    const secret = value.trim();
+    if (secret.length === 0) continue;
+    out[providerId] = secret;
+  }
+  return out;
+}
+function loadCredentials(homeDir2) {
+  return projectApiKeys(loadAccountStore(homeDir2));
+}
+function saveCredentials(creds, homeDir2) {
+  const store = loadAccountStore(homeDir2);
+  const desired = normalizeCredentials(creds);
+  return saveAccountStore(replaceApiKeyLayer(store, desired), homeDir2);
+}
+function projectApiKeys(store) {
+  const out = {};
+  for (const providerId of Object.keys(store.providers)) {
+    const record = getActiveAccount(store, providerId);
+    if (record?.kind === "api_key") out[providerId] = record.secret;
+  }
+  return out;
+}
+function replaceApiKeyLayer(store, desired) {
+  const providers = {};
+  for (const [providerId, entry] of Object.entries(store.providers)) {
+    const kept = {};
+    for (const [accountId, record] of Object.entries(entry.accounts)) {
+      if (record.kind !== "api_key") kept[accountId] = record;
+    }
+    const keptIds = Object.keys(kept);
+    if (keptIds.length === 0) continue;
+    const active = entry.activeAccountId !== void 0 && kept[entry.activeAccountId] !== void 0 ? entry.activeAccountId : keptIds[0];
+    providers[providerId] = { activeAccountId: active, accounts: kept };
+  }
+  for (const [providerId, secret] of Object.entries(desired)) {
+    const existing = providers[providerId];
+    const accounts = existing ? { ...existing.accounts } : {};
+    accounts[DEFAULT_ACCOUNT_ID] = { kind: "api_key", secret };
+    providers[providerId] = { activeAccountId: DEFAULT_ACCOUNT_ID, accounts };
+  }
+  return { version: STORE_VERSION, providers };
+}
+function credentialEnvPatch(creds, env) {
+  const stored = normalizeCredentials(creds);
+  const patch = {};
+  for (const info of PROVIDERS) {
+    const secret = stored[info.id];
+    if (secret === void 0) continue;
+    if (info.envVars.some((name) => hasCredential(env[name]))) continue;
+    const target = info.envVars[0];
+    if (target === void 0) continue;
+    patch[target] = secret;
+  }
+  return patch;
+}
+var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+var TAIL = 4;
+var PREFIX = 6;
+var MIN_LENGTH_FOR_TAIL = 12;
+var MIN_LENGTH_FOR_PREFIX = 20;
+function redactSecret(secret) {
+  const value = typeof secret === "string" ? secret.trim() : "";
+  if (value.length < MIN_LENGTH_FOR_TAIL) return MASK;
+  const tail = value.slice(-TAIL);
+  if (value.length < MIN_LENGTH_FOR_PREFIX) return `${MASK}${tail}`;
+  return `${value.slice(0, PREFIX)}\u2026${tail}`;
+}
+var STORE_VERSION = 2;
+var DEFAULT_ACCOUNT_ID = "default";
+var KNOWN_PROVIDER_IDS = new Set(PROVIDERS.map((provider) => provider.id));
+function emptyStore() {
+  return { version: STORE_VERSION, providers: {} };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeKey(key) {
+  return key.length > 0 && key !== "__proto__" && key !== "constructor" && key !== "prototype";
+}
+function trimmedString(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeTokens(raw) {
+  if (!isPlainObject(raw)) return void 0;
+  const tokens = {};
+  const accessToken = trimmedString(raw.accessToken);
+  const refreshToken = trimmedString(raw.refreshToken);
+  if (accessToken !== void 0) tokens.accessToken = accessToken;
+  if (refreshToken !== void 0) tokens.refreshToken = refreshToken;
+  if (tokens.accessToken === void 0 && tokens.refreshToken === void 0) return void 0;
+  if (typeof raw.expiresAt === "number" && Number.isFinite(raw.expiresAt)) tokens.expiresAt = raw.expiresAt;
+  const tokenType = trimmedString(raw.tokenType);
+  if (tokenType !== void 0) tokens.tokenType = tokenType;
+  const scope = trimmedString(raw.scope);
+  if (scope !== void 0) tokens.scope = scope;
+  return tokens;
+}
+function normalizeIdentity(raw) {
+  if (!isPlainObject(raw)) return void 0;
+  const identity = {};
+  const label = trimmedString(raw.label);
+  const accountId = trimmedString(raw.accountId);
+  const email = trimmedString(raw.email);
+  if (label !== void 0) identity.label = label;
+  if (accountId !== void 0) identity.accountId = accountId;
+  if (email !== void 0) identity.email = email;
+  return Object.keys(identity).length > 0 ? identity : void 0;
+}
+function normalizeRecord(providerId, raw) {
+  if (!isPlainObject(raw)) return void 0;
+  if (raw.kind === "api_key") {
+    if (!providerSupportsMethod(providerId, "api-key")) return void 0;
+    const secret = trimmedString(raw.secret);
+    return secret === void 0 ? void 0 : { kind: "api_key", secret };
+  }
+  if (raw.kind === "oauth") {
+    if (!providerSupportsMethod(providerId, "oauth")) return void 0;
+    const tokens = normalizeTokens(raw.tokens);
+    if (tokens === void 0) return void 0;
+    const identity = normalizeIdentity(raw.identity);
+    return identity === void 0 ? { kind: "oauth", tokens } : { kind: "oauth", tokens, identity };
+  }
+  return void 0;
+}
+function normalizeProviderAccounts(providerId, raw) {
+  if (!isPlainObject(raw)) return void 0;
+  const accountsRaw = isPlainObject(raw.accounts) ? raw.accounts : {};
+  const accounts = {};
+  for (const [accountId, recordRaw] of Object.entries(accountsRaw)) {
+    if (!isSafeKey(accountId)) continue;
+    const record = normalizeRecord(providerId, recordRaw);
+    if (record !== void 0) accounts[accountId] = record;
+  }
+  const ids = Object.keys(accounts);
+  if (ids.length === 0) return void 0;
+  const active = typeof raw.activeAccountId === "string" && accounts[raw.activeAccountId] !== void 0 ? raw.activeAccountId : ids[0];
+  return { activeAccountId: active, accounts };
+}
+function normalizeAccountStore(raw) {
+  if (!isPlainObject(raw)) return emptyStore();
+  const looksV2 = isPlainObject(raw.providers) || raw.version !== void 0;
+  const store = emptyStore();
+  if (looksV2) {
+    const providersRaw = isPlainObject(raw.providers) ? raw.providers : {};
+    for (const [providerId, entry] of Object.entries(providersRaw)) {
+      if (!isSafeKey(providerId) || !KNOWN_PROVIDER_IDS.has(providerId)) continue;
+      const accounts = normalizeProviderAccounts(providerId, entry);
+      if (accounts !== void 0) store.providers[providerId] = accounts;
+    }
+    return store;
+  }
+  for (const [providerId, secret] of Object.entries(normalizeCredentials(raw))) {
+    store.providers[providerId] = {
+      activeAccountId: DEFAULT_ACCOUNT_ID,
+      accounts: { [DEFAULT_ACCOUNT_ID]: { kind: "api_key", secret } }
+    };
+  }
+  return store;
+}
+function loadAccountStore(homeDir2) {
+  try {
+    const text = readFileSync2(credentialsFilePath(homeDir2), "utf8");
+    return normalizeAccountStore(JSON.parse(text));
+  } catch {
+    return emptyStore();
+  }
+}
+function saveAccountStore(store, homeDir2) {
+  try {
+    const path = credentialsFilePath(homeDir2);
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true, mode: DIR_MODE });
+    chmodSync(dir, DIR_MODE);
+    writeFileSync(path, `${JSON.stringify(normalizeAccountStore(store), null, 2)}
+`, {
+      encoding: "utf8",
+      mode: FILE_MODE
+    });
+    chmodSync(path, FILE_MODE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getActiveAccount(store, providerId) {
+  const entry = store.providers[providerId];
+  if (entry === void 0) return void 0;
+  const id = entry.activeAccountId;
+  if (id !== void 0 && entry.accounts[id] !== void 0) return entry.accounts[id];
+  const first = Object.keys(entry.accounts)[0];
+  return first === void 0 ? void 0 : entry.accounts[first];
+}
+function listAccounts(store, providerId) {
+  const entry = store.providers[providerId];
+  if (entry === void 0) return [];
+  return Object.entries(entry.accounts).map(([accountId, record]) => ({
+    accountId,
+    record,
+    active: accountId === entry.activeAccountId
+  }));
+}
+function chooseAccountId(record, requested) {
+  if (requested !== void 0 && isSafeKey(requested)) return requested;
+  if (record.kind === "oauth" && record.identity?.accountId !== void 0 && isSafeKey(record.identity.accountId)) {
+    return record.identity.accountId;
+  }
+  if (record.kind === "api_key") return DEFAULT_ACCOUNT_ID;
+  return `account-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function addAccount(store, providerId, record, options) {
+  if (!KNOWN_PROVIDER_IDS.has(providerId)) {
+    throw new Error(`unknown provider "${providerId}"`);
+  }
+  const method = record.kind === "api_key" ? "api-key" : "oauth";
+  if (!providerSupportsMethod(providerId, method)) {
+    throw new Error(`provider "${providerId}" does not support ${record.kind} accounts`);
+  }
+  const accountId = chooseAccountId(record, options?.accountId);
+  const existing = store.providers[providerId];
+  const accounts = { ...existing?.accounts ?? {} };
+  accounts[accountId] = record;
+  const makeActive = options?.makeActive ?? true;
+  const activeAccountId = makeActive ? accountId : existing?.activeAccountId !== void 0 && accounts[existing.activeAccountId] !== void 0 ? existing.activeAccountId : accountId;
+  return {
+    store: { version: STORE_VERSION, providers: { ...store.providers, [providerId]: { activeAccountId, accounts } } },
+    accountId
+  };
+}
+function setActiveAccount(store, providerId, accountId) {
+  const entry = store.providers[providerId];
+  if (entry === void 0 || entry.accounts[accountId] === void 0) return store;
+  return {
+    version: STORE_VERSION,
+    providers: { ...store.providers, [providerId]: { ...entry, activeAccountId: accountId } }
+  };
+}
+function removeAccount(store, providerId, accountId) {
+  const entry = store.providers[providerId];
+  if (entry === void 0 || entry.accounts[accountId] === void 0) return store;
+  const accounts = { ...entry.accounts };
+  delete accounts[accountId];
+  const providers = { ...store.providers };
+  const remaining = Object.keys(accounts);
+  if (remaining.length === 0) {
+    delete providers[providerId];
+  } else {
+    const activeAccountId = entry.activeAccountId !== void 0 && accounts[entry.activeAccountId] !== void 0 ? entry.activeAccountId : remaining[0];
+    providers[providerId] = { activeAccountId, accounts };
+  }
+  return { version: STORE_VERSION, providers };
+}
+function logoutProvider(store, providerId) {
+  if (store.providers[providerId] === void 0) return store;
+  const providers = { ...store.providers };
+  delete providers[providerId];
+  return { version: STORE_VERSION, providers };
+}
+function accountEnvPatch(store, env) {
+  const normalized = normalizeAccountStore(store);
+  const patch = {};
+  for (const info of PROVIDERS) {
+    const record = getActiveAccount(normalized, info.id);
+    if (record === void 0) continue;
+    if (info.envVars.some((name) => hasCredential(env[name]))) continue;
+    if (record.kind === "api_key") {
+      const target = info.envVars[0];
+      if (target !== void 0) patch[target] = record.secret;
+      continue;
+    }
+    const accessVar = info.envVars[0];
+    if (accessVar !== void 0 && record.tokens.accessToken !== void 0) {
+      patch[accessVar] = record.tokens.accessToken;
+    }
+    if (record.tokens.refreshToken !== void 0) {
+      const refreshVar = info.envVars.find((name) => /REFRESH/i.test(name));
+      if (refreshVar !== void 0) patch[refreshVar] = record.tokens.refreshToken;
+    }
+  }
+  return patch;
+}
+
+// packages/cli/src/web/connection-config.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
+import { randomUUID } from "node:crypto";
+var BASE_URL_VARS = {
+  deepseek: "DEEPSEEK_BASE_URL",
+  anthropic: "ANTHROPIC_BASE_URL",
+  azure: "AZURE_OPENAI_BASE_URL",
+  openai: "OPENAI_BASE_URL",
+  "z-ai": "Z_AI_BASE_URL",
+  kimi: "KIMI_BASE_URL",
+  qwen: "QWEN_BASE_URL",
+  xai: "XAI_BASE_URL",
+  opencode: "OPENCODE_BASE_URL",
+  cline: "CLINE_BASE_URL",
+  copilot: "COPILOT_BASE_URL"
+};
+function validateConnectionConfig(providerId, value) {
+  const result = {};
+  if (value.baseUrl !== void 0) {
+    if (!BASE_URL_VARS[providerId]) throw new Error("This provider does not support a custom API endpoint.");
+    const url = new URL(value.baseUrl);
+    if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+      throw new Error("API endpoint must be credential-free HTTPS, or loopback HTTP, without a query or fragment.");
+    }
+    result.baseUrl = url.href.replace(/\/$/, "");
+  }
+  if (value.model !== void 0) {
+    if (providerId !== "azure") throw new Error("Deployment model configuration is only supported for Azure; select other models through runtime selection.");
+    if (!value.model.trim() || value.model.length > 256 || /[\s\x00-\x1f\x7f]/.test(value.model)) throw new Error("Invalid deployment model.");
+    result.model = value.model;
+  }
+  if (value.projectId !== void 0) {
+    if (providerId !== "google" || !/^[a-z][a-z0-9-]{4,62}[a-z0-9]$/.test(value.projectId)) throw new Error("Invalid Google Cloud project ID.");
+    result.projectId = value.projectId;
+  }
+  return result;
+}
+function loadConnectionConfigs(homeDir2) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(join3(homeStateDir(homeDir2), "web-connections.json"), "utf8"));
+  } catch {
+    return {};
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const result = {};
+  for (const providerId of [...Object.keys(BASE_URL_VARS), "google"]) {
+    const row = raw[providerId];
+    if (!row || typeof row !== "object" || Array.isArray(row)) continue;
+    const config = row;
+    try {
+      result[providerId] = validateConnectionConfig(providerId, {
+        ...typeof config.baseUrl === "string" ? { baseUrl: config.baseUrl } : {},
+        ...typeof config.model === "string" ? { model: config.model } : {},
+        ...typeof config.projectId === "string" ? { projectId: config.projectId } : {}
+      });
+    } catch {
+    }
+  }
+  return result;
+}
+function saveConnectionConfig(providerId, config, homeDir2) {
+  const value = validateConnectionConfig(providerId, config);
+  const next = { ...loadConnectionConfigs(homeDir2), [providerId]: value };
+  const path = join3(homeStateDir(homeDir2), "web-connections.json");
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  chmodSync2(dirname2(path), 448);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync2(temporary, JSON.stringify(next) + "\n", { mode: 384, flag: "wx" });
+    renameSync(temporary, path);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}
+function connectionConfigEnvPatch(env, homeDir2) {
+  const patch = {};
+  for (const [id, config] of Object.entries(loadConnectionConfigs(homeDir2))) {
+    const variable = BASE_URL_VARS[id];
+    if (variable && config.baseUrl && !env[variable]) patch[variable] = config.baseUrl;
+    if (id === "azure" && config.model && !env.AZURE_OPENAI_MODEL) patch.AZURE_OPENAI_MODEL = config.model;
+    if (id === "google" && config.projectId && !env.GOOGLE_CLOUD_PROJECT && !env.ZERO_GEMINI_PROJECT) patch.ZERO_GEMINI_PROJECT = config.projectId;
+  }
+  return patch;
+}
+
+export {
+  getSettings,
+  getSettingSources,
+  getAnalyticsSetupDraft,
+  defaultWriteLayer,
+  updateSetting,
+  resetSettings,
+  previewSetting,
+  subscribeSettings,
+  reloadSettings,
+  configureSettingsStore,
+  useSettings,
+  maybeLoadCodexAuth,
+  loadCredentials,
+  saveCredentials,
+  credentialEnvPatch,
+  redactSecret,
+  loadAccountStore,
+  saveAccountStore,
+  listAccounts,
+  addAccount,
+  setActiveAccount,
+  removeAccount,
+  logoutProvider,
+  accountEnvPatch,
+  validateConnectionConfig,
+  loadConnectionConfigs,
+  saveConnectionConfig,
+  connectionConfigEnvPatch,
+  resolveEngagement
+};