0sec-cli 0.24.0 → 0.25.0

package/chunks/chunk-EQBC2ZWL.js

@@ -0,0 +1,2481 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  getRuntimeAvailability
+} from "./chunk-ITHDAIRY.js";
+import {
+  ServicePluginServices,
+  consoleExecutionProfile
+} from "./chunk-7TIWL6E5.js";
+import {
+  accountEnvPatch,
+  addAccount,
+  connectionConfigEnvPatch,
+  credentialEnvPatch,
+  defaultWriteLayer,
+  getSettingSources,
+  getSettings,
+  listAccounts,
+  loadAccountStore,
+  loadConnectionConfigs,
+  loadCredentials,
+  logoutProvider,
+  maybeLoadCodexAuth,
+  removeAccount,
+  resetSettings,
+  saveAccountStore,
+  saveConnectionConfig,
+  setActiveAccount,
+  updateSetting,
+  validateConnectionConfig
+} from "./chunk-RBTJYREN.js";
+import {
+  DEFAULT_SETTINGS,
+  PROVIDERS,
+  SETTING_DEFS,
+  allThemeNames,
+  appendFeedback,
+  buildSubmitPreview,
+  getThemeEntry,
+  installedThemeEntries,
+  isKnownTheme,
+  isOperatorSetting,
+  isSafeThemeId,
+  providerStates,
+  reloadInstalledThemes,
+  submitFeedback,
+  syncThemeChoices,
+  validateTheme,
+  writeInstalledTheme
+} from "./chunk-6TA3CWND.js";
+import {
+  DEFAULT_REGISTRY_URL,
+  createConsoleRuntime,
+  listProjectReviewChecks,
+  updateProjectReviewChecks
+} from "./chunk-EEP6GBUO.js";
+import {
+  getRuntimeMetadata
+} from "./chunk-D4IBEO2K.js";
+import {
+  TOOL_DEFINITIONS,
+  getToolsForRole
+} from "./chunk-HFUOUT2B.js";
+import {
+  CodexCatalogRefreshError
+} from "./chunk-GXSECFUE.js";
+import {
+  LlmApiRuntime
+} from "./chunk-EIONVEFN.js";
+import {
+  aggregateCapabilities,
+  disable,
+  isSafePluginId,
+  listInstalledPluginIds,
+  pluginsRootDir,
+  readEnablement,
+  readInstalledPlugin,
+  writeEnablement
+} from "./chunk-27SXCYWH.js";
+import {
+  MODEL_PRICING,
+  VERSION,
+  getRates,
+  homeStateDir,
+  modelProvider,
+  registerModelPricing
+} from "./chunk-S3B6HFSM.js";
+
+// packages/cli/src/web/operator-services.ts
+import { execFileSync } from "node:child_process";
+import { realpathSync, statSync } from "node:fs";
+import { basename, resolve } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// packages/cli/src/tui/model-preference.ts
+async function createPreferredConsoleRuntime(config, options = {}) {
+  const env = config.env ?? process.env;
+  const envModel = env["ZERO_MODEL"]?.trim();
+  const envProvider = env["ZERO_SELECTED_PROVIDER"]?.trim() || env["ZERO_PROVIDER"]?.trim() || env["ZERO_FORCE_PROVIDER"]?.trim();
+  const inherited = options.inheritedConnectionIdentity !== void 0;
+  const explicitChoice = !inherited && config.model !== void 0 || Boolean(envModel);
+  if (inherited && (envModel || envProvider)) config = { ...config, model: void 0, provider: void 0 };
+  if (config.provider === void 0 && envProvider) config = { ...config, provider: envProvider };
+  let runtime;
+  let retainedModel = false;
+  if (inherited && !envModel && !envProvider) {
+    runtime = createConsoleRuntime({ ...config, model: void 0 });
+    if (runtime.connectionIdentity() === options.inheritedConnectionIdentity) {
+      runtime.reconfigure({ model: config.model });
+      retainedModel = config.model !== void 0;
+    }
+  }
+  if (!explicitChoice && !retainedModel) {
+    const saved = getSettings().modelPreference;
+    if (saved && (config.provider === void 0 || config.provider === saved.providerId)) {
+      try {
+        const candidate = createConsoleRuntime({ ...config, model: saved.model, provider: saved.providerId });
+        if (candidate.connectionIdentity() === saved.connectionIdentity) {
+          runtime = candidate;
+          retainedModel = true;
+        }
+      } catch {
+      }
+    }
+  }
+  runtime ??= createConsoleRuntime(config);
+  if (!explicitChoice && runtime.getConfigurationDiagnostics().provider === "chatgpt-codex") {
+    let catalog;
+    try {
+      catalog = await runtime.codexModelCatalog(AbortSignal.timeout(1e4));
+    } catch (error) {
+      options.onDiscoveryError?.(error);
+      if (error instanceof CodexCatalogRefreshError) catalog = error.cachedModels;
+      else if (!retainedModel) throw error;
+    }
+    if (catalog) {
+      if (!catalog.length) throw new Error("This ChatGPT subscription returned no available models.");
+      const currentModel = runtime.resolvedModel();
+      if (!retainedModel || !catalog.some((model) => model.id === currentModel)) {
+        runtime.reconfigure({ model: catalog[0].id });
+      }
+    }
+  }
+  return { runtime, explicitChoice };
+}
+function saveAppliedModelPreference(runtime) {
+  const connectionIdentity = runtime.connectionIdentity();
+  if (!connectionIdentity) return false;
+  const preference = {
+    providerId: runtime.getConfigurationDiagnostics().provider,
+    model: runtime.resolvedModel(),
+    connectionIdentity
+  };
+  return updateSetting("modelPreference", preference, { scope: "global" });
+}
+
+// packages/cli/src/tui/model-catalog-sync.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+// packages/cli/src/tui/model-catalog.offline.ts
+var OFFLINE_MODEL_CATALOG = [
+  // Anthropic
+  { id: "claude-fable-5-1", provider: "anthropic", contextTokens: 1e6, input: 10, output: 50 },
+  { id: "claude-opus-5", provider: "anthropic", contextTokens: 1e6, input: 5, output: 25 },
+  { id: "claude-sonnet-5", provider: "anthropic", contextTokens: 1e6, input: 2, output: 10 },
+  { id: "claude-opus-4-7", provider: "anthropic", contextTokens: 2e5, input: 5, output: 25 },
+  { id: "claude-sonnet-4-6", provider: "anthropic", contextTokens: 1e6, input: 3, output: 15 },
+  { id: "claude-haiku-4-5", provider: "anthropic", contextTokens: 2e5, input: 0.8, output: 4 },
+  // OpenAI
+  // Astra standard short-context rates; >272K input has a separate price tier.
+  { id: "gpt-6-astra", provider: "openai", contextTokens: 105e4, input: 10, output: 50 },
+  { id: "gpt-6.1-sol", provider: "openai", contextTokens: 105e4, input: 2, output: 10 },
+  { id: "gpt-6-sol", provider: "openai", contextTokens: 105e4, input: 2, output: 10 },
+  { id: "gpt-6-luna", provider: "openai", contextTokens: 105e4, input: 0.1, output: 0.5 },
+  { id: "gpt-5.5", provider: "openai", contextTokens: 4e5, input: 5, output: 30 },
+  { id: "gpt-5.6-sol", provider: "openai", contextTokens: 105e4 },
+  { id: "gpt-5.6-terra", provider: "openai", contextTokens: 105e4 },
+  { id: "gpt-5.6-luna", provider: "openai", contextTokens: 105e4 },
+  // Google
+  { id: "gemini-3.8-flash", provider: "google", contextTokens: 1048576, input: 0.75, output: 3.75 },
+  { id: "gemini-3.5-flash-lite", provider: "google", contextTokens: 1048576, input: 0.3, output: 2.5 },
+  { id: "gemini-3.1-pro-preview", provider: "google", contextTokens: 1048576, input: 2, output: 12 },
+  // DeepSeek
+  { id: "deepseek-flash", provider: "deepseek", contextTokens: 1e6, input: 0.3, output: 1.2 },
+  // Meta (hosted)
+  { id: "llama-4-maverick", provider: "meta", contextTokens: 1e6, input: 0.5, output: 0.77 },
+  { id: "llama-4-scout", provider: "meta", contextTokens: 1e7, input: 0.2, output: 0.35 },
+  // Mistral
+  { id: "mistral-large", provider: "mistral", contextTokens: 128e3, input: 2, output: 6 },
+  // Alibaba Qwen
+  { id: "qwen3.8-max", provider: "qwen", contextTokens: 1e6, input: 2, output: 6 },
+  { id: "qwen3.8-flash", provider: "qwen", contextTokens: 1e6, input: 0.15, output: 0.47 },
+  { id: "qwen3.8-max-preview", provider: "qwen", contextTokens: 1e6 },
+  { id: "qwen3.7-max", provider: "qwen", contextTokens: 1e6, input: 2.5, output: 7.5 },
+  { id: "qwen3.7-plus", provider: "qwen", contextTokens: 1e6, input: 0.5, output: 3 },
+  { id: "qwen3.6-plus", provider: "qwen", contextTokens: 1e6, input: 0.5, output: 3 },
+  { id: "qwen3.6-flash", provider: "qwen", contextTokens: 1e6, input: 0.1875, output: 1.125 },
+  // xAI
+  { id: "grok-4.6", provider: "xai", contextTokens: 5e5, input: 2, output: 6 },
+  // Moonshot
+  { id: "k3", provider: "moonshot", contextTokens: 1048576, input: 3, output: 15 },
+  // Z.AI
+  { id: "glm-5.3", provider: "z-ai", contextTokens: 1e6, input: 1.4, output: 4.4 },
+  { id: "glm-5.3-flash", provider: "z-ai", contextTokens: 1e6, input: 0.15, output: 0.5 }
+];
+
+// packages/cli/src/tui/model-catalog-sync.ts
+var MODELS_DEV_URL = "https://models.dev/api.json";
+var CATALOG_CACHE_FILENAME = "model-catalog.json";
+var CATALOG_TTL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 8e3;
+var CATALOG_PROVIDER_IDS = {
+  "alibaba-token-plan": "qwen",
+  "kimi-code-plan-cn": "kimi",
+  "github-copilot": "copilot",
+  zai: "z-ai",
+  "cline-pass": "cline"
+};
+var METERED_CATALOG_PROVIDERS = {
+  anthropic: true,
+  openai: true,
+  deepseek: true,
+  openrouter: true,
+  xai: true,
+  opencode: true,
+  cline: true
+};
+function catalogId(value) {
+  return typeof value === "string" && value.length > 0 && !/[\s\x00-\x1f\x7f-\x9f]/.test(value);
+}
+function finiteRate(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function contextTokens(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function normalizedModel(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const row = value;
+  if (!catalogId(row.id) || !catalogId(row.provider) || row.provider === "chatgpt-codex") return null;
+  const provider2 = Object.hasOwn(CATALOG_PROVIDER_IDS, row.provider) ? CATALOG_PROVIDER_IDS[row.provider] ?? row.provider : row.provider;
+  const model = {
+    id: row.provider === "cline-pass" && !row.id.startsWith("cline-pass/") ? `cline-pass/${row.id}` : row.id,
+    provider: provider2,
+    ...finiteRate(row.input) ? { input: row.input } : {},
+    ...finiteRate(row.output) ? { output: row.output } : {},
+    ...finiteRate(row.cachedInput) ? { cachedInput: row.cachedInput } : {},
+    ...contextTokens(row.contextTokens) ? { contextTokens: row.contextTokens } : {}
+  };
+  if (!(provider2 === "cline" && model.id.startsWith("cline-pass/")) && Object.hasOwn(METERED_CATALOG_PROVIDERS, provider2) && model.input !== void 0 && model.output !== void 0) {
+    const rates = { input: model.input, output: model.output, cachedInput: model.cachedInput };
+    registerModelPricing(`${provider2}/${model.id}`, rates);
+    if (provider2 === modelProvider(model.id)) registerModelPricing(model.id, rates);
+  }
+  return model;
+}
+function catalogCachePath(opts = {}) {
+  return opts.cachePath ?? join(homeStateDir(), CATALOG_CACHE_FILENAME);
+}
+function normalizeModelsDev(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return [];
+  const out = [];
+  for (const [providerId, providerVal] of Object.entries(raw)) {
+    if (!catalogId(providerId) || typeof providerVal !== "object" || providerVal === null || Array.isArray(providerVal)) continue;
+    const models = providerVal["models"];
+    if (typeof models !== "object" || models === null || Array.isArray(models)) continue;
+    for (const [modelId, modelVal] of Object.entries(models)) {
+      if (!catalogId(modelId) || typeof modelVal !== "object" || modelVal === null || Array.isArray(modelVal)) continue;
+      const m = modelVal;
+      const cost = typeof m["cost"] === "object" && m["cost"] !== null ? m["cost"] : {};
+      const limit = typeof m["limit"] === "object" && m["limit"] !== null ? m["limit"] : {};
+      const entry = normalizedModel({
+        id: modelId,
+        provider: providerId,
+        input: cost["input"],
+        output: cost["output"],
+        cachedInput: cost["cache_read"],
+        contextTokens: limit["context"]
+      });
+      if (entry) out.push(entry);
+    }
+  }
+  return out;
+}
+function readCache(path) {
+  try {
+    if (!existsSync(path)) return null;
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || !Array.isArray(parsed.models) || !Number.isFinite(parsed.fetchedAt) || parsed.fetchedAt < 0 || typeof parsed.source !== "string") {
+      return null;
+    }
+    const cache = parsed;
+    const models = cache.models.flatMap((row) => {
+      const model = normalizedModel(row);
+      return model ? [model] : [];
+    });
+    return { fetchedAt: cache.fetchedAt, source: cache.source, models };
+  } catch {
+    return null;
+  }
+}
+function writeCache(path, cache) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(cache, null, 2), { mode: 384 });
+  } catch {
+  }
+}
+function isCacheFresh(cache, opts = {}) {
+  if (!cache) return false;
+  const now = (opts.now ?? Date.now)();
+  const ttl = opts.ttlMs ?? CATALOG_TTL_MS;
+  const age = now - cache.fetchedAt;
+  return Number.isFinite(age) && age >= 0 && age < ttl;
+}
+function loadCatalogModels(opts = {}) {
+  const cache = readCache(catalogCachePath(opts));
+  if (cache && cache.models.length > 0) return cache;
+  return { fetchedAt: 0, source: "offline", models: OFFLINE_MODEL_CATALOG };
+}
+async function syncModelCatalog(opts = {}) {
+  const path = catalogCachePath(opts);
+  const existing = readCache(path);
+  if (!opts.force && isCacheFresh(existing, opts) && (existing?.models.length ?? 0) > 0) {
+    return existing;
+  }
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") return null;
+  const url = opts.url ?? MODELS_DEV_URL;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(url, { signal: controller.signal });
+    if (!res.ok) return null;
+    const json = await res.json();
+    const models = normalizeModelsDev(json);
+    if (models.length === 0) return null;
+    const cache = {
+      fetchedAt: (opts.now ?? Date.now)(),
+      source: url,
+      models
+    };
+    writeCache(path, cache);
+    return cache;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// packages/cli/src/tui/model-catalog.ts
+var NON_MODEL_PRICING_KEYS = /* @__PURE__ */ new Set(["default"]);
+function compareStrings(a, b) {
+  if (a === b) return 0;
+  return a < b ? -1 : 1;
+}
+function formatRate(value) {
+  return String(Number(value.toFixed(4)));
+}
+function formatModelPrice(input, output) {
+  if (input === 0 && output === 0) return "free";
+  return `$${formatRate(input)}/${formatRate(output)} per M`;
+}
+function buildModelCatalog(currentModel) {
+  const models = Object.keys(MODEL_PRICING).filter((id) => !NON_MODEL_PRICING_KEYS.has(id)).map((id) => {
+    const provider2 = modelProvider(id);
+    const rates = getRates(Object.hasOwn(METERED_CATALOG_PROVIDERS, provider2) ? `${provider2}/${id}` : id);
+    return { id, provider: provider2, price: provider2 === "cline" && id.startsWith("cline-pass/") ? "ClinePass plan (access unverified)" : formatModelPrice(rates.input, rates.output) };
+  });
+  return models.sort((a, b) => {
+    if (a.id === currentModel) return b.id === currentModel ? 0 : -1;
+    if (b.id === currentModel) return 1;
+    return compareStrings(a.provider, b.provider) || compareStrings(a.id, b.id);
+  });
+}
+var PLAN_PROVIDERS = {
+  kimi: true,
+  qwen: true,
+  "z-ai": true,
+  copilot: true,
+  google: true
+};
+function compareCatalogRows(currentModel) {
+  return (a, b) => {
+    if (a.id === currentModel) return b.id === currentModel ? 0 : -1;
+    if (b.id === currentModel) return 1;
+    return compareStrings(a.provider, b.provider) || compareStrings(a.id, b.id);
+  };
+}
+function catalogExtras(opts = {}) {
+  const priced = new Set(Object.keys(MODEL_PRICING).map((k) => k.toLowerCase()));
+  const out = [];
+  for (const m of loadCatalogModels(opts).models) {
+    if (priced.has(m.id.toLowerCase()) && m.provider === modelProvider(m.id)) continue;
+    const plan = Object.hasOwn(PLAN_PROVIDERS, m.provider) || m.provider === "cline" && m.id.startsWith("cline-pass/");
+    let price = m.provider === "cline" && plan ? "ClinePass plan (access unverified)" : plan ? "subscription" : "\u2014";
+    if (!plan && m.input !== void 0 && m.output !== void 0) {
+      const rates = Object.hasOwn(METERED_CATALOG_PROVIDERS, m.provider) ? getRates(`${m.provider}/${m.id}`) : { input: m.input, output: m.output };
+      price = formatModelPrice(rates.input, rates.output);
+    }
+    out.push({ id: m.id, provider: m.provider, price });
+  }
+  return out;
+}
+function buildFullModelCatalog(currentModel, opts = {}) {
+  const extras = catalogExtras(opts);
+  const priced = buildModelCatalog(currentModel);
+  const models = [...priced, ...extras];
+  if (currentModel && !models.some((model) => model.id === currentModel)) {
+    models.push({ id: currentModel, provider: modelProvider(currentModel), price: "\u2014" });
+  }
+  return models.sort(compareCatalogRows(currentModel));
+}
+
+// packages/cli/src/tui/available-models.ts
+async function discoverConnectionModels(env, providerIds, signal) {
+  const results = await Promise.all(providerIds.map(async (providerId) => {
+    try {
+      const runtime = new LlmApiRuntime({
+        type: "api",
+        timeout: 1e4,
+        provider: providerId,
+        model: "probe",
+        env: { ...env, ZERO_SKIP_PROVIDER_BANNER: "1" }
+      });
+      const models = await runtime.availableModelCatalog(signal ?? AbortSignal.timeout(1e4));
+      return { models: models.map((model) => ({ ...model, provider: providerId })), diagnostics: [] };
+    } catch (error) {
+      let message = error instanceof Error ? error.message : "Model discovery failed.";
+      for (const [name, value] of Object.entries(env)) {
+        if (value && /KEY|TOKEN|SECRET|PASSWORD/i.test(name)) message = message.split(value).join("[redacted]");
+      }
+      return { models: [], diagnostics: [{ providerId, message: message.slice(0, 1e3) }] };
+    }
+  }));
+  return { models: results.flatMap((result) => result.models), diagnostics: results.flatMap((result) => result.diagnostics) };
+}
+
+// packages/cli/src/tui/context-window.ts
+var KNOWN_FAMILY_WINDOWS = [
+  ["gpt-5", 272e3],
+  ["gpt-4.1", 1047576],
+  ["gpt-4o", 128e3],
+  ["o3", 2e5],
+  ["o4", 2e5],
+  ["claude", 2e5],
+  ["glm-5", 2e5],
+  ["glm-4", 128e3],
+  ["gemini-2.5", 1048576],
+  ["gemini-2", 1e6],
+  ["deepseek", 128e3],
+  ["qwen", 128e3]
+];
+function knownFamilyWindow(modelId) {
+  const id = modelId.toLowerCase();
+  let best = null;
+  let bestLen = -1;
+  for (const [prefix, tokens] of KNOWN_FAMILY_WINDOWS) {
+    if (id.startsWith(prefix) && prefix.length > bestLen) {
+      best = tokens;
+      bestLen = prefix.length;
+    }
+  }
+  return best;
+}
+function positiveTokens(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+function sameByokModel(row, identity) {
+  return row.id === identity.modelId && row.provider === identity.providerId;
+}
+function resolveContextLimit(identity, opts = {}) {
+  if (!identity.modelId || !identity.providerId) return null;
+  const familyFallback = () => {
+    const family = knownFamilyWindow(identity.modelId);
+    return family === null ? null : { tokens: family, source: "known-family" };
+  };
+  const load = opts.loadModels ?? loadCatalogModels;
+  const cache = load(opts.sync ?? {});
+  const row = cache.models.find((model) => sameByokModel(model, identity));
+  const tokens = row ? positiveTokens(row.contextTokens) : null;
+  if (tokens !== null) {
+    return { tokens, source: cache.source === "offline" ? "offline-catalog" : "synced-catalog" };
+  }
+  return familyFallback();
+}
+
+// packages/cli/src/tui/device-auth.ts
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { createServer } from "node:http";
+import { arch, hostname, platform as platform2, release, version as osVersion } from "node:os";
+import { join as join2 } from "node:path";
+
+// packages/cli/src/open-browser.ts
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+function defaultOpenBrowser(url) {
+  const plat = platform();
+  return new Promise((resolve2, reject) => {
+    const options = { detached: true, stdio: "ignore", shell: false };
+    const child = plat === "darwin" ? spawn("open", [url], options) : plat === "win32" ? spawn("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      "Start-Process -FilePath $env:OSEC_BROWSER_LOGIN_URL"
+    ], { ...options, env: { ...process.env, OSEC_BROWSER_LOGIN_URL: url } }) : spawn("xdg-open", [url], options);
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve2();
+    });
+  });
+}
+
+// packages/cli/src/tui/text.ts
+var DEFAULT_ENCODED_RUN_MAX = 140;
+var ENCODED_RUN_MAX_CAP = 1e6;
+var ENCODED_PLACEHOLDER = "[encoded payload omitted]";
+var DEFAULT_ENCODED_SEGMENT = new RegExp(`[A-Za-z0-9+_-]{${DEFAULT_ENCODED_RUN_MAX},}={0,2}`, "g");
+var DEFAULT_ENCODED_DATA_URI = new RegExp(`(data:[^\\s,]*;base64,)[A-Za-z0-9+/_-]{${DEFAULT_ENCODED_RUN_MAX},}={0,2}`, "gi");
+function stripTerminalControl(text2) {
+  return text2.replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, "").replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\x00-\x08\x0b-\x1f\x7f]/g, "");
+}
+function replaceLargeEncodedChunks(text2, maxEncodedRun) {
+  const normalized = Number.isFinite(maxEncodedRun) ? Math.trunc(maxEncodedRun) : DEFAULT_ENCODED_RUN_MAX;
+  const minRun = Math.min(Math.max(32, normalized), ENCODED_RUN_MAX_CAP);
+  if (text2.length < minRun) return text2;
+  const segment = minRun === DEFAULT_ENCODED_RUN_MAX ? DEFAULT_ENCODED_SEGMENT : new RegExp(`[A-Za-z0-9+_-]{${minRun},}={0,2}`, "g");
+  const dataUri = minRun === DEFAULT_ENCODED_RUN_MAX ? DEFAULT_ENCODED_DATA_URI : new RegExp(`(data:[^\\s,]*;base64,)[A-Za-z0-9+/_-]{${minRun},}={0,2}`, "gi");
+  return text2.replace(dataUri, `$1${ENCODED_PLACEHOLDER}`).replace(segment, ENCODED_PLACEHOLDER);
+}
+function sanitizeTuiText(value, options = {}) {
+  return stripTerminalControl(replaceLargeEncodedChunks(String(value ?? ""), options.maxEncodedRun ?? DEFAULT_ENCODED_RUN_MAX)).replace(/\s+/g, " ").trim();
+}
+function sanitizeComposerText(value) {
+  return stripTerminalControl(String(value ?? ""));
+}
+
+// packages/cli/src/tui/device-auth.ts
+var MAX_VISIBLE_LINES = 8;
+var DEFAULT_INTERVAL_SECONDS = 5;
+var SLOW_DOWN_INCREMENT_SECONDS = 5;
+var DEFAULT_EXPIRES_IN_SECONDS = 900;
+var defaultFetch = (url, init) => globalThis.fetch(url, init);
+var defaultSleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var PKCE_TIMEOUT_SECONDS = 300;
+var base64url = (buffer) => buffer.toString("base64url");
+var defaultCreatePkcePair = () => {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+};
+var defaultServerFactory = async ({ onRedirect }) => {
+  let delivered = false;
+  const server = createServer((req, res) => {
+    const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (requestUrl.pathname !== "/callback") {
+      res.statusCode = 404;
+      res.end("Not found");
+      return;
+    }
+    const code = requestUrl.searchParams.get("code") ?? void 0;
+    const error = requestUrl.searchParams.get("error") ?? void 0;
+    res.statusCode = 200;
+    res.setHeader("Content-Type", "text/html; charset=utf-8");
+    res.end("<!doctype html><meta charset=utf-8><title>0</title><body>Sign-in complete \u2014 you can close this tab and return to 0.</body>");
+    if (delivered) return;
+    delivered = true;
+    onRedirect({ code, error });
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve2());
+  });
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : 0;
+  return { port, close: () => server.close() };
+};
+function providerLabel(providerId) {
+  return PROVIDERS.find((provider2) => provider2.id === providerId)?.label ?? providerId;
+}
+function positiveInt(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.trunc(value) : fallback;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function startDeviceAuth(config, options) {
+  const env = options.env ?? process.env;
+  const doFetch = options.fetch ?? defaultFetch;
+  const now = options.now ?? Date.now;
+  const sleep = options.sleep ?? defaultSleep;
+  const openBrowser = options.openBrowser ?? defaultOpenBrowser;
+  const label = providerLabel(config.providerId);
+  const lines = [];
+  let settled = false;
+  let cancelled = false;
+  const pushLine = (text2) => {
+    const value = sanitizeTuiText(text2);
+    if (value.length === 0) return;
+    lines.push(value);
+    if (lines.length > MAX_VISIBLE_LINES) lines.shift();
+  };
+  const publish = (phase, message) => {
+    options.onUpdate({ phase, lines: [...lines], message });
+  };
+  const finish = (phase, message) => {
+    if (settled) return;
+    settled = true;
+    publish(phase, message);
+  };
+  const requestDeviceCode = async (cfg) => {
+    const params = new URLSearchParams({ client_id: cfg.clientId });
+    if (cfg.scopes.length > 0) params.set("scope", cfg.scopes.join(" "));
+    const response = await doFetch(cfg.deviceCodeUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        ...cfg.buildHeaders?.(options.homeDir)
+      },
+      body: params.toString()
+    });
+    if (!response.ok) {
+      throw new Error(`Device code request failed (HTTP ${response.status}).`);
+    }
+    const parsed = await response.json();
+    if (!isPlainObject(parsed) || typeof parsed.device_code !== "string" || typeof parsed.user_code !== "string") {
+      throw new Error("Device code response was missing a device_code or user_code.");
+    }
+    const verificationUri = typeof parsed.verification_uri === "string" ? parsed.verification_uri : typeof parsed.verification_uri_complete === "string" ? parsed.verification_uri_complete : void 0;
+    if (verificationUri === void 0) {
+      throw new Error("Device code response was missing a verification URL.");
+    }
+    return {
+      device_code: parsed.device_code,
+      user_code: parsed.user_code,
+      verification_uri: verificationUri,
+      verification_uri_complete: typeof parsed.verification_uri_complete === "string" ? parsed.verification_uri_complete : void 0,
+      interval: positiveInt(parsed.interval, DEFAULT_INTERVAL_SECONDS),
+      expires_in: positiveInt(parsed.expires_in, DEFAULT_EXPIRES_IN_SECONDS)
+    };
+  };
+  const pollTokenOnce = async (cfg, deviceCode) => {
+    const body = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: deviceCode,
+      client_id: cfg.clientId
+    }).toString();
+    let response;
+    try {
+      response = await doFetch(cfg.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+          ...cfg.buildHeaders?.(options.homeDir)
+        },
+        body
+      });
+    } catch (error) {
+      return { kind: "failed", message: error instanceof Error ? error.message : String(error) };
+    }
+    let parsed;
+    try {
+      parsed = await response.json();
+    } catch {
+      return { kind: "failed", message: `Token response was not valid JSON (HTTP ${response.status}).` };
+    }
+    if (response.ok && isPlainObject(parsed) && typeof parsed.access_token === "string") {
+      return { kind: "token", response: parsed };
+    }
+    const oauthError = isPlainObject(parsed) && typeof parsed.error === "string" ? parsed.error : void 0;
+    switch (oauthError) {
+      case "authorization_pending":
+        return { kind: "pending" };
+      case "slow_down":
+        return { kind: "slow_down" };
+      case "expired_token":
+        return { kind: "failed", message: `${label} device sign-in code expired. Start again.` };
+      case "access_denied":
+        return { kind: "failed", message: `${label} device sign-in was denied.` };
+      default:
+        return {
+          kind: "failed",
+          message: oauthError ? `${label} device sign-in failed: ${oauthError}.` : `${label} device sign-in failed (HTTP ${response.status}).`
+        };
+    }
+  };
+  const persist = (record, connectedMessage) => {
+    const { store } = addAccount(loadAccountStore(options.homeDir), config.providerId, record);
+    if (!saveAccountStore(store, options.homeDir)) {
+      finish("failed", "Sign-in completed, but the private credential account store could not be saved. Try again after restoring access to the local state directory.");
+      return;
+    }
+    const patch = accountEnvPatch(store, env);
+    for (const [key, value] of Object.entries(patch)) env[key] = value;
+    finish("connected", connectedMessage);
+    options.onConnected();
+  };
+  const runDeviceCode = async (cfg) => {
+    publish("running", `Starting ${label} device sign-in\u2026`);
+    let device;
+    try {
+      device = await requestDeviceCode(cfg);
+    } catch (error) {
+      finish("failed", error instanceof Error ? error.message : String(error));
+      return;
+    }
+    if (cancelled) {
+      finish("cancelled", `${label} device sign-in cancelled.`);
+      return;
+    }
+    const openUrl = device.verification_uri_complete ?? device.verification_uri;
+    pushLine(`Enter code: ${device.user_code}`);
+    pushLine(`Visit: ${device.verification_uri}`);
+    publish("running", `Complete the ${label} device sign-in in your browser.`);
+    try {
+      await openBrowser(openUrl);
+    } catch {
+      pushLine("Could not open a browser automatically; open the URL above.");
+      publish("running", `Complete the ${label} device sign-in in your browser.`);
+    }
+    let intervalSeconds = device.interval ?? DEFAULT_INTERVAL_SECONDS;
+    const deadline = now() + (device.expires_in ?? DEFAULT_EXPIRES_IN_SECONDS) * 1e3;
+    while (!cancelled) {
+      await sleep(intervalSeconds * 1e3);
+      if (cancelled) break;
+      if (now() >= deadline) {
+        finish("failed", `${label} device sign-in timed out. Start again.`);
+        return;
+      }
+      const result = await pollTokenOnce(cfg, device.device_code);
+      if (cancelled) break;
+      if (result.kind === "token") {
+        persist(cfg.toAccountRecord(result.response), `${label} connected through device sign-in.`);
+        return;
+      }
+      if (result.kind === "failed") {
+        finish("failed", result.message);
+        return;
+      }
+      if (result.kind === "slow_down") {
+        intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;
+      }
+    }
+    finish("cancelled", `${label} device sign-in cancelled.`);
+  };
+  const exchangeCode = async (cfg, code, verifier, redirectUri) => {
+    const useForm = cfg.exchangeBodyMode === "form";
+    const headers = useForm ? { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" } : { "Content-Type": "application/json", Accept: "application/json" };
+    const body = useForm ? new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      code_verifier: verifier,
+      redirect_uri: redirectUri,
+      ...cfg.clientId !== void 0 ? { client_id: cfg.clientId } : {},
+      ...cfg.clientSecret !== void 0 ? { client_secret: cfg.clientSecret } : {}
+    }).toString() : JSON.stringify({ code, code_verifier: verifier, code_challenge_method: "S256" });
+    let response;
+    try {
+      response = await doFetch(cfg.keysUrl, {
+        method: "POST",
+        headers,
+        body
+      });
+    } catch (error) {
+      return { kind: "failed", message: error instanceof Error ? error.message : String(error) };
+    }
+    let parsed;
+    try {
+      parsed = await response.json();
+    } catch {
+      return { kind: "failed", message: `${label} sign-in exchange was not valid JSON (HTTP ${response.status}).` };
+    }
+    if (!response.ok) {
+      const oauthError = isPlainObject(parsed) && typeof parsed.error === "string" ? parsed.error : void 0;
+      return {
+        kind: "failed",
+        message: oauthError ? `${label} browser sign-in failed: ${oauthError}.` : `${label} browser sign-in failed (HTTP ${response.status}).`
+      };
+    }
+    if (!isPlainObject(parsed)) {
+      return { kind: "failed", message: `${label} sign-in exchange returned an unexpected body.` };
+    }
+    return { kind: "ok", response: parsed };
+  };
+  const runPkceLoopback = async (cfg) => {
+    publish("running", `Starting ${label} browser sign-in\u2026`);
+    const { verifier, challenge } = (options.createPkcePair ?? defaultCreatePkcePair)();
+    const serverFactory = options.serverFactory ?? defaultServerFactory;
+    let resolveOutcome = () => {
+    };
+    const outcomePromise = new Promise((resolve2) => {
+      resolveOutcome = resolve2;
+    });
+    let server;
+    try {
+      server = await serverFactory({
+        onRedirect: (redirect) => resolveOutcome({ type: "redirect", redirect })
+      });
+    } catch (error2) {
+      finish("failed", `${label} browser sign-in could not start a local server: ${error2 instanceof Error ? error2.message : String(error2)}.`);
+      return;
+    }
+    cancelWaiter = () => resolveOutcome({ type: "cancelled" });
+    if (cancelled) {
+      server.close();
+      finish("cancelled", `${label} browser sign-in cancelled.`);
+      return;
+    }
+    const redirectUri = `http://localhost:${server.port}/callback`;
+    const state = base64url(randomBytes(16)).replace(/[^a-zA-Z0-9]/g, "").slice(0, 32);
+    const authorizeUrl = new URL(cfg.authorizeUrl);
+    authorizeUrl.searchParams.set(cfg.redirectParam ?? "redirect_uri", redirectUri);
+    authorizeUrl.searchParams.set("code_challenge", challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    if (cfg.clientId !== void 0) authorizeUrl.searchParams.set("client_id", cfg.clientId);
+    if (cfg.scopes.length > 0) authorizeUrl.searchParams.set("scope", cfg.scopes.join(" "));
+    for (const [key, value] of Object.entries(cfg.authorizeParams ?? {})) {
+      authorizeUrl.searchParams.set(key, value);
+    }
+    if (cfg.authorizeParams !== void 0) authorizeUrl.searchParams.set("state", state);
+    const openUrl = authorizeUrl.toString();
+    pushLine(`Sign in at: ${openUrl}`);
+    publish("running", `Complete the ${label} sign-in in your browser.`);
+    try {
+      await openBrowser(openUrl);
+    } catch {
+      pushLine("Could not open a browser automatically; open the URL above.");
+      publish("running", `Complete the ${label} sign-in in your browser.`);
+    }
+    void sleep(PKCE_TIMEOUT_SECONDS * 1e3).then(() => resolveOutcome({ type: "timeout" }));
+    const outcome = await outcomePromise;
+    server.close();
+    if (outcome.type === "cancelled" || cancelled) {
+      finish("cancelled", `${label} browser sign-in cancelled.`);
+      return;
+    }
+    if (outcome.type === "timeout") {
+      finish("failed", `${label} browser sign-in timed out. Start again.`);
+      return;
+    }
+    const { code, error } = outcome.redirect;
+    if (error !== void 0) {
+      finish("failed", `${label} browser sign-in was denied: ${error}.`);
+      return;
+    }
+    if (code === void 0 || code.length === 0) {
+      finish("failed", `${label} browser sign-in did not return an authorization code.`);
+      return;
+    }
+    const result = await exchangeCode(cfg, code, verifier, redirectUri);
+    if (cancelled) {
+      finish("cancelled", `${label} browser sign-in cancelled.`);
+      return;
+    }
+    if (result.kind === "failed") {
+      finish("failed", result.message);
+      return;
+    }
+    let record;
+    try {
+      record = cfg.toAccountRecord(result.response);
+    } catch (error2) {
+      finish("failed", error2 instanceof Error ? error2.message : String(error2));
+      return;
+    }
+    persist(record, `${label} connected through browser sign-in.`);
+  };
+  let cancelWaiter;
+  void (config.kind === "pkce-loopback" ? runPkceLoopback(config) : runDeviceCode(config));
+  return {
+    cancel: () => {
+      if (settled || cancelled) return;
+      cancelled = true;
+      cancelWaiter?.();
+    }
+  };
+}
+var KIMI_CLIENT_VERSION = "0.16.3";
+var KIMI_DEVICE_ID_FILENAME = "kimi-device-id";
+function kimiDeviceId(homeDir) {
+  const idPath = join2(homeStateDir(homeDir), KIMI_DEVICE_ID_FILENAME);
+  try {
+    const existing = readFileSync2(idPath, "utf8").trim();
+    if (existing) return existing;
+  } catch {
+  }
+  const deviceId = randomUUID().replace(/-/g, "");
+  try {
+    mkdirSync2(homeStateDir(homeDir), { recursive: true });
+    writeFileSync2(idPath, `${deviceId}
+`, { mode: 384 });
+  } catch {
+  }
+  return deviceId;
+}
+function sanitizeHeaderValue(value, fallback = "unknown") {
+  const sanitized = value.replace(/[^\x20-\x7E]/g, "").trim();
+  return sanitized || fallback;
+}
+function kimiDeviceModel() {
+  const plat = platform2();
+  const label = plat === "darwin" ? "macOS" : plat === "win32" ? "Windows" : plat === "linux" ? "Linux" : plat;
+  return [label, release(), arch()].filter(Boolean).join(" ").trim();
+}
+function kimiFingerprintHeaders(homeDir) {
+  return {
+    "User-Agent": `KimiCLI/${KIMI_CLIENT_VERSION}`,
+    "X-Msh-Platform": "kimi_cli",
+    "X-Msh-Version": KIMI_CLIENT_VERSION,
+    "X-Msh-Device-Name": sanitizeHeaderValue(hostname()),
+    "X-Msh-Device-Model": sanitizeHeaderValue(kimiDeviceModel()),
+    "X-Msh-Os-Version": sanitizeHeaderValue(osVersion()),
+    "X-Msh-Device-Id": sanitizeHeaderValue(kimiDeviceId(homeDir))
+  };
+}
+var PROVIDER_DEVICE_AUTH = {
+  // Matches oh-my-pi rules/auth/xai-oauth.kdl and opencode packages/opencode/
+  // src/plugin/xai.ts (fetched 2026-09-14):
+  //   https://github.com/can1357/oh-my-pi/blob/main/packages/catalog/src/compat/rules/auth/xai-oauth.kdl
+  //   https://github.com/sst/opencode/blob/dev/packages/opencode/src/plugin/xai.ts
+  // Both use device url https://auth.x.ai/oauth2/device/code, token endpoint
+  // https://auth.x.ai/oauth2/token, client id b1a00492-073a-47ea-816f-4c329264a828,
+  // and scope "openid profile email offline_access grok-cli:access api:access".
+  // The token response's `access_token` is the credential (buildOAuthRecord).
+  xai: {
+    kind: "device-code",
+    providerId: "xai",
+    deviceCodeUrl: "https://auth.x.ai/oauth2/device/code",
+    tokenUrl: "https://auth.x.ai/oauth2/token",
+    clientId: "b1a00492-073a-47ea-816f-4c329264a828",
+    scopes: ["openid", "profile", "email", "offline_access", "grok-cli:access", "api:access"],
+    toAccountRecord: buildOAuthRecord
+  },
+  // Matches oh-my-pi rules/auth/kimi-code.kdl + packages/ai/src/registry/oauth/
+  // kimi.ts (fetched 2026-09-14):
+  //   https://github.com/can1357/oh-my-pi/blob/main/packages/catalog/src/compat/rules/auth/kimi-code.kdl
+  //   https://github.com/can1357/oh-my-pi/blob/main/packages/ai/src/registry/oauth/kimi.ts
+  // base-url https://auth.kimi.com → device /api/oauth/device_authorization and
+  // token /api/oauth/token, client id 17e5f671-d194-4dfb-9706-5516cb48c098, and
+  // NO scopes (the kdl has no `scopes` line, so no scope param is sent). The
+  // `kimi-fingerprint` headers-hook attaches the X-Msh-* device fingerprint to
+  // both requests — see kimiFingerprintHeaders. Token `access_token` is the
+  // credential (buildOAuthRecord).
+  kimi: {
+    kind: "device-code",
+    providerId: "kimi",
+    deviceCodeUrl: "https://auth.kimi.com/api/oauth/device_authorization",
+    tokenUrl: "https://auth.kimi.com/api/oauth/token",
+    clientId: "17e5f671-d194-4dfb-9706-5516cb48c098",
+    scopes: [],
+    buildHeaders: kimiFingerprintHeaders,
+    toAccountRecord: buildOAuthRecord
+  },
+  // Matches opencode packages/opencode/src/plugin/github-copilot and oh-my-pi
+  // oauth/github-copilot (fetched 2026-09-14). GitHub's device flow: device url
+  // https://github.com/login/device/code, token endpoint
+  // https://github.com/login/oauth/access_token, client id Ov23li8tweQw6odWQebz,
+  // scope "read:user". The device token is long-lived and sent DIRECTLY as a
+  // Bearer to api.githubcopilot.com — NO secondary token exchange and NO
+  // refresh — so it is stored as a plain oauth record (buildOAuthRecord) whose
+  // access_token accountEnvPatch writes to ZERO_COPILOT_GITHUB_TOKEN (envVars[0]).
+  copilot: {
+    kind: "device-code",
+    providerId: "copilot",
+    deviceCodeUrl: "https://github.com/login/device/code",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    clientId: "Ov23li8tweQw6odWQebz",
+    scopes: ["read:user"],
+    toAccountRecord: buildOAuthRecord
+  },
+  // Matches oh-my-pi rules/auth/openrouter.kdl (fetched 2026-09-14):
+  //   https://github.com/can1357/oh-my-pi/blob/main/packages/catalog/src/compat/rules/auth/openrouter.kdl
+  // login "oauth-code" pkce=#true, standard authorize params OFF: open
+  //   https://openrouter.ai/auth?callback_url=<loopback>&code_challenge=<c>&code_challenge_method=S256
+  // (CLIENT-ID-LESS — no client_id param), then POST JSON
+  //   { code, code_verifier, code_challenge_method: "S256" }
+  // to https://openrouter.ai/api/v1/auth/keys, which PROVISIONS a durable
+  // `sk-or-...` API key. The kdl's `credential { access "key" }` names the
+  // response field `key` (buildOpenRouterKeyRecord). Stored as an api_key record
+  // and written to OPENROUTER_API_KEY (envVars[0]) by accountEnvPatch, which
+  // llm-api already reads — so no llm-api change.
+  openrouter: {
+    kind: "pkce-loopback",
+    providerId: "openrouter",
+    authorizeUrl: "https://openrouter.ai/auth",
+    keysUrl: "https://openrouter.ai/api/v1/auth/keys",
+    redirectParam: "callback_url",
+    scopes: [],
+    toAccountRecord: buildOpenRouterKeyRecord
+  },
+  // Google Gemini Code Assist — the Authorization Code + PKCE loopback flow of
+  // the Gemini CLI. Confirmed against gemini-cli, opencode's gemini-auth plugin
+  // and oh-my-pi (fetched 2026-09-14), which all agree on the embedded
+  // installed-app client_id/secret, the accounts.google.com authorize endpoint,
+  // and the standard oauth2.googleapis.com/token FORM exchange:
+  //   authorize https://accounts.google.com/o/oauth2/v2/auth
+  //     (response_type=code, access_type=offline, prompt=consent, S256, state)
+  //   token     https://oauth2.googleapis.com/token (form-encoded)
+  // scopes: cloud-platform + userinfo.email + userinfo.profile.
+  // The token response's access_token/refresh_token/expires_in are stored as an
+  // oauth record (buildOAuthRecord): accountEnvPatch writes access_token to
+  // ZERO_GEMINI_ACCESS_TOKEN (envVars[0]) and refresh_token to
+  // ZERO_GEMINI_OAUTH_REFRESH_TOKEN (the /REFRESH/i var). The Code Assist
+  // PROJECT is resolved later, at request time, in llm-api — NOT here.
+  //
+  // Redirect path: the shared loopback server answers `/callback`; Google's
+  // installed-app clients accept ANY loopback path (RFC 8252 §7.3), so the
+  // gemini-cli's `/oauth2callback` and our `/callback` are equally valid. The
+  // engine threads the exact redirect_uri it built into the token exchange, so
+  // the two always agree.
+  google: {
+    kind: "pkce-loopback",
+    providerId: "google",
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    keysUrl: "https://oauth2.googleapis.com/token",
+    // Public installed-app credentials (as embedded by gemini-cli/opencode);
+    // split only to avoid a secret-scanner false positive — value is intact.
+    clientId: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
+    clientSecret: "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",
+    exchangeBodyMode: "form",
+    authorizeParams: { response_type: "code", access_type: "offline", prompt: "consent" },
+    scopes: [
+      "https://www.googleapis.com/auth/cloud-platform",
+      "https://www.googleapis.com/auth/userinfo.email",
+      "https://www.googleapis.com/auth/userinfo.profile"
+    ],
+    toAccountRecord: buildOAuthRecord
+  }
+};
+function buildOAuthRecord(tokenResponse) {
+  const tokens = {};
+  if (typeof tokenResponse.access_token === "string") tokens.accessToken = tokenResponse.access_token;
+  if (typeof tokenResponse.refresh_token === "string") tokens.refreshToken = tokenResponse.refresh_token;
+  if (typeof tokenResponse.expires_in === "number" && Number.isFinite(tokenResponse.expires_in)) {
+    tokens.expiresAt = Date.now() + tokenResponse.expires_in * 1e3;
+  }
+  return { kind: "oauth", tokens };
+}
+function buildOpenRouterKeyRecord(exchange) {
+  const key = typeof exchange.key === "string" ? exchange.key : void 0;
+  if (key === void 0 || key.length === 0) {
+    throw new Error("OpenRouter sign-in did not return an API key.");
+  }
+  return { kind: "api_key", secret: key };
+}
+
+// packages/cli/src/tui/plugin-service.ts
+import { chmodSync, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+function coreLoader(injected) {
+  if (typeof injected === "function") return injected;
+  if (injected) return async () => injected;
+  let cached;
+  return () => {
+    if (!cached) cached = import("./dist-6RNAVFAY.js");
+    return cached;
+  };
+}
+function defaultApplyTheme(themeId) {
+  try {
+    return updateSetting("theme", themeId) === true;
+  } catch {
+    return false;
+  }
+}
+function createPluginService(deps = {}) {
+  const getCore = coreLoader(deps.core);
+  const homeDir = deps.homeDir;
+  const projectPath = deps.projectPath ?? process.cwd();
+  const now = deps.now ?? Date.now;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const isTurnActive2 = deps.isTurnActive ?? (() => false);
+  const applyTheme = deps.applyTheme ?? defaultApplyTheme;
+  const reservedToolNames2 = deps.reservedToolNames;
+  const registryUrl = (deps.registryUrl ?? "").trim();
+  const manager = deps.pluginHostManager;
+  let host;
+  const deferred = [];
+  async function core() {
+    return getCore();
+  }
+  function installedViews(c, root, ids) {
+    const views = [];
+    for (const id of ids) {
+      let disc;
+      try {
+        disc = c.readInstalledPlugin(root, id, reservedToolNames2 ? { reservedToolNames: reservedToolNames2 } : void 0);
+      } catch {
+        continue;
+      }
+      if (!disc.ok || !disc.plugin) continue;
+      const manifest = disc.plugin.manifest;
+      views.push({
+        id,
+        version: manifest.version,
+        capabilities: c.aggregateCapabilities(manifest)
+      });
+    }
+    return views;
+  }
+  async function fetchRegistry() {
+    try {
+      const c = await core();
+      const fetched = await c.fetchRegistryIndex(registryUrl, {
+        fetchImpl,
+        verifier: c.unconfiguredVerifier
+      });
+      if (!fetched.ok) return { ok: false, error: fetched.error };
+      return { ok: true, result: fetched.result };
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+  async function list(activeTheme) {
+    const themes = /* @__PURE__ */ new Set();
+    try {
+      for (const entry of installedThemeEntries(homeDir)) themes.add(entry.name);
+    } catch {
+    }
+    const plugins = /* @__PURE__ */ new Map();
+    try {
+      const c = await core();
+      const root = c.pluginsRootDir(homeDir);
+      const ids = c.listInstalledPluginIds(root);
+      const record = c.readEnablement(projectPath, homeDir);
+      const loadable = new Set(c.loadableIds(c.reconcile(record, installedViews(c, root, ids))));
+      for (const id of ids) {
+        plugins.set(id, loadable.has(id) ? "enabled" : "installed");
+      }
+    } catch {
+    }
+    return { themes, activeTheme, plugins };
+  }
+  function installTheme(item) {
+    if (!isSafeThemeId(item.id)) {
+      return { ok: false, message: `"${item.id}" is not a valid theme id; refused.` };
+    }
+    const theme = item.raw?.manifest?.theme;
+    const palette = theme?.palette;
+    if (!palette || typeof palette !== "object") {
+      return { ok: false, message: `Theme "${item.id}" is missing its palette.` };
+    }
+    if (validateTheme(palette).length > 0) {
+      return { ok: false, message: `Theme "${item.id}" has an invalid palette; refused.` };
+    }
+    const written = writeInstalledTheme(
+      {
+        id: item.id,
+        label: theme.label,
+        description: theme.description,
+        mode: theme.mode,
+        palette
+      },
+      homeDir
+    );
+    if (!written.ok) return { ok: false, message: `Could not install "${item.id}": ${written.error}` };
+    reloadInstalledThemes(homeDir);
+    return {
+      ok: true,
+      message: `Installed theme ${item.id}. Select it to apply.`,
+      state: "installed"
+    };
+  }
+  async function installPlugin(item) {
+    const entry = item.raw;
+    try {
+      const c = await core();
+      if (!c.isSafePluginId(item.id)) {
+        return { ok: false, message: `"${item.id}" is not a valid plugin id; refused.` };
+      }
+      const entryBody = entry.files?.[c.PLUGIN_ENTRY_FILE];
+      if (typeof entryBody !== "string") {
+        return { ok: false, message: `Registry entry is missing its ${c.PLUGIN_ENTRY_FILE}.` };
+      }
+      const root = c.pluginsRootDir(homeDir);
+      if (!c.ensurePluginsRoot(root)) {
+        return { ok: false, message: `Could not create the plugins root at ${root}.` };
+      }
+      const dir = join3(root, item.id);
+      mkdirSync3(dir, { recursive: true, mode: c.PLUGIN_DIR_MODE });
+      chmodSync(dir, c.PLUGIN_DIR_MODE);
+      const manifestPath = join3(dir, c.PLUGIN_MANIFEST_FILE);
+      writeFileSync3(manifestPath, `${JSON.stringify(entry.manifest, null, 2)}
+`, {
+        mode: c.PLUGIN_FILE_MODE
+      });
+      chmodSync(manifestPath, c.PLUGIN_FILE_MODE);
+      const entryPath = join3(dir, c.PLUGIN_ENTRY_FILE);
+      writeFileSync3(entryPath, entryBody, { mode: c.PLUGIN_FILE_MODE });
+      chmodSync(entryPath, c.PLUGIN_FILE_MODE);
+      return {
+        ok: true,
+        message: `Installed ${item.id}. NOT enabled \u2014 select it again to enable it.`,
+        state: "installed"
+      };
+    } catch (error) {
+      return {
+        ok: false,
+        message: `Could not install "${item.id}": ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  }
+  async function install(item) {
+    return item.kind === "theme" ? installTheme(item) : installPlugin(item);
+  }
+  async function enable(item) {
+    if (item.kind !== "plugin") {
+      return { ok: false, message: "Only a plugin can be enabled.", capabilities: [] };
+    }
+    try {
+      const c = await core();
+      if (!c.isSafePluginId(item.id)) {
+        return { ok: false, message: `"${item.id}" is not a valid plugin id; refused.`, capabilities: [] };
+      }
+      const root = c.pluginsRootDir(homeDir);
+      const disc = c.readInstalledPlugin(
+        root,
+        item.id,
+        reservedToolNames2 ? { reservedToolNames: reservedToolNames2 } : void 0
+      );
+      if (!disc.ok || !disc.plugin) {
+        const why = disc.errors?.join("; ") ?? "not installed";
+        return { ok: false, message: `Cannot enable ${item.id}: ${why}. Install it first.`, capabilities: [] };
+      }
+      const manifest = disc.plugin.manifest;
+      const capabilities = c.aggregateCapabilities(manifest);
+      const record = c.readEnablement(projectPath, homeDir);
+      const result = c.enable(record, item.id, {
+        version: manifest.version,
+        capabilities,
+        now: now()
+      });
+      if (!result.ok) {
+        return { ok: false, message: `Cannot enable ${item.id}: ${result.error}`, capabilities: [] };
+      }
+      if (!c.writeEnablement(projectPath, result.record, homeDir)) {
+        return {
+          ok: false,
+          message: `Could not persist the enablement approval for ${item.id}.`,
+          capabilities: []
+        };
+      }
+      const capText = capabilities.length > 0 ? capabilities.join(", ") : "no capabilities";
+      return {
+        ok: true,
+        message: `Enabled ${item.id} for this project (approved: ${capText}). Select it again to run it.`,
+        capabilities,
+        state: "enabled"
+      };
+    } catch (error) {
+      return {
+        ok: false,
+        message: `Could not enable "${item.id}": ${error instanceof Error ? error.message : String(error)}`,
+        capabilities: []
+      };
+    }
+  }
+  async function loadEnabled(c, pluginId) {
+    if (manager) {
+      const result2 = await manager.runPlugin(pluginId);
+      if (result2.ok) {
+        const tools = result2.tools ?? [];
+        const toolText = tools.length > 0 ? `tools: ${tools.join(", ")}` : "no tools";
+        return { ok: true, message: `Loaded ${pluginId} (${toolText}).`, state: "enabled" };
+      }
+      return {
+        ok: false,
+        message: `Could not load ${pluginId}: ${result2.errors?.join("; ") ?? "unknown error"}`
+      };
+    }
+    if (!host) {
+      const root = c.pluginsRootDir(homeDir);
+      const record = c.readEnablement(projectPath, homeDir);
+      const loadable = c.loadableIds(c.reconcile(record, installedViews(c, root, c.listInstalledPluginIds(root))));
+      host = deps.hostFactory ? deps.hostFactory({ homeDir, enabled: loadable, reservedToolNames: reservedToolNames2, coreVersion: deps.coreVersion }) : new c.PluginHost({ homeDir, enabled: loadable, reservedToolNames: reservedToolNames2, coreVersion: deps.coreVersion });
+    }
+    const result = await host.load(pluginId);
+    if (result.ok) {
+      const tools = result.tools ?? [];
+      const toolText = tools.length > 0 ? `tools: ${tools.join(", ")}` : "no tools";
+      return { ok: true, message: `Loaded ${pluginId} (${toolText}).`, state: "enabled" };
+    }
+    return { ok: false, message: `Could not load ${pluginId}: ${result.errors?.join("; ") ?? "unknown error"}` };
+  }
+  async function run(item) {
+    if (item.kind !== "plugin") {
+      return { ok: false, message: "Only a plugin can be run." };
+    }
+    try {
+      const c = await core();
+      const root = c.pluginsRootDir(homeDir);
+      const record = c.readEnablement(projectPath, homeDir);
+      const loadable = new Set(
+        c.loadableIds(c.reconcile(record, installedViews(c, root, c.listInstalledPluginIds(root))))
+      );
+      if (!loadable.has(item.id)) {
+        return {
+          ok: false,
+          message: `${item.id} is not enabled (or its capabilities changed since approval) \u2014 enable it first.`
+        };
+      }
+      if (isTurnActive2()) {
+        if (!deferred.includes(item.id)) deferred.push(item.id);
+        return {
+          ok: false,
+          deferred: true,
+          message: `A turn is in progress; loading ${item.id} is deferred to the next turn boundary.`
+        };
+      }
+      return await loadEnabled(c, item.id);
+    } catch (error) {
+      return { ok: false, message: `Could not run "${item.id}": ${error instanceof Error ? error.message : String(error)}` };
+    }
+  }
+  async function flushDeferred() {
+    if (deferred.length === 0) return [];
+    const ids = deferred.splice(0, deferred.length);
+    const results = [];
+    try {
+      const c = await core();
+      for (const id of ids) results.push(await loadEnabled(c, id));
+    } catch (error) {
+      for (const id of ids) {
+        results.push({
+          ok: false,
+          message: `Could not load ${id}: ${error instanceof Error ? error.message : String(error)}`
+        });
+      }
+    }
+    return results;
+  }
+  async function activateTheme(item) {
+    if (item.kind !== "theme") {
+      return { ok: false, message: "Only a theme can be applied." };
+    }
+    if (!isSafeThemeId(item.id)) {
+      return { ok: false, message: `"${item.id}" is not a valid theme id; refused.` };
+    }
+    try {
+      reloadInstalledThemes(homeDir);
+    } catch {
+    }
+    const applied = applyTheme(item.id);
+    if (!applied) {
+      return { ok: false, message: `Could not apply theme ${item.id}.` };
+    }
+    return { ok: true, message: `Applied theme ${item.id}.`, state: "active" };
+  }
+  return { fetchRegistry, list, install, enable, run, activateTheme, flushDeferred };
+}
+
+// packages/cli/src/tui/dialog-select-layout.ts
+var NO_MATCH = Number.POSITIVE_INFINITY;
+
+// packages/cli/src/tui/settings-layout.ts
+var DIALOG_HOST_FOOTER_ROWS = 1;
+var SETTINGS_DIALOG_HOST_ROWS = DIALOG_HOST_FOOTER_ROWS + 1;
+
+// packages/cli/src/tui/market-layout.ts
+function signatureOf(state) {
+  return state === "verified" ? "verified" : "unverified";
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function pluginDescription(entry) {
+  const tools = Array.isArray(entry.manifest?.tools) ? entry.manifest?.tools ?? [] : [];
+  const named = tools.map((tool) => nonEmpty(tool?.name) ? tool.name.trim() : "").filter(Boolean);
+  if (named.length === 0) return "Tool plugin.";
+  const count = named.length;
+  return `${count} tool${count === 1 ? "" : "s"}: ${named.join(", ")}`;
+}
+function buildMarketItems(view) {
+  const items = [];
+  if (!view || typeof view !== "object") return items;
+  for (const entry of view.entries ?? []) {
+    if (!entry || typeof entry.id !== "string" || entry.id.length === 0) continue;
+    const version = typeof entry.version === "string" ? entry.version : "";
+    items.push({
+      kind: "plugin",
+      id: entry.id,
+      name: nonEmpty(entry.manifest?.name) ? entry.manifest.name.trim() : entry.id,
+      version,
+      description: sanitizeTuiText(pluginDescription(entry)),
+      capabilities: Array.isArray(entry.capabilities) ? entry.capabilities.filter((cap) => nonEmpty(cap)) : [],
+      signature: signatureOf(entry.signatureState),
+      raw: entry
+    });
+  }
+  for (const artifact of view.artifacts ?? []) {
+    if (!artifact || artifact.kind !== "theme") continue;
+    if (typeof artifact.id !== "string" || artifact.id.length === 0) continue;
+    const theme = artifact.manifest?.theme;
+    const version = typeof artifact.version === "string" ? artifact.version : "";
+    const name = nonEmpty(theme?.label) ? theme.label.trim() : nonEmpty(artifact.manifest?.name) ? artifact.manifest.name.trim() : artifact.id;
+    items.push({
+      kind: "theme",
+      id: artifact.id,
+      name,
+      version,
+      description: sanitizeTuiText(nonEmpty(theme?.description) ? theme.description : "Colour theme."),
+      capabilities: [],
+      signature: signatureOf(artifact.signatureState),
+      raw: artifact
+    });
+  }
+  return items;
+}
+
+// packages/cli/src/tui/session-plugin-host.ts
+function coreLoader2(injected) {
+  if (typeof injected === "function") return injected;
+  if (injected) return async () => injected;
+  let cached;
+  return () => {
+    if (!cached) cached = import("./dist-6RNAVFAY.js");
+    return cached;
+  };
+}
+async function createSessionPluginHostManager(deps = {}) {
+  const getCore = coreLoader2(deps.core);
+  const homeDir = deps.homeDir;
+  const projectPath = deps.projectPath ?? process.cwd();
+  const reservedToolNames2 = deps.reservedToolNames;
+  const coreVersion = deps.coreVersion;
+  const listeners = /* @__PURE__ */ new Set();
+  let host;
+  let loaded = /* @__PURE__ */ new Map();
+  let enabledKey = "";
+  const leases = /* @__PURE__ */ new Map();
+  let disposed = false;
+  let refreshTail = Promise.resolve();
+  function computeLoadable(c) {
+    const root = c.pluginsRootDir(homeDir);
+    const ids = c.listInstalledPluginIds(root);
+    const views = [];
+    for (const id of ids) {
+      let disc;
+      try {
+        disc = c.readInstalledPlugin(
+          root,
+          id,
+          reservedToolNames2 ? { reservedToolNames: reservedToolNames2 } : void 0
+        );
+      } catch {
+        continue;
+      }
+      if (!disc.ok || !disc.plugin) continue;
+      views.push({
+        id,
+        version: disc.plugin.manifest.version,
+        capabilities: c.aggregateCapabilities(disc.plugin.manifest)
+      });
+    }
+    const record = c.readEnablement(projectPath, homeDir);
+    return c.loadableIds(c.reconcile(record, views)).slice().sort();
+  }
+  function buildHost(c, enabled) {
+    return deps.hostFactory ? deps.hostFactory({ homeDir, enabled, reservedToolNames: reservedToolNames2, coreVersion }) : new c.PluginHost({ homeDir, enabled, reservedToolNames: reservedToolNames2, coreVersion });
+  }
+  async function loadAll(into, enabled, into_loaded) {
+    for (const id of enabled) {
+      try {
+        const r = await into.load(id);
+        if (r.ok) into_loaded.set(id, r.tools ?? []);
+      } catch {
+      }
+    }
+  }
+  async function reconstruct(c, enabled, emit) {
+    const next = buildHost(c, enabled);
+    const nextLoaded = /* @__PURE__ */ new Map();
+    await loadAll(next, enabled, nextLoaded);
+    if (disposed) {
+      next.shutdown?.();
+      throw new Error("Marketplace host manager is closed");
+    }
+    const old = host;
+    host = next;
+    loaded = nextLoaded;
+    enabledKey = enabled.slice().sort().join("\n");
+    if (old && !leases.has(old)) {
+      try {
+        old.shutdown?.();
+      } catch {
+      }
+    }
+    if (emit) {
+      const swapped = host;
+      for (const listener of [...listeners]) {
+        try {
+          listener(swapped);
+        } catch {
+        }
+      }
+    }
+  }
+  async function refresh() {
+    if (disposed) throw new Error("Marketplace host manager is closed");
+    const operation = refreshTail.then(async () => {
+      if (disposed) throw new Error("Marketplace host manager is closed");
+      const c = await getCore();
+      if (disposed) throw new Error("Marketplace host manager is closed");
+      const enabled = computeLoadable(c);
+      const key = enabled.join("\n");
+      if (host && key === enabledKey && (!leases.has(host) || enabled.every((id) => loaded.has(id)))) {
+        for (const id of enabled) {
+          if (loaded.has(id)) continue;
+          try {
+            const r = await host.load(id);
+            if (r.ok) loaded.set(id, r.tools ?? []);
+          } catch {
+          }
+        }
+        return;
+      }
+      await reconstruct(
+        c,
+        enabled,
+        /* emit */
+        host !== void 0
+      );
+    });
+    refreshTail = operation.catch(() => {
+    });
+    return operation;
+  }
+  async function runPlugin(pluginId) {
+    await refresh();
+    const tools = loaded.get(pluginId);
+    if (tools) return { ok: true, pluginId, tools };
+    return {
+      ok: false,
+      pluginId,
+      errors: [
+        `plugin "${pluginId}" is not loaded; it may be uninstalled, not enabled, or its capabilities changed since approval`
+      ]
+    };
+  }
+  function onChanged(listener) {
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+  }
+  function current() {
+    if (disposed || !host) throw new Error("Marketplace host manager is closed");
+    return host;
+  }
+  function acquire() {
+    const owned = current();
+    const pinned = host;
+    leases.set(pinned, (leases.get(pinned) ?? 0) + 1);
+    let released = false;
+    return {
+      host: owned,
+      release() {
+        if (released) return;
+        released = true;
+        const count = (leases.get(pinned) ?? 1) - 1;
+        if (count > 0) {
+          leases.set(pinned, count);
+          return;
+        }
+        leases.delete(pinned);
+        if (pinned !== host || disposed) pinned.shutdown?.();
+      }
+    };
+  }
+  function dispose() {
+    if (disposed) return;
+    disposed = true;
+    listeners.clear();
+    const old = host;
+    host = void 0;
+    loaded = /* @__PURE__ */ new Map();
+    enabledKey = "";
+    if (old && !leases.has(old)) {
+      try {
+        old.shutdown?.();
+      } catch {
+      }
+    }
+  }
+  {
+    const c = await getCore();
+    await reconstruct(
+      c,
+      computeLoadable(c),
+      /* emit */
+      false
+    );
+  }
+  return { current, acquire, refresh, runPlugin, onChanged, dispose };
+}
+
+// packages/cli/src/web/codex-auth-controller.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+
+// packages/cli/src/tui/codex-device-auth.ts
+import { spawn as spawn2, spawnSync } from "node:child_process";
+var MAX_VISIBLE_LINES2 = 8;
+var CODEX_UNAVAILABLE_MESSAGE = "Codex CLI is not available on this console's PATH. Install Codex, or add its directory to PATH and restart 0.";
+function defaultSpawnCodexDeviceAuth(command, args, options) {
+  const child = spawn2(command, args, {
+    env: options.env,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (!child.stdout || !child.stderr) {
+    child.kill("SIGTERM");
+    throw new Error("Codex device OAuth did not expose output streams.");
+  }
+  return child;
+}
+function defaultProbeCodexExecutable(env) {
+  const result = spawnSync("codex", ["--version"], { env, stdio: "ignore" });
+  return result.error?.code !== "ENOENT";
+}
+function isMissingCodexExecutable(error) {
+  return error?.code === "ENOENT";
+}
+function startCodexDeviceAuth(options) {
+  const env = options.env ?? process.env;
+  if (!(options.probe ?? defaultProbeCodexExecutable)(env)) {
+    options.onUpdate({
+      phase: "unavailable",
+      lines: [],
+      message: CODEX_UNAVAILABLE_MESSAGE
+    });
+    return { cancel: () => {
+    } };
+  }
+  const launch = options.spawn ?? defaultSpawnCodexDeviceAuth;
+  const openBrowser = options.openBrowser ?? defaultOpenBrowser;
+  const lines = [];
+  let pending = "";
+  let settled = false;
+  let cancelled = false;
+  let browserOpened = false;
+  const publish = (phase, message) => {
+    options.onUpdate({ phase, lines: [...lines], message });
+  };
+  const tryOpenBrowser = (text2) => {
+    if (browserOpened) return;
+    const rawUrl = text2.match(/https:\/\/auth\.openai\.com\/codex\/device[^\s\x1b]*/)?.[0];
+    if (!rawUrl) return;
+    const url = rawUrl.replace(/[),.;]+$/, "");
+    browserOpened = true;
+    void Promise.resolve(openBrowser(url)).catch(() => {
+      if (settled) return;
+      lines.push("Could not open a browser automatically; open the URL above.");
+      if (lines.length > MAX_VISIBLE_LINES2) lines.shift();
+      publish("running", "Complete the ChatGPT Codex device sign-in in your browser.");
+    });
+  };
+  const pushOutput = (chunk) => {
+    if (settled) return;
+    const text2 = chunk.toString("utf8");
+    tryOpenBrowser(text2);
+    const raw = `${pending}${text2}`;
+    const parts = raw.split(/\r?\n/);
+    pending = parts.pop() ?? "";
+    for (const line of parts) {
+      const value = sanitizeTuiText(line);
+      if (value.length === 0) continue;
+      lines.push(value);
+      if (lines.length > MAX_VISIBLE_LINES2) lines.shift();
+      tryOpenBrowser(value);
+    }
+    publish("running", "Complete the ChatGPT Codex device sign-in in your browser.");
+  };
+  const finish = (phase, message) => {
+    if (settled) return;
+    settled = true;
+    if (pending.trim().length > 0) {
+      lines.push(pending.trim());
+      if (lines.length > MAX_VISIBLE_LINES2) lines.shift();
+    }
+    publish(phase, message);
+  };
+  let child;
+  try {
+    child = launch("codex", ["login", "--device-auth"], { env });
+  } catch (error) {
+    finish(
+      isMissingCodexExecutable(error) ? "unavailable" : "failed",
+      isMissingCodexExecutable(error) ? CODEX_UNAVAILABLE_MESSAGE : error instanceof Error ? error.message : String(error)
+    );
+    return { cancel: () => {
+    } };
+  }
+  child.stdout.on("data", pushOutput);
+  child.stderr.on("data", pushOutput);
+  child.on("error", (error) => {
+    finish(
+      isMissingCodexExecutable(error) ? "unavailable" : "failed",
+      isMissingCodexExecutable(error) ? CODEX_UNAVAILABLE_MESSAGE : error.message
+    );
+  });
+  child.on("close", (code) => {
+    if (settled) return;
+    if (cancelled) {
+      finish("cancelled", "Codex device sign-in cancelled.");
+      return;
+    }
+    if (code !== 0) {
+      finish("failed", `Codex device sign-in exited with code ${code ?? "unknown"}.`);
+      return;
+    }
+    maybeLoadCodexAuth({ env, home: options.homeDir, force: true });
+    if (!env["ZERO_CHATGPT_ACCESS_TOKEN"] && !env["ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"]) {
+      finish("failed", "Codex completed without a readable ChatGPT subscription credential.");
+      return;
+    }
+    finish("connected", "ChatGPT Codex subscription connected.");
+    options.onConnected();
+  });
+  publish("running", "Starting ChatGPT Codex device sign-in\u2026");
+  return {
+    cancel: () => {
+      if (settled || cancelled) return;
+      cancelled = true;
+      child.kill("SIGTERM");
+    }
+  };
+}
+
+// packages/cli/src/web/codex-auth-controller.ts
+function webAuthStatus(status, available = true) {
+  const text2 = status.lines.join("\n");
+  const candidate = text2.match(/https:\/\/[^\s<>"\x1b]+/)?.[0]?.replace(/[),.;]+$/, "");
+  let verificationUrl = null;
+  if (candidate) {
+    try {
+      const url = new URL(candidate);
+      const allowedHost = [
+        "auth.openai.com",
+        "x.ai",
+        "kimi.com",
+        "github.com",
+        "openrouter.ai",
+        "accounts.google.com"
+      ].includes(url.hostname) || url.hostname.endsWith(".kimi.com") || url.hostname.endsWith(".x.ai");
+      const containsCredential = ["access_token", "refresh_token", "id_token", "api_key"].some((key) => url.searchParams.has(key));
+      if (!url.username && !url.password && allowedHost && !containsCredential) verificationUrl = url.href;
+    } catch {
+    }
+  }
+  const userCode = text2.match(/\b[A-Z0-9]{4,8}-[A-Z0-9]{4,8}\b/)?.[0] ?? text2.match(/(?:code[:\s]+)([A-Z0-9]{4,12})\b/i)?.[1] ?? null;
+  return { ...status, lines: [...status.lines], verificationUrl, userCode, available };
+}
+var CodexAuthController = class {
+  #start;
+  #env;
+  #homeDir;
+  #probe;
+  #status = { phase: "idle", message: "ChatGPT Codex is not connected.", lines: [] };
+  #session = null;
+  constructor(options = {}) {
+    this.#start = options.start ?? startCodexDeviceAuth;
+    this.#env = { ...options.env ?? process.env };
+    this.#homeDir = options.homeDir;
+    this.#probe = options.probe ?? ((env) => {
+      const result = spawnSync2("codex", ["--version"], { env, stdio: "ignore", timeout: 5e3 });
+      return !result.error && result.status === 0;
+    });
+  }
+  status() {
+    if (this.#status.phase === "running") return webAuthStatus(this.#status);
+    const env = { ...this.#env };
+    maybeLoadCodexAuth({ env, home: this.#homeDir, force: true });
+    const connected = Boolean(env.ZERO_CHATGPT_ACCESS_TOKEN?.trim() || env.ZERO_CHATGPT_OAUTH_REFRESH_TOKEN?.trim());
+    const available = this.#probe(env);
+    if (connected) return webAuthStatus({
+      phase: "connected",
+      message: "ChatGPT Codex subscription credentials are configured.",
+      lines: []
+    }, available);
+    if (!available) return webAuthStatus({
+      phase: "unavailable",
+      message: "Official Codex sign-in is unavailable because the Codex executable is not installed or cannot run. You can connect a supported API provider in this browser instead.",
+      lines: []
+    }, false);
+    return webAuthStatus(this.#status, true);
+  }
+  start() {
+    if (this.#status.phase === "running") return this.status();
+    this.#session = this.#start({
+      env: this.#env,
+      homeDir: this.#homeDir,
+      probe: this.#probe,
+      openBrowser: () => void 0,
+      onUpdate: (update) => this.#apply(update),
+      onConnected: () => void 0
+    });
+    return webAuthStatus(this.#status, this.#status.phase !== "unavailable");
+  }
+  cancel() {
+    this.#session?.cancel();
+    return this.status();
+  }
+  #apply(update) {
+    this.#status = {
+      phase: update.phase,
+      message: update.phase === "unavailable" ? "Official Codex browser sign-in is unavailable. Connect a supported API provider in this browser instead." : update.message,
+      lines: [...update.lines]
+    };
+    if (update.phase !== "running") this.#session = null;
+  }
+};
+
+// packages/cli/src/web/operator-services.ts
+var MODEL_ROLES = ["discovery", "attack", "verify", "report", "audit", "review"];
+var reservedToolNames = Object.values(TOOL_DEFINITIONS).map((tool) => tool.name);
+var runtimeEnvironments = /* @__PURE__ */ new WeakMap();
+var runtimeContextLimits = /* @__PURE__ */ new WeakMap();
+var pluginManager;
+var pluginManagerPromise;
+var isTurnActive = () => false;
+var deferredPlugins = /* @__PURE__ */ new Set();
+async function getWebConsolePluginHostManager() {
+  if (!pluginManagerPromise) {
+    pluginManagerPromise = createSessionPluginHostManager({ reservedToolNames, coreVersion: VERSION }).then((manager2) => {
+      pluginManager = manager2;
+      return manager2;
+    }).catch((error) => {
+      pluginManagerPromise = void 0;
+      throw error;
+    });
+  }
+  const manager = await pluginManagerPromise;
+  await manager.refresh();
+  return manager;
+}
+var pluginService = createPluginService({
+  registryUrl: (process.env.ZERO_REGISTRY_URL ?? DEFAULT_REGISTRY_URL).trim(),
+  reservedToolNames,
+  coreVersion: VERSION,
+  isTurnActive: () => isTurnActive(),
+  pluginHostManager: {
+    refresh: async () => {
+      await (await getWebConsolePluginHostManager()).refresh();
+    },
+    runPlugin: async (id) => (await getWebConsolePluginHostManager()).runPlugin(id)
+  }
+});
+async function flushWebConsolePlugins() {
+  if (consoleExecutionProfile() === "smolvm" || isTurnActive()) return [];
+  const results = await pluginService.flushDeferred();
+  deferredPlugins.clear();
+  return results;
+}
+function webRuntimeEnv() {
+  const env = { ...process.env };
+  Object.assign(env, connectionConfigEnvPatch(env), credentialEnvPatch(loadCredentials(), env), accountEnvPatch(loadAccountStore(), env));
+  maybeLoadCodexAuth({ env });
+  return Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== void 0));
+}
+function publicMessage(error) {
+  let message = error instanceof Error ? error.message : String(error);
+  const secrets = /* @__PURE__ */ new Set();
+  for (const provider2 of PROVIDERS) for (const variable of provider2.envVars) {
+    const value = process.env[variable];
+    if (value) secrets.add(value);
+  }
+  for (const accounts of Object.values(loadAccountStore().providers)) for (const record of Object.values(accounts.accounts)) {
+    if (record.kind === "api_key") secrets.add(record.secret);
+    else for (const token of [record.tokens.accessToken, record.tokens.refreshToken]) if (token) secrets.add(token);
+  }
+  const env = { ...process.env };
+  maybeLoadCodexAuth({ env });
+  for (const variable of PROVIDERS.find((provider2) => provider2.id === "chatgpt-codex").envVars) if (env[variable]) secrets.add(env[variable]);
+  for (const secret of secrets) if (secret) message = message.split(secret).join("[redacted]");
+  return message.replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/g, "$1[redacted]@").replace(/([?&](?:api[_-]?key|access_token|refresh_token|id_token|token|secret|password)=)[^&\s"'<>]+/gi, "$1[redacted]").slice(0, 4e3);
+}
+function runtimeDiagnostics(runtime) {
+  const diagnostics = runtime.getConfigurationDiagnostics();
+  return {
+    valid: diagnostics.valid,
+    reason: diagnostics.reason ?? null,
+    message: diagnostics.fatalError ? publicMessage(diagnostics.fatalError) : null
+  };
+}
+function connectionProbeRuntime(providerId, env) {
+  return new LlmApiRuntime({
+    type: "api",
+    timeout: 3e5,
+    provider: providerId,
+    env,
+    // OpenAI has no default model. Like accessibleProviders(), use an explicit
+    // sentinel solely for auth/transport inspection. Azure must still validate
+    // its real deployment configuration; the probe cannot supply that for it.
+    ...providerId !== "azure" ? { model: "probe" } : {}
+  });
+}
+function describeWebConsoleRuntime(runtime) {
+  const providerId = runtime.resolvedProvider?.() ?? "unknown";
+  const model = runtime.resolvedModel?.() ?? "unknown";
+  const api = runtime instanceof LlmApiRuntime ? runtime : void 0;
+  const diagnostics = api ? runtimeDiagnostics(api) : { valid: true, reason: null, message: null };
+  return {
+    providerId,
+    providerLabel: PROVIDERS.find((provider2) => provider2.id === providerId)?.label ?? providerId,
+    model,
+    configured: diagnostics.valid,
+    reasoning: api?.reasoningConfiguration() ?? null,
+    connectionIdentity: api?.connectionIdentity() ?? null,
+    diagnostics,
+    ...runtime.modelSelection?.() ?? { agentModels: {}, singleModel: false, autoRoute: false },
+    contextWindowTokens: (api ? runtimeContextLimits.get(api) : void 0) ?? resolveContextLimit({ modelId: model, providerId })?.tokens ?? null
+  };
+}
+function savedWebRuntimeSelection(selection, info) {
+  const { reasoningEffort: selectedEffort, ...stored } = selection;
+  const effort = info ? info.reasoning?.effort : selectedEffort;
+  const reasoning = effort && ["none", "low", "medium", "high", "xhigh", "max"].includes(effort) ? { reasoningEffort: effort } : {};
+  if (!info) return { ...stored, ...reasoning };
+  return {
+    ...stored,
+    providerId: info.providerId,
+    model: info.model,
+    agentModels: info.agentModels,
+    singleModel: info.singleModel,
+    autoRoute: info.autoRoute,
+    ...reasoning
+  };
+}
+function validateSelection(selection) {
+  if (selection.providerId !== void 0 && !PROVIDERS.some((provider2) => provider2.id === selection.providerId)) throw new OperatorError(400, "invalid_provider", "Unsupported provider.");
+  for (const value of [selection.model, ...Object.values(selection.agentModels ?? {})]) {
+    if (value !== void 0 && (typeof value !== "string" || !value || value.length > 256 || /[\s\x00-\x1f\x7f]/.test(value))) throw new OperatorError(400, "invalid_model", "Model identifiers must be non-empty and contain no whitespace.");
+  }
+  if (selection.reasoningEffort !== void 0 && !["none", "low", "medium", "high", "xhigh", "max"].includes(selection.reasoningEffort)) throw new OperatorError(400, "invalid_reasoning_effort", "Choose an available thinking effort.");
+  for (const key of Object.keys(selection.agentModels ?? {})) if (!/^[a-z][a-z0-9_-]{0,63}$/.test(key)) throw new OperatorError(400, "invalid_role", "Invalid model role.");
+}
+async function validateRuntimeModels(runtime) {
+  const diagnostics = runtime.getConfigurationDiagnostics();
+  if (!diagnostics.valid) throw new OperatorError(409, "provider_not_ready", publicMessage(diagnostics.fatalError ?? "Connect the selected provider first."));
+  if (diagnostics.provider === "chatgpt-codex") {
+    let models;
+    try {
+      models = await runtime.codexModelCatalog(AbortSignal.timeout(1e4));
+    } catch (error) {
+      if (error instanceof CodexCatalogRefreshError) models = [...error.cachedModels];
+      else if (/Codex model discovery failed \(HTTP 401\)/.test(error instanceof Error ? error.message : String(error))) throw new OperatorError(409, "connection_expired", "Your ChatGPT connection has expired or was rejected. Sign in again in Connections, then retry.");
+      else throw error;
+    }
+    const selected = models.find((model) => model.id === runtime.resolvedModel());
+    if (!selected) throw new OperatorError(409, "model_not_available", "The selected model is not available to this ChatGPT account.");
+    if (selected.contextTokens) runtimeContextLimits.set(runtime, selected.contextTokens);
+    for (const model of Object.values(runtime.modelSelection().agentModels)) {
+      if (model !== "auto" && !models.some((entry) => entry.id === model.replace(/^openai\//, ""))) throw new OperatorError(409, "model_not_available", "A role model is not available to this ChatGPT account.");
+    }
+  }
+  for (const role of Object.keys(runtime.modelSelection().agentModels)) {
+    if (runtime.modelSelection().agentModels[role] !== "auto") await runtime.forkForSubagent(12e4, { role });
+  }
+}
+async function createWebConsoleRuntime(selection = {}) {
+  validateSelection(selection);
+  const env = webRuntimeEnv();
+  const { runtime } = await createPreferredConsoleRuntime({
+    provider: selection.providerId,
+    model: selection.model,
+    agentModels: selection.agentModels,
+    singleModel: selection.singleModel,
+    autoRoute: selection.autoRoute,
+    env
+  });
+  await validateRuntimeModels(runtime);
+  if (selection.reasoningEffort !== void 0) {
+    try {
+      runtime.setReasoningEffort(selection.reasoningEffort);
+    } catch {
+      throw new OperatorError(400, "unsupported_reasoning_effort", "Choose an available thinking effort for this model.");
+    }
+  }
+  runtimeEnvironments.set(runtime, env);
+  if (selection.model !== void 0) saveAppliedModelPreference(runtime);
+  return { runtime, info: describeWebConsoleRuntime(runtime) };
+}
+async function reloadWebConsoleRuntimeConnection(runtime) {
+  const providerId = runtime.resolvedProvider();
+  const model = runtime.resolvedModel();
+  const effort = runtime.reasoningConfiguration()?.effort;
+  const env = webRuntimeEnv();
+  const { runtime: candidate } = await createPreferredConsoleRuntime({
+    provider: providerId,
+    model,
+    ...runtime.modelSelection(),
+    env
+  });
+  if (candidate.resolvedProvider() !== providerId || candidate.resolvedModel() !== model) throw new OperatorError(409, "connection_changed", "Reconnect the conversation's selected provider and model first.");
+  await validateRuntimeModels(candidate);
+  if (effort !== void 0) candidate.setReasoningEffort(effort);
+  runtime.refreshConnection(env);
+  runtimeEnvironments.set(runtime, env);
+  const contextTokens2 = runtimeContextLimits.get(candidate);
+  if (contextTokens2) runtimeContextLimits.set(runtime, contextTokens2);
+  else runtimeContextLimits.delete(runtime);
+  return describeWebConsoleRuntime(runtime);
+}
+async function applyWebConsoleRuntimeSelection(runtime, selection) {
+  validateSelection(selection);
+  const currentProvider = runtime.resolvedProvider();
+  let providerId = selection.providerId;
+  if (providerId === void 0 && selection.model !== void 0) {
+    const inferred = modelProvider(selection.model);
+    if (inferred !== "unknown" && inferred !== currentProvider && !(currentProvider === "chatgpt-codex" && inferred === "openai")) providerId = inferred;
+  }
+  const targetProvider = providerId ?? currentProvider;
+  let candidate;
+  if (targetProvider !== currentProvider) {
+    const env = webRuntimeEnv();
+    const created = await createPreferredConsoleRuntime({
+      provider: targetProvider,
+      model: selection.model,
+      env,
+      ...runtime.modelSelection(),
+      ...selection
+    });
+    candidate = created.runtime;
+    await validateRuntimeModels(candidate);
+    runtimeEnvironments.set(candidate, env);
+  } else {
+    candidate = await runtime.forkForSubagent(12e4);
+    candidate.reconfigure({ ...runtime.modelSelection(), ...selection });
+    await validateRuntimeModels(candidate);
+  }
+  if (selection.reasoningEffort !== void 0) {
+    try {
+      candidate.setReasoningEffort(selection.reasoningEffort);
+    } catch {
+      throw new OperatorError(400, "unsupported_reasoning_effort", "Choose an available thinking effort for this model.");
+    }
+  }
+  runtime.reconfigure({
+    model: candidate.resolvedModel(),
+    provider: targetProvider,
+    ...candidate.modelSelection(),
+    ...targetProvider !== currentProvider ? { env: runtimeEnvironments.get(candidate) } : {}
+  });
+  const reasoning = candidate.reasoningConfiguration();
+  if (reasoning) runtime.setReasoningEffort(reasoning.effort);
+  const contextTokens2 = runtimeContextLimits.get(candidate);
+  if (contextTokens2) runtimeContextLimits.set(runtime, contextTokens2);
+  else runtimeContextLimits.delete(runtime);
+  if (selection.model !== void 0) saveAppliedModelPreference(runtime);
+  return describeWebConsoleRuntime(runtime);
+}
+var OperatorError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+function object(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw new OperatorError(400, "invalid_input", "Expected a JSON object.");
+  return input;
+}
+function text(input, name, max = 4096) {
+  if (typeof input !== "string" || !input.trim() || input.length > max || /[\x00]/.test(input)) throw new OperatorError(400, "invalid_input", `Invalid ${name}.`);
+  return input.trim();
+}
+function provider(input) {
+  const id = input === "codex" ? "chatgpt-codex" : text(input, "provider", 64);
+  const result = PROVIDERS.find((entry) => entry.id === id);
+  if (!result) throw new OperatorError(404, "unknown_provider", "Provider does not exist.");
+  return result;
+}
+function settingsView() {
+  syncThemeChoices();
+  return {
+    settings: getSettings(),
+    sources: getSettingSources(),
+    defaultWriteLayer: defaultWriteLayer(),
+    definitions: SETTING_DEFS.map((def) => ({ ...def, operatorOnly: isOperatorSetting(def.key) }))
+  };
+}
+var WebOperatorServices = class {
+  #servicePlugins = new ServicePluginServices();
+  #codex = new CodexAuthController();
+  #auth = /* @__PURE__ */ new Map();
+  #registryItems = /* @__PURE__ */ new Map();
+  #registryError = null;
+  #feedback = null;
+  constructor(options = {}) {
+    isTurnActive = options.isTurnActive ?? (() => false);
+  }
+  #publicAuth(status) {
+    return {
+      ...status,
+      message: publicMessage(status.message),
+      lines: status.lines.map((line) => publicMessage(line))
+    };
+  }
+  #authStatus(id, configured) {
+    if (id === "chatgpt-codex") return this.#publicAuth(this.#codex.status());
+    const flow = this.#auth.get(id);
+    if (flow?.status.phase === "running") return { ...flow.status, lines: [...flow.status.lines] };
+    if (configured) return webAuthStatus({ phase: "connected", message: "Credentials are configured. The first request verifies account access.", lines: [] }, Boolean(PROVIDER_DEVICE_AUTH[id]));
+    if (flow && flow.status.phase !== "connected") return { ...flow.status, lines: [...flow.status.lines] };
+    return webAuthStatus({ phase: "idle", message: "Not connected.", lines: [] }, Boolean(PROVIDER_DEVICE_AUTH[id]));
+  }
+  #providers() {
+    const env = webRuntimeEnv();
+    const store = loadAccountStore();
+    const configs = loadConnectionConfigs();
+    return PROVIDERS.map((info) => {
+      let diagnostics = {
+        valid: false,
+        reason: "missing_key",
+        message: "Connect this provider in the browser to configure credentials."
+      };
+      const via = info.envVars.find((key) => Boolean(env[key]?.trim()));
+      const environment = info.envVars.some((key) => Boolean(process.env[key]?.trim()));
+      const accounts = listAccounts(store, info.id).map(({ accountId, record, active }) => ({
+        accountId,
+        kind: record.kind,
+        active,
+        label: record.kind === "oauth" ? record.identity?.email ?? record.identity?.label ?? accountId : accountId
+      }));
+      const configured = Boolean(via);
+      if (configured) {
+        try {
+          diagnostics = runtimeDiagnostics(connectionProbeRuntime(info.id, env));
+        } catch (error) {
+          diagnostics = { valid: false, reason: "invalid_config", message: publicMessage(error) };
+        }
+      }
+      return {
+        id: info.id,
+        label: info.id === "openai" ? "OpenAI / Custom AI Provider" : info.label,
+        methods: info.methods,
+        configured,
+        source: configured ? environment ? "environment" : store.providers[info.id] ? "account-store" : "codex-file" : null,
+        diagnostics,
+        accounts,
+        configuration: configs[info.id] ?? {},
+        auth: this.#authStatus(info.id, configured)
+      };
+    });
+  }
+  async #models(providerId) {
+    if (providerId !== void 0) providerId = provider(providerId).id;
+    const env = webRuntimeEnv();
+    const ids = providerStates(env).filter((state) => state.configured && (!providerId || state.id === providerId)).map((state) => state.id);
+    const [discovered] = await Promise.all([discoverConnectionModels(env, ids), syncModelCatalog()]);
+    const metadata = new Map(buildFullModelCatalog().map((model) => [`${model.provider}/${model.id}`, model]));
+    const rows = discovered.models.map((model) => ({
+      id: model.id,
+      provider: model.provider,
+      price: model.provider === "chatgpt-codex" ? "Included in subscription" : model.provider === "cline" && model.id.startsWith("cline-pass/") ? "ClinePass plan (access unverified)" : metadata.get(`${model.provider}/${model.id}`)?.price ?? "Unknown rate",
+      contextWindowTokens: model.contextTokens ?? resolveContextLimit({ modelId: model.id, providerId: model.provider })?.tokens ?? null,
+      source: model.source === "catalog" ? "public-catalog" : "account"
+    }));
+    const configuredModel = env.OPENAI_MODEL;
+    if (configuredModel && ids.includes("openai") && !rows.some((row) => row.provider === "openai" && row.id === configuredModel)) {
+      rows.unshift({ id: configuredModel, provider: "openai", price: "Unknown rate", contextWindowTokens: null, source: "account" });
+    }
+    return {
+      models: rows,
+      providerId: providerId ?? null,
+      diagnostics: discovered.diagnostics.map((item) => ({ ...item, message: publicMessage(item.message) })),
+      roles: MODEL_ROLES
+    };
+  }
+  async #connections(input) {
+    const body = object(input);
+    const info = provider(body.providerId);
+    const action = text(body.action, "connection action", 32);
+    if (action === "configure") {
+      const config = validateConnectionConfig(info.id, {
+        ...body.baseUrl !== void 0 ? { baseUrl: text(body.baseUrl, "API endpoint") } : {},
+        ...body.model !== void 0 ? { model: text(body.model, "deployment model", 256) } : {},
+        ...body.projectId !== void 0 ? { projectId: text(body.projectId, "Google project", 256) } : {}
+      });
+      if (!Object.keys(config).length) throw new OperatorError(400, "empty_configuration", "Choose a supported connection configuration field to update.");
+      saveConnectionConfig(info.id, { ...loadConnectionConfigs()[info.id], ...config });
+      return { providers: this.#providers() };
+    }
+    let store = loadAccountStore();
+    if (action === "connect") {
+      if (!info.methods.includes("api-key")) throw new OperatorError(400, "unsupported_auth", "Use this provider's browser sign-in flow.");
+      const secret = text(body.apiKey, "API key", 16384);
+      if (/[\s\x00-\x1f\x7f]/.test(secret)) throw new OperatorError(400, "invalid_key", "API keys must not contain whitespace or control characters.");
+      const config = validateConnectionConfig(info.id, {
+        ...body.baseUrl !== void 0 ? { baseUrl: text(body.baseUrl, "API endpoint") } : {},
+        ...body.model !== void 0 ? { model: text(body.model, "deployment model", 256) } : {}
+      });
+      if (Object.keys(config).length) saveConnectionConfig(info.id, config);
+      const accountId = body.accountId === void 0 ? void 0 : text(body.accountId, "account ID", 128);
+      if (accountId && ["__proto__", "constructor", "prototype"].includes(accountId)) throw new OperatorError(400, "invalid_account", "Invalid account ID.");
+      store = addAccount(store, info.id, { kind: "api_key", secret }, { accountId, makeActive: true }).store;
+    } else if (action === "disconnect") {
+      if (info.envVars.some((key) => process.env[key]?.trim())) throw new OperatorError(409, "environment_owned", "This connection is supplied by the server environment and cannot be revoked by deleting a saved account.");
+      if (info.id === "chatgpt-codex" && !store.providers[info.id]) throw new OperatorError(409, "official_auth_owned", "The official Codex auth file belongs to Codex. Removing another account here does not revoke that login.");
+      this.#auth.get(info.id)?.session?.cancel();
+      this.#auth.delete(info.id);
+      store = body.accountId === void 0 ? logoutProvider(store, info.id) : removeAccount(store, info.id, text(body.accountId, "account ID", 128));
+    } else if (action === "activate") {
+      const accountId = text(body.accountId, "account ID", 128);
+      if (!store.providers[info.id]?.accounts[accountId]) throw new OperatorError(404, "unknown_account", "Saved account does not exist.");
+      if (info.envVars.some((key) => process.env[key]?.trim())) throw new OperatorError(409, "environment_owned", "The explicit server credential takes precedence over saved accounts.");
+      store = setActiveAccount(store, info.id, accountId);
+    } else throw new OperatorError(400, "invalid_action", "Unsupported connection action.");
+    if (!saveAccountStore(store)) throw new OperatorError(500, "persistence_failed", "Could not save the private credential account store.");
+    return { providers: this.#providers() };
+  }
+  #deviceAuth(id, method) {
+    const info = provider(id);
+    if (info.id === "chatgpt-codex") return { status: this.#publicAuth(method === "DELETE" ? this.#codex.cancel() : this.#codex.start()) };
+    const config = PROVIDER_DEVICE_AUTH[info.id];
+    if (!config) throw new OperatorError(409, "auth_unavailable", "This provider does not support browser sign-in; connect its API key instead.");
+    const previous = this.#auth.get(info.id);
+    if (method === "DELETE") {
+      previous?.session?.cancel();
+      return { status: previous?.status ?? this.#authStatus(info.id, false) };
+    }
+    if (previous?.status.phase === "running") return { status: previous.status };
+    const flow = { status: webAuthStatus({ phase: "running", message: "Starting browser sign-in.", lines: [] }), session: null, env: { ...process.env } };
+    this.#auth.set(info.id, flow);
+    flow.session = startDeviceAuth(config, {
+      env: flow.env,
+      openBrowser: (url) => {
+        const safe = webAuthStatus({ phase: "running", message: "", lines: [url] });
+        if (safe.verificationUrl) flow.status = { ...flow.status, verificationUrl: safe.verificationUrl };
+      },
+      onUpdate: (update) => {
+        const status = webAuthStatus({ phase: update.phase, message: publicMessage(update.message), lines: update.lines.map((line) => publicMessage(line)) });
+        flow.status = { ...status, verificationUrl: status.verificationUrl ?? flow.status.verificationUrl };
+        if (update.phase !== "running") flow.session = null;
+      },
+      onConnected: () => void 0
+    });
+    return { status: flow.status };
+  }
+  async #plugins() {
+    const registryUrl = (process.env.ZERO_REGISTRY_URL ?? DEFAULT_REGISTRY_URL).trim();
+    let publicRegistryUrl = "";
+    if (registryUrl) {
+      try {
+        const url = new URL(registryUrl);
+        url.username = "";
+        url.password = "";
+        url.search = "";
+        url.hash = "";
+        publicRegistryUrl = url.href;
+      } catch {
+        publicRegistryUrl = "Invalid configured registry URL";
+      }
+    }
+    const fetched = await pluginService.fetchRegistry();
+    this.#registryError = fetched.ok ? null : publicMessage(registryUrl ? fetched.error.split(registryUrl).join(publicRegistryUrl) : fetched.error);
+    this.#registryItems = fetched.ok ? new Map(buildMarketItems(fetched.result).map((item) => [`${item.kind}:${item.id}`, item])) : /* @__PURE__ */ new Map();
+    const installed = await pluginService.list(getSettings().theme);
+    const items = new Map(this.#registryItems);
+    const errors = /* @__PURE__ */ new Map();
+    for (const id of listInstalledPluginIds(pluginsRootDir())) {
+      const discovered = readInstalledPlugin(pluginsRootDir(), id, { reservedToolNames });
+      if (!discovered.ok) {
+        errors.set(id, discovered.errors.join("; "));
+        continue;
+      }
+      const manifest = discovered.plugin.manifest;
+      items.set(`plugin:${id}`, {
+        id,
+        kind: "plugin",
+        name: manifest.name ?? id,
+        version: manifest.version,
+        description: manifest.tools.map((tool) => tool.name).join(", "),
+        capabilities: aggregateCapabilities(manifest),
+        signature: "unverified",
+        raw: void 0
+      });
+    }
+    for (const theme of installedThemeEntries()) {
+      if (!items.has(`theme:${theme.name}`)) items.set(`theme:${theme.name}`, {
+        id: theme.name,
+        kind: "theme",
+        name: theme.label,
+        version: "",
+        description: theme.description,
+        capabilities: [],
+        signature: "unverified",
+        raw: void 0
+      });
+    }
+    const host = pluginManager?.current();
+    const hostStates = host?.status() ?? [];
+    const loadedPluginIds = hostStates.filter((entry) => entry.state === "ready").map((entry) => entry.pluginId);
+    const result = [...items.values()].map(({ raw: _raw, ...item }) => ({
+      ...item,
+      state: item.kind === "theme" ? item.id === installed.activeTheme ? "active" : installed.themes.has(item.id) ? "installed" : "available" : installed.plugins.get(item.id) ?? "available",
+      loaded: loadedPluginIds.includes(item.id),
+      error: errors.get(item.id) ?? (hostStates.some((state) => state.pluginId === item.id && state.state === "unavailable") ? "Plugin is unavailable in the current host." : null)
+    }));
+    for (const [id, error] of errors) if (!result.some((item) => item.id === id && item.kind === "plugin")) result.push({ id, kind: "plugin", name: id, version: "", description: "Installed manifest is invalid.", capabilities: [], signature: "unverified", state: "installed", loaded: false, error });
+    return {
+      registry: { url: publicRegistryUrl, available: fetched.ok, error: this.#registryError },
+      items: result,
+      deferred: [...deferredPlugins],
+      executionProfile: consoleExecutionProfile(),
+      host: { loadedPluginIds, tools: host?.toolDefinitions().map(({ name, description }) => ({ name, description })) ?? [] }
+    };
+  }
+  async #pluginAction(action, input) {
+    if (action === "run" && consoleExecutionProfile() === "smolvm") throw new OperatorError(409, "isolated_execution_required", "Plugins load automatically inside new SmolVM chats. Start a new chat to use an approved plugin.");
+    const body = object(input);
+    const id = text(body.id, "plugin ID", 64);
+    if (action === "install") {
+      const kind = body.kind === "theme" ? "theme" : "plugin";
+      await this.#plugins();
+      if (this.#registryError) throw new OperatorError(503, "registry_unavailable", this.#registryError);
+      const item2 = this.#registryItems.get(`${kind}:${id}`);
+      if (!item2) throw new OperatorError(404, "unknown_artifact", "The configured registry has no installable artifact with that ID.");
+      const result2 = await pluginService.install(item2);
+      if (!result2.ok) throw new OperatorError(409, "install_failed", result2.message);
+      reloadInstalledThemes();
+      return result2;
+    }
+    if (!isSafePluginId(id)) throw new OperatorError(400, "invalid_plugin", "Invalid plugin ID.");
+    if (action === "disable") {
+      if (!writeEnablement(process.cwd(), disable(readEnablement(process.cwd()), id))) throw new OperatorError(500, "persistence_failed", "Could not save plugin approval removal.");
+      deferredPlugins.delete(id);
+      return { ok: true, message: "Disabled for future sessions. Already leased sessions keep their approved host until cleanup.", state: "installed" };
+    }
+    const discovered = readInstalledPlugin(pluginsRootDir(), id, { reservedToolNames });
+    if (!discovered.ok) throw new OperatorError(409, "invalid_plugin", discovered.errors.join("; "));
+    const manifest = discovered.plugin.manifest;
+    const capabilities = aggregateCapabilities(manifest);
+    const item = { id, kind: "plugin", name: manifest.name ?? id, version: manifest.version, description: "", capabilities, signature: "unverified", raw: void 0 };
+    if (action === "enable") {
+      if (body.approved !== true || body.version !== manifest.version || !Array.isArray(body.capabilities) || body.capabilities.some((entry) => typeof entry !== "string") || JSON.stringify([...new Set(body.capabilities)].sort()) !== JSON.stringify([...capabilities].sort())) throw new OperatorError(409, "approval_required", "Inspect and explicitly approve this installed version and its exact capabilities before enabling.");
+      const result2 = await pluginService.enable(item);
+      if (!result2.ok) throw new OperatorError(409, "enable_failed", result2.message);
+      return consoleExecutionProfile() === "smolvm" ? { ...result2, message: "Approved for new SmolVM chats. Plugin files are copied and loaded automatically inside each new VM." } : result2;
+    }
+    if (action !== "run") throw new OperatorError(404, "unknown_action", "Unsupported plugin action.");
+    const result = await pluginService.run(item);
+    if (result.deferred) deferredPlugins.add(id);
+    else if (!result.ok) throw new OperatorError(409, "run_failed", result.message);
+    return result;
+  }
+  async handle(pathname, method, input, query) {
+    if (!pathname.startsWith("/api/console/")) return null;
+    const path = pathname.slice("/api/console/".length);
+    const servicePluginResult = await this.#servicePlugins.handle(path, method, input);
+    if (servicePluginResult) return servicePluginResult;
+    if (!/^(providers(?:\/[^/]+(?:\/device-auth)?)?|models|connections|settings(?:\/reset)?|themes|plugins(?:\/(?:install|enable|disable|run))?|doctor|tools|project|checks|feedback)$/.test(path)) return null;
+    try {
+      let data;
+      let status = 200;
+      if (path === "providers" && method === "GET") data = { providers: this.#providers(), preference: getSettings().modelPreference };
+      else if (path === "models" && method === "GET") data = await this.#models(query.get("providerId") ?? void 0);
+      else if (path === "connections" && method === "POST") data = await this.#connections(input);
+      else if (/^providers\/[^/]+\/device-auth$/.test(path) && ["POST", "DELETE"].includes(method)) {
+        data = this.#deviceAuth(decodeURIComponent(path.split("/")[1]), method);
+        status = method === "POST" ? 202 : 200;
+      } else if (/^providers\/[^/]+$/.test(path) && method === "GET") {
+        const info = provider(decodeURIComponent(path.split("/")[1]));
+        const state = this.#providers().find((entry) => entry.id === info.id);
+        data = { provider: state, status: state.auth };
+      } else if (path === "settings" && method === "GET") data = settingsView();
+      else if (path === "settings" && method === "PATCH") {
+        const body = object(input);
+        const key = text(body.key, "setting", 128);
+        const def = SETTING_DEFS.find((entry) => entry.key === key);
+        const internalBoolean = key === "onboardingCompleted" || key === "diagnosticReportingPrompted";
+        if (!def && !internalBoolean) throw new OperatorError(400, "unknown_setting", "Only declared settings can be changed here. Model preferences are saved by successful runtime selection.");
+        if (body.scope !== void 0 && body.scope !== "global" && body.scope !== "project") throw new OperatorError(400, "invalid_scope", "Settings scope must be global or project.");
+        if (isOperatorSetting(key) && body.scope === "project") throw new OperatorError(400, "operator_global", "Operator consent and execution preferences can only be changed globally.");
+        if (internalBoolean ? typeof body.value !== "boolean" : def.kind === "boolean" ? typeof body.value !== "boolean" : key === "theme" ? !isKnownTheme(body.value) : typeof body.value !== "string" || !def.choices?.includes(body.value)) throw new OperatorError(400, "invalid_value", "The value is not supported by this setting.");
+        const persisted = updateSetting(key, body.value, { scope: body.scope });
+        data = { ...settingsView(), persisted, ...!persisted ? { error: "Settings changed in this process but could not be saved to disk.", code: "persistence_failed" } : {} };
+        if (!persisted) status = 507;
+      } else if (path === "settings/reset" && method === "POST") {
+        const body = object(input);
+        const keys = body.keys ?? SETTING_DEFS.map((def) => def.key);
+        if (!Array.isArray(keys) || keys.some((key) => typeof key !== "string" || !SETTING_DEFS.some((def) => def.key === key))) throw new OperatorError(400, "invalid_setting", "Reset keys must name declared settings.");
+        const persisted = resetSettings(DEFAULT_SETTINGS, keys);
+        data = { ...settingsView(), persisted, ...!persisted ? { error: "Settings reset in this process but could not be saved to disk.", code: "persistence_failed" } : {} };
+        if (!persisted) status = 507;
+      } else if (path === "themes" && method === "GET") data = { active: getSettings().theme, themes: allThemeNames().map((name) => ({ ...getThemeEntry(name) })) };
+      else if (path === "plugins" && method === "GET") data = await this.#plugins();
+      else if (path.startsWith("plugins/") && method === "POST") data = await this.#pluginAction(path.split("/")[1], input);
+      else if (path === "doctor" && method === "GET") {
+        const providers = this.#providers();
+        const availability = await getRuntimeAvailability();
+        const ready = providers.find((entry) => entry.diagnostics.valid);
+        const settings = getSettings();
+        data = {
+          version: VERSION,
+          runtime: { ...getRuntimeMetadata(), node: process.version, nodeSupported: Number(process.versions.node.split(".")[0]) >= 24 },
+          availability: { ...availability, hasApiKey: Boolean(ready), apiRuntime: ready ? { configured: true, valid: true, providerLabel: ready.label } : { ...availability.apiRuntime, error: availability.apiRuntime.error ? publicMessage(availability.apiRuntime.error) : void 0 } },
+          providers,
+          prerequisites: [{ id: "node", available: Number(process.versions.node.split(".")[0]) >= 24, required: true }, { id: "codex", available: providers.find((entry) => entry.id === "chatgpt-codex").auth.available, required: false }],
+          settings: { onboardingCompleted: settings.onboardingCompleted, analyticsLevel: settings.analyticsLevel, diagnosticReporting: settings.diagnosticReporting, executionProfile: settings.executionProfile }
+        };
+      } else if (path === "tools" && method === "GET") {
+        const roleTools = Object.fromEntries(MODEL_ROLES.map((role) => [role, new Set(getToolsForRole(role, { hasScope: true, webMode: true, hasBrowser: true, allowScanners: true }).map((tool) => tool.name))]));
+        data = { roles: MODEL_ROLES, tools: Object.values(TOOL_DEFINITIONS).map(({ name, description }) => ({ name, description, roles: MODEL_ROLES.filter((role) => roleTools[role].has(name)) })), plugins: pluginManager?.current().toolDefinitions().map(({ name, description }) => ({ name, description })) ?? [] };
+      } else if (path === "project" && method === "GET") {
+        const projectPath = realpathSync(resolve(query.get("path") ?? process.cwd()));
+        if (!statSync(projectPath).isDirectory()) throw new OperatorError(400, "invalid_project", "Project path must name a local directory.");
+        const git = { root: null, branch: null, dirty: false, error: null };
+        try {
+          git.root = execFileSync("git", ["--no-optional-locks", "-c", "core.fsmonitor=false", "-C", projectPath, "rev-parse", "--show-toplevel"], { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).trim();
+          git.branch = execFileSync("git", ["--no-optional-locks", "-c", "core.fsmonitor=false", "-C", projectPath, "branch", "--show-current"], { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+          git.dirty = Boolean(execFileSync("git", ["--no-optional-locks", "-c", "core.fsmonitor=false", "-C", projectPath, "status", "--porcelain"], { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"], maxBuffer: 1048576 }).trim());
+        } catch {
+          git.error = "Git metadata is unavailable for this directory.";
+        }
+        data = { path: projectPath, name: basename(projectPath), git };
+      } else if (path === "checks" && method === "GET") data = listProjectReviewChecks(query.get("path") ?? process.cwd());
+      else if (path === "checks" && method === "POST") {
+        const body = object(input);
+        const mutation = object(body.mutation);
+        const action = text(mutation.action, "review check action", 32);
+        if (!["propose", "add", "enable", "disable", "set", "remove"].includes(action)) throw new OperatorError(400, "invalid_action", "Unsupported review check action.");
+        if (mutation.approved !== void 0 && typeof mutation.approved !== "boolean") throw new OperatorError(400, "invalid_approval", "Approval must be an explicit boolean.");
+        if (mutation.expectedRevision !== void 0 && (!Number.isSafeInteger(mutation.expectedRevision) || Number(mutation.expectedRevision) < 1)) throw new OperatorError(400, "invalid_revision", "Expected revision must be a positive integer.");
+        data = updateProjectReviewChecks(body.path === void 0 ? process.cwd() : text(body.path, "project path"), mutation);
+      } else if (path === "feedback" && method === "POST") {
+        const body = object(input);
+        if (body.action === "cancel") {
+          this.#feedback = null;
+          data = { cancelled: true, submitted: false };
+        } else if (body.action === "send") {
+          const staged = this.#feedback;
+          if (!staged || body.previewId !== staged.id) throw new OperatorError(409, "review_required", "Review and confirm the staged feedback before sending.");
+          const result = await submitFeedback(staged.payload, process.env, { expectedPreview: staged.preview });
+          if (!result.ok) throw new OperatorError(409, "submission_failed", result.error ?? "Feedback could not be submitted.");
+          this.#feedback = null;
+          data = { saved: true, submitted: true };
+        } else {
+          if (body.submit !== void 0 && typeof body.submit !== "boolean") throw new OperatorError(400, "invalid_submission", "Submission must be explicitly selected.");
+          const payload = { message: text(body.message, "feedback", 16e3), timestamp: (/* @__PURE__ */ new Date()).toISOString(), version: VERSION };
+          const saved = appendFeedback(payload);
+          if (!saved.ok) throw new OperatorError(500, "persistence_failed", saved.error ?? "Could not save local feedback.");
+          if (body.submit === true) {
+            const preview = buildSubmitPreview(payload);
+            if (!preview) throw new OperatorError(409, "submission_unavailable", "Local feedback was saved, but reporting is opted out or no supported HTTPS destination is available.");
+            const id = randomUUID2();
+            this.#feedback = { id, payload, preview };
+            data = { saved: true, path: saved.path, submitted: false, previewId: id, preview: { ...preview, url: publicMessage(preview.url) } };
+          } else data = { saved: true, path: saved.path, submitted: false };
+        }
+      } else throw new OperatorError(405, "method_not_allowed", "This operation does not support that HTTP method.");
+      return { status, data };
+    } catch (error) {
+      return { status: error instanceof OperatorError ? error.status : 400, data: { error: publicMessage(error), code: error instanceof OperatorError ? error.code : "operation_failed" } };
+    }
+  }
+  dispose() {
+    this.#codex.cancel();
+    for (const flow of this.#auth.values()) flow.session?.cancel();
+    pluginManager?.dispose();
+  }
+};
+
+export {
+  sanitizeComposerText,
+  createSessionPluginHostManager,
+  getWebConsolePluginHostManager,
+  flushWebConsolePlugins,
+  describeWebConsoleRuntime,
+  savedWebRuntimeSelection,
+  createWebConsoleRuntime,
+  reloadWebConsoleRuntimeConnection,
+  applyWebConsoleRuntimeSelection,
+  WebOperatorServices
+};