@ai-ecoverse/slicc-agent 6.15.1 → 6.16.0

package/README.md

@@ -154,6 +154,8 @@ The first provider is AWS Bedrock with a Bedrock API key as the bearer token; th
 
 **Blocked providers.** `needs: 'cors-free-transport'` is the static fact; `blocked: 'cors-free-transport'`, on both `ProviderOption` and the account, says the current transport can't reach that provider right now: the worker's kernel transport is unavailable, or it is the page's own fetch without a linked exit (`transportReach(client)` in `src/net.ts`, from the transport's traits). The worker follows `client.onTraits`, so a provider unblocks as soon as an extension or a linked slicc gives a CORS-free route, and blocks again when it goes, with no reload. A blocked provider is still offered and can be added; a connected one keeps its key and its row, but its models are left out of `models` and `labels`, so the picker offers none until the route is back.
 
+**Subscription sign-ins.** xAI, Kimi For Coding and ChatGPT (`openai-codex`, shown as ChatGPT) sign in with pi-ai's own device-code flows (`DEVICE_SIGN_INS` in `src/sign-ins.ts`); xAI and Kimi keep API-key entry too, so their accounts are `auth: 'oauth'` with `secret: 'api-key'` (spectrum's “Use an API key instead”) and a `keyUrl`. Spectrum's Sign in calls `connect(id, undefined, undefined, { method: 'sign-in' })` in the click, and a pasted key `put`s first and calls `connect(id, undefined, fields, { method: 'key' })` (spectrum's `ConnectOptions`); without the fourth argument an `oauth` account signs in. The adapter opens an `about:blank` popup (`slicc-sign-in`) before anything else in the click's task, then asks the worker's `signIn(id)`, which adds the account, runs the provider's `auth.oauth.login` and answers `{ url, code }` once the provider gives its device code (an `https:` page only). While it waits the account is `signing-in` with `signIn: { url, code? }`, kept in the page and never in the replicated settings state; the popup goes to `url`, and spectrum shows `code` with Copy and a link to `url` when the browser blocked the popup. The adapter's `connect` call then waits in the worker for the token (a sign-in no `connect` claims within a minute is dropped) and hands the vault `grant { provider, name, response, settings? }`, `name` being the account's `vaultName` and `response` the token response built from pi-ai's credential, as bytes zeroed after the call; the token is never stored, logged, licked or put in the state, and pi-ai's own error texts, which can quote a token response, never leave the worker. A refusal reads “The sign-in was refused.”, a timeout, network failure or malformed answer “The sign-in didn't finish. Try again.”, the vault's `EEXIST` “This name holds another provider's key.”, and Cancel aborts at once with an `AbortError`. Signing in again is a rotation that keeps the placeholder, and over a pasted key the vault keeps that key restorable. The vault refreshes the token through `egress`; after `invalid_grant` its record is `expired` and the account offers Sign in again. ChatGPT's API reads the account id from the access token's JWT, which a placeholder isn't: the grant carries `settings: { CHATGPT_ACCOUNT_ID }` (every sign-in), the credential's env gets it from the record, and the worker hands pi-ai a carrier key `slicc.<claims>.<placeholder>` that the worker's fetch turns back into `Bearer <placeholder>` before the vault fills it, so pi-ai sends `chatgpt-account-id` itself; its turns use SSE, not WebSockets. Kimi's auth host answers browsers but its API needs the CORS-free transport; xAI's API answers browsers but its device endpoints don't, so an xAI sign-in needs the CORS-free transport while its key doesn't; ChatGPT's auth host answers browsers and its API doesn't. The flows load lazily from pi-ai: xAI's and Kimi's modules import nothing from Node, and openai-codex's imports `node:http` for its browser callback, which the device flow never runs, so slicc-bios's `node:*` stubs let it load.
+
 **Adding providers.** The settings state's `providers` lists every provider seven can add (`ProviderOption`: `id`, `name`, `description`, `auth`, `keyUrl`, `needs`, `fields` and `vaultName`, sorted by name), and the spectrum adapter serves it as `providers()` with a `providers` event when it changes. `accounts` then lists only the added ones: Bedrock and Adobe start as added, `connect` adds a provider, and one with a vault record or stored fields counts as added too. The added list is `providers` in `/.slicc/accounts.json`. `vaultName` is the record name spectrum `put`s the key under: pi-ai's env name, or `<ID>_API_KEY` for providers that share one (Moonshot AI, OpenCode and the Qwen token plans), since a `put` under another provider's name would rebind that record; Bedrock's is `AWS_BEARER_TOKEN_BEDROCK` and Adobe's `ADOBE_IMS_TOKEN`. The agent finds a provider's record by its `provider`, never by name. Each provider has at most one secret, its key; `fields` are the non-secret inputs (`name`, `label`, `required`, `placeholder`, `help`, `customBase`, `vaultSetting`, `options` and `value`). `vaultSetting` names the vault record setting a field fills (slicc-vault's tenant-bound wildcards, V3), so the vault can bind a provider's wildcard endpoints to the user's own tenant: Cloudflare's `account` is `CLOUDFLARE_ACCOUNT_ID` and `gateway` `CLOUDFLARE_GATEWAY_ID`, and Azure's `endpoint` is `AZURE_OPENAI_RESOURCE_NAME` (spectrum applies it only to a bare resource name; an `https:` value stays a `customBase`). On an added account each field's `value` is its stored value, trimmed, so Settings can show it and knows a custom base URL to unregister after a reload; a field with a default carries that instead (Bedrock's `us-west-2`). Bedrock's `region` has `options`, the 21 regions where AWS supports Bedrock API keys (the bearer token seven uses; AWS's “Supported Regions … for Amazon Bedrock API keys”), labelled with AWS's names (`Europe (Frankfurt), eu-central-1`); a stored region outside the list comes first, under its own name, so a select never shows a region the account doesn't use. `disconnect(id)` keeps the row and its fields, so connecting again needs only the key, and `remove(id)` drops the row and its fields; for both, spectrum removes the vault record first. On an MCP row, `remove` disconnects it. `connect` with a secret is refused for every model account ("API keys are kept in seven's vault: update seven"); the only secret it still takes is an MCP sign-in's callback answer.
 
 ### In slicc-spectrum

package/dist/codex.js

@@ -0,0 +1,50 @@
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import { CODEX_ACCOUNT } from "./sign-ins.js";
+const CLAIM = "https://api.openai.com/auth";
+const MARK = "slicc";
+const CARRIED = /^Bearer slicc\.[A-Za-z0-9+/=]+\.([^.\s]+)$/;
+function codexKey(placeholder, account) {
+  const claims = btoa(JSON.stringify({ [CLAIM]: { chatgpt_account_id: account } }));
+  return `${MARK}.${claims}.${placeholder}`;
+}
+function codexProvider() {
+  const base = openaiCodexProvider();
+  return {
+    ...base,
+    name: "ChatGPT",
+    auth: {
+      ...base.auth,
+      apiKey: {
+        name: "ChatGPT sign-in",
+        resolve: async ({ credential, signal }) => {
+          signal.throwIfAborted();
+          const account = credential?.env?.[CODEX_ACCOUNT];
+          if (!credential?.key || !account) return void 0;
+          return {
+            auth: { apiKey: codexKey(credential.key, account) },
+            env: credential.env,
+            source: "vault"
+          };
+        }
+      }
+    },
+    stream: (model, context, options) => base.stream(model, context, { ...options, transport: "sse" }),
+    streamSimple: (model, context, options) => base.streamSimple(model, context, { ...options, transport: "sse" })
+  };
+}
+function codexFetch(inner) {
+  return (input, init) => {
+    const request = new Request(input, init);
+    const carried = CARRIED.exec(request.headers.get("authorization") ?? "");
+    if (!carried) return inner(request);
+    const headers = new Headers(request.headers);
+    headers.set("authorization", `Bearer ${carried[1]}`);
+    return inner(new Request(request, { headers }));
+  };
+}
+export {
+  codexFetch,
+  codexKey,
+  codexProvider
+};
+//# sourceMappingURL=codex.js.map

package/dist/codex.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/codex.ts"],
+  "sourcesContent": ["import type { Provider } from '@earendil-works/pi-ai';\nimport { openaiCodexProvider } from '@earendil-works/pi-ai/providers/openai-codex';\nimport { CODEX_ACCOUNT } from './sign-ins.ts';\n\nconst CLAIM = 'https://api.openai.com/auth';\nconst MARK = 'slicc';\nconst CARRIED = /^Bearer slicc\\.[A-Za-z0-9+/=]+\\.([^.\\s]+)$/;\n\nexport function codexKey(placeholder: string, account: string): string {\n  const claims = btoa(JSON.stringify({ [CLAIM]: { chatgpt_account_id: account } }));\n  return `${MARK}.${claims}.${placeholder}`;\n}\n\nexport function codexProvider(): Provider {\n  const base = openaiCodexProvider() as Provider;\n  return {\n    ...base,\n    name: 'ChatGPT',\n    auth: {\n      ...base.auth,\n      apiKey: {\n        name: 'ChatGPT sign-in',\n        resolve: async ({ credential, signal }) => {\n          signal.throwIfAborted();\n          const account = credential?.env?.[CODEX_ACCOUNT];\n          if (!credential?.key || !account) return undefined;\n          return {\n            auth: { apiKey: codexKey(credential.key, account) },\n            env: credential.env,\n            source: 'vault',\n          };\n        },\n      },\n    },\n    stream: (model, context, options) =>\n      base.stream(model, context, { ...options, transport: 'sse' } as typeof options),\n    streamSimple: (model, context, options) =>\n      base.streamSimple(model, context, { ...options, transport: 'sse' }),\n  };\n}\n\nexport function codexFetch(inner: typeof fetch): typeof fetch {\n  return (input, init) => {\n    const request = new Request(input, init);\n    const carried = CARRIED.exec(request.headers.get('authorization') ?? '');\n    if (!carried) return inner(request);\n    const headers = new Headers(request.headers);\n    headers.set('authorization', `Bearer ${carried[1]}`);\n    return inner(new Request(request, { headers }));\n  };\n}\n"],
+  "mappings": "AACA,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAE9B,MAAM,QAAQ;AACd,MAAM,OAAO;AACb,MAAM,UAAU;AAET,SAAS,SAAS,aAAqB,SAAyB;AACrE,QAAM,SAAS,KAAK,KAAK,UAAU,EAAE,CAAC,KAAK,GAAG,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC;AAChF,SAAO,GAAG,IAAI,IAAI,MAAM,IAAI,WAAW;AACzC;AAEO,SAAS,gBAA0B;AACxC,QAAM,OAAO,oBAAoB;AACjC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,MAAM;AAAA,IACN,MAAM;AAAA,MACJ,GAAG,KAAK;AAAA,MACR,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,SAAS,OAAO,EAAE,YAAY,OAAO,MAAM;AACzC,iBAAO,eAAe;AACtB,gBAAM,UAAU,YAAY,MAAM,aAAa;AAC/C,cAAI,CAAC,YAAY,OAAO,CAAC,QAAS,QAAO;AACzC,iBAAO;AAAA,YACL,MAAM,EAAE,QAAQ,SAAS,WAAW,KAAK,OAAO,EAAE;AAAA,YAClD,KAAK,WAAW;AAAA,YAChB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ,CAAC,OAAO,SAAS,YACvB,KAAK,OAAO,OAAO,SAAS,EAAE,GAAG,SAAS,WAAW,MAAM,CAAmB;AAAA,IAChF,cAAc,CAAC,OAAO,SAAS,YAC7B,KAAK,aAAa,OAAO,SAAS,EAAE,GAAG,SAAS,WAAW,MAAM,CAAC;AAAA,EACtE;AACF;AAEO,SAAS,WAAW,OAAmC;AAC5D,SAAO,CAAC,OAAO,SAAS;AACtB,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,UAAU,QAAQ,KAAK,QAAQ,QAAQ,IAAI,eAAe,KAAK,EAAE;AACvE,QAAI,CAAC,QAAS,QAAO,MAAM,OAAO;AAClC,UAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,YAAQ,IAAI,iBAAiB,UAAU,QAAQ,CAAC,CAAC,EAAE;AACnD,WAAO,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD;AACF;",
+  "names": []
+}

package/dist/device.js

@@ -0,0 +1,145 @@
+import { VaultRefusal } from "./secrets/vault.js";
+import {
+  CODEX,
+  CODEX_ACCOUNT,
+  httpsUrl,
+  NAME_TAKEN,
+  SIGN_IN_LOCKED,
+  SIGN_IN_REFUSED,
+  SIGN_IN_UNFINISHED,
+  SIGN_IN_UNKEPT
+} from "./sign-ins.js";
+const ATTACH_MS = 6e4;
+class Kept extends Error {
+}
+const cancelled = () => new DOMException("The sign-in was cancelled.", "AbortError");
+function keptError(error) {
+  if (error instanceof VaultRefusal && error.code === "EEXIST") return new Kept(NAME_TAKEN);
+  if (error instanceof VaultRefusal && error.code === "EACCES" && /lock/i.test(error.message))
+    return new Kept(SIGN_IN_LOCKED);
+  return new Kept(SIGN_IN_UNKEPT);
+}
+function flowError(error) {
+  if (error instanceof Kept) return error;
+  const text = error instanceof Error ? error.message : String(error ?? "");
+  return new Error(/denied|refused/i.test(text) ? SIGN_IN_REFUSED : SIGN_IN_UNFINISHED);
+}
+function tokenResponse(credential, now) {
+  const seconds = Math.round((credential.expires - now) / 1e3);
+  return new TextEncoder().encode(
+    JSON.stringify({
+      access_token: credential.access,
+      ...credential.refresh ? { refresh_token: credential.refresh } : {},
+      token_type: "Bearer",
+      ...Number.isFinite(seconds) ? { expires_in: Math.max(0, seconds) } : {}
+    })
+  );
+}
+function settingsOf(providerId, credential) {
+  const account = credential.accountId;
+  return providerId === CODEX && typeof account === "string" && account ? { settings: { [CODEX_ACCOUNT]: account } } : {};
+}
+function follow(signal, controller) {
+  const abort = () => controller.abort(cancelled());
+  if (signal?.aborted) abort();
+  signal?.addEventListener("abort", abort, { once: true });
+  return () => signal?.removeEventListener("abort", abort);
+}
+const DEVICE_CODE = "device_code";
+function deviceFlows(grant, options = {}) {
+  const flows = /* @__PURE__ */ new Map();
+  const now = options.now ?? Date.now;
+  const drop = (providerId, flow) => {
+    clearTimeout(flow.timer);
+    if (flows.get(providerId) === flow) flows.delete(providerId);
+  };
+  const stop = (providerId) => {
+    const flow = flows.get(providerId);
+    if (!flow) return;
+    drop(providerId, flow);
+    flow.controller.abort(cancelled());
+  };
+  return {
+    has: (providerId) => flows.has(providerId),
+    stop,
+    start(provider, name, context) {
+      stop(provider.id);
+      const oauth = provider.auth.oauth;
+      if (!oauth) return Promise.reject(new Error(SIGN_IN_UNFINISHED));
+      const controller = new AbortController();
+      const { signal } = controller;
+      const shown = Promise.withResolvers();
+      const attached = Promise.withResolvers();
+      const notify = (event) => {
+        if (event.type !== DEVICE_CODE) return;
+        if (!httpsUrl(event.verificationUri)) {
+          shown.reject(new Error(SIGN_IN_UNFINISHED));
+          controller.abort(new Error(SIGN_IN_UNFINISHED));
+          return;
+        }
+        shown.resolve({ url: event.verificationUri, code: event.userCode });
+      };
+      const prompt = async (asked) => {
+        if (asked.type === "select" && asked.options.some((option) => option.id === DEVICE_CODE))
+          return DEVICE_CODE;
+        throw new Error(SIGN_IN_UNFINISHED);
+      };
+      const until = (promise) => new Promise((resolve, reject) => {
+        signal.addEventListener("abort", () => reject(signal.reason), { once: true });
+        promise.then(resolve, reject);
+      });
+      const run = async () => {
+        const credential = await oauth.login({ signal, notify, prompt });
+        await until(attached.promise);
+        signal.throwIfAborted();
+        const response = tokenResponse(credential, now());
+        try {
+          await grant({
+            provider: provider.id,
+            name,
+            response,
+            ...settingsOf(provider.id, credential)
+          });
+        } catch (error) {
+          throw keptError(error);
+        } finally {
+          response.fill(0);
+        }
+      };
+      const done = run().catch((error) => {
+        throw signal.aborted && !(error instanceof Kept) ? cancelled() : flowError(error);
+      });
+      done.catch((error) => shown.reject(error));
+      const flow = {
+        controller,
+        attached,
+        done,
+        timer: setTimeout(() => stop(provider.id), options.attachMs ?? ATTACH_MS)
+      };
+      flows.set(provider.id, flow);
+      const off = follow(context.abortSignal, controller);
+      return shown.promise.finally(off);
+    },
+    async finish(providerId, context) {
+      const flow = flows.get(providerId);
+      if (!flow) throw new Error(SIGN_IN_UNFINISHED);
+      clearTimeout(flow.timer);
+      const off = follow(context.abortSignal, flow.controller);
+      flow.attached.resolve();
+      try {
+        await flow.done;
+      } finally {
+        off();
+        drop(providerId, flow);
+      }
+    }
+  };
+}
+export {
+  ATTACH_MS,
+  deviceFlows,
+  flowError,
+  keptError,
+  tokenResponse
+};
+//# sourceMappingURL=device.js.map

package/dist/device.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/device.ts"],
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type { AuthEvent, AuthPrompt, OAuthCredential, Provider } from '@earendil-works/pi-ai';\nimport { VaultRefusal } from './secrets/vault.ts';\nimport {\n  CODEX,\n  CODEX_ACCOUNT,\n  type DeviceSignIn,\n  httpsUrl,\n  NAME_TAKEN,\n  SIGN_IN_LOCKED,\n  SIGN_IN_REFUSED,\n  SIGN_IN_UNFINISHED,\n  SIGN_IN_UNKEPT,\n} from './sign-ins.ts';\n\nexport const ATTACH_MS = 60_000;\n\nexport interface ProviderGrant {\n  provider: string;\n  name: string;\n  response: Uint8Array;\n  settings?: Record<string, string>;\n}\n\nexport type Grant = (grant: ProviderGrant) => Promise<unknown>;\n\nexport interface DeviceFlows {\n  has(providerId: string): boolean;\n  start(provider: Provider, name: string, context: Context): Promise<DeviceSignIn>;\n  finish(providerId: string, context: Context): Promise<void>;\n  stop(providerId: string): void;\n}\n\ninterface Flow {\n  controller: AbortController;\n  attached: PromiseWithResolvers<void>;\n  timer: ReturnType<typeof setTimeout>;\n  done: Promise<void>;\n}\n\nclass Kept extends Error {}\n\nconst cancelled = () => new DOMException('The sign-in was cancelled.', 'AbortError');\n\nexport function keptError(error: unknown): Error {\n  if (error instanceof VaultRefusal && error.code === 'EEXIST') return new Kept(NAME_TAKEN);\n  if (error instanceof VaultRefusal && error.code === 'EACCES' && /lock/i.test(error.message))\n    return new Kept(SIGN_IN_LOCKED);\n  return new Kept(SIGN_IN_UNKEPT);\n}\n\nexport function flowError(error: unknown): Error {\n  if (error instanceof Kept) return error;\n  const text = error instanceof Error ? error.message : String(error ?? '');\n  return new Error(/denied|refused/i.test(text) ? SIGN_IN_REFUSED : SIGN_IN_UNFINISHED);\n}\n\nexport function tokenResponse(credential: OAuthCredential, now: number): Uint8Array {\n  const seconds = Math.round((credential.expires - now) / 1000);\n  return new TextEncoder().encode(\n    JSON.stringify({\n      access_token: credential.access,\n      ...(credential.refresh ? { refresh_token: credential.refresh } : {}),\n      token_type: 'Bearer',\n      ...(Number.isFinite(seconds) ? { expires_in: Math.max(0, seconds) } : {}),\n    })\n  );\n}\n\nfunction settingsOf(providerId: string, credential: OAuthCredential) {\n  const account = credential.accountId;\n  return providerId === CODEX && typeof account === 'string' && account\n    ? { settings: { [CODEX_ACCOUNT]: account } }\n    : {};\n}\n\nfunction follow(signal: AbortSignal | undefined, controller: AbortController): () => void {\n  const abort = () => controller.abort(cancelled());\n  if (signal?.aborted) abort();\n  signal?.addEventListener('abort', abort, { once: true });\n  return () => signal?.removeEventListener('abort', abort);\n}\n\nconst DEVICE_CODE = 'device_code';\n\nexport function deviceFlows(\n  grant: Grant,\n  options: { attachMs?: number; now?: () => number } = {}\n): DeviceFlows {\n  const flows = new Map<string, Flow>();\n  const now = options.now ?? Date.now;\n  const drop = (providerId: string, flow: Flow) => {\n    clearTimeout(flow.timer);\n    if (flows.get(providerId) === flow) flows.delete(providerId);\n  };\n  const stop = (providerId: string) => {\n    const flow = flows.get(providerId);\n    if (!flow) return;\n    drop(providerId, flow);\n    flow.controller.abort(cancelled());\n  };\n  return {\n    has: (providerId) => flows.has(providerId),\n    stop,\n    start(provider, name, context) {\n      stop(provider.id);\n      const oauth = provider.auth.oauth;\n      if (!oauth) return Promise.reject(new Error(SIGN_IN_UNFINISHED));\n      const controller = new AbortController();\n      const { signal } = controller;\n      const shown = Promise.withResolvers<DeviceSignIn>();\n      const attached = Promise.withResolvers<void>();\n      const notify = (event: AuthEvent) => {\n        if (event.type !== DEVICE_CODE) return;\n        if (!httpsUrl(event.verificationUri)) {\n          shown.reject(new Error(SIGN_IN_UNFINISHED));\n          controller.abort(new Error(SIGN_IN_UNFINISHED));\n          return;\n        }\n        shown.resolve({ url: event.verificationUri, code: event.userCode });\n      };\n      const prompt = async (asked: AuthPrompt) => {\n        if (asked.type === 'select' && asked.options.some((option) => option.id === DEVICE_CODE))\n          return DEVICE_CODE;\n        throw new Error(SIGN_IN_UNFINISHED);\n      };\n      const until = (promise: Promise<void>) =>\n        new Promise<void>((resolve, reject) => {\n          signal.addEventListener('abort', () => reject(signal.reason), { once: true });\n          promise.then(resolve, reject);\n        });\n      const run = async () => {\n        const credential = await oauth.login({ signal, notify, prompt });\n        await until(attached.promise);\n        signal.throwIfAborted();\n        const response = tokenResponse(credential, now());\n        try {\n          await grant({\n            provider: provider.id,\n            name,\n            response,\n            ...settingsOf(provider.id, credential),\n          });\n        } catch (error) {\n          throw keptError(error);\n        } finally {\n          response.fill(0);\n        }\n      };\n      const done = run().catch((error: unknown) => {\n        throw signal.aborted && !(error instanceof Kept) ? cancelled() : flowError(error);\n      });\n      done.catch((error: unknown) => shown.reject(error));\n      const flow: Flow = {\n        controller,\n        attached,\n        done,\n        timer: setTimeout(() => stop(provider.id), options.attachMs ?? ATTACH_MS),\n      };\n      flows.set(provider.id, flow);\n      const off = follow(context.abortSignal, controller);\n      return shown.promise.finally(off);\n    },\n    async finish(providerId, context) {\n      const flow = flows.get(providerId);\n      if (!flow) throw new Error(SIGN_IN_UNFINISHED);\n      clearTimeout(flow.timer);\n      const off = follow(context.abortSignal, flow.controller);\n      flow.attached.resolve();\n      try {\n        await flow.done;\n      } finally {\n        off();\n        drop(providerId, flow);\n      }\n    },\n  };\n}\n"],
+  "mappings": "AAEA,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,YAAY;AAyBzB,MAAM,aAAa,MAAM;AAAC;AAE1B,MAAM,YAAY,MAAM,IAAI,aAAa,8BAA8B,YAAY;AAE5E,SAAS,UAAU,OAAuB;AAC/C,MAAI,iBAAiB,gBAAgB,MAAM,SAAS,SAAU,QAAO,IAAI,KAAK,UAAU;AACxF,MAAI,iBAAiB,gBAAgB,MAAM,SAAS,YAAY,QAAQ,KAAK,MAAM,OAAO;AACxF,WAAO,IAAI,KAAK,cAAc;AAChC,SAAO,IAAI,KAAK,cAAc;AAChC;AAEO,SAAS,UAAU,OAAuB;AAC/C,MAAI,iBAAiB,KAAM,QAAO;AAClC,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,SAAS,EAAE;AACxE,SAAO,IAAI,MAAM,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,kBAAkB;AACtF;AAEO,SAAS,cAAc,YAA6B,KAAyB;AAClF,QAAM,UAAU,KAAK,OAAO,WAAW,UAAU,OAAO,GAAI;AAC5D,SAAO,IAAI,YAAY,EAAE;AAAA,IACvB,KAAK,UAAU;AAAA,MACb,cAAc,WAAW;AAAA,MACzB,GAAI,WAAW,UAAU,EAAE,eAAe,WAAW,QAAQ,IAAI,CAAC;AAAA,MAClE,YAAY;AAAA,MACZ,GAAI,OAAO,SAAS,OAAO,IAAI,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;AAAA,IACzE,CAAC;AAAA,EACH;AACF;AAEA,SAAS,WAAW,YAAoB,YAA6B;AACnE,QAAM,UAAU,WAAW;AAC3B,SAAO,eAAe,SAAS,OAAO,YAAY,YAAY,UAC1D,EAAE,UAAU,EAAE,CAAC,aAAa,GAAG,QAAQ,EAAE,IACzC,CAAC;AACP;AAEA,SAAS,OAAO,QAAiC,YAAyC;AACxF,QAAM,QAAQ,MAAM,WAAW,MAAM,UAAU,CAAC;AAChD,MAAI,QAAQ,QAAS,OAAM;AAC3B,UAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,SAAO,MAAM,QAAQ,oBAAoB,SAAS,KAAK;AACzD;AAEA,MAAM,cAAc;AAEb,SAAS,YACd,OACA,UAAqD,CAAC,GACzC;AACb,QAAM,QAAQ,oBAAI,IAAkB;AACpC,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,OAAO,CAAC,YAAoB,SAAe;AAC/C,iBAAa,KAAK,KAAK;AACvB,QAAI,MAAM,IAAI,UAAU,MAAM,KAAM,OAAM,OAAO,UAAU;AAAA,EAC7D;AACA,QAAM,OAAO,CAAC,eAAuB;AACnC,UAAM,OAAO,MAAM,IAAI,UAAU;AACjC,QAAI,CAAC,KAAM;AACX,SAAK,YAAY,IAAI;AACrB,SAAK,WAAW,MAAM,UAAU,CAAC;AAAA,EACnC;AACA,SAAO;AAAA,IACL,KAAK,CAAC,eAAe,MAAM,IAAI,UAAU;AAAA,IACzC;AAAA,IACA,MAAM,UAAU,MAAM,SAAS;AAC7B,WAAK,SAAS,EAAE;AAChB,YAAM,QAAQ,SAAS,KAAK;AAC5B,UAAI,CAAC,MAAO,QAAO,QAAQ,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAC/D,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,EAAE,OAAO,IAAI;AACnB,YAAM,QAAQ,QAAQ,cAA4B;AAClD,YAAM,WAAW,QAAQ,cAAoB;AAC7C,YAAM,SAAS,CAAC,UAAqB;AACnC,YAAI,MAAM,SAAS,YAAa;AAChC,YAAI,CAAC,SAAS,MAAM,eAAe,GAAG;AACpC,gBAAM,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAC1C,qBAAW,MAAM,IAAI,MAAM,kBAAkB,CAAC;AAC9C;AAAA,QACF;AACA,cAAM,QAAQ,EAAE,KAAK,MAAM,iBAAiB,MAAM,MAAM,SAAS,CAAC;AAAA,MACpE;AACA,YAAM,SAAS,OAAO,UAAsB;AAC1C,YAAI,MAAM,SAAS,YAAY,MAAM,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,WAAW;AACrF,iBAAO;AACT,cAAM,IAAI,MAAM,kBAAkB;AAAA,MACpC;AACA,YAAM,QAAQ,CAAC,YACb,IAAI,QAAc,CAAC,SAAS,WAAW;AACrC,eAAO,iBAAiB,SAAS,MAAM,OAAO,OAAO,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAC5E,gBAAQ,KAAK,SAAS,MAAM;AAAA,MAC9B,CAAC;AACH,YAAM,MAAM,YAAY;AACtB,cAAM,aAAa,MAAM,MAAM,MAAM,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC/D,cAAM,MAAM,SAAS,OAAO;AAC5B,eAAO,eAAe;AACtB,cAAM,WAAW,cAAc,YAAY,IAAI,CAAC;AAChD,YAAI;AACF,gBAAM,MAAM;AAAA,YACV,UAAU,SAAS;AAAA,YACnB;AAAA,YACA;AAAA,YACA,GAAG,WAAW,SAAS,IAAI,UAAU;AAAA,UACvC,CAAC;AAAA,QACH,SAAS,OAAO;AACd,gBAAM,UAAU,KAAK;AAAA,QACvB,UAAE;AACA,mBAAS,KAAK,CAAC;AAAA,QACjB;AAAA,MACF;AACA,YAAM,OAAO,IAAI,EAAE,MAAM,CAAC,UAAmB;AAC3C,cAAM,OAAO,WAAW,EAAE,iBAAiB,QAAQ,UAAU,IAAI,UAAU,KAAK;AAAA,MAClF,CAAC;AACD,WAAK,MAAM,CAAC,UAAmB,MAAM,OAAO,KAAK,CAAC;AAClD,YAAM,OAAa;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,WAAW,MAAM,KAAK,SAAS,EAAE,GAAG,QAAQ,YAAY,SAAS;AAAA,MAC1E;AACA,YAAM,IAAI,SAAS,IAAI,IAAI;AAC3B,YAAM,MAAM,OAAO,QAAQ,aAAa,UAAU;AAClD,aAAO,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAClC;AAAA,IACA,MAAM,OAAO,YAAY,SAAS;AAChC,YAAM,OAAO,MAAM,IAAI,UAAU;AACjC,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kBAAkB;AAC7C,mBAAa,KAAK,KAAK;AACvB,YAAM,MAAM,OAAO,QAAQ,aAAa,KAAK,UAAU;AACvD,WAAK,SAAS,QAAQ;AACtB,UAAI;AACF,cAAM,KAAK;AAAA,MACb,UAAE;AACA,YAAI;AACJ,aAAK,YAAY,IAAI;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/main.js

@@ -22,6 +22,7 @@ import {
   locateWasm,
   sandboxFactory
 } from "./codemode/index.js";
+import { codexFetch } from "./codex.js";
 import { attachFreezer } from "./freezer/index.js";
 import { lateGelatiere } from "./gelatiere/index.js";
 import { hostAgent } from "./host.js";
@@ -197,11 +198,13 @@ async function modelsOf(scope, options, given) {
   );
   await models.refresh({ allowNetwork: false }).catch(() => void 0);
   const bases = () => modelBases(providers, models, fields.env);
-  scope.fetch = vaultFetch(
-    vault,
-    transport,
-    modelRoute(bases, () => records.state.value),
-    records.rejecting
+  scope.fetch = codexFetch(
+    vaultFetch(
+      vault,
+      transport,
+      modelRoute(bases, () => records.state.value),
+      records.rejecting
+    )
   );
   const endpoints = vaultEndpoints(vault);
   const defaultModel = async () => {
@@ -266,7 +269,8 @@ async function settingsOf(made, mcp, moved) {
   const settings = await createAgentSettings(models, { records, fields }, providers, {
     mcp,
     moved: keys,
-    reach
+    reach,
+    vault: moved.vault
   });
   settings.state.subscribe(() => void moved.licks.flush(BACKGROUND_CONTEXT).catch(() => void 0));
   return settings;

package/dist/main.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/main.ts"],
-  "sourcesContent": ["import { attachKernel } from '@ai-ecoverse/slicc-kernel';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Provider } from '@earendil-works/pi-ai';\nimport type { Models } from '@earendil-works/pi-ai/models';\nimport {\n  createRegistry,\n  type ModelRef,\n  type Storage,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { CodingTools } from '@earendil-works/pi-durable/tools';\nimport { type Agent, type AgentOptions, openAgent } from './agent.ts';\nimport {\n  type ApprovalJudge,\n  approvalJudge,\n  judgeModelOf,\n  judgeSpender,\n  ownerIntent,\n  seedPolicy,\n  verdictRecorder,\n} from './approvals/index.ts';\nimport { browserGuard } from './browser/guard.ts';\nimport { attachChanges, CHANGES_MS } from './changes/index.ts';\nimport {\n  codemodeExtension,\n  codemodeTool,\n  disabledBySettings,\n  locateWasm,\n  sandboxFactory,\n} from './codemode/index.ts';\nimport { attachFreezer } from './freezer/index.ts';\nimport { lateGelatiere } from './gelatiere/index.ts';\nimport { type AgentHost, hostAgent } from './host.ts';\nimport { imageReads } from './images/index.ts';\nimport { createActivity } from './kernel/activity.ts';\nimport { type AgentUsers, agentUsers, warnSupport } from './kernel/agent-users.ts';\nimport type { KernelClient } from './kernel/client.ts';\nimport { HOME, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nimport { processGroups } from './kernel/groups.ts';\nimport { backgroundJobs } from './kernel/jobs.ts';\nimport { adminOver, type UserClient, type UserClients, userClients } from './kernel/users.ts';\nimport { AGENT_DIR, ROOT_HOME } from './layout.ts';\nimport { type Licks, setupLicks } from './licks/index.ts';\nimport { lickTriage } from './licks/triage.ts';\nimport { type McpAccounts, setupMcp } from './mcp/index.ts';\nimport type { MemoryEntry } from './memory/format.ts';\nimport { setupMemory } from './memory/index.ts';\nimport { modelsCommand } from './models/index.ts';\nimport { pageOnly, type Reach, type Transport, transportFetch, transportReach } from './net.ts';\nimport { sliccPrompt } from './prompt.ts';\nimport { AZURE, azureBase } from './providers.ts';\nimport { createPages } from './remote/pages.ts';\nimport { identity } from './scoops/identity.ts';\nimport { type Assets, packageAssets, type ScoopsRuntime, setupScoops } from './scoops/index.ts';\nimport { vaultCredentials } from './secrets/credentials.ts';\nimport {\n  BEDROCK_ENDPOINTS,\n  type ModelBases,\n  modelRoute,\n  vaultEndpoints,\n} from './secrets/endpoints.ts';\nimport { secretsExtension, shellGrants } from './secrets/extension.ts';\nimport { grantFetch, mcpFetch, vaultFetch } from './secrets/fetch.ts';\nimport { keysMoved, type Wiped, wipeLegacy } from './secrets/legacy.ts';\nimport { secretNames } from './secrets/names.ts';\nimport { type VaultRecords, vaultRecords } from './secrets/records.ts';\nimport { scrubWith } from './secrets/scrub.ts';\nimport { fileStore, type PlainStore } from './secrets/store.ts';\nimport { listenVault, Vault, WAITING_MS } from './secrets/vault.ts';\nimport { type Choosable, unfreeze, unfreezeCreated } from './selection.ts';\nimport {\n  BEDROCK,\n  catalogStore,\n  createAgentSettings,\n  createSliccModels,\n  providerFields,\n  resolveDefaultModel,\n  sliccProviders,\n} from './settings.ts';\nimport { RELOAD_MS, setupSkills } from './skills/index.ts';\nimport { setupSprinkles } from './sprinkles/index.ts';\nimport { openOpfsSqliteStorage } from './sqlite.ts';\nimport {\n  agentVersion,\n  browserConnected,\n  commandsOnPath,\n  kernelBoot,\n  transportName,\n} from './system.ts';\nimport { titlesExtension } from './titles/extension.ts';\nimport { labeler, settingsText, titler } from './titles/generate.ts';\nimport { attachLabels } from './titles/labels.ts';\nimport { type KernelPorts, kernelPorts, serveConnections, type WorkerScope } from './worker.ts';\n\nexport interface AgentWorkerScope extends WorkerScope {\n  fetch: typeof fetch;\n  location: { origin: string };\n}\n\nexport type KernelAttach = (port: MessagePort) => Promise<KernelClient & { transport: Transport }>;\n\nexport interface AgentWorkerOptions {\n  model?: ModelRef;\n  providers?: Provider[];\n  attach?: KernelAttach;\n  store?: () => Promise<PlainStore>;\n  storage?: () => Promise<Storage>;\n  assets?: Assets;\n  codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;\n  codemodeWorker?: string | URL;\n  catalog?: string;\n  users?: boolean;\n  mcpRedirect?: string;\n  approvalMs?: number;\n}\n\nexport function usersOf(\n  admin: MessagePort | undefined,\n  wanted: boolean | undefined,\n  attach: KernelAttach\n): UserClients | undefined {\n  if (!admin) return undefined;\n  if (wanted === false) {\n    admin.close();\n    return undefined;\n  }\n  return userClients(adminOver(admin), attach as (port: MessagePort) => Promise<UserClient>);\n}\n\nexport const STORE_DIR = '/.slicc';\nexport const ACCOUNTS_FILE = `${STORE_DIR}/accounts.json`;\nexport const MODELS_FILE = `${STORE_DIR}/models.json`;\n\nasync function attached(ports: Promise<KernelPorts>, options: AgentWorkerOptions) {\n  const wiped = await wipeLegacy();\n  const attach: KernelAttach = options.attach ?? attachKernel;\n  const { kernel, admin } = await ports;\n  const client = await attach(kernel);\n  const users = usersOf(admin, options.users, attach);\n  await warnSupport(users, client, options.users);\n  const home = new SliccKernelEnv(client, { cwd: HOME });\n  await privateStore(home);\n  return {\n    client,\n    users,\n    home,\n    wiped,\n    at: { home: HOME, ...(users ? { agentDir: AGENT_DIR } : {}) },\n  };\n}\n\nfunction privateStore(env: SliccKernelEnv): Promise<unknown> {\n  return env.exec(`mkdir -p ${STORE_DIR} && chmod 700 ${STORE_DIR}`, undefined, BACKGROUND_CONTEXT);\n}\n\nasync function codemodeTools(\n  client: KernelClient,\n  options: AgentWorkerOptions,\n  native: typeof fetch,\n  extra: Parameters<typeof codemodeTool>[0]['extra'],\n  dir = `${HOME}/.pi/agent`\n) {\n  const settings = await client.fs.readFile(`${dir}/settings.json`).catch(() => undefined);\n  if (disabledBySettings(settings === undefined ? undefined : new TextDecoder().decode(settings)))\n    return [];\n  const sandbox = sandboxFactory(\n    options.codemodeWasm ?? (() => locateWasm(native, new URL(import.meta.url))),\n    options.codemodeWorker\n  );\n  return [\n    codemodeTool({ declared: CodingTools.tools as readonly ToolRegistration[], sandbox, extra }),\n  ];\n}\n\nexport function seesImages(models: Pick<Models, 'getModel'>, ref: ModelRef | undefined): boolean {\n  const found = ref && models.getModel(ref.provider, ref.modelId);\n  return found ? found.input.includes('image') : true;\n}\n\nexport const MCP_CALLBACK = '/oauth/mcp-callback';\n\nasync function openUnfrozen(\n  options: AgentWorkerOptions,\n  { choosable: chosen }: { choosable: Choosable },\n  base: Omit<AgentOptions, 'storage' | 'beforeResume' | 'conversationCreated'>\n): Promise<Agent> {\n  const storage = await (options.storage ?? (() => openOpfsSqliteStorage()))();\n  return openAgent({\n    ...base,\n    storage,\n    conversationCreated: unfreezeCreated(chosen),\n    beforeResume: (harness, using) => unfreeze(harness, storage, chosen, using),\n  });\n}\n\nasync function secretsFor(home: SliccKernelEnv, vault: Vault) {\n  scrubWith(vault);\n  const names = secretNames(home, vault);\n  await names.refresh(BACKGROUND_CONTEXT);\n  return names;\n}\n\nexport function modelBases(\n  providers: readonly Provider[],\n  models: Pick<ReturnType<typeof createSliccModels>, 'getModels'>,\n  env: (providerId: string) => Readonly<Record<string, string>> | undefined = () => undefined\n): ModelBases[] {\n  return providers.map((provider) => ({\n    provider: provider.id,\n    urls: [\n      ...new Set(\n        [\n          provider.baseUrl,\n          ...models.getModels(provider.id).map((model) => model.baseUrl),\n          ...(provider.id === BEDROCK ? BEDROCK_ENDPOINTS : []),\n          ...(provider.id === AZURE ? [azureBase(env(provider.id) ?? {})] : []),\n        ].filter((url): url is string => typeof url === 'string' && url !== '')\n      ),\n    ],\n  }));\n}\n\nfunction mcpVault(\n  vault: Vault,\n  made: { store: PlainStore; records: VaultRecords; endpoints: ReturnType<typeof vaultEndpoints> }\n) {\n  const { store, records, endpoints } = made;\n  return {\n    store,\n    vault: {\n      records,\n      fetch: (server: string, base: typeof fetch) => mcpFetch(vault, base, server),\n      grant: (server: string, base: typeof fetch) => grantFetch(vault, server, base),\n      servers: endpoints.servers,\n      token: endpoints.token,\n    },\n  };\n}\n\nfunction hostSecrets(\n  vault: Vault,\n  names: Awaited<ReturnType<typeof secretsFor>>,\n  parts: readonly { close(): void }[]\n) {\n  return {\n    vault: vault.state,\n    list: () => names.state.value,\n    close: () => {\n      for (const part of parts) part.close();\n    },\n  };\n}\n\nasync function modelsOf(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions,\n  given: { vault: Vault; home: SliccKernelEnv; transport: typeof fetch; version: string }\n) {\n  const { vault, home, transport, version } = given;\n  const store = await (options.store ?? (async () => fileStore(home, ACCOUNTS_FILE)))();\n  const records = vaultRecords(vault);\n  const loaded = records.refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n  const providers = options.providers ?? sliccProviders(version);\n  const fields = await providerFields(store, providers);\n  const credentials = vaultCredentials(records, fields.env, fields.ready);\n  const models = createSliccModels(\n    credentials,\n    providers,\n    catalogStore(fileStore(home, MODELS_FILE))\n  );\n  await models.refresh({ allowNetwork: false }).catch(() => undefined);\n  const bases = () => modelBases(providers, models, fields.env);\n  scope.fetch = vaultFetch(\n    vault,\n    transport,\n    modelRoute(bases, () => records.state.value),\n    records.rejecting\n  );\n  const endpoints = vaultEndpoints(vault);\n  const defaultModel = async () => {\n    await Promise.race([loaded, new Promise((resolve) => setTimeout(resolve, WAITING_MS))]);\n    return resolveDefaultModel(credentials, providers, models);\n  };\n  return { store, records, providers, fields, models, bases, endpoints, defaultModel };\n}\n\nfunction baseRegistry(facts: Awaited<ReturnType<typeof factsOf>>, origin: string) {\n  const registry = createRegistry();\n  registry.install(CodingTools);\n  registry.install(browserGuard([origin]));\n  registry.install(sliccPrompt(facts));\n  const read = (CodingTools.tools as readonly ToolRegistration[]).find(\n    (tool) => tool.name === 'read'\n  ) as ToolRegistration;\n  registry.install(imageReads(read));\n  return registry;\n}\n\nasync function factsOf(client: KernelClient & { transport: Transport }, native: typeof fetch) {\n  return {\n    version: await agentVersion((url) => native(url)),\n    commands: await commandsOnPath(client),\n    transport: transportName(client.transport),\n    browser: await browserConnected(client),\n  };\n}\n\nfunction routeFetch(scope: AgentWorkerScope, client: KernelClient & { transport: Transport }) {\n  const native = scope.fetch.bind(scope);\n  const loopback = client.loopbackFetch?.bind(client);\n  const transport = transportFetch(client.transport, scope.location.origin, native, loopback);\n  scope.fetch = transport;\n  return { native, transport };\n}\n\nasync function prepare(\n  scope: AgentWorkerScope,\n  kernel: { client: KernelClient & { transport: Transport }; home: SliccKernelEnv; vault: Vault },\n  options: AgentWorkerOptions\n) {\n  const names = await secretsFor(kernel.home, kernel.vault);\n  const { native, transport } = routeFetch(scope, kernel.client);\n  const facts = await factsOf(kernel.client, native);\n  const made = await modelsOf(scope, options, {\n    vault: kernel.vault,\n    home: kernel.home,\n    transport,\n    version: facts.version,\n  });\n  return {\n    names,\n    native,\n    transport,\n    facts,\n    ...made,\n    reach: transportReach(kernel.client),\n    registry: baseRegistry(facts, scope.location.origin),\n  };\n}\n\nfunction modelsOfAgent(\n  agent: Agent,\n  settings: Awaited<ReturnType<typeof createAgentSettings>>,\n  catalog: Models,\n  vault: Vault\n) {\n  const locked = () => vault.state.value.locked !== 'no';\n  return modelsCommand({ agents: agent.agents, settings, catalog, locked });\n}\n\nasync function settingsOf(\n  made: Awaited<ReturnType<typeof modelsOf>> & { reach: Reach },\n  mcp: McpAccounts,\n  moved: { agent: Agent; vault: Vault; wiped: Wiped; licks: Licks }\n) {\n  const { models, records, fields, providers, reach } = made;\n  const keys = await keysMoved(moved.agent.harness, { records, vault: moved.vault }, moved.wiped);\n  const settings = await createAgentSettings(models, { records, fields }, providers, {\n    mcp,\n    moved: keys,\n    reach,\n  });\n  settings.state.subscribe(() => void moved.licks.flush(BACKGROUND_CONTEXT).catch(() => undefined));\n  return settings;\n}\n\nasync function setupApprovals(\n  models: Models,\n  home: SliccKernelEnv,\n  at: { home: string; agentDir?: string },\n  agent: Agent,\n  stored: { readonly value: readonly MemoryEntry[] | undefined },\n  options: Pick<AgentWorkerOptions, 'approvalMs'>\n) {\n  const memories = () => stored.value;\n  const { approvalMs } = options;\n  await seedPolicy(home, BACKGROUND_CONTEXT).catch(() => false);\n  const settings = settingsText(home, HOME, at.agentDir);\n  const intent = ownerIntent({ env: home, agents: agent.agents, memories });\n  const judge: ApprovalJudge = {\n    judge: approvalJudge({\n      models,\n      model: async (context) => judgeModelOf(await settings(context)),\n      intent,\n      spend: judgeSpender((agentId, context) => agent.agents.conversation(agentId, context)),\n    }),\n    record: verdictRecorder((agentId, context) => agent.agents.conversation(agentId, context)),\n  };\n  return { judge, intent, ...(approvalMs ? { approvalMs } : {}) };\n}\n\nfunction setupTitles(\n  registry: ReturnType<typeof createRegistry>,\n  models: Models,\n  home: SliccKernelEnv,\n  at: { home: string; agentDir?: string },\n  opened: () => Agent | undefined\n) {\n  const settings = settingsText(home, HOME, at.agentDir);\n  const titleFn = titler(models, settings);\n  const titles = titlesExtension({\n    agents: () => opened()?.agents,\n    harness: () => opened()?.harness,\n    title: () => titleFn,\n  });\n  registry.install(titles.extension);\n  return { titleFn, cancel: titles.cancel, label: labeler(models, settings) };\n}\n\nfunction freezerOf(\n  agent: Agent,\n  parts: {\n    home: SliccKernelEnv;\n    memory: ReturnType<typeof setupMemory>;\n    titles: ReturnType<typeof setupTitles>;\n    people: AgentUsers | undefined;\n    users: UserClients | undefined;\n    ready: { providers: readonly Provider[]; models: ReturnType<typeof createSliccModels> };\n  }\n) {\n  const { home, memory, titles, people, users, ready } = parts;\n  return attachFreezer({\n    harness: agent.harness,\n    agents: agent.agents,\n    env: home,\n    extract: memory.extract,\n    title: titles.titleFn,\n    cancelTitle: titles.cancel,\n    ...(people ? { layout: people.layout } : {}),\n    imports: {\n      env: home,\n      memoryHome: people ? ROOT_HOME : HOME,\n      catalog: ready.models,\n      providers: ready.providers,\n      ...(users ? { users: users.users } : {}),\n      ...(people ? { envOf: (cone: string) => people.envOfAgent(`cone:${cone}`) } : {}),\n    },\n  });\n}\n\nasync function start(\n  scope: AgentWorkerScope,\n  ports: Promise<KernelPorts>,\n  options: AgentWorkerOptions,\n  vault: Vault\n): Promise<AgentHost> {\n  const { client, users, home, at, wiped } = await attached(ports, options);\n  const ready = await prepare(scope, { client, home, vault }, options);\n  const { names, native, transport, facts, models, registry, records, endpoints } = ready;\n  const memory = setupMemory(registry);\n  const coding = CodingTools.tools as readonly ToolRegistration[];\n  const mcp = setupMcp(registry);\n  const codemode = await codemodeTools(client, options, native, mcp.codemode, at.agentDir);\n  registry.install(codemodeExtension(codemode));\n  const licks = setupLicks(registry, transport);\n  licks.licks.triage(lickTriage(models));\n  const scoops = setupScoops(registry, licks.licks, [...coding, ...codemode, ...memory.tools]);\n  const skills = setupSkills(registry, licks.licks);\n  registry.install(secretsExtension({ names, vault }));\n  const titles = setupTitles(registry, models, home, at, () => opened);\n  const [activity, groups, jobs] = [\n    createActivity(),\n    processGroups(client),\n    backgroundJobs(client),\n  ];\n  const model = options.model ?? (await ready.defaultModel());\n  let opened: Agent | undefined;\n  const people = users ? agentUsers(users, client, home, () => opened?.agents) : undefined;\n  const environment = kernelEnvironment(client, {\n    activity,\n    groups,\n    jobs,\n    identify: identity(() => opened?.agents, model),\n    scrub: vault,\n    spawn: shellGrants(names),\n    ...(people ? { route: people.route } : {}),\n  });\n  const agent = await openUnfrozen(options, scoops, { models, model, registry, env: environment });\n  opened = agent;\n  await people?.start(agent.agents);\n  const sources = licks.attach(agent, {\n    env: home,\n    home: HOME,\n    models,\n    activity,\n    jobs,\n    ...(people ? { dirs: () => people.lickDirs(), cronUser: people.cronUser.bind(people) } : {}),\n  });\n  await sources.start(BACKGROUND_CONTEXT);\n  const booted = { version: facts.version, boot: await kernelBoot(client) };\n  await sources.boot(booted, BACKGROUND_CONTEXT);\n  const skillsRuntime = await skills.attach(\n    {\n      env: home,\n      ...at,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n      ...(people ? { people: people.people } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const mcpRuntime = await mcp.attach(\n    {\n      env: home,\n      ...at,\n      ...mcpVault(vault, ready),\n      licks: licks.licks,\n      fetch: transport,\n      version: facts.version,\n      reloadMs: RELOAD_MS,\n      codemode: codemode.length > 0,\n      cors: pageOnly(client.transport),\n      redirect: options.mcpRedirect ?? new URL(MCP_CALLBACK, scope.location.origin).href,\n    },\n    BACKGROUND_CONTEXT\n  );\n  const gelatiere = lateGelatiere();\n  const sprinkles = await setupSprinkles().attach(\n    {\n      intercept: gelatiere.intercept,\n      harness: agent.harness,\n      agents: agent.agents,\n      licks: licks.licks,\n      env: home,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n      ...(people?.sprinkles() ?? {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  people?.follow([sources, skillsRuntime, sprinkles]);\n  let roles: ScoopsRuntime | undefined;\n  const memoryRuntime = await memory.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      env: home,\n      ...at,\n      ...(people ? { home: ROOT_HOME } : {}),\n      reloadMs: RELOAD_MS,\n      roles: async (using) => roles?.roles(using),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const freezer = freezerOf(agent, { home, memory, titles, people, users, ready });\n  licks.licks.guard(freezer.frozenTarget);\n  const settings = await settingsOf(ready, mcpRuntime, { agent, vault, wiped, licks: licks.licks });\n  const pages = createPages({ claim: sprinkles.claim });\n  const runtime = await scoops.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      groups,\n      env: home,\n      envOf: async (conversationId, context) => environment({ conversationId }, context),\n      ...at,\n      ...(people\n        ? { layout: people.layout, spools: people.spools, enforced: people.enforced }\n        : {}),\n      alive: alive(client),\n      reads: skillsRuntime.dirs,\n      memory: memoryRuntime.command,\n      gelatiere: gelatiere.command,\n      freezer: freezer.command,\n      models: modelsOfAgent(agent, settings, models, vault),\n      panel: pages.command,\n      webhook: sources.webhook,\n      mcp: mcp.direct,\n      ...(options.assets ? { assets: options.assets } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  roles = runtime;\n  gelatiere.attach({\n    agents: agent.agents,\n    licks: licks.licks,\n    env: home,\n    home: HOME,\n    ...(await people?.gelatiere(home)),\n    scoops: scoops.scoops,\n    roles: runtime.roles,\n    assets: options.assets ?? packageAssets(),\n    fetch: scope.fetch,\n    skills: skillsRuntime.skills,\n    ...(options.catalog ? { catalog: options.catalog } : {}),\n  });\n  await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => undefined);\n  return hostAgent(agent, {\n    ...(await setupApprovals(models, home, at, agent, memoryRuntime.memories, options)),\n    settings,\n    licks: { licks: licks.licks, sources },\n    scoops: { scoops: scoops.scoops, runtime },\n    skills: skillsRuntime,\n    sprinkles,\n    memory: memoryRuntime,\n    freezer,\n    changes: attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS }),\n    pages,\n    labels: await attachLabels({ ...agent, label: titles.label, vault: vault.state }),\n    mcp: mcpRuntime,\n    ...(users ? { users } : {}),\n    secrets: hostSecrets(vault, names, [names, records, endpoints]),\n    uploads: {\n      env: environment,\n      sees: (ref) => seesImages(models, ref),\n    },\n    monitor: {\n      kernel: client,\n      groups,\n      ...(users ? { users: () => users.users.list() } : {}),\n    },\n  });\n}\n\nexport function alive(client: KernelClient) {\n  return async (pid: number): Promise<boolean> => {\n    if (!client.ps) return true;\n    return (await client.ps()).some((process) => process.pid === pid);\n  };\n}\n\nexport function runAgentWorker(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions = {}\n): Promise<AgentHost> {\n  const vault = new Vault();\n  listenVault(scope, vault);\n  const host = start(scope, kernelPorts(scope), options, vault);\n  host.catch(() => undefined);\n  serveConnections(scope, host);\n  return host;\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AAGnC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,mBAAmB;AAC5B,SAAwC,iBAAiB;AACzD;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,eAAe,kBAAkB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;AAC9B,SAAyB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAC/B,SAA0B,YAAY,mBAAmB;AAEzD,SAAS,MAAM,mBAAmB,sBAAsB;AACxD,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAC/B,SAAS,WAA8C,mBAAmB;AAC1E,SAAS,WAAW,iBAAiB;AACrC,SAAqB,kBAAkB;AACvC,SAAS,kBAAkB;AAC3B,SAA2B,gBAAgB;AAE3C,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAS,UAAsC,gBAAgB,sBAAsB;AACrF,SAAS,mBAAmB;AAC5B,SAAS,OAAO,iBAAiB;AACjC,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAsB,eAAmC,mBAAmB;AAC5E,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,mBAAmB;AAC9C,SAAS,YAAY,UAAU,kBAAkB;AACjD,SAAS,WAAuB,kBAAkB;AAClD,SAAS,mBAAmB;AAC5B,SAA4B,oBAAoB;AAChD,SAAS,iBAAiB;AAC1B,SAAS,iBAAkC;AAC3C,SAAS,aAAa,OAAO,kBAAkB;AAC/C,SAAyB,UAAU,uBAAuB;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,mBAAmB;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,SAAS,cAAc,cAAc;AAC9C,SAAS,oBAAoB;AAC7B,SAA2B,aAAa,wBAA0C;AAwB3E,SAAS,QACd,OACA,QACA,QACyB;AACzB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,WAAW,OAAO;AACpB,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY,UAAU,KAAK,GAAG,MAAoD;AAC3F;AAEO,MAAM,YAAY;AAClB,MAAM,gBAAgB,GAAG,SAAS;AAClC,MAAM,cAAc,GAAG,SAAS;AAEvC,eAAe,SAAS,OAA6B,SAA6B;AAChF,QAAM,QAAQ,MAAM,WAAW;AAC/B,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM;AAChC,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,QAAM,QAAQ,QAAQ,OAAO,QAAQ,OAAO,MAAM;AAClD,QAAM,YAAY,OAAO,QAAQ,QAAQ,KAAK;AAC9C,QAAM,OAAO,IAAI,eAAe,QAAQ,EAAE,KAAK,KAAK,CAAC;AACrD,QAAM,aAAa,IAAI;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,EAAE,MAAM,MAAM,GAAI,QAAQ,EAAE,UAAU,UAAU,IAAI,CAAC,EAAG;AAAA,EAC9D;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,SAAO,IAAI,KAAK,YAAY,SAAS,iBAAiB,SAAS,IAAI,QAAW,kBAAkB;AAClG;AAEA,eAAe,cACb,QACA,SACA,QACA,OACA,MAAM,GAAG,IAAI,cACb;AACA,QAAM,WAAW,MAAM,OAAO,GAAG,SAAS,GAAG,GAAG,gBAAgB,EAAE,MAAM,MAAM,MAAS;AACvF,MAAI,mBAAmB,aAAa,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC5F,WAAO,CAAC;AACV,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB,MAAM,WAAW,QAAQ,IAAI,IAAI,YAAY,GAAG,CAAC;AAAA,IAC1E,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,EAAE,UAAU,YAAY,OAAsC,SAAS,MAAM,CAAC;AAAA,EAC7F;AACF;AAEO,SAAS,WAAW,QAAkC,KAAoC;AAC/F,QAAM,QAAQ,OAAO,OAAO,SAAS,IAAI,UAAU,IAAI,OAAO;AAC9D,SAAO,QAAQ,MAAM,MAAM,SAAS,OAAO,IAAI;AACjD;AAEO,MAAM,eAAe;AAE5B,eAAe,aACb,SACA,EAAE,WAAW,OAAO,GACpB,MACgB;AAChB,QAAM,UAAU,OAAO,QAAQ,YAAY,MAAM,sBAAsB,IAAI;AAC3E,SAAO,UAAU;AAAA,IACf,GAAG;AAAA,IACH;AAAA,IACA,qBAAqB,gBAAgB,MAAM;AAAA,IAC3C,cAAc,CAAC,SAAS,UAAU,SAAS,SAAS,SAAS,QAAQ,KAAK;AAAA,EAC5E,CAAC;AACH;AAEA,eAAe,WAAW,MAAsB,OAAc;AAC5D,YAAU,KAAK;AACf,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,MAAM,QAAQ,kBAAkB;AACtC,SAAO;AACT;AAEO,SAAS,WACd,WACA,QACA,MAA4E,MAAM,QACpE;AACd,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,UAAU,SAAS;AAAA,IACnB,MAAM;AAAA,MACJ,GAAG,IAAI;AAAA,QACL;AAAA,UACE,SAAS;AAAA,UACT,GAAG,OAAO,UAAU,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,UAC7D,GAAI,SAAS,OAAO,UAAU,oBAAoB,CAAC;AAAA,UACnD,GAAI,SAAS,OAAO,QAAQ,CAAC,UAAU,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,QACrE,EAAE,OAAO,CAAC,QAAuB,OAAO,QAAQ,YAAY,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,EACF,EAAE;AACJ;AAEA,SAAS,SACP,OACA,MACA;AACA,QAAM,EAAE,OAAO,SAAS,UAAU,IAAI;AACtC,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,OAAO,CAAC,QAAgB,SAAuB,SAAS,OAAO,MAAM,MAAM;AAAA,MAC3E,OAAO,CAAC,QAAgB,SAAuB,WAAW,OAAO,QAAQ,IAAI;AAAA,MAC7E,SAAS,UAAU;AAAA,MACnB,OAAO,UAAU;AAAA,IACnB;AAAA,EACF;AACF;AAEA,SAAS,YACP,OACA,OACA,OACA;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,MAAM,MAAM,MAAM,MAAM;AAAA,IACxB,OAAO,MAAM;AACX,iBAAW,QAAQ,MAAO,MAAK,MAAM;AAAA,IACvC;AAAA,EACF;AACF;AAEA,eAAe,SACb,OACA,SACA,OACA;AACA,QAAM,EAAE,OAAO,MAAM,WAAW,QAAQ,IAAI;AAC5C,QAAM,QAAQ,OAAO,QAAQ,UAAU,YAAY,UAAU,MAAM,aAAa,IAAI;AACpF,QAAM,UAAU,aAAa,KAAK;AAClC,QAAM,SAAS,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACxE,QAAM,YAAY,QAAQ,aAAa,eAAe,OAAO;AAC7D,QAAM,SAAS,MAAM,eAAe,OAAO,SAAS;AACpD,QAAM,cAAc,iBAAiB,SAAS,OAAO,KAAK,OAAO,KAAK;AACtE,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA,aAAa,UAAU,MAAM,WAAW,CAAC;AAAA,EAC3C;AACA,QAAM,OAAO,QAAQ,EAAE,cAAc,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AACnE,QAAM,QAAQ,MAAM,WAAW,WAAW,QAAQ,OAAO,GAAG;AAC5D,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW,OAAO,MAAM,QAAQ,MAAM,KAAK;AAAA,IAC3C,QAAQ;AAAA,EACV;AACA,QAAM,YAAY,eAAe,KAAK;AACtC,QAAM,eAAe,YAAY;AAC/B,UAAM,QAAQ,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,UAAU,CAAC,CAAC,CAAC;AACtF,WAAO,oBAAoB,aAAa,WAAW,MAAM;AAAA,EAC3D;AACA,SAAO,EAAE,OAAO,SAAS,WAAW,QAAQ,QAAQ,OAAO,WAAW,aAAa;AACrF;AAEA,SAAS,aAAa,OAA4C,QAAgB;AAChF,QAAM,WAAW,eAAe;AAChC,WAAS,QAAQ,WAAW;AAC5B,WAAS,QAAQ,aAAa,CAAC,MAAM,CAAC,CAAC;AACvC,WAAS,QAAQ,YAAY,KAAK,CAAC;AACnC,QAAM,OAAQ,YAAY,MAAsC;AAAA,IAC9D,CAAC,SAAS,KAAK,SAAS;AAAA,EAC1B;AACA,WAAS,QAAQ,WAAW,IAAI,CAAC;AACjC,SAAO;AACT;AAEA,eAAe,QAAQ,QAAiD,QAAsB;AAC5F,SAAO;AAAA,IACL,SAAS,MAAM,aAAa,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAChD,UAAU,MAAM,eAAe,MAAM;AAAA,IACrC,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,SAAS,MAAM,iBAAiB,MAAM;AAAA,EACxC;AACF;AAEA,SAAS,WAAW,OAAyB,QAAiD;AAC5F,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK;AACrC,QAAM,WAAW,OAAO,eAAe,KAAK,MAAM;AAClD,QAAM,YAAY,eAAe,OAAO,WAAW,MAAM,SAAS,QAAQ,QAAQ,QAAQ;AAC1F,QAAM,QAAQ;AACd,SAAO,EAAE,QAAQ,UAAU;AAC7B;AAEA,eAAe,QACb,OACA,QACA,SACA;AACA,QAAM,QAAQ,MAAM,WAAW,OAAO,MAAM,OAAO,KAAK;AACxD,QAAM,EAAE,QAAQ,UAAU,IAAI,WAAW,OAAO,OAAO,MAAM;AAC7D,QAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AACjD,QAAM,OAAO,MAAM,SAAS,OAAO,SAAS;AAAA,IAC1C,OAAO,OAAO;AAAA,IACd,MAAM,OAAO;AAAA,IACb;AAAA,IACA,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH,OAAO,eAAe,OAAO,MAAM;AAAA,IACnC,UAAU,aAAa,OAAO,MAAM,SAAS,MAAM;AAAA,EACrD;AACF;AAEA,SAAS,cACP,OACA,UACA,SACA,OACA;AACA,QAAM,SAAS,MAAM,MAAM,MAAM,MAAM,WAAW;AAClD,SAAO,cAAc,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS,OAAO,CAAC;AAC1E;AAEA,eAAe,WACb,MACA,KACA,OACA;AACA,QAAM,EAAE,QAAQ,SAAS,QAAQ,WAAW,MAAM,IAAI;AACtD,QAAM,OAAO,MAAM,UAAU,MAAM,MAAM,SAAS,EAAE,SAAS,OAAO,MAAM,MAAM,GAAG,MAAM,KAAK;AAC9F,QAAM,WAAW,MAAM,oBAAoB,QAAQ,EAAE,SAAS,OAAO,GAAG,WAAW;AAAA,IACjF;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AACD,WAAS,MAAM,UAAU,MAAM,KAAK,MAAM,MAAM,MAAM,kBAAkB,EAAE,MAAM,MAAM,MAAS,CAAC;AAChG,SAAO;AACT;AAEA,eAAe,eACb,QACA,MACA,IACA,OACA,QACA,SACA;AACA,QAAM,WAAW,MAAM,OAAO;AAC9B,QAAM,EAAE,WAAW,IAAI;AACvB,QAAM,WAAW,MAAM,kBAAkB,EAAE,MAAM,MAAM,KAAK;AAC5D,QAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ;AACrD,QAAM,SAAS,YAAY,EAAE,KAAK,MAAM,QAAQ,MAAM,QAAQ,SAAS,CAAC;AACxE,QAAM,QAAuB;AAAA,IAC3B,OAAO,cAAc;AAAA,MACnB;AAAA,MACA,OAAO,OAAO,YAAY,aAAa,MAAM,SAAS,OAAO,CAAC;AAAA,MAC9D;AAAA,MACA,OAAO,aAAa,CAAC,SAAS,YAAY,MAAM,OAAO,aAAa,SAAS,OAAO,CAAC;AAAA,IACvF,CAAC;AAAA,IACD,QAAQ,gBAAgB,CAAC,SAAS,YAAY,MAAM,OAAO,aAAa,SAAS,OAAO,CAAC;AAAA,EAC3F;AACA,SAAO,EAAE,OAAO,QAAQ,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG;AAChE;AAEA,SAAS,YACP,UACA,QACA,MACA,IACA,QACA;AACA,QAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ;AACrD,QAAM,UAAU,OAAO,QAAQ,QAAQ;AACvC,QAAM,SAAS,gBAAgB;AAAA,IAC7B,QAAQ,MAAM,OAAO,GAAG;AAAA,IACxB,SAAS,MAAM,OAAO,GAAG;AAAA,IACzB,OAAO,MAAM;AAAA,EACf,CAAC;AACD,WAAS,QAAQ,OAAO,SAAS;AACjC,SAAO,EAAE,SAAS,QAAQ,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AAC5E;AAEA,SAAS,UACP,OACA,OAQA;AACA,QAAM,EAAE,MAAM,QAAQ,QAAQ,QAAQ,OAAO,MAAM,IAAI;AACvD,SAAO,cAAc;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,KAAK;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,GAAI,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC1C,SAAS;AAAA,MACP,KAAK;AAAA,MACL,YAAY,SAAS,YAAY;AAAA,MACjC,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,MACjB,GAAI,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MACtC,GAAI,SAAS,EAAE,OAAO,CAAC,SAAiB,OAAO,WAAW,QAAQ,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,IACjF;AAAA,EACF,CAAC;AACH;AAEA,eAAe,MACb,OACA,OACA,SACA,OACoB;AACpB,QAAM,EAAE,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,SAAS,OAAO,OAAO;AACxE,QAAM,QAAQ,MAAM,QAAQ,OAAO,EAAE,QAAQ,MAAM,MAAM,GAAG,OAAO;AACnE,QAAM,EAAE,OAAO,QAAQ,WAAW,OAAO,QAAQ,UAAU,SAAS,UAAU,IAAI;AAClF,QAAM,SAAS,YAAY,QAAQ;AACnC,QAAM,SAAS,YAAY;AAC3B,QAAM,MAAM,SAAS,QAAQ;AAC7B,QAAM,WAAW,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAAI,UAAU,GAAG,QAAQ;AACvF,WAAS,QAAQ,kBAAkB,QAAQ,CAAC;AAC5C,QAAM,QAAQ,WAAW,UAAU,SAAS;AAC5C,QAAM,MAAM,OAAO,WAAW,MAAM,CAAC;AACrC,QAAM,SAAS,YAAY,UAAU,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,KAAK,CAAC;AAC3F,QAAM,SAAS,YAAY,UAAU,MAAM,KAAK;AAChD,WAAS,QAAQ,iBAAiB,EAAE,OAAO,MAAM,CAAC,CAAC;AACnD,QAAM,SAAS,YAAY,UAAU,QAAQ,MAAM,IAAI,MAAM,MAAM;AACnE,QAAM,CAAC,UAAU,QAAQ,IAAI,IAAI;AAAA,IAC/B,eAAe;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,EACvB;AACA,QAAM,QAAQ,QAAQ,SAAU,MAAM,MAAM,aAAa;AACzD,MAAI;AACJ,QAAM,SAAS,QAAQ,WAAW,OAAO,QAAQ,MAAM,MAAM,QAAQ,MAAM,IAAI;AAC/E,QAAM,cAAc,kBAAkB,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,SAAS,MAAM,QAAQ,QAAQ,KAAK;AAAA,IAC9C,OAAO;AAAA,IACP,OAAO,YAAY,KAAK;AAAA,IACxB,GAAI,SAAS,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,EAC1C,CAAC;AACD,QAAM,QAAQ,MAAM,aAAa,SAAS,QAAQ,EAAE,QAAQ,OAAO,UAAU,KAAK,YAAY,CAAC;AAC/F,WAAS;AACT,QAAM,QAAQ,MAAM,MAAM,MAAM;AAChC,QAAM,UAAU,MAAM,OAAO,OAAO;AAAA,IAClC,KAAK;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,SAAS,EAAE,MAAM,MAAM,OAAO,SAAS,GAAG,UAAU,OAAO,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,EAC5F,CAAC;AACD,QAAM,QAAQ,MAAM,kBAAkB;AACtC,QAAM,SAAS,EAAE,SAAS,MAAM,SAAS,MAAM,MAAM,WAAW,MAAM,EAAE;AACxE,QAAM,QAAQ,KAAK,QAAQ,kBAAkB;AAC7C,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,KAAK;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,MACV,GAAI,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,MAAM,IAAI;AAAA,IAC3B;AAAA,MACE,KAAK;AAAA,MACL,GAAG;AAAA,MACH,GAAG,SAAS,OAAO,KAAK;AAAA,MACxB,OAAO,MAAM;AAAA,MACb,OAAO;AAAA,MACP,SAAS,MAAM;AAAA,MACf,UAAU;AAAA,MACV,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,SAAS,OAAO,SAAS;AAAA,MAC/B,UAAU,QAAQ,eAAe,IAAI,IAAI,cAAc,MAAM,SAAS,MAAM,EAAE;AAAA,IAChF;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,eAAe,EAAE;AAAA,IACvC;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,KAAK;AAAA,MACL,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,MACV,GAAI,QAAQ,UAAU,KAAK,CAAC;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACA,UAAQ,OAAO,CAAC,SAAS,eAAe,SAAS,CAAC;AAClD,MAAI;AACJ,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,KAAK;AAAA,MACL,GAAG;AAAA,MACH,GAAI,SAAS,EAAE,MAAM,UAAU,IAAI,CAAC;AAAA,MACpC,UAAU;AAAA,MACV,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,QAAQ,OAAO,MAAM,CAAC;AAC/E,QAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAM,WAAW,MAAM,WAAW,OAAO,YAAY,EAAE,OAAO,OAAO,OAAO,OAAO,MAAM,MAAM,CAAC;AAChG,QAAM,QAAQ,YAAY,EAAE,OAAO,UAAU,MAAM,CAAC;AACpD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,KAAK;AAAA,MACL,OAAO,OAAO,gBAAgB,YAAY,YAAY,EAAE,eAAe,GAAG,OAAO;AAAA,MACjF,GAAG;AAAA,MACH,GAAI,SACA,EAAE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS,IAC1E,CAAC;AAAA,MACL,OAAO,MAAM,MAAM;AAAA,MACnB,OAAO,cAAc;AAAA,MACrB,QAAQ,cAAc;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,SAAS,QAAQ;AAAA,MACjB,QAAQ,cAAc,OAAO,UAAU,QAAQ,KAAK;AAAA,MACpD,OAAO,MAAM;AAAA,MACb,SAAS,QAAQ;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AACA,UAAQ;AACR,YAAU,OAAO;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,MAAM;AAAA,IACN,GAAI,MAAM,QAAQ,UAAU,IAAI;AAAA,IAChC,QAAQ,OAAO;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ,UAAU,cAAc;AAAA,IACxC,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc;AAAA,IACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,cAAc,OAAO,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACpE,SAAO,UAAU,OAAO;AAAA,IACtB,GAAI,MAAM,eAAe,QAAQ,MAAM,IAAI,OAAO,cAAc,UAAU,OAAO;AAAA,IACjF;AAAA,IACA,OAAO,EAAE,OAAO,MAAM,OAAO,QAAQ;AAAA,IACrC,QAAQ,EAAE,QAAQ,OAAO,QAAQ,QAAQ;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,SAAS,cAAc,EAAE,QAAQ,MAAM,QAAQ,KAAK,MAAM,UAAU,WAAW,CAAC;AAAA,IAChF;AAAA,IACA,QAAQ,MAAM,aAAa,EAAE,GAAG,OAAO,OAAO,OAAO,OAAO,OAAO,MAAM,MAAM,CAAC;AAAA,IAChF,KAAK;AAAA,IACL,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,SAAS,YAAY,OAAO,OAAO,CAAC,OAAO,SAAS,SAAS,CAAC;AAAA,IAC9D,SAAS;AAAA,MACP,KAAK;AAAA,MACL,MAAM,CAAC,QAAQ,WAAW,QAAQ,GAAG;AAAA,IACvC;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,MACA,GAAI,QAAQ,EAAE,OAAO,MAAM,MAAM,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,IACrD;AAAA,EACF,CAAC;AACH;AAEO,SAAS,MAAM,QAAsB;AAC1C,SAAO,OAAO,QAAkC;AAC9C,QAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAQ,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,QAAQ,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eACd,OACA,UAA8B,CAAC,GACX;AACpB,QAAM,QAAQ,IAAI,MAAM;AACxB,cAAY,OAAO,KAAK;AACxB,QAAM,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,KAAK;AAC5D,OAAK,MAAM,MAAM,MAAS;AAC1B,mBAAiB,OAAO,IAAI;AAC5B,SAAO;AACT;",
+  "sourcesContent": ["import { attachKernel } from '@ai-ecoverse/slicc-kernel';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Provider } from '@earendil-works/pi-ai';\nimport type { Models } from '@earendil-works/pi-ai/models';\nimport {\n  createRegistry,\n  type ModelRef,\n  type Storage,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { CodingTools } from '@earendil-works/pi-durable/tools';\nimport { type Agent, type AgentOptions, openAgent } from './agent.ts';\nimport {\n  type ApprovalJudge,\n  approvalJudge,\n  judgeModelOf,\n  judgeSpender,\n  ownerIntent,\n  seedPolicy,\n  verdictRecorder,\n} from './approvals/index.ts';\nimport { browserGuard } from './browser/guard.ts';\nimport { attachChanges, CHANGES_MS } from './changes/index.ts';\nimport {\n  codemodeExtension,\n  codemodeTool,\n  disabledBySettings,\n  locateWasm,\n  sandboxFactory,\n} from './codemode/index.ts';\nimport { codexFetch } from './codex.ts';\nimport { attachFreezer } from './freezer/index.ts';\nimport { lateGelatiere } from './gelatiere/index.ts';\nimport { type AgentHost, hostAgent } from './host.ts';\nimport { imageReads } from './images/index.ts';\nimport { createActivity } from './kernel/activity.ts';\nimport { type AgentUsers, agentUsers, warnSupport } from './kernel/agent-users.ts';\nimport type { KernelClient } from './kernel/client.ts';\nimport { HOME, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nimport { processGroups } from './kernel/groups.ts';\nimport { backgroundJobs } from './kernel/jobs.ts';\nimport { adminOver, type UserClient, type UserClients, userClients } from './kernel/users.ts';\nimport { AGENT_DIR, ROOT_HOME } from './layout.ts';\nimport { type Licks, setupLicks } from './licks/index.ts';\nimport { lickTriage } from './licks/triage.ts';\nimport { type McpAccounts, setupMcp } from './mcp/index.ts';\nimport type { MemoryEntry } from './memory/format.ts';\nimport { setupMemory } from './memory/index.ts';\nimport { modelsCommand } from './models/index.ts';\nimport { pageOnly, type Reach, type Transport, transportFetch, transportReach } from './net.ts';\nimport { sliccPrompt } from './prompt.ts';\nimport { AZURE, azureBase } from './providers.ts';\nimport { createPages } from './remote/pages.ts';\nimport { identity } from './scoops/identity.ts';\nimport { type Assets, packageAssets, type ScoopsRuntime, setupScoops } from './scoops/index.ts';\nimport { vaultCredentials } from './secrets/credentials.ts';\nimport {\n  BEDROCK_ENDPOINTS,\n  type ModelBases,\n  modelRoute,\n  vaultEndpoints,\n} from './secrets/endpoints.ts';\nimport { secretsExtension, shellGrants } from './secrets/extension.ts';\nimport { grantFetch, mcpFetch, vaultFetch } from './secrets/fetch.ts';\nimport { keysMoved, type Wiped, wipeLegacy } from './secrets/legacy.ts';\nimport { secretNames } from './secrets/names.ts';\nimport { type VaultRecords, vaultRecords } from './secrets/records.ts';\nimport { scrubWith } from './secrets/scrub.ts';\nimport { fileStore, type PlainStore } from './secrets/store.ts';\nimport { listenVault, Vault, WAITING_MS } from './secrets/vault.ts';\nimport { type Choosable, unfreeze, unfreezeCreated } from './selection.ts';\nimport {\n  BEDROCK,\n  catalogStore,\n  createAgentSettings,\n  createSliccModels,\n  providerFields,\n  resolveDefaultModel,\n  sliccProviders,\n} from './settings.ts';\nimport { RELOAD_MS, setupSkills } from './skills/index.ts';\nimport { setupSprinkles } from './sprinkles/index.ts';\nimport { openOpfsSqliteStorage } from './sqlite.ts';\nimport {\n  agentVersion,\n  browserConnected,\n  commandsOnPath,\n  kernelBoot,\n  transportName,\n} from './system.ts';\nimport { titlesExtension } from './titles/extension.ts';\nimport { labeler, settingsText, titler } from './titles/generate.ts';\nimport { attachLabels } from './titles/labels.ts';\nimport { type KernelPorts, kernelPorts, serveConnections, type WorkerScope } from './worker.ts';\n\nexport interface AgentWorkerScope extends WorkerScope {\n  fetch: typeof fetch;\n  location: { origin: string };\n}\n\nexport type KernelAttach = (port: MessagePort) => Promise<KernelClient & { transport: Transport }>;\n\nexport interface AgentWorkerOptions {\n  model?: ModelRef;\n  providers?: Provider[];\n  attach?: KernelAttach;\n  store?: () => Promise<PlainStore>;\n  storage?: () => Promise<Storage>;\n  assets?: Assets;\n  codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;\n  codemodeWorker?: string | URL;\n  catalog?: string;\n  users?: boolean;\n  mcpRedirect?: string;\n  approvalMs?: number;\n}\n\nexport function usersOf(\n  admin: MessagePort | undefined,\n  wanted: boolean | undefined,\n  attach: KernelAttach\n): UserClients | undefined {\n  if (!admin) return undefined;\n  if (wanted === false) {\n    admin.close();\n    return undefined;\n  }\n  return userClients(adminOver(admin), attach as (port: MessagePort) => Promise<UserClient>);\n}\n\nexport const STORE_DIR = '/.slicc';\nexport const ACCOUNTS_FILE = `${STORE_DIR}/accounts.json`;\nexport const MODELS_FILE = `${STORE_DIR}/models.json`;\n\nasync function attached(ports: Promise<KernelPorts>, options: AgentWorkerOptions) {\n  const wiped = await wipeLegacy();\n  const attach: KernelAttach = options.attach ?? attachKernel;\n  const { kernel, admin } = await ports;\n  const client = await attach(kernel);\n  const users = usersOf(admin, options.users, attach);\n  await warnSupport(users, client, options.users);\n  const home = new SliccKernelEnv(client, { cwd: HOME });\n  await privateStore(home);\n  return {\n    client,\n    users,\n    home,\n    wiped,\n    at: { home: HOME, ...(users ? { agentDir: AGENT_DIR } : {}) },\n  };\n}\n\nfunction privateStore(env: SliccKernelEnv): Promise<unknown> {\n  return env.exec(`mkdir -p ${STORE_DIR} && chmod 700 ${STORE_DIR}`, undefined, BACKGROUND_CONTEXT);\n}\n\nasync function codemodeTools(\n  client: KernelClient,\n  options: AgentWorkerOptions,\n  native: typeof fetch,\n  extra: Parameters<typeof codemodeTool>[0]['extra'],\n  dir = `${HOME}/.pi/agent`\n) {\n  const settings = await client.fs.readFile(`${dir}/settings.json`).catch(() => undefined);\n  if (disabledBySettings(settings === undefined ? undefined : new TextDecoder().decode(settings)))\n    return [];\n  const sandbox = sandboxFactory(\n    options.codemodeWasm ?? (() => locateWasm(native, new URL(import.meta.url))),\n    options.codemodeWorker\n  );\n  return [\n    codemodeTool({ declared: CodingTools.tools as readonly ToolRegistration[], sandbox, extra }),\n  ];\n}\n\nexport function seesImages(models: Pick<Models, 'getModel'>, ref: ModelRef | undefined): boolean {\n  const found = ref && models.getModel(ref.provider, ref.modelId);\n  return found ? found.input.includes('image') : true;\n}\n\nexport const MCP_CALLBACK = '/oauth/mcp-callback';\n\nasync function openUnfrozen(\n  options: AgentWorkerOptions,\n  { choosable: chosen }: { choosable: Choosable },\n  base: Omit<AgentOptions, 'storage' | 'beforeResume' | 'conversationCreated'>\n): Promise<Agent> {\n  const storage = await (options.storage ?? (() => openOpfsSqliteStorage()))();\n  return openAgent({\n    ...base,\n    storage,\n    conversationCreated: unfreezeCreated(chosen),\n    beforeResume: (harness, using) => unfreeze(harness, storage, chosen, using),\n  });\n}\n\nasync function secretsFor(home: SliccKernelEnv, vault: Vault) {\n  scrubWith(vault);\n  const names = secretNames(home, vault);\n  await names.refresh(BACKGROUND_CONTEXT);\n  return names;\n}\n\nexport function modelBases(\n  providers: readonly Provider[],\n  models: Pick<ReturnType<typeof createSliccModels>, 'getModels'>,\n  env: (providerId: string) => Readonly<Record<string, string>> | undefined = () => undefined\n): ModelBases[] {\n  return providers.map((provider) => ({\n    provider: provider.id,\n    urls: [\n      ...new Set(\n        [\n          provider.baseUrl,\n          ...models.getModels(provider.id).map((model) => model.baseUrl),\n          ...(provider.id === BEDROCK ? BEDROCK_ENDPOINTS : []),\n          ...(provider.id === AZURE ? [azureBase(env(provider.id) ?? {})] : []),\n        ].filter((url): url is string => typeof url === 'string' && url !== '')\n      ),\n    ],\n  }));\n}\n\nfunction mcpVault(\n  vault: Vault,\n  made: { store: PlainStore; records: VaultRecords; endpoints: ReturnType<typeof vaultEndpoints> }\n) {\n  const { store, records, endpoints } = made;\n  return {\n    store,\n    vault: {\n      records,\n      fetch: (server: string, base: typeof fetch) => mcpFetch(vault, base, server),\n      grant: (server: string, base: typeof fetch) => grantFetch(vault, server, base),\n      servers: endpoints.servers,\n      token: endpoints.token,\n    },\n  };\n}\n\nfunction hostSecrets(\n  vault: Vault,\n  names: Awaited<ReturnType<typeof secretsFor>>,\n  parts: readonly { close(): void }[]\n) {\n  return {\n    vault: vault.state,\n    list: () => names.state.value,\n    close: () => {\n      for (const part of parts) part.close();\n    },\n  };\n}\n\nasync function modelsOf(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions,\n  given: { vault: Vault; home: SliccKernelEnv; transport: typeof fetch; version: string }\n) {\n  const { vault, home, transport, version } = given;\n  const store = await (options.store ?? (async () => fileStore(home, ACCOUNTS_FILE)))();\n  const records = vaultRecords(vault);\n  const loaded = records.refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n  const providers = options.providers ?? sliccProviders(version);\n  const fields = await providerFields(store, providers);\n  const credentials = vaultCredentials(records, fields.env, fields.ready);\n  const models = createSliccModels(\n    credentials,\n    providers,\n    catalogStore(fileStore(home, MODELS_FILE))\n  );\n  await models.refresh({ allowNetwork: false }).catch(() => undefined);\n  const bases = () => modelBases(providers, models, fields.env);\n  scope.fetch = codexFetch(\n    vaultFetch(\n      vault,\n      transport,\n      modelRoute(bases, () => records.state.value),\n      records.rejecting\n    )\n  );\n  const endpoints = vaultEndpoints(vault);\n  const defaultModel = async () => {\n    await Promise.race([loaded, new Promise((resolve) => setTimeout(resolve, WAITING_MS))]);\n    return resolveDefaultModel(credentials, providers, models);\n  };\n  return { store, records, providers, fields, models, bases, endpoints, defaultModel };\n}\n\nfunction baseRegistry(facts: Awaited<ReturnType<typeof factsOf>>, origin: string) {\n  const registry = createRegistry();\n  registry.install(CodingTools);\n  registry.install(browserGuard([origin]));\n  registry.install(sliccPrompt(facts));\n  const read = (CodingTools.tools as readonly ToolRegistration[]).find(\n    (tool) => tool.name === 'read'\n  ) as ToolRegistration;\n  registry.install(imageReads(read));\n  return registry;\n}\n\nasync function factsOf(client: KernelClient & { transport: Transport }, native: typeof fetch) {\n  return {\n    version: await agentVersion((url) => native(url)),\n    commands: await commandsOnPath(client),\n    transport: transportName(client.transport),\n    browser: await browserConnected(client),\n  };\n}\n\nfunction routeFetch(scope: AgentWorkerScope, client: KernelClient & { transport: Transport }) {\n  const native = scope.fetch.bind(scope);\n  const loopback = client.loopbackFetch?.bind(client);\n  const transport = transportFetch(client.transport, scope.location.origin, native, loopback);\n  scope.fetch = transport;\n  return { native, transport };\n}\n\nasync function prepare(\n  scope: AgentWorkerScope,\n  kernel: { client: KernelClient & { transport: Transport }; home: SliccKernelEnv; vault: Vault },\n  options: AgentWorkerOptions\n) {\n  const names = await secretsFor(kernel.home, kernel.vault);\n  const { native, transport } = routeFetch(scope, kernel.client);\n  const facts = await factsOf(kernel.client, native);\n  const made = await modelsOf(scope, options, {\n    vault: kernel.vault,\n    home: kernel.home,\n    transport,\n    version: facts.version,\n  });\n  return {\n    names,\n    native,\n    transport,\n    facts,\n    ...made,\n    reach: transportReach(kernel.client),\n    registry: baseRegistry(facts, scope.location.origin),\n  };\n}\n\nfunction modelsOfAgent(\n  agent: Agent,\n  settings: Awaited<ReturnType<typeof createAgentSettings>>,\n  catalog: Models,\n  vault: Vault\n) {\n  const locked = () => vault.state.value.locked !== 'no';\n  return modelsCommand({ agents: agent.agents, settings, catalog, locked });\n}\n\nasync function settingsOf(\n  made: Awaited<ReturnType<typeof modelsOf>> & { reach: Reach },\n  mcp: McpAccounts,\n  moved: { agent: Agent; vault: Vault; wiped: Wiped; licks: Licks }\n) {\n  const { models, records, fields, providers, reach } = made;\n  const keys = await keysMoved(moved.agent.harness, { records, vault: moved.vault }, moved.wiped);\n  const settings = await createAgentSettings(models, { records, fields }, providers, {\n    mcp,\n    moved: keys,\n    reach,\n    vault: moved.vault,\n  });\n  settings.state.subscribe(() => void moved.licks.flush(BACKGROUND_CONTEXT).catch(() => undefined));\n  return settings;\n}\n\nasync function setupApprovals(\n  models: Models,\n  home: SliccKernelEnv,\n  at: { home: string; agentDir?: string },\n  agent: Agent,\n  stored: { readonly value: readonly MemoryEntry[] | undefined },\n  options: Pick<AgentWorkerOptions, 'approvalMs'>\n) {\n  const memories = () => stored.value;\n  const { approvalMs } = options;\n  await seedPolicy(home, BACKGROUND_CONTEXT).catch(() => false);\n  const settings = settingsText(home, HOME, at.agentDir);\n  const intent = ownerIntent({ env: home, agents: agent.agents, memories });\n  const judge: ApprovalJudge = {\n    judge: approvalJudge({\n      models,\n      model: async (context) => judgeModelOf(await settings(context)),\n      intent,\n      spend: judgeSpender((agentId, context) => agent.agents.conversation(agentId, context)),\n    }),\n    record: verdictRecorder((agentId, context) => agent.agents.conversation(agentId, context)),\n  };\n  return { judge, intent, ...(approvalMs ? { approvalMs } : {}) };\n}\n\nfunction setupTitles(\n  registry: ReturnType<typeof createRegistry>,\n  models: Models,\n  home: SliccKernelEnv,\n  at: { home: string; agentDir?: string },\n  opened: () => Agent | undefined\n) {\n  const settings = settingsText(home, HOME, at.agentDir);\n  const titleFn = titler(models, settings);\n  const titles = titlesExtension({\n    agents: () => opened()?.agents,\n    harness: () => opened()?.harness,\n    title: () => titleFn,\n  });\n  registry.install(titles.extension);\n  return { titleFn, cancel: titles.cancel, label: labeler(models, settings) };\n}\n\nfunction freezerOf(\n  agent: Agent,\n  parts: {\n    home: SliccKernelEnv;\n    memory: ReturnType<typeof setupMemory>;\n    titles: ReturnType<typeof setupTitles>;\n    people: AgentUsers | undefined;\n    users: UserClients | undefined;\n    ready: { providers: readonly Provider[]; models: ReturnType<typeof createSliccModels> };\n  }\n) {\n  const { home, memory, titles, people, users, ready } = parts;\n  return attachFreezer({\n    harness: agent.harness,\n    agents: agent.agents,\n    env: home,\n    extract: memory.extract,\n    title: titles.titleFn,\n    cancelTitle: titles.cancel,\n    ...(people ? { layout: people.layout } : {}),\n    imports: {\n      env: home,\n      memoryHome: people ? ROOT_HOME : HOME,\n      catalog: ready.models,\n      providers: ready.providers,\n      ...(users ? { users: users.users } : {}),\n      ...(people ? { envOf: (cone: string) => people.envOfAgent(`cone:${cone}`) } : {}),\n    },\n  });\n}\n\nasync function start(\n  scope: AgentWorkerScope,\n  ports: Promise<KernelPorts>,\n  options: AgentWorkerOptions,\n  vault: Vault\n): Promise<AgentHost> {\n  const { client, users, home, at, wiped } = await attached(ports, options);\n  const ready = await prepare(scope, { client, home, vault }, options);\n  const { names, native, transport, facts, models, registry, records, endpoints } = ready;\n  const memory = setupMemory(registry);\n  const coding = CodingTools.tools as readonly ToolRegistration[];\n  const mcp = setupMcp(registry);\n  const codemode = await codemodeTools(client, options, native, mcp.codemode, at.agentDir);\n  registry.install(codemodeExtension(codemode));\n  const licks = setupLicks(registry, transport);\n  licks.licks.triage(lickTriage(models));\n  const scoops = setupScoops(registry, licks.licks, [...coding, ...codemode, ...memory.tools]);\n  const skills = setupSkills(registry, licks.licks);\n  registry.install(secretsExtension({ names, vault }));\n  const titles = setupTitles(registry, models, home, at, () => opened);\n  const [activity, groups, jobs] = [\n    createActivity(),\n    processGroups(client),\n    backgroundJobs(client),\n  ];\n  const model = options.model ?? (await ready.defaultModel());\n  let opened: Agent | undefined;\n  const people = users ? agentUsers(users, client, home, () => opened?.agents) : undefined;\n  const environment = kernelEnvironment(client, {\n    activity,\n    groups,\n    jobs,\n    identify: identity(() => opened?.agents, model),\n    scrub: vault,\n    spawn: shellGrants(names),\n    ...(people ? { route: people.route } : {}),\n  });\n  const agent = await openUnfrozen(options, scoops, { models, model, registry, env: environment });\n  opened = agent;\n  await people?.start(agent.agents);\n  const sources = licks.attach(agent, {\n    env: home,\n    home: HOME,\n    models,\n    activity,\n    jobs,\n    ...(people ? { dirs: () => people.lickDirs(), cronUser: people.cronUser.bind(people) } : {}),\n  });\n  await sources.start(BACKGROUND_CONTEXT);\n  const booted = { version: facts.version, boot: await kernelBoot(client) };\n  await sources.boot(booted, BACKGROUND_CONTEXT);\n  const skillsRuntime = await skills.attach(\n    {\n      env: home,\n      ...at,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n      ...(people ? { people: people.people } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const mcpRuntime = await mcp.attach(\n    {\n      env: home,\n      ...at,\n      ...mcpVault(vault, ready),\n      licks: licks.licks,\n      fetch: transport,\n      version: facts.version,\n      reloadMs: RELOAD_MS,\n      codemode: codemode.length > 0,\n      cors: pageOnly(client.transport),\n      redirect: options.mcpRedirect ?? new URL(MCP_CALLBACK, scope.location.origin).href,\n    },\n    BACKGROUND_CONTEXT\n  );\n  const gelatiere = lateGelatiere();\n  const sprinkles = await setupSprinkles().attach(\n    {\n      intercept: gelatiere.intercept,\n      harness: agent.harness,\n      agents: agent.agents,\n      licks: licks.licks,\n      env: home,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n      ...(people?.sprinkles() ?? {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  people?.follow([sources, skillsRuntime, sprinkles]);\n  let roles: ScoopsRuntime | undefined;\n  const memoryRuntime = await memory.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      env: home,\n      ...at,\n      ...(people ? { home: ROOT_HOME } : {}),\n      reloadMs: RELOAD_MS,\n      roles: async (using) => roles?.roles(using),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const freezer = freezerOf(agent, { home, memory, titles, people, users, ready });\n  licks.licks.guard(freezer.frozenTarget);\n  const settings = await settingsOf(ready, mcpRuntime, { agent, vault, wiped, licks: licks.licks });\n  const pages = createPages({ claim: sprinkles.claim });\n  const runtime = await scoops.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      groups,\n      env: home,\n      envOf: async (conversationId, context) => environment({ conversationId }, context),\n      ...at,\n      ...(people\n        ? { layout: people.layout, spools: people.spools, enforced: people.enforced }\n        : {}),\n      alive: alive(client),\n      reads: skillsRuntime.dirs,\n      memory: memoryRuntime.command,\n      gelatiere: gelatiere.command,\n      freezer: freezer.command,\n      models: modelsOfAgent(agent, settings, models, vault),\n      panel: pages.command,\n      webhook: sources.webhook,\n      mcp: mcp.direct,\n      ...(options.assets ? { assets: options.assets } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  roles = runtime;\n  gelatiere.attach({\n    agents: agent.agents,\n    licks: licks.licks,\n    env: home,\n    home: HOME,\n    ...(await people?.gelatiere(home)),\n    scoops: scoops.scoops,\n    roles: runtime.roles,\n    assets: options.assets ?? packageAssets(),\n    fetch: scope.fetch,\n    skills: skillsRuntime.skills,\n    ...(options.catalog ? { catalog: options.catalog } : {}),\n  });\n  await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => undefined);\n  return hostAgent(agent, {\n    ...(await setupApprovals(models, home, at, agent, memoryRuntime.memories, options)),\n    settings,\n    licks: { licks: licks.licks, sources },\n    scoops: { scoops: scoops.scoops, runtime },\n    skills: skillsRuntime,\n    sprinkles,\n    memory: memoryRuntime,\n    freezer,\n    changes: attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS }),\n    pages,\n    labels: await attachLabels({ ...agent, label: titles.label, vault: vault.state }),\n    mcp: mcpRuntime,\n    ...(users ? { users } : {}),\n    secrets: hostSecrets(vault, names, [names, records, endpoints]),\n    uploads: {\n      env: environment,\n      sees: (ref) => seesImages(models, ref),\n    },\n    monitor: {\n      kernel: client,\n      groups,\n      ...(users ? { users: () => users.users.list() } : {}),\n    },\n  });\n}\n\nexport function alive(client: KernelClient) {\n  return async (pid: number): Promise<boolean> => {\n    if (!client.ps) return true;\n    return (await client.ps()).some((process) => process.pid === pid);\n  };\n}\n\nexport function runAgentWorker(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions = {}\n): Promise<AgentHost> {\n  const vault = new Vault();\n  listenVault(scope, vault);\n  const host = start(scope, kernelPorts(scope), options, vault);\n  host.catch(() => undefined);\n  serveConnections(scope, host);\n  return host;\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AAGnC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,mBAAmB;AAC5B,SAAwC,iBAAiB;AACzD;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,eAAe,kBAAkB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;AAC9B,SAAyB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAC/B,SAA0B,YAAY,mBAAmB;AAEzD,SAAS,MAAM,mBAAmB,sBAAsB;AACxD,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAC/B,SAAS,WAA8C,mBAAmB;AAC1E,SAAS,WAAW,iBAAiB;AACrC,SAAqB,kBAAkB;AACvC,SAAS,kBAAkB;AAC3B,SAA2B,gBAAgB;AAE3C,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAS,UAAsC,gBAAgB,sBAAsB;AACrF,SAAS,mBAAmB;AAC5B,SAAS,OAAO,iBAAiB;AACjC,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAsB,eAAmC,mBAAmB;AAC5E,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,mBAAmB;AAC9C,SAAS,YAAY,UAAU,kBAAkB;AACjD,SAAS,WAAuB,kBAAkB;AAClD,SAAS,mBAAmB;AAC5B,SAA4B,oBAAoB;AAChD,SAAS,iBAAiB;AAC1B,SAAS,iBAAkC;AAC3C,SAAS,aAAa,OAAO,kBAAkB;AAC/C,SAAyB,UAAU,uBAAuB;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,mBAAmB;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,SAAS,cAAc,cAAc;AAC9C,SAAS,oBAAoB;AAC7B,SAA2B,aAAa,wBAA0C;AAwB3E,SAAS,QACd,OACA,QACA,QACyB;AACzB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,WAAW,OAAO;AACpB,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY,UAAU,KAAK,GAAG,MAAoD;AAC3F;AAEO,MAAM,YAAY;AAClB,MAAM,gBAAgB,GAAG,SAAS;AAClC,MAAM,cAAc,GAAG,SAAS;AAEvC,eAAe,SAAS,OAA6B,SAA6B;AAChF,QAAM,QAAQ,MAAM,WAAW;AAC/B,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM;AAChC,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,QAAM,QAAQ,QAAQ,OAAO,QAAQ,OAAO,MAAM;AAClD,QAAM,YAAY,OAAO,QAAQ,QAAQ,KAAK;AAC9C,QAAM,OAAO,IAAI,eAAe,QAAQ,EAAE,KAAK,KAAK,CAAC;AACrD,QAAM,aAAa,IAAI;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,EAAE,MAAM,MAAM,GAAI,QAAQ,EAAE,UAAU,UAAU,IAAI,CAAC,EAAG;AAAA,EAC9D;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,SAAO,IAAI,KAAK,YAAY,SAAS,iBAAiB,SAAS,IAAI,QAAW,kBAAkB;AAClG;AAEA,eAAe,cACb,QACA,SACA,QACA,OACA,MAAM,GAAG,IAAI,cACb;AACA,QAAM,WAAW,MAAM,OAAO,GAAG,SAAS,GAAG,GAAG,gBAAgB,EAAE,MAAM,MAAM,MAAS;AACvF,MAAI,mBAAmB,aAAa,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC5F,WAAO,CAAC;AACV,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB,MAAM,WAAW,QAAQ,IAAI,IAAI,YAAY,GAAG,CAAC;AAAA,IAC1E,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,EAAE,UAAU,YAAY,OAAsC,SAAS,MAAM,CAAC;AAAA,EAC7F;AACF;AAEO,SAAS,WAAW,QAAkC,KAAoC;AAC/F,QAAM,QAAQ,OAAO,OAAO,SAAS,IAAI,UAAU,IAAI,OAAO;AAC9D,SAAO,QAAQ,MAAM,MAAM,SAAS,OAAO,IAAI;AACjD;AAEO,MAAM,eAAe;AAE5B,eAAe,aACb,SACA,EAAE,WAAW,OAAO,GACpB,MACgB;AAChB,QAAM,UAAU,OAAO,QAAQ,YAAY,MAAM,sBAAsB,IAAI;AAC3E,SAAO,UAAU;AAAA,IACf,GAAG;AAAA,IACH;AAAA,IACA,qBAAqB,gBAAgB,MAAM;AAAA,IAC3C,cAAc,CAAC,SAAS,UAAU,SAAS,SAAS,SAAS,QAAQ,KAAK;AAAA,EAC5E,CAAC;AACH;AAEA,eAAe,WAAW,MAAsB,OAAc;AAC5D,YAAU,KAAK;AACf,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,MAAM,QAAQ,kBAAkB;AACtC,SAAO;AACT;AAEO,SAAS,WACd,WACA,QACA,MAA4E,MAAM,QACpE;AACd,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,UAAU,SAAS;AAAA,IACnB,MAAM;AAAA,MACJ,GAAG,IAAI;AAAA,QACL;AAAA,UACE,SAAS;AAAA,UACT,GAAG,OAAO,UAAU,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,UAC7D,GAAI,SAAS,OAAO,UAAU,oBAAoB,CAAC;AAAA,UACnD,GAAI,SAAS,OAAO,QAAQ,CAAC,UAAU,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,QACrE,EAAE,OAAO,CAAC,QAAuB,OAAO,QAAQ,YAAY,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,EACF,EAAE;AACJ;AAEA,SAAS,SACP,OACA,MACA;AACA,QAAM,EAAE,OAAO,SAAS,UAAU,IAAI;AACtC,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,OAAO,CAAC,QAAgB,SAAuB,SAAS,OAAO,MAAM,MAAM;AAAA,MAC3E,OAAO,CAAC,QAAgB,SAAuB,WAAW,OAAO,QAAQ,IAAI;AAAA,MAC7E,SAAS,UAAU;AAAA,MACnB,OAAO,UAAU;AAAA,IACnB;AAAA,EACF;AACF;AAEA,SAAS,YACP,OACA,OACA,OACA;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,MAAM,MAAM,MAAM,MAAM;AAAA,IACxB,OAAO,MAAM;AACX,iBAAW,QAAQ,MAAO,MAAK,MAAM;AAAA,IACvC;AAAA,EACF;AACF;AAEA,eAAe,SACb,OACA,SACA,OACA;AACA,QAAM,EAAE,OAAO,MAAM,WAAW,QAAQ,IAAI;AAC5C,QAAM,QAAQ,OAAO,QAAQ,UAAU,YAAY,UAAU,MAAM,aAAa,IAAI;AACpF,QAAM,UAAU,aAAa,KAAK;AAClC,QAAM,SAAS,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACxE,QAAM,YAAY,QAAQ,aAAa,eAAe,OAAO;AAC7D,QAAM,SAAS,MAAM,eAAe,OAAO,SAAS;AACpD,QAAM,cAAc,iBAAiB,SAAS,OAAO,KAAK,OAAO,KAAK;AACtE,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA,aAAa,UAAU,MAAM,WAAW,CAAC;AAAA,EAC3C;AACA,QAAM,OAAO,QAAQ,EAAE,cAAc,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AACnE,QAAM,QAAQ,MAAM,WAAW,WAAW,QAAQ,OAAO,GAAG;AAC5D,QAAM,QAAQ;AAAA,IACZ;AAAA,MACE;AAAA,MACA;AAAA,MACA,WAAW,OAAO,MAAM,QAAQ,MAAM,KAAK;AAAA,MAC3C,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,YAAY,eAAe,KAAK;AACtC,QAAM,eAAe,YAAY;AAC/B,UAAM,QAAQ,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,UAAU,CAAC,CAAC,CAAC;AACtF,WAAO,oBAAoB,aAAa,WAAW,MAAM;AAAA,EAC3D;AACA,SAAO,EAAE,OAAO,SAAS,WAAW,QAAQ,QAAQ,OAAO,WAAW,aAAa;AACrF;AAEA,SAAS,aAAa,OAA4C,QAAgB;AAChF,QAAM,WAAW,eAAe;AAChC,WAAS,QAAQ,WAAW;AAC5B,WAAS,QAAQ,aAAa,CAAC,MAAM,CAAC,CAAC;AACvC,WAAS,QAAQ,YAAY,KAAK,CAAC;AACnC,QAAM,OAAQ,YAAY,MAAsC;AAAA,IAC9D,CAAC,SAAS,KAAK,SAAS;AAAA,EAC1B;AACA,WAAS,QAAQ,WAAW,IAAI,CAAC;AACjC,SAAO;AACT;AAEA,eAAe,QAAQ,QAAiD,QAAsB;AAC5F,SAAO;AAAA,IACL,SAAS,MAAM,aAAa,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAChD,UAAU,MAAM,eAAe,MAAM;AAAA,IACrC,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,SAAS,MAAM,iBAAiB,MAAM;AAAA,EACxC;AACF;AAEA,SAAS,WAAW,OAAyB,QAAiD;AAC5F,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK;AACrC,QAAM,WAAW,OAAO,eAAe,KAAK,MAAM;AAClD,QAAM,YAAY,eAAe,OAAO,WAAW,MAAM,SAAS,QAAQ,QAAQ,QAAQ;AAC1F,QAAM,QAAQ;AACd,SAAO,EAAE,QAAQ,UAAU;AAC7B;AAEA,eAAe,QACb,OACA,QACA,SACA;AACA,QAAM,QAAQ,MAAM,WAAW,OAAO,MAAM,OAAO,KAAK;AACxD,QAAM,EAAE,QAAQ,UAAU,IAAI,WAAW,OAAO,OAAO,MAAM;AAC7D,QAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AACjD,QAAM,OAAO,MAAM,SAAS,OAAO,SAAS;AAAA,IAC1C,OAAO,OAAO;AAAA,IACd,MAAM,OAAO;AAAA,IACb;AAAA,IACA,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH,OAAO,eAAe,OAAO,MAAM;AAAA,IACnC,UAAU,aAAa,OAAO,MAAM,SAAS,MAAM;AAAA,EACrD;AACF;AAEA,SAAS,cACP,OACA,UACA,SACA,OACA;AACA,QAAM,SAAS,MAAM,MAAM,MAAM,MAAM,WAAW;AAClD,SAAO,cAAc,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS,OAAO,CAAC;AAC1E;AAEA,eAAe,WACb,MACA,KACA,OACA;AACA,QAAM,EAAE,QAAQ,SAAS,QAAQ,WAAW,MAAM,IAAI;AACtD,QAAM,OAAO,MAAM,UAAU,MAAM,MAAM,SAAS,EAAE,SAAS,OAAO,MAAM,MAAM,GAAG,MAAM,KAAK;AAC9F,QAAM,WAAW,MAAM,oBAAoB,QAAQ,EAAE,SAAS,OAAO,GAAG,WAAW;AAAA,IACjF;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,OAAO,MAAM;AAAA,EACf,CAAC;AACD,WAAS,MAAM,UAAU,MAAM,KAAK,MAAM,MAAM,MAAM,kBAAkB,EAAE,MAAM,MAAM,MAAS,CAAC;AAChG,SAAO;AACT;AAEA,eAAe,eACb,QACA,MACA,IACA,OACA,QACA,SACA;AACA,QAAM,WAAW,MAAM,OAAO;AAC9B,QAAM,EAAE,WAAW,IAAI;AACvB,QAAM,WAAW,MAAM,kBAAkB,EAAE,MAAM,MAAM,KAAK;AAC5D,QAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ;AACrD,QAAM,SAAS,YAAY,EAAE,KAAK,MAAM,QAAQ,MAAM,QAAQ,SAAS,CAAC;AACxE,QAAM,QAAuB;AAAA,IAC3B,OAAO,cAAc;AAAA,MACnB;AAAA,MACA,OAAO,OAAO,YAAY,aAAa,MAAM,SAAS,OAAO,CAAC;AAAA,MAC9D;AAAA,MACA,OAAO,aAAa,CAAC,SAAS,YAAY,MAAM,OAAO,aAAa,SAAS,OAAO,CAAC;AAAA,IACvF,CAAC;AAAA,IACD,QAAQ,gBAAgB,CAAC,SAAS,YAAY,MAAM,OAAO,aAAa,SAAS,OAAO,CAAC;AAAA,EAC3F;AACA,SAAO,EAAE,OAAO,QAAQ,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG;AAChE;AAEA,SAAS,YACP,UACA,QACA,MACA,IACA,QACA;AACA,QAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ;AACrD,QAAM,UAAU,OAAO,QAAQ,QAAQ;AACvC,QAAM,SAAS,gBAAgB;AAAA,IAC7B,QAAQ,MAAM,OAAO,GAAG;AAAA,IACxB,SAAS,MAAM,OAAO,GAAG;AAAA,IACzB,OAAO,MAAM;AAAA,EACf,CAAC;AACD,WAAS,QAAQ,OAAO,SAAS;AACjC,SAAO,EAAE,SAAS,QAAQ,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AAC5E;AAEA,SAAS,UACP,OACA,OAQA;AACA,QAAM,EAAE,MAAM,QAAQ,QAAQ,QAAQ,OAAO,MAAM,IAAI;AACvD,SAAO,cAAc;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,KAAK;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,GAAI,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC1C,SAAS;AAAA,MACP,KAAK;AAAA,MACL,YAAY,SAAS,YAAY;AAAA,MACjC,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,MACjB,GAAI,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MACtC,GAAI,SAAS,EAAE,OAAO,CAAC,SAAiB,OAAO,WAAW,QAAQ,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,IACjF;AAAA,EACF,CAAC;AACH;AAEA,eAAe,MACb,OACA,OACA,SACA,OACoB;AACpB,QAAM,EAAE,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,SAAS,OAAO,OAAO;AACxE,QAAM,QAAQ,MAAM,QAAQ,OAAO,EAAE,QAAQ,MAAM,MAAM,GAAG,OAAO;AACnE,QAAM,EAAE,OAAO,QAAQ,WAAW,OAAO,QAAQ,UAAU,SAAS,UAAU,IAAI;AAClF,QAAM,SAAS,YAAY,QAAQ;AACnC,QAAM,SAAS,YAAY;AAC3B,QAAM,MAAM,SAAS,QAAQ;AAC7B,QAAM,WAAW,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAAI,UAAU,GAAG,QAAQ;AACvF,WAAS,QAAQ,kBAAkB,QAAQ,CAAC;AAC5C,QAAM,QAAQ,WAAW,UAAU,SAAS;AAC5C,QAAM,MAAM,OAAO,WAAW,MAAM,CAAC;AACrC,QAAM,SAAS,YAAY,UAAU,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,KAAK,CAAC;AAC3F,QAAM,SAAS,YAAY,UAAU,MAAM,KAAK;AAChD,WAAS,QAAQ,iBAAiB,EAAE,OAAO,MAAM,CAAC,CAAC;AACnD,QAAM,SAAS,YAAY,UAAU,QAAQ,MAAM,IAAI,MAAM,MAAM;AACnE,QAAM,CAAC,UAAU,QAAQ,IAAI,IAAI;AAAA,IAC/B,eAAe;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,EACvB;AACA,QAAM,QAAQ,QAAQ,SAAU,MAAM,MAAM,aAAa;AACzD,MAAI;AACJ,QAAM,SAAS,QAAQ,WAAW,OAAO,QAAQ,MAAM,MAAM,QAAQ,MAAM,IAAI;AAC/E,QAAM,cAAc,kBAAkB,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,SAAS,MAAM,QAAQ,QAAQ,KAAK;AAAA,IAC9C,OAAO;AAAA,IACP,OAAO,YAAY,KAAK;AAAA,IACxB,GAAI,SAAS,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,EAC1C,CAAC;AACD,QAAM,QAAQ,MAAM,aAAa,SAAS,QAAQ,EAAE,QAAQ,OAAO,UAAU,KAAK,YAAY,CAAC;AAC/F,WAAS;AACT,QAAM,QAAQ,MAAM,MAAM,MAAM;AAChC,QAAM,UAAU,MAAM,OAAO,OAAO;AAAA,IAClC,KAAK;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,SAAS,EAAE,MAAM,MAAM,OAAO,SAAS,GAAG,UAAU,OAAO,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,EAC5F,CAAC;AACD,QAAM,QAAQ,MAAM,kBAAkB;AACtC,QAAM,SAAS,EAAE,SAAS,MAAM,SAAS,MAAM,MAAM,WAAW,MAAM,EAAE;AACxE,QAAM,QAAQ,KAAK,QAAQ,kBAAkB;AAC7C,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,KAAK;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,MACV,GAAI,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,MAAM,IAAI;AAAA,IAC3B;AAAA,MACE,KAAK;AAAA,MACL,GAAG;AAAA,MACH,GAAG,SAAS,OAAO,KAAK;AAAA,MACxB,OAAO,MAAM;AAAA,MACb,OAAO;AAAA,MACP,SAAS,MAAM;AAAA,MACf,UAAU;AAAA,MACV,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,SAAS,OAAO,SAAS;AAAA,MAC/B,UAAU,QAAQ,eAAe,IAAI,IAAI,cAAc,MAAM,SAAS,MAAM,EAAE;AAAA,IAChF;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,eAAe,EAAE;AAAA,IACvC;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,KAAK;AAAA,MACL,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,MACV,GAAI,QAAQ,UAAU,KAAK,CAAC;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACA,UAAQ,OAAO,CAAC,SAAS,eAAe,SAAS,CAAC;AAClD,MAAI;AACJ,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,KAAK;AAAA,MACL,GAAG;AAAA,MACH,GAAI,SAAS,EAAE,MAAM,UAAU,IAAI,CAAC;AAAA,MACpC,UAAU;AAAA,MACV,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,QAAQ,OAAO,MAAM,CAAC;AAC/E,QAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAM,WAAW,MAAM,WAAW,OAAO,YAAY,EAAE,OAAO,OAAO,OAAO,OAAO,MAAM,MAAM,CAAC;AAChG,QAAM,QAAQ,YAAY,EAAE,OAAO,UAAU,MAAM,CAAC;AACpD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,KAAK;AAAA,MACL,OAAO,OAAO,gBAAgB,YAAY,YAAY,EAAE,eAAe,GAAG,OAAO;AAAA,MACjF,GAAG;AAAA,MACH,GAAI,SACA,EAAE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS,IAC1E,CAAC;AAAA,MACL,OAAO,MAAM,MAAM;AAAA,MACnB,OAAO,cAAc;AAAA,MACrB,QAAQ,cAAc;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,SAAS,QAAQ;AAAA,MACjB,QAAQ,cAAc,OAAO,UAAU,QAAQ,KAAK;AAAA,MACpD,OAAO,MAAM;AAAA,MACb,SAAS,QAAQ;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AACA,UAAQ;AACR,YAAU,OAAO;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,MAAM;AAAA,IACN,GAAI,MAAM,QAAQ,UAAU,IAAI;AAAA,IAChC,QAAQ,OAAO;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ,UAAU,cAAc;AAAA,IACxC,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc;AAAA,IACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,cAAc,OAAO,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACpE,SAAO,UAAU,OAAO;AAAA,IACtB,GAAI,MAAM,eAAe,QAAQ,MAAM,IAAI,OAAO,cAAc,UAAU,OAAO;AAAA,IACjF;AAAA,IACA,OAAO,EAAE,OAAO,MAAM,OAAO,QAAQ;AAAA,IACrC,QAAQ,EAAE,QAAQ,OAAO,QAAQ,QAAQ;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,SAAS,cAAc,EAAE,QAAQ,MAAM,QAAQ,KAAK,MAAM,UAAU,WAAW,CAAC;AAAA,IAChF;AAAA,IACA,QAAQ,MAAM,aAAa,EAAE,GAAG,OAAO,OAAO,OAAO,OAAO,OAAO,MAAM,MAAM,CAAC;AAAA,IAChF,KAAK;AAAA,IACL,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,SAAS,YAAY,OAAO,OAAO,CAAC,OAAO,SAAS,SAAS,CAAC;AAAA,IAC9D,SAAS;AAAA,MACP,KAAK;AAAA,MACL,MAAM,CAAC,QAAQ,WAAW,QAAQ,GAAG;AAAA,IACvC;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,MACA,GAAI,QAAQ,EAAE,OAAO,MAAM,MAAM,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,IACrD;AAAA,EACF,CAAC;AACH;AAEO,SAAS,MAAM,QAAsB;AAC1C,SAAO,OAAO,QAAkC;AAC9C,QAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAQ,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,QAAQ,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eACd,OACA,UAA8B,CAAC,GACX;AACpB,QAAM,QAAQ,IAAI,MAAM;AACxB,cAAY,OAAO,KAAK;AACxB,QAAM,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,KAAK;AAC5D,OAAK,MAAM,MAAM,MAAS;AAC1B,mBAAiB,OAAO,IAAI;AAC5B,SAAO;AACT;",
   "names": []
 }

package/dist/preferred.js

@@ -28,6 +28,7 @@ const PREFERRED_MODELS = {
   opencode: "kimi-k2.6",
   "opencode-go": "kimi-k3",
   "kimi-coding": "kimi-for-coding",
+  "openai-codex": "gpt-5.5",
   meta: "muse-spark-1.3",
   "cloudflare-workers-ai": "@cf/moonshotai/kimi-k2.6",
   "cloudflare-ai-gateway": "workers-ai/@cf/moonshotai/kimi-k2.6",

package/dist/preferred.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/preferred.ts"],
-  "sourcesContent": ["export const BEDROCK = 'amazon-bedrock';\n\nexport const PREFERRED_MODELS: Readonly<Record<string, string>> = {\n  [BEDROCK]: 'us.anthropic.claude-sonnet-5-5',\n  'ant-ling': 'Ring-2.6-1T',\n  anthropic: 'claude-opus-4-8',\n  openai: 'gpt-5.5',\n  azure: 'gpt-5.4',\n  nvidia: 'nvidia/nemotron-3-ultra-550b-a55b',\n  deepseek: 'deepseek-v4-pro',\n  google: 'gemini-3.1-pro-preview',\n  'google-vertex': 'gemini-3.1-pro-preview',\n  openrouter: 'moonshotai/kimi-k2.6',\n  'vercel-ai-gateway': 'zai/glm-5.1',\n  xai: 'grok-4.7',\n  groq: 'openai/gpt-oss-120b',\n  cerebras: 'gpt-oss-120b',\n  zai: 'glm-5.3',\n  'zai-coding-cn': 'glm-5.3',\n  mistral: 'devstral-medium-latest',\n  minimax: 'MiniMax-M2.7',\n  'minimax-cn': 'MiniMax-M2.7',\n  moonshotai: 'kimi-k2.6',\n  'moonshotai-cn': 'kimi-k2.6',\n  huggingface: 'moonshotai/Kimi-K2.6',\n  fireworks: 'accounts/fireworks/models/kimi-k3',\n  together: 'moonshotai/Kimi-K3',\n  baseten: 'zai-org/GLM-5.2',\n  opencode: 'kimi-k2.6',\n  'opencode-go': 'kimi-k3',\n  'kimi-coding': 'kimi-for-coding',\n  meta: 'muse-spark-1.3',\n  'cloudflare-workers-ai': '@cf/moonshotai/kimi-k2.6',\n  'cloudflare-ai-gateway': 'workers-ai/@cf/moonshotai/kimi-k2.6',\n  'qwen-token-plan': 'qwen3.7-max',\n  'qwen-token-plan-cn': 'qwen3.7-max',\n  'qwen-token-plan-individual': 'qwen3.8-max',\n  xiaomi: 'mimo-v2.5-pro',\n  'xiaomi-token-plan-cn': 'mimo-v2.5-pro',\n  'xiaomi-token-plan-ams': 'mimo-v2.5-pro',\n  'xiaomi-token-plan-sgp': 'mimo-v2.5-pro',\n};\n\nexport function preferredModel<T extends { id: string }>(\n  providerId: string,\n  available: readonly T[]\n): T | undefined {\n  const preferredId = PREFERRED_MODELS[providerId];\n  return available.find((model) => model.id === preferredId) ?? available[0];\n}\n"],
-  "mappings": "AAAO,MAAM,UAAU;AAEhB,MAAM,mBAAqD;AAAA,EAChE,CAAC,OAAO,GAAG;AAAA,EACX,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,qBAAqB;AAAA,EACrB,KAAK;AAAA,EACL,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,SAAS;AAAA,EACT,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,WAAW;AAAA,EACX,UAAU;AAAA,EACV,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AAAA,EACf,eAAe;AAAA,EACf,MAAM;AAAA,EACN,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,mBAAmB;AAAA,EACnB,sBAAsB;AAAA,EACtB,8BAA8B;AAAA,EAC9B,QAAQ;AAAA,EACR,wBAAwB;AAAA,EACxB,yBAAyB;AAAA,EACzB,yBAAyB;AAC3B;AAEO,SAAS,eACd,YACA,WACe;AACf,QAAM,cAAc,iBAAiB,UAAU;AAC/C,SAAO,UAAU,KAAK,CAAC,UAAU,MAAM,OAAO,WAAW,KAAK,UAAU,CAAC;AAC3E;",
+  "sourcesContent": ["export const BEDROCK = 'amazon-bedrock';\n\nexport const PREFERRED_MODELS: Readonly<Record<string, string>> = {\n  [BEDROCK]: 'us.anthropic.claude-sonnet-5-5',\n  'ant-ling': 'Ring-2.6-1T',\n  anthropic: 'claude-opus-4-8',\n  openai: 'gpt-5.5',\n  azure: 'gpt-5.4',\n  nvidia: 'nvidia/nemotron-3-ultra-550b-a55b',\n  deepseek: 'deepseek-v4-pro',\n  google: 'gemini-3.1-pro-preview',\n  'google-vertex': 'gemini-3.1-pro-preview',\n  openrouter: 'moonshotai/kimi-k2.6',\n  'vercel-ai-gateway': 'zai/glm-5.1',\n  xai: 'grok-4.7',\n  groq: 'openai/gpt-oss-120b',\n  cerebras: 'gpt-oss-120b',\n  zai: 'glm-5.3',\n  'zai-coding-cn': 'glm-5.3',\n  mistral: 'devstral-medium-latest',\n  minimax: 'MiniMax-M2.7',\n  'minimax-cn': 'MiniMax-M2.7',\n  moonshotai: 'kimi-k2.6',\n  'moonshotai-cn': 'kimi-k2.6',\n  huggingface: 'moonshotai/Kimi-K2.6',\n  fireworks: 'accounts/fireworks/models/kimi-k3',\n  together: 'moonshotai/Kimi-K3',\n  baseten: 'zai-org/GLM-5.2',\n  opencode: 'kimi-k2.6',\n  'opencode-go': 'kimi-k3',\n  'kimi-coding': 'kimi-for-coding',\n  'openai-codex': 'gpt-5.5',\n  meta: 'muse-spark-1.3',\n  'cloudflare-workers-ai': '@cf/moonshotai/kimi-k2.6',\n  'cloudflare-ai-gateway': 'workers-ai/@cf/moonshotai/kimi-k2.6',\n  'qwen-token-plan': 'qwen3.7-max',\n  'qwen-token-plan-cn': 'qwen3.7-max',\n  'qwen-token-plan-individual': 'qwen3.8-max',\n  xiaomi: 'mimo-v2.5-pro',\n  'xiaomi-token-plan-cn': 'mimo-v2.5-pro',\n  'xiaomi-token-plan-ams': 'mimo-v2.5-pro',\n  'xiaomi-token-plan-sgp': 'mimo-v2.5-pro',\n};\n\nexport function preferredModel<T extends { id: string }>(\n  providerId: string,\n  available: readonly T[]\n): T | undefined {\n  const preferredId = PREFERRED_MODELS[providerId];\n  return available.find((model) => model.id === preferredId) ?? available[0];\n}\n"],
+  "mappings": "AAAO,MAAM,UAAU;AAEhB,MAAM,mBAAqD;AAAA,EAChE,CAAC,OAAO,GAAG;AAAA,EACX,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,qBAAqB;AAAA,EACrB,KAAK;AAAA,EACL,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,SAAS;AAAA,EACT,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,WAAW;AAAA,EACX,UAAU;AAAA,EACV,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AAAA,EACf,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,MAAM;AAAA,EACN,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,mBAAmB;AAAA,EACnB,sBAAsB;AAAA,EACtB,8BAA8B;AAAA,EAC9B,QAAQ;AAAA,EACR,wBAAwB;AAAA,EACxB,yBAAyB;AAAA,EACzB,yBAAyB;AAC3B;AAEO,SAAS,eACd,YACA,WACe;AACf,QAAM,cAAc,iBAAiB,UAAU;AAC/C,SAAO,UAAU,KAAK,CAAC,UAAU,MAAM,OAAO,WAAW,KAAK,UAAU,CAAC;AAC3E;",
   "names": []
 }

package/dist/providers.js

@@ -33,6 +33,7 @@ import { xiaomiTokenPlanCnProvider } from "@earendil-works/pi-ai/providers/xiaom
 import { xiaomiTokenPlanSgpProvider } from "@earendil-works/pi-ai/providers/xiaomi-token-plan-sgp";
 import { zaiProvider } from "@earendil-works/pi-ai/providers/zai";
 import { zaiCodingCnProvider } from "@earendil-works/pi-ai/providers/zai-coding-cn";
+import { CODEX } from "./sign-ins.js";
 const RESOURCE = /^[a-z0-9][a-z0-9-]{0,62}$/i;
 const DEPLOYMENTS = /^[^=,\s]+\s*=\s*[^=,\s]+(\s*,\s*[^=,\s]+\s*=\s*[^=,\s]+)*$/;
 function httpsBase(value) {
@@ -305,7 +306,8 @@ const KEY_PROVIDERS = [
     env: "XAI_API_KEY",
     description: "Grok models from xAI.",
     keyUrl: "https://console.x.ai",
-    cors: true
+    cors: true,
+    signIn: true
   },
   {
     id: "meta",
@@ -369,7 +371,8 @@ const KEY_PROVIDERS = [
     env: "KIMI_API_KEY",
     description: "Kimi models on the Kimi Code subscription.",
     keyUrl: "https://www.kimi.com/code/console",
-    cors: false
+    cors: false,
+    signIn: true
   },
   {
     id: "ant-ling",
@@ -457,12 +460,21 @@ const LISTINGS = new Map([
     {
       description: entry.description,
       keyUrl: entry.keyUrl,
-      auth: entry.fields ? "fields" : "api-key",
+      auth: entry.signIn ? "oauth" : entry.fields ? "fields" : "api-key",
       corsFree: !entry.cors,
       vaultName: named.get(entry.id),
       ...entry.fields ? { fields: entry.fields } : {}
     }
-  ])
+  ]),
+  [
+    CODEX,
+    {
+      description: "GPT models on your ChatGPT Plus or Pro plan, with your ChatGPT account.",
+      auth: "oauth",
+      corsFree: true,
+      vaultName: "OPENAI_CODEX_TOKEN"
+    }
+  ]
 ]);
 const ADDED_FIRST = ["amazon-bedrock", "adobe"];
 export {