@aiden-ade/sandbox-agent 0.1.59 → 0.1.60

package/dist/model-scan-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-scan-runner.js","sourceRoot":"","sources":["../src/model-scan-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAE1B,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AAaxC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgC,EAChC,OAA6B;IAE7B,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,eAAe,GAAG;YACtB,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;YACpC,GAAG,uBAAuB,CAAC,SAAS,CAAC;SACtC,CAAC;QACF,MAAM,0BAA0B,CAAC;YAC/B,YAAY,EAAE,OAAO,CAAC,eAAe,EAAE;YACvC,QAAQ,EAAE,eAAe;YACzB,GAAG,OAAO,CAAC,kBAAkB;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG;gBACvB,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACpC,GAAG,uBAAuB,CAAC,UAAU,CAAC;aACvC,CAAC;YACF,MAAM,0BAA0B,CAAC;gBAC/B,YAAY,EAAE,OAAO,CAAC,eAAe,EAAE;gBACvC,QAAQ,EAAE,gBAAgB;gBAC1B,GAAG,OAAO,CAAC,kBAAkB;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,cAAc,GAAG;gBACrB,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACpC,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC;aAC9C,CAAC;YACF,MAAM,0BAA0B,CAAC;gBAC/B,YAAY,EAAE,OAAO,CAAC,eAAe,EAAE;gBACvC,QAAQ,EAAE,cAAc;gBACxB,GAAG,OAAO,CAAC,kBAAkB;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACT,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/dist/network-diagnostics.d.ts

@@ -0,0 +1,8 @@
+export type TransportFailureCode = "backend_unreachable" | "network_dns_failure" | "network_intercepted" | "network_proxy_auth_required" | "network_tls_failure";
+/**
+ * Classify only transport causes supported by concrete error evidence. Generic
+ * timeouts/resets stay `backend_unreachable`; the daemon must not guess that a
+ * VPN or captive portal is responsible without an observable DNS/TLS/HTTP clue.
+ */
+export declare function classifyTransportFailure(error: unknown): TransportFailureCode;
+//# sourceMappingURL=network-diagnostics.d.ts.map

package/dist/network-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-diagnostics.d.ts","sourceRoot":"","sources":["../src/network-diagnostics.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,GACrB,6BAA6B,GAC7B,qBAAqB,CAAC;AAoC1B;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAkC7E"}

package/dist/network-diagnostics.js

@@ -0,0 +1,56 @@
+function collectEvidence(error) {
+    const text = [];
+    const statuses = [];
+    const pending = [error];
+    const seen = new Set();
+    while (pending.length > 0 && seen.size < 12) {
+        const value = pending.shift();
+        if (typeof value === "string") {
+            text.push(value);
+            continue;
+        }
+        if (!value || typeof value !== "object" || seen.has(value))
+            continue;
+        seen.add(value);
+        const record = value;
+        for (const key of ["message", "code", "name"]) {
+            if (typeof record[key] === "string")
+                text.push(record[key]);
+        }
+        for (const key of ["status", "statusCode"]) {
+            if (typeof record[key] === "number")
+                statuses.push(record[key]);
+        }
+        for (const key of ["cause", "description", "context", "response"]) {
+            if (record[key] !== undefined)
+                pending.push(record[key]);
+        }
+    }
+    return { text: text.join(" ").toLowerCase(), statuses };
+}
+/**
+ * Classify only transport causes supported by concrete error evidence. Generic
+ * timeouts/resets stay `backend_unreachable`; the daemon must not guess that a
+ * VPN or captive portal is responsible without an observable DNS/TLS/HTTP clue.
+ */
+export function classifyTransportFailure(error) {
+    const evidence = collectEvidence(error);
+    const unexpectedStatus = evidence.text.match(/unexpected (?:server )?response:\s*(\d{3})/i);
+    const status = unexpectedStatus ? Number.parseInt(unexpectedStatus[1], 10) : undefined;
+    const statuses = status === undefined ? evidence.statuses : [...evidence.statuses, status];
+    if (statuses.includes(407) ||
+        /proxy authentication required|proxy_authentication_required/.test(evidence.text)) {
+        return "network_proxy_auth_required";
+    }
+    if (/\b(enotfound|eai_again|eai_nodata)\b|getaddrinfo|dns (?:lookup|resolution)/.test(evidence.text)) {
+        return "network_dns_failure";
+    }
+    if (/self_signed_cert|self signed certificate|unable to verify|certificate (?:has expired|is not yet valid|rejected)|cert_(?:has_expired|not_yet_valid)|tlsv\d|ssl routines|hostname.*certificate/.test(evidence.text)) {
+        return "network_tls_failure";
+    }
+    if (statuses.some((candidate) => candidate === 200 || [301, 302, 303, 307, 308].includes(candidate))) {
+        return "network_intercepted";
+    }
+    return "backend_unreachable";
+}
+//# sourceMappingURL=network-diagnostics.js.map

package/dist/network-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-diagnostics.js","sourceRoot":"","sources":["../src/network-diagnostics.ts"],"names":[],"mappings":"AAYA,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAc,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAU,EAAE,CAAC;YACvD,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAU,EAAE,CAAC;YACpD,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAU,EAAE,CAAC;YAC3E,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE3F,IACE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EACjF,CAAC;QACD,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAED,IACE,4EAA4E,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChG,CAAC;QACD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,IACE,8LAA8L,CAAC,IAAI,CACjM,QAAQ,CAAC,IAAI,CACd,EACD,CAAC;QACD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAChG,CAAC;QACD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC"}

package/dist/observable-map.d.ts

@@ -0,0 +1,25 @@
+/**
+ * A `Map` that reports membership changes.
+ *
+ * Used where state is derived from "does this map have any entries?" and the
+ * map is mutated from many call sites. Subscribing to the map itself means a
+ * future mutation site cannot silently forget to keep the derived state in
+ * sync — the failure mode that left desktop sleep prevention wired to a code
+ * path nothing actually called.
+ *
+ * `onChange` fires only on real changes: deleting an absent key or clearing an
+ * empty map is a no-op.
+ */
+export declare class ObservableMap<K, V> extends Map<K, V> {
+    /**
+     * Invoked after every membership change.
+     *
+     * Assigned after construction rather than passed to the constructor because
+     * `Map`'s constructor may populate entries before subclass fields exist.
+     */
+    onChange: (() => void) | null;
+    set(key: K, value: V): this;
+    delete(key: K): boolean;
+    clear(): void;
+}
+//# sourceMappingURL=observable-map.d.ts.map

package/dist/observable-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observable-map.d.ts","sourceRoot":"","sources":["../src/observable-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,qBAAa,aAAa,CAAC,CAAC,EAAE,CAAC,CAAE,SAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAQ;IAErC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAQ3B,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO;IAMvB,KAAK,IAAI,IAAI;CAKd"}

package/dist/observable-map.js

@@ -0,0 +1,42 @@
+/**
+ * A `Map` that reports membership changes.
+ *
+ * Used where state is derived from "does this map have any entries?" and the
+ * map is mutated from many call sites. Subscribing to the map itself means a
+ * future mutation site cannot silently forget to keep the derived state in
+ * sync — the failure mode that left desktop sleep prevention wired to a code
+ * path nothing actually called.
+ *
+ * `onChange` fires only on real changes: deleting an absent key or clearing an
+ * empty map is a no-op.
+ */
+export class ObservableMap extends Map {
+    /**
+     * Invoked after every membership change.
+     *
+     * Assigned after construction rather than passed to the constructor because
+     * `Map`'s constructor may populate entries before subclass fields exist.
+     */
+    onChange = null;
+    set(key, value) {
+        const existed = super.has(key);
+        const result = super.set(key, value);
+        // Replacing a value for an existing key does not change membership.
+        if (!existed)
+            this.onChange?.();
+        return result;
+    }
+    delete(key) {
+        const removed = super.delete(key);
+        if (removed)
+            this.onChange?.();
+        return removed;
+    }
+    clear() {
+        const had = this.size > 0;
+        super.clear();
+        if (had)
+            this.onChange?.();
+    }
+}
+//# sourceMappingURL=observable-map.js.map

package/dist/observable-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observable-map.js","sourceRoot":"","sources":["../src/observable-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,aAAoB,SAAQ,GAAS;IAChD;;;;;OAKG;IACH,QAAQ,GAAwB,IAAI,CAAC;IAErC,GAAG,CAAC,GAAM,EAAE,KAAQ;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,oEAAoE;QACpE,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,GAAM;QACX,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,GAAG;YAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/provider-auth-preflight.d.ts

@@ -0,0 +1,22 @@
+import { type CliVersionProbeResult } from "./cli-executable.js";
+export type ProviderAuthPreflightStatus = "ready" | "auth_required" | "unknown";
+export interface ProviderAuthPreflightResult {
+    status: ProviderAuthPreflightStatus;
+    message?: string;
+}
+type Probe = (executable: string, env: Record<string, string>, args: string[], timeoutMs: number) => Promise<CliVersionProbeResult>;
+/** Drop sticky ready state. Call when a run fails with a clear auth error. */
+export declare function invalidateProviderAuthPreflight(backendKind?: string, executable?: string): void;
+/** Test-only: clear the sticky ready cache between cases. */
+export declare function __resetProviderAuthPreflightCache(): void;
+/** True when provider stderr/error text clearly means the CLI is signed out. */
+export declare function looksLikeProviderAuthFailure(text: string): boolean;
+export declare function preflightProviderAuth(input: {
+    backendKind: string;
+    executable: string;
+    env: Record<string, string>;
+    probe?: Probe;
+    timeoutMs?: number;
+}): Promise<ProviderAuthPreflightResult>;
+export {};
+//# sourceMappingURL=provider-auth-preflight.d.ts.map

package/dist/provider-auth-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth-preflight.d.ts","sourceRoot":"","sources":["../src/provider-auth-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAoB,MAAM,qBAAqB,CAAC;AAEnF,MAAM,MAAM,2BAA2B,GAAG,OAAO,GAAG,eAAe,GAAG,SAAS,CAAC;AAEhF,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,2BAA2B,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,KAAK,GAAG,CACX,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAkCpC,8EAA8E;AAC9E,wBAAgB,+BAA+B,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAY/F;AAED,6DAA6D;AAC7D,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAoBD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElE;AAQD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAwCvC"}

package/dist/provider-auth-preflight.js

@@ -0,0 +1,110 @@
+import { runCliProbeAsync } from "./cli-executable.js";
+const AUTH_PROBES = {
+    claude_cli: {
+        args: ["auth", "status", "--json"],
+        label: "Claude Code",
+        loginCommand: "claude auth login",
+    },
+    codex_app_server: {
+        args: ["login", "status"],
+        label: "Codex",
+        loginCommand: "codex login",
+    },
+    cursor_agent_cli: {
+        args: ["status", "--format", "json"],
+        label: "Cursor Agent",
+        loginCommand: "cursor-agent login",
+    },
+};
+/**
+ * Sticky "ready" only — keyed by provider binary. Auth is a session concern for
+ * the local daemon: once Cursor/Claude/Codex has proven signed-in, later sends
+ * skip the ~3s status probe until we see a definitive sign-out (or invalidate).
+ *
+ * Never sticky-cache `auth_required`: after the user logs in, the next send must
+ * re-probe and succeed. Never cache `unknown` (timeouts must not block forever).
+ */
+const readyAuthCache = new Map();
+function authCacheKey(backendKind, executable) {
+    return `${backendKind}::${executable}`;
+}
+/** Drop sticky ready state. Call when a run fails with a clear auth error. */
+export function invalidateProviderAuthPreflight(backendKind, executable) {
+    if (!backendKind) {
+        readyAuthCache.clear();
+        return;
+    }
+    if (executable) {
+        readyAuthCache.delete(authCacheKey(backendKind, executable));
+        return;
+    }
+    for (const key of [...readyAuthCache.keys()]) {
+        if (key.startsWith(`${backendKind}::`))
+            readyAuthCache.delete(key);
+    }
+}
+/** Test-only: clear the sticky ready cache between cases. */
+export function __resetProviderAuthPreflightCache() {
+    readyAuthCache.clear();
+}
+function jsonAuthenticationState(output) {
+    try {
+        const parsed = JSON.parse(output);
+        for (const key of ["authenticated", "isAuthenticated", "loggedIn", "isLoggedIn"]) {
+            if (typeof parsed[key] === "boolean")
+                return parsed[key];
+        }
+    }
+    catch {
+        // Text status output is handled below.
+    }
+    return null;
+}
+function definitivelySignedOut(output) {
+    return /not\s+(logged\s+in|authenticated)|login\s+required|authentication\s+required|no\s+authentication|unauthorized/i.test(output);
+}
+/** True when provider stderr/error text clearly means the CLI is signed out. */
+export function looksLikeProviderAuthFailure(text) {
+    return definitivelySignedOut(text);
+}
+function unsupportedStatusCommand(output) {
+    return /unknown\s+(command|option)|unrecognized\s+(command|option|subcommand)|invalid\s+subcommand/i.test(output);
+}
+export async function preflightProviderAuth(input) {
+    const spec = AUTH_PROBES[input.backendKind];
+    if (!spec)
+        return { status: "unknown" };
+    const cacheKey = authCacheKey(input.backendKind, input.executable);
+    // Custom probes (tests) always run; production reuses sticky ready.
+    if (!input.probe) {
+        const cached = readyAuthCache.get(cacheKey);
+        if (cached?.status === "ready") {
+            return cached;
+        }
+    }
+    const result = await (input.probe ?? runCliProbeAsync)(input.executable, input.env, spec.args, input.timeoutMs ?? 3_000);
+    const output = `${result.stdout}\n${result.stderr}`.trim();
+    const jsonState = jsonAuthenticationState(result.stdout.trim());
+    const signedOut = jsonState === false || definitivelySignedOut(output);
+    if (signedOut) {
+        // Clear any stale ready so the next send re-probes after the user logs in.
+        if (!input.probe)
+            readyAuthCache.delete(cacheKey);
+        return {
+            status: "auth_required",
+            message: `${spec.label} is installed but not signed in. Run \`${spec.loginCommand}\` on this computer, then try again.`,
+        };
+    }
+    if (result.status === 0) {
+        const ready = { status: "ready" };
+        if (!input.probe)
+            readyAuthCache.set(cacheKey, ready);
+        return ready;
+    }
+    if (unsupportedStatusCommand(output))
+        return { status: "unknown" };
+    // Timeouts, crashes, and unfamiliar output must not become false auth
+    // failures. The provider retains its existing launch/error handling.
+    return { status: "unknown" };
+}
+//# sourceMappingURL=provider-auth-preflight.js.map

package/dist/provider-auth-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth-preflight.js","sourceRoot":"","sources":["../src/provider-auth-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAgBnF,MAAM,WAAW,GAA4E;IAC3F,UAAU,EAAE;QACV,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAClC,KAAK,EAAE,aAAa;QACpB,YAAY,EAAE,mBAAmB;KAClC;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QACzB,KAAK,EAAE,OAAO;QACd,YAAY,EAAE,aAAa;KAC5B;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC;QACpC,KAAK,EAAE,cAAc;QACrB,YAAY,EAAE,oBAAoB;KACnC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuC,CAAC;AAEtE,SAAS,YAAY,CAAC,WAAmB,EAAE,UAAkB;IAC3D,OAAO,GAAG,WAAW,KAAK,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,+BAA+B,CAAC,WAAoB,EAAE,UAAmB;IACvF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,cAAc,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,WAAW,IAAI,CAAC;YAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,iCAAiC;IAC/C,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAc;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA4B,CAAC;QAC7D,KAAK,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;YACjF,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,gHAAgH,CAAC,IAAI,CAC1H,MAAM,CACP,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAc;IAC9C,OAAO,6FAA6F,CAAC,IAAI,CACvG,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAM3C;IACC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAExC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACnE,oEAAoE;IACpE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC,CACpD,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,GAAG,EACT,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,SAAS,IAAI,KAAK,CACzB,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,SAAS,KAAK,KAAK,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,0CAA0C,IAAI,CAAC,YAAY,sCAAsC;SACxH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAgC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,wBAAwB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnE,sEAAsE;IACtE,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC"}

package/dist/provider-model-discovery.d.ts

@@ -0,0 +1,38 @@
+export declare const MODEL_DISCOVERY_TIMEOUT_MS = 8000;
+export declare function extractModelIdsFromJson(value: unknown): string[];
+/** Parse `codex debug models` JSON — only slugs the CLI exposes in the picker. */
+export declare function extractCodexModelSlugsFromDebugJson(value: unknown): string[];
+/** Parse `codex debug models` JSON and expand supported reasoning levels for effort merge. */
+export declare function extractCodexDiscoveredModelIdsFromDebugJson(value: unknown): string[];
+/** Lossless native OpenCode model capabilities for provider-defined variants. */
+export interface OpenCodeDiscoveredModelCapability {
+    id: string;
+    variants: string[];
+}
+export declare function extractOpenCodeModelCapabilitiesFromVerboseOutput(text: string): OpenCodeDiscoveredModelCapability[];
+/**
+ * Expand `opencode models --verbose` output into discovery ids. A reasoning-capable
+ * model with tunable variants emits one `<id>-<variant>` per known variant (e.g.
+ * `opencode/deepseek-v4-flash-free-low`, `...-medium`, `...-high`, `...-max`) — these
+ * collapse back to base + effort via the existing `parseModelEffortSuffix` machinery,
+ * exactly like Codex's `debug models` reasoning-tier expansion. A model with
+ * `reasoning: true` but no (recognized) tunable variant — e.g. `big-pickle`, which
+ * always reasons with no selectable level — emits its bare id only, so it is never
+ * treated as effort-tunable. An unrecognized variant key is dropped rather than
+ * guessed at, so it can never corrupt a base model id.
+ */
+export declare function extractOpenCodeDiscoveredModelIdsFromVerboseOutput(text: string): string[];
+export declare function extractModelIdsFromText(value: string): string[];
+/** Parse `cursor-agent models` lines like `gpt-5.3-codex - Codex 5.3`. */
+export declare function extractModelIdsFromLabeledList(value: string): string[];
+export declare function isValidClaudeModelId(id: string): boolean;
+/** Drop short Claude id prefixes when a longer sibling exists (e.g. claude-opus-4 vs claude-opus-4-6). */
+export declare function filterClaudePrefixModelIds(ids: readonly string[]): string[];
+/** Drop dated API snapshot ids when the undated sibling is present. */
+export declare function filterClaudeDatedModelIds(ids: readonly string[]): string[];
+/** Claude Code has no non-interactive model list yet; scrape embedded ids from the binary. */
+export declare function extractClaudeModelIdsFromExecutable(executable: string): string[];
+export declare function getCatalogModelIds(provider: string): string[];
+export declare function supportsProviderModelDiscovery(provider: string): boolean;
+export declare function discoverProviderModels(provider: string, executable: string, env: Record<string, string>): Promise<string[]>;
+//# sourceMappingURL=provider-model-discovery.d.ts.map

package/dist/provider-model-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-model-discovery.d.ts","sourceRoot":"","sources":["../src/provider-model-discovery.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AA6ChD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAgBhE;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAe5E;AAqBD,8FAA8F;AAC9F,wBAAgB,2CAA2C,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CA+BpF;AA0CD,iFAAiF;AACjF,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA2ED,wBAAgB,iDAAiD,CAC/D,IAAI,EAAE,MAAM,GACX,iCAAiC,EAAE,CAmBrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kDAAkD,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBzF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAc/D;AAED,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAYtE;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAgBxD;AAED,0GAA0G;AAC1G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAW3E;AAED,uEAAuE;AACvE,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAO1E;AAUD,8FAA8F;AAC9F,wBAAgB,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAahF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAG7D;AAgJD,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BnB"}