@atomic-chat/core 0.5.1

package/dist/integrations/configure/codex.js

@@ -0,0 +1,43 @@
+/**
+ * Codex CLI — `~/.codex/config.toml`.
+ *
+ * Port of `configure_codex` in `src-tauri/src/core/system/commands.rs`. This is the only writer that
+ * edits TOML, and it does it textually rather than by parsing: the file is the user's, so the two
+ * regions we own are delimited by managed markers and everything between them is left alone.
+ *
+ * Two regions, not one, because Codex 0.135+ makes Atomic the default provider through the bare
+ * root keys `model` / `model_provider`, and bare TOML keys must precede every `[table]`. So a head
+ * block goes at the very top, the user's content follows, and the `[model_providers.atomic]` table
+ * goes last. Rerunning strips both regions first, which is why a rerun is idempotent.
+ *
+ * The user's content is `trimEnd`-ed but never trimmed at the start: leading blank lines left by
+ * stripping a previous head block are part of the recorded output.
+ */
+import { ATOMIC_MANAGED_BEGIN, ATOMIC_MANAGED_END } from '../config-io.js';
+import { stripAtomicManagedBlock, tomlBasicStringEscape } from '../config-io.js';
+import { registerWriter } from './registry.js';
+const DIR = '.codex';
+const PATH = `${DIR}/config.toml`;
+export async function configureCodex(input) {
+    const { fs, apiUrl, model, apiKey } = input;
+    await fs.mkdirp(DIR);
+    const existing = (await fs.read(PATH)) ?? '';
+    const cleaned = stripAtomicManagedBlock(existing);
+    const head = `${ATOMIC_MANAGED_BEGIN}\n` +
+        `model = "${tomlBasicStringEscape(model)}"\n` +
+        `model_provider = "atomic"\n` +
+        `${ATOMIC_MANAGED_END}\n`;
+    // Codex reads the secret from the env var named here, never inline — so with no key there is no
+    // `env_key` line at all, rather than a placeholder.
+    const envKeyLine = apiKey === '' ? '' : `env_key = "ATOMIC_CHAT_API_KEY"\n`;
+    const block = `${ATOMIC_MANAGED_BEGIN}\n` +
+        `[model_providers.atomic]\n` +
+        `name = "Atomic Chat"\n` +
+        `base_url = "${tomlBasicStringEscape(apiUrl)}"\n` +
+        envKeyLine +
+        `${ATOMIC_MANAGED_END}\n`;
+    const content = cleaned.trim() === '' ? `${head}\n${block}` : `${head}\n${cleaned.trimEnd()}\n${block}`;
+    await fs.write(PATH, content);
+}
+registerWriter('codex', configureCodex);
+//# sourceMappingURL=codex.js.map

package/dist/integrations/configure/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/integrations/configure/codex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,MAAM,GAAG,GAAG,QAAQ,CAAA;AACpB,MAAM,IAAI,GAAG,GAAG,GAAG,cAAc,CAAA;AAEjC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAqB;IACxD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IAC3C,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAEpB,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAEjD,MAAM,IAAI,GACR,GAAG,oBAAoB,IAAI;QAC3B,YAAY,qBAAqB,CAAC,KAAK,CAAC,KAAK;QAC7C,6BAA6B;QAC7B,GAAG,kBAAkB,IAAI,CAAA;IAE3B,gGAAgG;IAChG,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mCAAmC,CAAA;IAC3E,MAAM,KAAK,GACT,GAAG,oBAAoB,IAAI;QAC3B,4BAA4B;QAC5B,wBAAwB;QACxB,eAAe,qBAAqB,CAAC,MAAM,CAAC,KAAK;QACjD,UAAU;QACV,GAAG,kBAAkB,IAAI,CAAA;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,KAAK,KAAK,EAAE,CAAA;IAEvG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC/B,CAAC;AAED,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA"}

package/dist/integrations/configure/copilot.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GitHub Copilot CLI has no provider config file — it reads its BYOK settings from the environment
+ * at launch — so configuring it means persisting `COPILOT_*` to the shell rc (Windows: `setx`).
+ * `COPILOT_OFFLINE` is on so no GitHub sign-in is required and traffic stays on the local provider.
+ *
+ * Copilot is the one agent that OMITS the key variable entirely when there is none, rather than
+ * writing an `atomic` placeholder: an empty `COPILOT_PROVIDER_API_KEY` would be sent as a credential.
+ */
+import type { ConfigureWriter } from './registry.js';
+export declare const configureCopilot: ConfigureWriter;

package/dist/integrations/configure/copilot.js

@@ -0,0 +1,14 @@
+/**
+ * GitHub Copilot CLI has no provider config file — it reads its BYOK settings from the environment
+ * at launch — so configuring it means persisting `COPILOT_*` to the shell rc (Windows: `setx`).
+ * `COPILOT_OFFLINE` is on so no GitHub sign-in is required and traffic stays on the local provider.
+ *
+ * Copilot is the one agent that OMITS the key variable entirely when there is none, rather than
+ * writing an `atomic` placeholder: an empty `COPILOT_PROVIDER_API_KEY` would be sent as a credential.
+ */
+import { registerWriter } from './registry.js';
+import { configureEnvAgent } from './env-agent.js';
+const MARKER = '# Atomic Chat - Copilot CLI Config';
+export const configureCopilot = (input) => configureEnvAgent(input, { agentId: 'copilot', marker: MARKER, prefix: 'COPILOT_' });
+registerWriter('copilot', configureCopilot);
+//# sourceMappingURL=copilot.js.map

package/dist/integrations/configure/copilot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot.js","sourceRoot":"","sources":["../../../src/integrations/configure/copilot.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,MAAM,GAAG,oCAAoC,CAAA;AAEnD,MAAM,CAAC,MAAM,gBAAgB,GAAoB,CAAC,KAAK,EAAE,EAAE,CACzD,iBAAiB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;AAEtF,cAAc,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA"}

package/dist/integrations/configure/droid.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Factory Droid keeps its BYOK providers in `~/.factory/settings.json` as a `customModels` array,
+ * and selects one with a top-level `model` string.
+ *
+ * The selector is the awkward part: Droid addresses a custom model by its POSITION in the array
+ * (`custom:<displayName with spaces->dashes>-<index>`), not by name. So the value we write depends
+ * on where our entry lands — seeding other models first shifts it. We upsert by `displayName`
+ * (our managed marker) precisely so a rerun replaces our entry in place and the selector stays valid
+ * instead of appending a duplicate and renumbering the user's models.
+ */
+import type { ConfigureWriter } from './registry.js';
+export declare const configureDroid: ConfigureWriter;

package/dist/integrations/configure/droid.js

@@ -0,0 +1,47 @@
+/**
+ * Factory Droid keeps its BYOK providers in `~/.factory/settings.json` as a `customModels` array,
+ * and selects one with a top-level `model` string.
+ *
+ * The selector is the awkward part: Droid addresses a custom model by its POSITION in the array
+ * (`custom:<displayName with spaces->dashes>-<index>`), not by name. So the value we write depends
+ * on where our entry lands — seeding other models first shifts it. We upsert by `displayName`
+ * (our managed marker) precisely so a rerun replaces our entry in place and the selector stays valid
+ * instead of appending a duplicate and renumbering the user's models.
+ */
+import { AtomicCoreError } from '../../contracts/index.js';
+import { canonicalJson, keyOr, parseJsonStrict } from '../config-io.js';
+import { asJsonArray, asJsonObject } from './json-tree.js';
+import { registerWriter } from './registry.js';
+const DISPLAY_NAME = 'Atomic Chat';
+const SETTINGS_PATH = '.factory/settings.json';
+/** Droid's own ceiling for a generic chat-completions provider; lower values truncate long edits. */
+const MAX_OUTPUT_TOKENS = 16_384;
+export const configureDroid = async ({ apiUrl, model, apiKey, fs }) => {
+    const text = await fs.read(SETTINGS_PATH);
+    const parsed = text === undefined ? {} : parseJsonStrict(text, fs.absolute(SETTINGS_PATH));
+    const root = asJsonObject(parsed);
+    if (!root)
+        throw new AtomicCoreError('IO_ERROR', 'settings.json is not a JSON object');
+    // A `customModels` that is not an array is unusable to Droid anyway, so it is replaced rather than
+    // preserved — unlike the individual entries inside it, which are the user's own providers.
+    const models = asJsonArray(root['customModels']) ?? [];
+    const entry = {
+        model,
+        displayName: DISPLAY_NAME,
+        baseUrl: apiUrl,
+        // Droid rejects an empty apiKey outright, so a keyless local server still needs a placeholder.
+        apiKey: keyOr(apiKey, 'atomic'),
+        provider: 'generic-chat-completion-api',
+        maxOutputTokens: MAX_OUTPUT_TOKENS,
+    };
+    let index = models.findIndex((m) => asJsonObject(m)?.['displayName'] === DISPLAY_NAME);
+    if (index >= 0)
+        models[index] = entry;
+    else
+        index = models.push(entry) - 1;
+    root['customModels'] = models;
+    root['model'] = `custom:${DISPLAY_NAME.split(' ').join('-')}-${index}`;
+    await fs.write(SETTINGS_PATH, canonicalJson(root));
+};
+registerWriter('droid', configureDroid);
+//# sourceMappingURL=droid.js.map

package/dist/integrations/configure/droid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"droid.js","sourceRoot":"","sources":["../../../src/integrations/configure/droid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,MAAM,YAAY,GAAG,aAAa,CAAA;AAClC,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAC9C,qGAAqG;AACrG,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEhC,MAAM,CAAC,MAAM,cAAc,GAAoB,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE;IACrF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAA;IAC1F,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAA;IAEtF,mGAAmG;IACnG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAA;IACtD,MAAM,KAAK,GAAe;QACxB,KAAK;QACL,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,MAAM;QACf,+FAA+F;QAC/F,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,6BAA6B;QACvC,eAAe,EAAE,iBAAiB;KACnC,CAAA;IAED,IAAI,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,YAAY,CAAC,CAAA;IACtF,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;;QAChC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAA;IAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,UAAU,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAA;IAEtE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA"}

package/dist/integrations/configure/dsh.d.ts

@@ -0,0 +1,34 @@
+/**
+ * DeepSeek Harness (`dsh`) reads `$DSH_HOME/settings.yaml` (default `~/.dsh`) live, so pointing it at
+ * the local server is a single upsert of the `llm-pi-ai.providers.atomic` route — no restart needed.
+ *
+ * This is the only writer here that refuses its input, and the reason is blast radius: dsh rejects
+ * the ENTIRE `llm-pi-ai` section when one route in it is invalid, taking the user's other providers
+ * down with it. A route needs `api`, `baseURL` and a non-empty `models` list, so a blank URL or model
+ * is refused before the tree is touched at all. The credential is validated for the same reason: an
+ * unquoted dotenv value ends at whitespace or `#`, and a newline would inject a second assignment, so
+ * a key carrying any of those is rejected — with a message that names the variable and never the
+ * value, so a rejected key cannot leak into a log or a toast.
+ *
+ * Two more things are load-bearing. The route is replaced WHOLESALE rather than deep-merged: a merge
+ * would let a stale `apiKeyEnv` from an earlier keyed run survive a keyless run and break every
+ * request with MISSING_CREDENTIAL. And because the YAML round trip drops comments and expands
+ * anchors, the pre-existing file is copied to `settings.yaml.atomic-backup` — once, so a later run
+ * cannot overwrite the true pre-Atomic state with our own generated output.
+ */
+import type { ConfigureWriter } from './registry.js';
+type YamlMapping = Record<string, unknown>;
+/** Reject a value no dotenv line can carry. The message names the variable, never the value. */
+export declare function dshValidateEnvValue(name: string, value: string): void;
+/** The `llm-pi-ai.providers.atomic` node. Keyless omits `apiKeyEnv` rather than writing an empty one. */
+export declare function dshRouteNode(apiUrl: string, model: string, withKey: boolean): YamlMapping;
+/**
+ * Upsert our route into an already-parsed tree. Pure: no I/O, no environment. Everything outside
+ * `llm-pi-ai.providers.atomic` is preserved, including relative order — assigning to an existing key
+ * keeps its position, in JavaScript as in `serde_yaml`'s insertion-ordered mapping.
+ */
+export declare function applyDshProvider(root: unknown, apiUrl: string, model: string, withKey: boolean): unknown;
+/** `$DSH_HOME` when set, else `~/.dsh`. A literal `~` can reach us from a quoted rc-file value. */
+export declare function dshHome(env: NodeJS.ProcessEnv, home: string): string;
+export declare const configureDsh: ConfigureWriter;
+export {};

package/dist/integrations/configure/dsh.js

@@ -0,0 +1,146 @@
+/**
+ * DeepSeek Harness (`dsh`) reads `$DSH_HOME/settings.yaml` (default `~/.dsh`) live, so pointing it at
+ * the local server is a single upsert of the `llm-pi-ai.providers.atomic` route — no restart needed.
+ *
+ * This is the only writer here that refuses its input, and the reason is blast radius: dsh rejects
+ * the ENTIRE `llm-pi-ai` section when one route in it is invalid, taking the user's other providers
+ * down with it. A route needs `api`, `baseURL` and a non-empty `models` list, so a blank URL or model
+ * is refused before the tree is touched at all. The credential is validated for the same reason: an
+ * unquoted dotenv value ends at whitespace or `#`, and a newline would inject a second assignment, so
+ * a key carrying any of those is rejected — with a message that names the variable and never the
+ * value, so a rejected key cannot leak into a log or a toast.
+ *
+ * Two more things are load-bearing. The route is replaced WHOLESALE rather than deep-merged: a merge
+ * would let a stale `apiKeyEnv` from an earlier keyed run survive a keyless run and break every
+ * request with MISSING_CREDENTIAL. And because the YAML round trip drops comments and expands
+ * anchors, the pre-existing file is copied to `settings.yaml.atomic-backup` — once, so a later run
+ * cannot overwrite the true pre-Atomic state with our own generated output.
+ */
+import { AtomicCoreError } from '../../contracts/index.js';
+import { ATOMIC_MANAGED_BEGIN, ATOMIC_MANAGED_END, canonicalYaml, expandTilde, parseYaml, stripAtomicManagedBlock, } from '../config-io.js';
+import { registerWriter } from './registry.js';
+const SECTION = 'llm-pi-ai';
+const ROUTE_ID = 'atomic';
+/** The route names an env var, never the secret itself. */
+const KEY_ENV = 'ATOMIC_API_KEY';
+const CONTEXT_WINDOW = 65_536;
+const MAX_TOKENS = 8_192;
+function asMapping(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    return value;
+}
+/**
+ * Borrow `parent[key]` as a mapping, creating it when absent. A bare `llm-pi-ai:` with nothing under
+ * it parses to null, which is a hole to fill rather than data to protect. Anything else non-mapping
+ * is real user content and errors out — `settings.yaml` is shared with every other harness plugin, so
+ * a silent overwrite would delete config we do not own.
+ */
+function childMapping(parent, key, label) {
+    if (parent[key] === undefined || parent[key] === null)
+        parent[key] = {};
+    const child = asMapping(parent[key]);
+    if (!child) {
+        throw new AtomicCoreError('IO_ERROR', `\`${label}\` in settings.yaml is not a mapping. Fix or remove it and try again.`);
+    }
+    return child;
+}
+/** Reject a value no dotenv line can carry. The message names the variable, never the value. */
+export function dshValidateEnvValue(name, value) {
+    if (/[\n\r#"']/.test(value) || /\s/.test(value)) {
+        throw new AtomicCoreError('INVALID_ARGUMENT', `${name} contains characters that cannot be stored in a .env file`);
+    }
+}
+/** The `llm-pi-ai.providers.atomic` node. Keyless omits `apiKeyEnv` rather than writing an empty one. */
+export function dshRouteNode(apiUrl, model, withKey) {
+    return {
+        displayName: 'Atomic Chat',
+        api: 'openai-completions',
+        baseURL: apiUrl,
+        ...(withKey ? { apiKeyEnv: KEY_ENV } : {}),
+        models: [{ id: model, contextWindow: CONTEXT_WINDOW, maxTokens: MAX_TOKENS }],
+    };
+}
+/**
+ * Upsert our route into an already-parsed tree. Pure: no I/O, no environment. Everything outside
+ * `llm-pi-ai.providers.atomic` is preserved, including relative order — assigning to an existing key
+ * keeps its position, in JavaScript as in `serde_yaml`'s insertion-ordered mapping.
+ */
+export function applyDshProvider(root, apiUrl, model, withKey) {
+    if (apiUrl.trim() === '') {
+        throw new AtomicCoreError('INVALID_ARGUMENT', 'No local server URL. Start the local API server and try again.');
+    }
+    if (model.trim() === '') {
+        throw new AtomicCoreError('INVALID_ARGUMENT', 'No model selected. DeepSeek Harness rejects a provider with an empty model list, which would ' +
+            'also disable any other provider configured in that section.');
+    }
+    // An empty, whitespace-only or comment-only document parses to null; one heal covers all three.
+    const healed = root === null || root === undefined ? {} : root;
+    const map = asMapping(healed);
+    if (!map)
+        throw new AtomicCoreError('IO_ERROR', 'settings.yaml top level is not a YAML mapping');
+    const section = childMapping(map, SECTION, SECTION);
+    const providers = childMapping(section, 'providers', `${SECTION}.providers`);
+    providers[ROUTE_ID] = dshRouteNode(apiUrl, model, withKey);
+    return map;
+}
+/**
+ * Upsert — or, with no vars, remove — our managed block in a dotenv file, preserving every line
+ * outside it. Deliberately not the shell-rc writer: that one emits `export K='V'`, uses a different
+ * marker scheme, and always appends a fresh block, so it cannot express "remove the block and write
+ * nothing", which is exactly what the keyless path needs.
+ */
+async function writeManagedEnv(fs, path, vars, unix) {
+    for (const v of vars)
+        dshValidateEnvValue(v.name, v.value);
+    const found = await fs.read(path);
+    // Nothing to clear: do not create the file just to leave it empty.
+    if (found === undefined && vars.length === 0)
+        return;
+    const kept = stripAtomicManagedBlock(found ?? '').trimEnd();
+    let out;
+    if (vars.length === 0) {
+        out = kept === '' ? '' : `${kept}\n`;
+    }
+    else {
+        const body = vars.map((v) => `${v.name}=${v.value}\n`).join('');
+        const block = `${ATOMIC_MANAGED_BEGIN}\n${body}${ATOMIC_MANAGED_END}\n`;
+        out = kept === '' ? block : `${kept}\n\n${block}`;
+    }
+    await fs.write(path, out, unix ? { mode: 0o600 } : {});
+}
+/** `$DSH_HOME` when set, else `~/.dsh`. A literal `~` can reach us from a quoted rc-file value. */
+export function dshHome(env, home) {
+    const raw = env['DSH_HOME']?.trim();
+    return raw ? expandTilde(raw, home) : '.dsh';
+}
+export const configureDsh = async ({ apiUrl, model, apiKey, fs, env, platform }) => {
+    const dir = dshHome(env, fs.home);
+    const settingsPath = `${dir}/settings.yaml`;
+    const trimmed = apiKey.trim();
+    const key = trimmed === '' ? undefined : trimmed;
+    // Validate the credential before settings.yaml, so an unusable key cannot leave a route pointing at
+    // a reference we then failed to store.
+    if (key !== undefined)
+        dshValidateEnvValue(KEY_ENV, key);
+    // Parse before creating anything, so a malformed file leaves no debris.
+    const text = (await fs.read(settingsPath)) ?? '';
+    const root = parseYaml(text, fs.absolute(settingsPath));
+    const patched = applyDshProvider(root, apiUrl, model, key !== undefined);
+    const serialized = canonicalYaml(patched);
+    if (text !== '') {
+        const backup = `${dir}/settings.yaml.atomic-backup`;
+        if (!(await fs.exists(backup)))
+            await fs.write(backup, text);
+    }
+    await fs.write(settingsPath, serialized.endsWith('\n') ? serialized : `${serialized}\n`);
+    // The secret never enters settings.yaml. dsh resolves the reference from the inherited environment,
+    // then `$DSH_HOME/.credentials.yaml`, then the invoking directory's `.env`, then this file — the
+    // lowest-precedence layer, so anything the user sets deliberately still wins.
+    const unix = platform !== 'win32';
+    await writeManagedEnv(fs, `${dir}/.env`, 
+    // Keyless: the route carries no `apiKeyEnv`, so a leftover value would outlive its use.
+    key === undefined ? [] : [{ name: KEY_ENV, value: key }], unix);
+};
+registerWriter('dsh', configureDsh);
+//# sourceMappingURL=dsh.js.map

package/dist/integrations/configure/dsh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh.js","sourceRoot":"","sources":["../../../src/integrations/configure/dsh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE1D,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,SAAS,EACT,uBAAuB,GACxB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,MAAM,OAAO,GAAG,WAAW,CAAA;AAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAA;AACzB,2DAA2D;AAC3D,MAAM,OAAO,GAAG,gBAAgB,CAAA;AAChC,MAAM,cAAc,GAAG,MAAM,CAAA;AAC7B,MAAM,UAAU,GAAG,KAAK,CAAA;AAIxB,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzF,OAAO,KAAoB,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAAmB,EAAE,GAAW,EAAE,KAAa;IACnE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAA;IACvE,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CACvB,UAAU,EACV,KAAK,KAAK,uEAAuE,CAClF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAa;IAC7D,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,IAAI,2DAA2D,CACnE,CAAA;IACH,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,OAAgB;IAC1E,OAAO;QACL,WAAW,EAAE,aAAa;QAC1B,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;KAC9E,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAa,EAAE,MAAc,EAAE,KAAa,EAAE,OAAgB;IAC7F,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,+FAA+F;YAC7F,6DAA6D,CAChE,CAAA;IACH,CAAC;IACD,gGAAgG;IAChG,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,+CAA+C,CAAC,CAAA;IAEhG,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,YAAY,CAAC,CAAA;IAC5E,SAAS,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAC1D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,EAAY,EACZ,IAAY,EACZ,IAA4C,EAC5C,IAAa;IAEb,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;IAE1D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,mEAAmE;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IACpD,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IAE3D,IAAI,GAAW,CAAA;IACf,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAA;IACtC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/D,MAAM,KAAK,GAAG,GAAG,oBAAoB,KAAK,IAAI,GAAG,kBAAkB,IAAI,CAAA;QACvE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,KAAK,EAAE,CAAA;IACnD,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACxD,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,OAAO,CAAC,GAAsB,EAAE,IAAY;IAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAA;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAoB,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,YAAY,GAAG,GAAG,GAAG,gBAAgB,CAAA;IAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,GAAG,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IAChD,oGAAoG;IACpG,uCAAuC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAExD,wEAAwE;IACxE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAA;IAExE,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAEzC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,GAAG,GAAG,8BAA8B,CAAA;QACnD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC,CAAA;IAExF,oGAAoG;IACpG,iGAAiG;IACjG,8EAA8E;IAC9E,MAAM,IAAI,GAAG,QAAQ,KAAK,OAAO,CAAA;IACjC,MAAM,eAAe,CACnB,EAAE,EACF,GAAG,GAAG,OAAO;IACb,wFAAwF;IACxF,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EACxD,IAAI,CACL,CAAA;AACH,CAAC,CAAA;AAED,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA"}

package/dist/integrations/configure/env-agent.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The five agents that have no provider config file at all — Copilot, Goose, OpenHands, Poolside and
+ * Muse Code read their endpoint from the environment. `configure_*` therefore persists the variables
+ * instead of writing a file: a marked block in the user's shell rc on unix, `setx` on Windows.
+ *
+ * The variables themselves come from `childEnv`, which is the same list `launch` sets directly on
+ * the spawned child — a rc file just written is not live in a process that is already running, so
+ * the two must never drift.
+ */
+import type { EnvEntry } from '../config-io.js';
+import type { ConfigureInput } from './registry.js';
+export interface EnvAgentSpec {
+    /** Catalog id, used to look the variable list up in `childEnv`. */
+    agentId: string;
+    /** The single comment line that both opens and closes our region in the rc file. */
+    marker: string;
+    /** `export <prefix>…` lines are dropped even outside the block, as a stale-export safety net. */
+    prefix: string;
+}
+/** The variables this agent needs, in the order the Rust `*_env_vars` builder emits them. */
+export declare function envAgentVars(agentId: string, apiUrl: string, model: string, apiKey: string): EnvEntry[];
+/**
+ * Persist the variables. On Windows each one goes through `setx` (a user-scope registry write) and
+ * no file is touched at all; everywhere else they become one marked block in the shell rc.
+ */
+export declare function configureEnvAgent(input: ConfigureInput, spec: EnvAgentSpec): Promise<void>;

package/dist/integrations/configure/env-agent.js

@@ -0,0 +1,41 @@
+/**
+ * The five agents that have no provider config file at all — Copilot, Goose, OpenHands, Poolside and
+ * Muse Code read their endpoint from the environment. `configure_*` therefore persists the variables
+ * instead of writing a file: a marked block in the user's shell rc on unix, `setx` on Windows.
+ *
+ * The variables themselves come from `childEnv`, which is the same list `launch` sets directly on
+ * the spawned child — a rc file just written is not live in a process that is already running, so
+ * the two must never drift.
+ */
+import { AtomicCoreError } from '../../contracts/index.js';
+import { childEnv, findAgent } from '../catalog.js';
+import { writeMarkedEnvToShell } from '../config-io.js';
+/** The variables this agent needs, in the order the Rust `*_env_vars` builder emits them. */
+export function envAgentVars(agentId, apiUrl, model, apiKey) {
+    const agent = findAgent(agentId);
+    if (!agent)
+        throw new AtomicCoreError('INTERNAL_ERROR', `Unknown agent: ${agentId}`);
+    return Object.entries(childEnv(agent, apiUrl, model, apiKey)).map(([key, value]) => ({ key, value }));
+}
+/**
+ * Persist the variables. On Windows each one goes through `setx` (a user-scope registry write) and
+ * no file is touched at all; everywhere else they become one marked block in the shell rc.
+ */
+export async function configureEnvAgent(input, spec) {
+    const entries = envAgentVars(spec.agentId, input.apiUrl, input.model, input.apiKey);
+    if (input.platform === 'win32') {
+        const spawn = input.spawn;
+        if (!spawn) {
+            throw new AtomicCoreError('INTERNAL_ERROR', 'Setting a persistent environment variable needs a command runner.', 'ConfigureInput.spawn is required on Windows');
+        }
+        for (const entry of entries) {
+            const result = await spawn('setx', [entry.key, entry.value]);
+            if (result.code !== 0) {
+                throw new AtomicCoreError('IO_ERROR', `Failed to set env var ${entry.key}: ${result.stderr}`);
+            }
+        }
+        return;
+    }
+    await writeMarkedEnvToShell(input.fs, input.shell, input.platform, spec.marker, spec.prefix, entries);
+}
+//# sourceMappingURL=env-agent.js.map

package/dist/integrations/configure/env-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-agent.js","sourceRoot":"","sources":["../../../src/integrations/configure/env-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAYvD,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,KAAa,EAAE,MAAc;IACzF,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,OAAO,EAAE,CAAC,CAAA;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AACvG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAqB,EAAE,IAAkB;IAC/E,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACnF,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,mEAAmE,EACnE,6CAA6C,CAC9C,CAAA;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;YAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,yBAAyB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YAC/F,CAAC;QACH,CAAC;QACD,OAAM;IACR,CAAC;IACD,MAAM,qBAAqB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACvG,CAAC"}

package/dist/integrations/configure/goose.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Goose reads `GOOSE_PROVIDER` / `GOOSE_MODEL` plus the OpenAI host variables from the environment;
+ * there is no provider file to patch. Goose appends its own path, so `OPENAI_HOST` is the bare
+ * host:port (the catalog marks it `endpointWithPrefix: false`) and `OPENAI_BASE_PATH` carries the
+ * chat-completions path.
+ *
+ * The block also holds `OPENAI_*` variables, which do not share the `GOOSE_` prefix. Rerun stays
+ * idempotent because the whole marked region is removed first; the prefix filter is only the safety
+ * net for stray lines outside it, which is why a user's own `export OPENAI_API_KEY` survives.
+ */
+import type { ConfigureWriter } from './registry.js';
+export declare const configureGoose: ConfigureWriter;

package/dist/integrations/configure/goose.js

@@ -0,0 +1,16 @@
+/**
+ * Goose reads `GOOSE_PROVIDER` / `GOOSE_MODEL` plus the OpenAI host variables from the environment;
+ * there is no provider file to patch. Goose appends its own path, so `OPENAI_HOST` is the bare
+ * host:port (the catalog marks it `endpointWithPrefix: false`) and `OPENAI_BASE_PATH` carries the
+ * chat-completions path.
+ *
+ * The block also holds `OPENAI_*` variables, which do not share the `GOOSE_` prefix. Rerun stays
+ * idempotent because the whole marked region is removed first; the prefix filter is only the safety
+ * net for stray lines outside it, which is why a user's own `export OPENAI_API_KEY` survives.
+ */
+import { registerWriter } from './registry.js';
+import { configureEnvAgent } from './env-agent.js';
+const MARKER = '# Atomic Chat - Goose Config';
+export const configureGoose = (input) => configureEnvAgent(input, { agentId: 'goose', marker: MARKER, prefix: 'GOOSE_' });
+registerWriter('goose', configureGoose);
+//# sourceMappingURL=goose.js.map

package/dist/integrations/configure/goose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"goose.js","sourceRoot":"","sources":["../../../src/integrations/configure/goose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,MAAM,GAAG,8BAA8B,CAAA;AAE7C,MAAM,CAAC,MAAM,cAAc,GAAoB,CAAC,KAAK,EAAE,EAAE,CACvD,iBAAiB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;AAElF,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA"}

package/dist/integrations/configure/hermes.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Hermes Agent's `config.yaml` is patched LINE BY LINE rather than parsed and re-emitted.
+ *
+ * That is deliberate: the file is hand-edited, heavily commented, and its `custom_providers` list
+ * carries the user's own bridges (Telegram, WhatsApp, …). A YAML round trip would drop every comment
+ * and reflow every block for the sake of three scalars. So we rewrite only the lines we own and
+ * splice our list entry in, leaving everything else byte-identical.
+ *
+ * Hermes ignores the API key entirely (`api_key` is accepted for call-site symmetry and reserved),
+ * and `.env` is patched only when it already exists — creating one would shadow the agent's own
+ * defaults.
+ */
+import type { ConfigFs } from '../config-io.js';
+import type { ConfigureWriter } from './registry.js';
+/** Rewrite everything after the first colon, with no quoting — the values here never need it. */
+export declare function replaceYamlScalarValue(line: string, value: string): string;
+/**
+ * Split the document into (before, entries, after) around `custom_providers:`. `entries` is one
+ * array of raw lines per list item; blank lines inside the block are dropped, which is why a rerun
+ * never accumulates whitespace there.
+ */
+export declare function splitCustomProviders(content: string): {
+    before: string[];
+    entries: string[][];
+    after: string[];
+};
+/** Re-emit the block: items at column 0, or `custom_providers: []` when nothing is left. */
+export declare function rebuildCustomProviders(before: string[], entries: string[][], after: string[]): string;
+/** Add or update only our entry, leaving the user's other bridges untouched and in order. */
+export declare function upsertAtomicProvider(content: string, apiUrl: string, model: string, ctx: number): string;
+/**
+ * Ensure `providers.<id>.request_timeout_seconds` exists, creating the `providers:` map and the
+ * provider sub-block as needed. A value the user already set is left alone — we only fill the gap.
+ */
+export declare function upsertProviderRequestTimeout(content: string, providerId: string, seconds: number): string;
+/**
+ * `~/.hermes` everywhere except Windows, where the installer writes `HERMES_HOME` to the user
+ * environment and the CLI honours it.
+ */
+export declare function hermesDir(env: NodeJS.ProcessEnv, platform: NodeJS.Platform, fs: ConfigFs): string;
+export declare const configureHermes: ConfigureWriter;