@bman654/clodex 1.3.0 → 2.1.0

package/dist/chunk-QLGIKUKC.js

@@ -0,0 +1,1171 @@
+#!/usr/bin/env node
+
+// src/server-runtime.ts
+import {
+  closeSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { dirname, join as join2 } from "path";
+
+// src/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+var APP_DIR_NAME = "clodex";
+function userHome(env = process.env) {
+  return env.HOME ?? env.USERPROFILE ?? homedir();
+}
+function resolveAppHomeOverride(env = process.env) {
+  const override = env.CLODEX_HOME;
+  return override?.trim() || void 0;
+}
+function getAppHome(env = process.env) {
+  const override = resolveAppHomeOverride(env);
+  if (override) return override;
+  return join(userHome(env), `.${APP_DIR_NAME}`);
+}
+function getConfigPath(env = process.env) {
+  return join(getAppHome(env), "config.json");
+}
+function getProvidersPath(env = process.env) {
+  return join(getAppHome(env), "providers.json");
+}
+function getCredentialCleanupPath(env = process.env) {
+  return join(getAppHome(env), "credential-cleanup.json");
+}
+function getLogsPath(env = process.env) {
+  return join(getAppHome(env), "logs");
+}
+
+// src/server-runtime.ts
+function getServerRuntimePath(env = process.env) {
+  return join2(getAppHome(env), "server-runtime.json");
+}
+function getServerRuntimeLockPath(env = process.env) {
+  return join2(getAppHome(env), "server-runtime.lock");
+}
+function isDiscoveryDisabled(flag, env = process.env) {
+  if (flag !== void 0) return flag;
+  const raw = env.CLODEX_NO_DISCOVERY?.trim().toLowerCase();
+  return raw === "1" || raw === "true";
+}
+function isPort(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535;
+}
+function parseServerRuntimeRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value;
+  const mode = record["mode"];
+  if (mode !== "endpoint" && mode !== "proxy") return null;
+  if (!isPort(record["port"])) return null;
+  const pid = record["pid"];
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return null;
+  const startedAt = typeof record["startedAt"] === "string" ? record["startedAt"] : "";
+  const caPath = record["caPath"];
+  if (mode === "proxy") {
+    if (typeof caPath !== "string" || !caPath.trim()) return null;
+    return { mode, port: record["port"], pid, caPath, startedAt };
+  }
+  return { mode, port: record["port"], pid, startedAt };
+}
+function parseServerRuntimeStates(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const items = Array.isArray(parsed) ? parsed : [parsed];
+  const states = [];
+  for (const item of items) {
+    const state = parseServerRuntimeRecord(item);
+    if (state) states.push(state);
+  }
+  return states;
+}
+function isPidAlive(pid, kill = process.kill.bind(process)) {
+  try {
+    kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === "EPERM";
+  }
+}
+var RUNTIME_LOCK_STALE_MS = 1e4;
+var RUNTIME_LOCK_WAIT_MS = 500;
+var RUNTIME_LOCK_RETRY_MS = 25;
+function tryAcquireRuntimeLock(lockPath, opts = {}) {
+  const now = opts.now ?? Date.now();
+  const alive = opts.isAlive ?? isPidAlive;
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = openSync(lockPath, "wx");
+      const content = { pid: process.pid, startedAt: now };
+      writeFileSync(fd, JSON.stringify(content));
+      closeSync(fd);
+      return () => {
+        try {
+          unlinkSync(lockPath);
+        } catch {
+        }
+      };
+    } catch {
+      let stale = false;
+      try {
+        const existing = JSON.parse(readFileSync(lockPath, "utf8"));
+        stale = !existing.pid || !alive(existing.pid) || typeof existing.startedAt === "number" && now - existing.startedAt > RUNTIME_LOCK_STALE_MS;
+      } catch {
+        stale = true;
+      }
+      if (!stale) return null;
+      try {
+        unlinkSync(lockPath);
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withRuntimeWriteLock(env, mutate) {
+  const lockPath = getServerRuntimeLockPath(env);
+  let release = null;
+  const deadline = Date.now() + RUNTIME_LOCK_WAIT_MS;
+  for (; ; ) {
+    release = tryAcquireRuntimeLock(lockPath);
+    if (release || Date.now() >= deadline) break;
+    sleepSync(RUNTIME_LOCK_RETRY_MS);
+  }
+  try {
+    mutate();
+  } finally {
+    release?.();
+  }
+}
+function readAllRecords(env) {
+  let raw;
+  try {
+    raw = readFileSync(getServerRuntimePath(env), "utf8");
+  } catch {
+    return [];
+  }
+  return parseServerRuntimeStates(raw);
+}
+function atomicWriteRecords(path, records) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const tmpPath = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmpPath, `${JSON.stringify(records, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  renameSync(tmpPath, path);
+}
+function registerServerRuntimeState(state, env = process.env, options = {}) {
+  const alive = options.isAlive ?? isPidAlive;
+  try {
+    withRuntimeWriteLock(env, () => {
+      const records = readAllRecords(env).filter(
+        (record) => record.pid !== state.pid && alive(record.pid)
+      );
+      records.push(state);
+      atomicWriteRecords(getServerRuntimePath(env), records);
+    });
+  } catch {
+  }
+}
+function unregisterServerRuntimeState(pid = process.pid, env = process.env, options = {}) {
+  const alive = options.isAlive ?? isPidAlive;
+  try {
+    withRuntimeWriteLock(env, () => {
+      const records = readAllRecords(env).filter(
+        (record) => record.pid !== pid && alive(record.pid)
+      );
+      if (records.length === 0) {
+        rmSync(getServerRuntimePath(env), { force: true });
+      } else {
+        atomicWriteRecords(getServerRuntimePath(env), records);
+      }
+    });
+  } catch {
+  }
+}
+function readLiveServerRuntimeStates(env = process.env, options = {}) {
+  const alive = options.isAlive ?? isPidAlive;
+  return readAllRecords(env).filter((state) => alive(state.pid));
+}
+function orderWrapperServerCandidates(records) {
+  return [...records].sort((a, b) => {
+    if (a.mode !== b.mode) return a.mode === "proxy" ? -1 : 1;
+    return (Date.parse(b.startedAt) || 0) - (Date.parse(a.startedAt) || 0);
+  });
+}
+
+// src/wrapper-env.ts
+var PROXY_ENV_VARS = ["HTTPS_PROXY", "HTTP_PROXY", "https_proxy", "http_proxy"];
+var REQUIRE_SERVER_ENV = "CLODEX_REQUIRE_SERVER";
+function removeAnthropicProxyBypass(env) {
+  const noProxyValues = [env["NO_PROXY"], env["no_proxy"]].filter((value) => value !== void 0);
+  if (noProxyValues.length === 0) return;
+  const filtered = [...new Set(noProxyValues.flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean).filter((value) => {
+    const entry = value.toLowerCase().replace(/^https?:\/\//, "");
+    const host = entry.replace(/:\d+$/, "");
+    if (host === "*") return false;
+    const suffix = host.startsWith("*.") ? host.slice(1) : host;
+    const bypassesAnthropic = suffix.startsWith(".") ? "api.anthropic.com".endsWith(suffix) : "api.anthropic.com" === suffix || "api.anthropic.com".endsWith(`.${suffix}`);
+    return !bypassesAnthropic;
+  }))].join(",");
+  if (filtered) {
+    env["NO_PROXY"] = filtered;
+    env["no_proxy"] = filtered;
+  } else {
+    delete env["NO_PROXY"];
+    delete env["no_proxy"];
+  }
+}
+var LOCAL_GATEWAY_API_KEY = "clodex-local";
+function wrapperRequiresServer(env) {
+  return env[REQUIRE_SERVER_ENV] === "1";
+}
+function computeWrapperEnv(baseEnv, state) {
+  const env = { ...baseEnv };
+  if (!state) return env;
+  if (state.mode === "proxy") {
+    const proxyUrl = `http://127.0.0.1:${state.port}`;
+    delete env["ANTHROPIC_BASE_URL"];
+    for (const name of PROXY_ENV_VARS) env[name] = proxyUrl;
+    if (state.caPath) env["NODE_EXTRA_CA_CERTS"] = state.caPath;
+    removeAnthropicProxyBypass(env);
+    return env;
+  }
+  for (const name of PROXY_ENV_VARS) delete env[name];
+  env["ANTHROPIC_BASE_URL"] = `http://127.0.0.1:${state.port}/anthropic`;
+  env["ANTHROPIC_API_KEY"] = LOCAL_GATEWAY_API_KEY;
+  return env;
+}
+
+// src/config.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { readFileSync as readFileSync4, renameSync as renameSync3, unlinkSync as unlinkSync4 } from "fs";
+
+// src/registry/io.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  chmodSync,
+  closeSync as closeSync3,
+  copyFileSync,
+  existsSync,
+  fsyncSync as fsyncSync2,
+  mkdirSync as mkdirSync3,
+  openSync as openSync3,
+  readFileSync as readFileSync3,
+  renameSync as renameSync2,
+  unlinkSync as unlinkSync3,
+  writeSync
+} from "fs";
+import { dirname as dirname3 } from "path";
+
+// src/registry/types.ts
+var REGISTRY_SCHEMA_VERSION = 1;
+
+// src/registry/lock.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { createHash, randomUUID } from "crypto";
+import {
+  closeSync as closeSync2,
+  fstatSync,
+  fsyncSync,
+  linkSync,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  statSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname2 } from "path";
+var DEFAULT_WAIT_MS = 3e4;
+var DEFAULT_CREDENTIAL_MUTATION_WAIT_MS = 15e4;
+var DEFAULT_RETRY_MS = 25;
+var registryLockContext = new AsyncLocalStorage();
+var RegistryLockLostError = class extends Error {
+  constructor(lockPath) {
+    super(`Provider registry lock ownership was lost before write: ${lockPath}`);
+    this.name = "RegistryLockLostError";
+  }
+};
+function getRegistryLockPath() {
+  return `${getProvidersPath()}.lock`;
+}
+function isPidAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function parseLockOwner(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!Number.isInteger(parsed.pid) || (parsed.pid ?? 0) <= 0) return null;
+    if (typeof parsed.startedAt !== "number" || !Number.isFinite(parsed.startedAt))
+      return null;
+    if (typeof parsed.token !== "string" || parsed.token.length === 0)
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function createLockRecord(lockPath, owner) {
+  const raw = JSON.stringify(owner);
+  const tempPath = `${lockPath}.${process.pid}.${owner.token}.tmp`;
+  let fd;
+  try {
+    fd = openSync2(tempPath, "wx", 384);
+    writeFileSync2(fd, raw);
+    fsyncSync(fd);
+    const stats = fstatSync(fd);
+    try {
+      linkSync(tempPath, lockPath);
+    } catch (err) {
+      if (err.code === "EEXIST") return null;
+      throw err;
+    }
+    return {
+      raw,
+      device: stats.dev,
+      inode: stats.ino,
+      modifiedAt: stats.mtimeMs
+    };
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+    try {
+      unlinkSync2(tempPath);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+}
+function lockFileMatchesLease(lease) {
+  let fd;
+  try {
+    fd = openSync2(lease.lockPath, "r");
+    const openedStats = fstatSync(fd);
+    const owner = parseLockOwner(readFileSync2(fd, "utf8"));
+    const pathStats = statSync(lease.lockPath);
+    return owner?.token === lease.token && openedStats.dev === lease.device && openedStats.ino === lease.inode && pathStats.dev === lease.device && pathStats.ino === lease.inode;
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+  }
+}
+function createLease(lockPath, owner, snapshot) {
+  const lease = {
+    active: true,
+    lockPath,
+    token: owner.token,
+    device: snapshot.device,
+    inode: snapshot.inode,
+    assertOwned: () => {
+      if (!lease.active || !lockFileMatchesLease(lease)) {
+        lease.active = false;
+        throw new RegistryLockLostError(lockPath);
+      }
+    },
+    release: () => {
+      if (!lease.active) return;
+      lease.active = false;
+      if (lockFileMatchesLease(lease)) unlinkSync2(lockPath);
+    }
+  };
+  return lease;
+}
+function assertRegistryWriteOwnership(registryPath = getProvidersPath()) {
+  const lockPath = `${registryPath}.lock`;
+  const lease = registryLockContext.getStore()?.leases.get(lockPath);
+  if (!lease) throw new RegistryLockLostError(lockPath);
+  lease.assertOwned();
+}
+function getStaleLockSnapshot(lockPath, alive) {
+  const raw = readFileSync2(lockPath, "utf8");
+  const stats = statSync(lockPath);
+  const snapshot = {
+    raw,
+    device: stats.dev,
+    inode: stats.ino,
+    modifiedAt: stats.mtimeMs
+  };
+  const owner = parseLockOwner(raw);
+  if (owner) return alive(owner.pid) ? null : snapshot;
+  return snapshot;
+}
+function removeStaleLock(lockPath, expected) {
+  try {
+    if (expected) {
+      const raw = readFileSync2(lockPath, "utf8");
+      const stats = statSync(lockPath);
+      if (raw !== expected.raw || stats.dev !== expected.device || stats.ino !== expected.inode || stats.mtimeMs !== expected.modifiedAt)
+        return false;
+    }
+    unlinkSync2(lockPath);
+    return true;
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    return false;
+  }
+}
+function tryAcquireReaperGuard(lockPath, now, alive) {
+  const guardPath = `${lockPath}.reap`;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const owner = {
+      pid: process.pid,
+      startedAt: now,
+      token: randomUUID()
+    };
+    try {
+      const snapshot = createLockRecord(guardPath, owner);
+      if (snapshot) return createLease(guardPath, owner, snapshot);
+    } catch (err) {
+      if (err.code === "ENOENT") continue;
+      throw err;
+    }
+    let stale = null;
+    try {
+      stale = getStaleLockSnapshot(guardPath, alive);
+    } catch (readErr) {
+      if (readErr.code === "ENOENT") continue;
+      throw readErr;
+    }
+    if (!stale) return null;
+    if (!removeStaleLock(guardPath, stale)) continue;
+  }
+  return null;
+}
+function tryAcquireRegistryLock(lockPath = getRegistryLockPath(), options = {}) {
+  const now = options.now?.() ?? Date.now();
+  const alive = options.isAlive ?? isPidAlive2;
+  mkdirSync2(dirname2(lockPath), { recursive: true, mode: 448 });
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const owner = {
+      pid: process.pid,
+      startedAt: now,
+      token: randomUUID()
+    };
+    try {
+      const snapshot = createLockRecord(lockPath, owner);
+      if (snapshot) return createLease(lockPath, owner, snapshot);
+    } catch (err) {
+      if (err.code === "ENOENT") continue;
+      throw err;
+    }
+    let stale = null;
+    try {
+      stale = getStaleLockSnapshot(lockPath, alive);
+    } catch (readErr) {
+      if (readErr.code === "ENOENT") continue;
+      throw readErr;
+    }
+    if (!stale) return null;
+    const reaperLease = tryAcquireReaperGuard(lockPath, now, alive);
+    if (!reaperLease) return null;
+    try {
+      let currentStale = null;
+      try {
+        currentStale = getStaleLockSnapshot(lockPath, alive);
+      } catch (readErr) {
+        if (readErr.code === "ENOENT") continue;
+        throw readErr;
+      }
+      if (!currentStale) return null;
+      if (!removeStaleLock(lockPath, currentStale)) continue;
+    } finally {
+      reaperLease.release();
+    }
+  }
+  return null;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function sleepSync2(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function lockTimeoutError(lockPath, waitMs, alive) {
+  let owner = null;
+  try {
+    owner = parseLockOwner(readFileSync2(lockPath, "utf8"));
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  if (owner && alive(owner.pid)) {
+    return new Error(
+      `Timed out after ${waitMs}ms waiting for lock held by clodex process (pid ${owner.pid}): ${lockPath}`
+    );
+  }
+  return new Error(
+    `Timed out after ${waitMs}ms waiting for lock: ${lockPath}`
+  );
+}
+async function withRegistryWriteLock(operation, options = {}) {
+  const lockPath = options.lockPath ?? getRegistryLockPath();
+  const inheritedLeases = registryLockContext.getStore()?.leases;
+  if (inheritedLeases?.get(lockPath)?.active) return operation();
+  const waitMs = options.waitMs ?? DEFAULT_WAIT_MS;
+  const retryMs = options.retryMs ?? DEFAULT_RETRY_MS;
+  const now = options.now ?? Date.now;
+  const deadline = now() + waitMs;
+  let lease = null;
+  while (!lease) {
+    lease = tryAcquireRegistryLock(lockPath, {
+      now,
+      isAlive: options.isAlive
+    });
+    if (lease) break;
+    if (now() >= deadline)
+      throw lockTimeoutError(lockPath, waitMs, options.isAlive ?? isPidAlive2);
+    await sleep(retryMs);
+  }
+  const leases = new Map(inheritedLeases);
+  leases.set(lockPath, lease);
+  const context = { leases };
+  return registryLockContext.run(context, async () => {
+    try {
+      return await operation();
+    } finally {
+      lease.release();
+    }
+  });
+}
+function withRegistryWriteLockSync(operation, options = {}) {
+  const lockPath = options.lockPath ?? getRegistryLockPath();
+  const inheritedLeases = registryLockContext.getStore()?.leases;
+  if (inheritedLeases?.get(lockPath)?.active) return operation();
+  const waitMs = options.waitMs ?? DEFAULT_WAIT_MS;
+  const retryMs = options.retryMs ?? DEFAULT_RETRY_MS;
+  const now = options.now ?? Date.now;
+  const deadline = now() + waitMs;
+  let lease = null;
+  while (!lease) {
+    lease = tryAcquireRegistryLock(lockPath, {
+      now,
+      isAlive: options.isAlive
+    });
+    if (lease) break;
+    if (now() >= deadline)
+      throw lockTimeoutError(lockPath, waitMs, options.isAlive ?? isPidAlive2);
+    sleepSync2(retryMs);
+  }
+  const leases = new Map(inheritedLeases);
+  leases.set(lockPath, lease);
+  const context = { leases };
+  return registryLockContext.run(context, () => {
+    try {
+      return operation();
+    } finally {
+      lease.release();
+    }
+  });
+}
+function getCredentialMutationLockPath(authRef) {
+  const digest = createHash("sha256").update("clodex-credential-mutation\0").update(authRef).digest("hex");
+  return `${getProvidersPath()}.credential-${digest}.lock`;
+}
+function withCredentialMutationLock(authRef, operation, options = {}) {
+  return withRegistryWriteLock(operation, {
+    ...options,
+    lockPath: getCredentialMutationLockPath(authRef),
+    waitMs: options.waitMs ?? DEFAULT_CREDENTIAL_MUTATION_WAIT_MS
+  });
+}
+
+// src/registry/migrate.ts
+function migrateOAuthOpenAiProvider(registry) {
+  if (registry.providers.some((p) => p.id === "openai-oauth")) return false;
+  const idx = registry.providers.findIndex(
+    (p) => p.id === "openai" && p.authType === "oauth"
+  );
+  if (idx < 0) return false;
+  const existing = registry.providers[idx];
+  registry.providers[idx] = {
+    ...existing,
+    id: "openai-oauth",
+    templateId: existing.templateId || "openai",
+    name: existing.name === "OpenAI" ? "OpenAI (ChatGPT)" : existing.name
+  };
+  return true;
+}
+
+// src/registry/validate.ts
+var PROVIDER_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function isValidProviderId(id) {
+  return PROVIDER_ID_PATTERN.test(id);
+}
+
+// src/registry/io.ts
+var DIR_MODE = 448;
+var FILE_MODE = 384;
+function ensureSecureAppHome() {
+  const home = getAppHome();
+  mkdirSync3(home, { recursive: true, mode: DIR_MODE });
+  try {
+    chmodSync(home, DIR_MODE);
+  } catch {
+  }
+}
+function writeSecureFile(path, content) {
+  ensureSecureAppHome();
+  mkdirSync3(dirname3(path), { recursive: true, mode: DIR_MODE });
+  const fd = openSync3(path, "wx", FILE_MODE);
+  try {
+    const payload = Buffer.from(content);
+    let offset = 0;
+    while (offset < payload.length) {
+      const written = writeSync(fd, payload, offset, payload.length - offset);
+      if (written <= 0) {
+        throw new Error(`Could not complete secure file write: ${path}`);
+      }
+      offset += written;
+    }
+    fsyncSync2(fd);
+  } finally {
+    closeSync3(fd);
+  }
+  try {
+    chmodSync(path, FILE_MODE);
+  } catch {
+  }
+}
+function syncParentDirectory(path) {
+  let fd;
+  try {
+    fd = openSync3(dirname3(path), "r");
+    fsyncSync2(fd);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EINVAL" && code !== "ENOTSUP" && code !== "EPERM") throw error;
+  } finally {
+    if (fd !== void 0) closeSync3(fd);
+  }
+}
+function parseProvider(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const p = raw;
+  if (typeof p.id !== "string" || !isValidProviderId(p.id)) return null;
+  if (typeof p.templateId !== "string" || !p.templateId) return null;
+  if (typeof p.name !== "string" || !p.name) return null;
+  if (typeof p.enabled !== "boolean") return null;
+  if (typeof p.authRef !== "string" || !p.authRef) return null;
+  if (typeof p.addedAt !== "string" || !p.addedAt) return null;
+  const api = p.api;
+  if (!api || typeof api !== "object") return null;
+  const provider = {
+    id: p.id,
+    templateId: p.templateId,
+    name: p.name,
+    enabled: p.enabled,
+    authRef: p.authRef,
+    api,
+    addedAt: p.addedAt
+  };
+  if (p.subscriptionFilter === "free") {
+    provider.subscriptionFilter = p.subscriptionFilter;
+  }
+  if (p.authType === "api" || p.authType === "oauth" || p.authType === "none") {
+    provider.authType = p.authType;
+  }
+  if (typeof p.refreshedAt === "string") provider.refreshedAt = p.refreshedAt;
+  if (p.modelsCache && typeof p.modelsCache === "object") {
+    const cache = p.modelsCache;
+    if (typeof cache.fetchedAt === "string" && Array.isArray(cache.models)) {
+      provider.modelsCache = {
+        fetchedAt: cache.fetchedAt,
+        models: cache.models.filter((m) => m && typeof m === "object")
+      };
+    }
+  }
+  return provider;
+}
+function hasOwn(record, key) {
+  return Object.prototype.hasOwnProperty.call(record, key);
+}
+function hasValidStrictProviderFields(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return false;
+  const provider = raw;
+  if (hasOwn(provider, "subscriptionFilter") && provider.subscriptionFilter !== "free") {
+    return false;
+  }
+  if (hasOwn(provider, "authType") && provider.authType !== "api" && provider.authType !== "oauth" && provider.authType !== "none") {
+    return false;
+  }
+  if (hasOwn(provider, "refreshedAt") && typeof provider.refreshedAt !== "string") {
+    return false;
+  }
+  if (hasOwn(provider, "modelsCache")) {
+    const cache = provider.modelsCache;
+    if (!cache || typeof cache !== "object" || Array.isArray(cache)) return false;
+    const fields = cache;
+    if (typeof fields.fetchedAt !== "string" || !Array.isArray(fields.models)) {
+      return false;
+    }
+    if (fields.models.some((model) => !model || typeof model !== "object" || Array.isArray(model))) {
+      return false;
+    }
+  }
+  return true;
+}
+function parseRegistry(raw) {
+  const empty = { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
+  if (!raw || typeof raw !== "object") return empty;
+  const data = raw;
+  const providers = [];
+  if (Array.isArray(data.providers)) {
+    for (const entry of data.providers) {
+      const parsed = parseProvider(entry);
+      if (parsed) providers.push(parsed);
+    }
+  }
+  const registry = {
+    schemaVersion: typeof data.schemaVersion === "number" ? data.schemaVersion : REGISTRY_SCHEMA_VERSION,
+    providers
+  };
+  if (typeof data.importedAt === "string") registry.importedAt = data.importedAt;
+  if (typeof data.pricingCacheAt === "string") registry.pricingCacheAt = data.pricingCacheAt;
+  return registry;
+}
+function parseRegistryStrict(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Provider registry must be a JSON object.");
+  }
+  const data = raw;
+  if (data.schemaVersion !== REGISTRY_SCHEMA_VERSION) {
+    throw new Error("Provider registry has an unsupported schema version.");
+  }
+  if (!Array.isArray(data.providers)) {
+    throw new Error("Provider registry is missing its providers list.");
+  }
+  for (const entry of data.providers) {
+    if (!parseProvider(entry) || !hasValidStrictProviderFields(entry)) {
+      throw new Error("Provider registry contains an invalid provider entry.");
+    }
+  }
+  return parseRegistry(raw);
+}
+function readRegistryStrict(path) {
+  return parseRegistryStrict(JSON.parse(readFileSync3(path, "utf8")));
+}
+function loadRegistry(path = getProvidersPath()) {
+  if (!existsSync(path)) {
+    return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
+  }
+  try {
+    const raw = JSON.parse(readFileSync3(path, "utf8"));
+    const registry = parseRegistry(raw);
+    const migrated = migrateOAuthOpenAiProvider(registry);
+    if (migrated) {
+      try {
+        withRegistryWriteLockSync(() => {
+          if (!existsSync(path)) return;
+          const current = readRegistryStrict(path);
+          if (migrateOAuthOpenAiProvider(current)) saveRegistry(current, path);
+        }, { lockPath: `${path}.lock` });
+      } catch {
+      }
+    }
+    return registry;
+  } catch {
+    return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
+  }
+}
+function loadRegistryStrict(path = getProvidersPath()) {
+  if (!existsSync(path)) {
+    return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
+  }
+  const registry = readRegistryStrict(path);
+  migrateOAuthOpenAiProvider(registry);
+  return registry;
+}
+function saveRegistry(registry, path = getProvidersPath()) {
+  assertRegistryWriteOwnership(path);
+  const payload = `${JSON.stringify(registry, null, 2)}
+`;
+  const backup = `${path}.bak`;
+  if (existsSync(path)) {
+    try {
+      copyFileSync(path, backup);
+    } catch {
+    }
+  }
+  const tmp = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  try {
+    writeSecureFile(tmp, payload);
+    assertRegistryWriteOwnership(path);
+    renameSync2(tmp, path);
+    syncParentDirectory(path);
+  } finally {
+    try {
+      unlinkSync3(tmp);
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+}
+
+// src/config.ts
+function readJsonFile(path) {
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function readConfig() {
+  return readJsonFile(getConfigPath()) ?? {};
+}
+function writeConfig(config) {
+  const configPath = getConfigPath();
+  assertRegistryWriteOwnership(configPath);
+  const payload = `${JSON.stringify(config, null, 2)}
+`;
+  const tmp = `${configPath}.${process.pid}.${randomUUID3()}.tmp`;
+  try {
+    writeSecureFile(tmp, payload);
+    assertRegistryWriteOwnership(configPath);
+    renameSync3(tmp, configPath);
+    syncParentDirectory(configPath);
+  } finally {
+    try {
+      unlinkSync4(tmp);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+}
+function updateConfig(mutate) {
+  const configPath = getConfigPath();
+  return withRegistryWriteLockSync(() => {
+    const config = readJsonFile(configPath) ?? {};
+    const result = mutate(config);
+    writeConfig(config);
+    return result;
+  }, { lockPath: `${configPath}.lock` });
+}
+async function updateConfigAsync(mutate) {
+  const configPath = getConfigPath();
+  return withRegistryWriteLock(async () => {
+    const config = readJsonFile(configPath) ?? {};
+    const update = await mutate(config);
+    if (update.write) writeConfig(config);
+    return update.result;
+  }, { lockPath: `${configPath}.lock` });
+}
+function loadPreferences() {
+  const config = readConfig();
+  return {
+    lastModel: config.lastModel,
+    lastProvider: config.lastProvider,
+    recentModelsByProvider: config.recentModelsByProvider,
+    favoriteModels: config.favoriteModels,
+    modelAliases: config.modelAliases,
+    claudeBridgeMode: config.claudeBridgeMode,
+    serverBridgeMode: config.serverBridgeMode,
+    appPathOverrides: config.appPathOverrides,
+    recentLaunchFolders: config.recentLaunchFolders,
+    server: config.server
+  };
+}
+function savePreferences(prefs) {
+  updateConfig((config) => {
+    if (prefs.lastModel !== void 0) config.lastModel = prefs.lastModel;
+    if (prefs.lastProvider !== void 0) config.lastProvider = prefs.lastProvider;
+    if (prefs.recentModelsByProvider !== void 0) config.recentModelsByProvider = prefs.recentModelsByProvider;
+    if (prefs.favoriteModels !== void 0) config.favoriteModels = prefs.favoriteModels;
+    if (prefs.modelAliases !== void 0) config.modelAliases = prefs.modelAliases;
+    if (prefs.claudeBridgeMode !== void 0) config.claudeBridgeMode = prefs.claudeBridgeMode;
+    if (prefs.serverBridgeMode !== void 0) config.serverBridgeMode = prefs.serverBridgeMode;
+    if (prefs.appPathOverrides !== void 0) config.appPathOverrides = prefs.appPathOverrides;
+    if (prefs.recentLaunchFolders !== void 0) config.recentLaunchFolders = prefs.recentLaunchFolders;
+  });
+}
+function getAppPathOverride(appId) {
+  const value = loadPreferences().appPathOverrides?.[appId];
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function resolveBridgeMode(command, explicit, opts = {}) {
+  const key = command === "claude" ? "claudeBridgeMode" : "serverBridgeMode";
+  if (explicit) {
+    if (opts.persist === true) savePreferences({ [key]: explicit });
+    return explicit;
+  }
+  return loadPreferences()[key] ?? "proxy";
+}
+var MAX_RECENT_MODELS = 3;
+function recordLaunchSelection(_agent, providerId, modelId, prefs) {
+  const prevRecent = prefs.recentModelsByProvider?.[providerId] ?? [];
+  const updatedRecent = [modelId, ...prevRecent.filter((id) => id !== modelId)].slice(0, MAX_RECENT_MODELS);
+  savePreferences({
+    lastProvider: providerId,
+    lastModel: modelId,
+    recentModelsByProvider: { ...prefs.recentModelsByProvider, [providerId]: updatedRecent }
+  });
+}
+var SERVER_PASSWORD_SERVICE = "clodex-server-password";
+var SERVER_PASSWORD_ACCOUNT = "server-password";
+async function getServerPasswordKeyring() {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    return new Entry(SERVER_PASSWORD_SERVICE, SERVER_PASSWORD_ACCOUNT);
+  } catch {
+    return null;
+  }
+}
+async function getSavedServerPassword() {
+  const keyring = await getServerPasswordKeyring();
+  if (!keyring) return readConfig().server?.savedPassword ?? null;
+  const savedPassword = await updateConfigAsync(async (config) => {
+    const server = config.server;
+    const password = server?.savedPassword;
+    if (!password) return { result: null, write: false };
+    try {
+      await keyring.setPassword(password);
+      delete server.savedPassword;
+      if (Object.keys(server).length === 0) delete config.server;
+      return { result: password, write: true };
+    } catch {
+      return { result: password, write: false };
+    }
+  });
+  if (savedPassword) return savedPassword;
+  try {
+    return await keyring.getPassword();
+  } catch {
+    return null;
+  }
+}
+async function setSavedServerPassword(password) {
+  const keyring = await getServerPasswordKeyring();
+  if (keyring) {
+    try {
+      await keyring.setPassword(password);
+      return;
+    } catch {
+    }
+  }
+  await updateConfigAsync((config) => {
+    config.server = {
+      ...config.server ?? {},
+      savedPassword: password
+    };
+    return { result: void 0, write: true };
+  });
+}
+function getServerExposedProviders() {
+  const list = readConfig().server?.exposedProviders;
+  return list && list.length > 0 ? list : null;
+}
+function setServerExposedProviders(providerIds) {
+  updateConfig((config) => {
+    config.server = {
+      ...config.server ?? {},
+      exposedProviders: providerIds
+    };
+  });
+}
+function getServerMaskGatewayIds() {
+  return readConfig().server?.maskGatewayIds ?? true;
+}
+function setServerMaskGatewayIds(mask) {
+  updateConfig((config) => {
+    config.server = {
+      ...config.server ?? {},
+      maskGatewayIds: mask
+    };
+  });
+}
+function getServerFavoritesOnly() {
+  return readConfig().server?.favoritesOnly ?? false;
+}
+function setServerFavoritesOnly(favoritesOnly) {
+  updateConfig((config) => {
+    config.server = {
+      ...config.server ?? {},
+      favoritesOnly
+    };
+  });
+}
+function getServerListenMode() {
+  return readConfig().server?.listenMode === "network" ? "network" : "local";
+}
+function setServerListenMode(listenMode) {
+  updateConfig((config) => {
+    config.server = {
+      ...config.server ?? {},
+      listenMode
+    };
+  });
+}
+
+// src/launch.ts
+import { execSync, spawn } from "child_process";
+import { existsSync as existsSync3, appendFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+
+// src/binary-lookup.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+function findBinaryOnPath(name, fallbackPaths, options = {}) {
+  const isWindows2 = options.isWindows ?? process.platform === "win32";
+  const exists = options.exists ?? existsSync2;
+  const runWhich = options.runWhich ?? ((binary, win) => execFileSync(win ? "where.exe" : "which", [binary], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"]
+  }));
+  try {
+    const lines = runWhich(name, isWindows2).trim().split("\n").map((line) => line.trim()).filter(Boolean);
+    const path = (isWindows2 ? lines.find((line) => line.toLowerCase().endsWith(".cmd")) : null) ?? lines[0];
+    if (path && (!options.verifyWhichResult || exists(path))) return path;
+  } catch {
+  }
+  for (const path of fallbackPaths) {
+    if (exists(path)) return path;
+  }
+  return null;
+}
+
+// src/launch.ts
+var isWindows = process.platform === "win32";
+var FALLBACK_PATHS = isWindows ? [
+  join3(process.env["APPDATA"] ?? homedir2(), "npm", "claude.cmd"),
+  join3(process.env["APPDATA"] ?? homedir2(), "npm", "claude"),
+  join3(homedir2(), "AppData", "Roaming", "npm", "claude.cmd")
+] : [
+  join3(homedir2(), ".local", "bin", "claude"),
+  join3(homedir2(), ".npm", "bin", "claude"),
+  "/usr/local/bin/claude",
+  "/opt/homebrew/bin/claude"
+];
+function findClaudeBinary() {
+  const environmentOverride = process.env["CLODEX_CLAUDE_PATH"];
+  if (environmentOverride?.trim()) {
+    return existsSync3(environmentOverride) ? environmentOverride : null;
+  }
+  const override = getAppPathOverride("claude");
+  if (override) return existsSync3(override) ? override : null;
+  return findBinaryOnPath("claude", FALLBACK_PATHS);
+}
+function getInstalledClaudeVersion() {
+  try {
+    const claudePath = findClaudeBinary();
+    if (!claudePath) return "2.1.183";
+    const result = execSync(`${isWindows ? `"${claudePath}"` : claudePath} --version`, {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const match = result.match(/(\d+\.\d+\.\d+)/);
+    if (match) return match[1];
+  } catch {
+  }
+  return "2.1.183";
+}
+function buildClaudeArgs(model, extraArgs) {
+  return model ? ["--model", model, ...extraArgs] : [...extraArgs];
+}
+function launchClaude(env, model, extraArgs) {
+  return new Promise((resolve) => {
+    const claudePath = findClaudeBinary();
+    const args = buildClaudeArgs(model, extraArgs);
+    const debugFileIdx = extraArgs.indexOf("--debug-file");
+    const debugLogPath = debugFileIdx !== -1 && extraArgs[debugFileIdx + 1] ? extraArgs[debugFileIdx + 1] : void 0;
+    const originalStdoutWrite = process.stdout.write;
+    const originalStderrWrite = process.stderr.write;
+    const muteWrite = (chunk, encoding, callback) => {
+      if (typeof encoding === "function") {
+        callback = encoding;
+      }
+      if (debugLogPath) {
+        try {
+          const str = typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk);
+          appendFileSync(debugLogPath, `[parent] ${str}`);
+        } catch {
+        }
+      }
+      if (callback) callback();
+      return true;
+    };
+    process.stdout.write = muteWrite;
+    process.stderr.write = muteWrite;
+    const restore = () => {
+      process.stdout.write = originalStdoutWrite;
+      process.stderr.write = originalStderrWrite;
+    };
+    const child = spawn(claudePath, args, {
+      stdio: "inherit",
+      env,
+      shell: isWindows
+    });
+    const forward = (signal) => {
+      child.kill(signal);
+    };
+    process.once("SIGINT", () => forward("SIGINT"));
+    process.once("SIGTERM", () => forward("SIGTERM"));
+    child.on("exit", (code) => {
+      restore();
+      resolve(code ?? 0);
+    });
+    child.on("error", (err) => {
+      restore();
+      resolve(1);
+    });
+  });
+}
+
+export {
+  getAppHome,
+  getCredentialCleanupPath,
+  getLogsPath,
+  isDiscoveryDisabled,
+  registerServerRuntimeState,
+  unregisterServerRuntimeState,
+  readLiveServerRuntimeStates,
+  orderWrapperServerCandidates,
+  removeAnthropicProxyBypass,
+  wrapperRequiresServer,
+  computeWrapperEnv,
+  assertRegistryWriteOwnership,
+  withRegistryWriteLock,
+  withRegistryWriteLockSync,
+  withCredentialMutationLock,
+  isValidProviderId,
+  ensureSecureAppHome,
+  loadRegistry,
+  loadRegistryStrict,
+  saveRegistry,
+  loadPreferences,
+  savePreferences,
+  resolveBridgeMode,
+  recordLaunchSelection,
+  getSavedServerPassword,
+  setSavedServerPassword,
+  getServerExposedProviders,
+  setServerExposedProviders,
+  getServerMaskGatewayIds,
+  setServerMaskGatewayIds,
+  getServerFavoritesOnly,
+  setServerFavoritesOnly,
+  getServerListenMode,
+  setServerListenMode,
+  findClaudeBinary,
+  getInstalledClaudeVersion,
+  launchClaude
+};
+//# sourceMappingURL=chunk-QLGIKUKC.js.map