@circuitwall/jarela 2.2.0 → 2.3.0

package/.next/standalone/.next/server/middleware.js

@@ -29582,7 +29582,7 @@ Object.defineProperty(exports, "getImplicitTags", ({
 }));
 const _constants = __webpack_require__(96100);
 const _handlers = __webpack_require__(57155);
-const _encodeheadersafe = __webpack_require__(60190);
+const _encodeheadersafe = __webpack_require__(37809);
 const _lazyresult = __webpack_require__(31147);
 const getDerivedTags = (pathname)=>{
     const derivedTags = [
@@ -33056,6 +33056,57 @@ function _stringFormat(Class, format, fnOrRegex, _params = {}) {
 }
 
 
+/***/ }),
+
+/***/ 37809:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+/**
+ * Percent-encode every character other than horizontal tab and printable ASCII
+ * so a value can be safely serialized into an HTTP header.
+ *
+ * Node's `validateHeaderValue` and `fetch`'s ByteString conversion accept
+ * different character ranges. Restricting values to `\t\x20-\x7e` produces a
+ * conservative representation that both can serialize. Characters outside a
+ * transport's accepted range (Hebrew, Arabic, Chinese, emoji, …) would
+ * otherwise throw `ERR_INVALID_CHAR` or a `TypeError`, which crashes ISR or
+ * fails a cache read on every affected request.
+ *
+ * Cache tags are encoded at the public boundaries — tag construction
+ * (`getImplicitTags`, `validateTags`) and invalidation input
+ * (`revalidatePath`, `revalidateTag`, `updateTag`) — so storage, comparison,
+ * and the wire all see the same canonical form.
+ *
+ * The class is narrower than either transport accepts. Everything inside it
+ * passes through byte-for-byte, including `,`, `/`, `%`, `[`, `]`, `_`, `-` and
+ * `\t`, which preserves the comma-separated header format and the
+ * dynamic-segment markers in derived tags (`_N_T_/[slug]/page`).
+ *
+ * Properties:
+ * - Fast-path: input that already fits the class is returned unchanged. This
+ *   makes the encoder idempotent on already-encoded `%xx` sequences.
+ * - Matches *runs* of out-of-class code units so surrogate pairs (e.g. an
+ *   emoji) are handed to `encodeURIComponent` as a complete code point — a
+ *   per-code-unit regex would split the pair and throw `URIError`.
+ */ 
+Object.defineProperty(exports, "__esModule", ({
+    value: true
+}));
+Object.defineProperty(exports, "encodeHeaderSafe", ({
+    enumerable: true,
+    get: function() {
+        return encodeHeaderSafe;
+    }
+}));
+const OUT_OF_CLASS_CHAR = /[^\t\x20-\x7e]/;
+const OUT_OF_CLASS_RUN = /[^\t\x20-\x7e]+/g;
+function encodeHeaderSafe(value) {
+    return OUT_OF_CLASS_CHAR.test(value) ? value.replace(OUT_OF_CLASS_RUN, (run)=>encodeURIComponent(run)) : value;
+}
+
+//# sourceMappingURL=encode-header-safe.js.map
+
 /***/ }),
 
 /***/ 38169:
@@ -37202,350 +37253,6 @@ class InvariantError extends Error {
 } //# sourceMappingURL=invariant-error.js.map
 
 
-/***/ }),
-
-/***/ 42851:
-/***/ ((module) => {
-
-"use strict";
-
-
-var has = Object.prototype.hasOwnProperty
-  , prefix = '~';
-
-/**
- * Constructor to create a storage for our `EE` objects.
- * An `Events` instance is a plain object whose properties are event names.
- *
- * @constructor
- * @private
- */
-function Events() {}
-
-//
-// We try to not inherit from `Object.prototype`. In some engines creating an
-// instance in this way is faster than calling `Object.create(null)` directly.
-// If `Object.create(null)` is not supported we prefix the event names with a
-// character to make sure that the built-in object properties are not
-// overridden or used as an attack vector.
-//
-if (Object.create) {
-  Events.prototype = Object.create(null);
-
-  //
-  // This hack is needed because the `__proto__` property is still inherited in
-  // some old browsers like Android 4, iPhone 5.1, Opera 11 and Safari 5.
-  //
-  if (!new Events().__proto__) prefix = false;
-}
-
-/**
- * Representation of a single event listener.
- *
- * @param {Function} fn The listener function.
- * @param {*} context The context to invoke the listener with.
- * @param {Boolean} [once=false] Specify if the listener is a one-time listener.
- * @constructor
- * @private
- */
-function EE(fn, context, once) {
-  this.fn = fn;
-  this.context = context;
-  this.once = once || false;
-}
-
-/**
- * Add a listener for a given event.
- *
- * @param {EventEmitter} emitter Reference to the `EventEmitter` instance.
- * @param {(String|Symbol)} event The event name.
- * @param {Function} fn The listener function.
- * @param {*} context The context to invoke the listener with.
- * @param {Boolean} once Specify if the listener is a one-time listener.
- * @returns {EventEmitter}
- * @private
- */
-function addListener(emitter, event, fn, context, once) {
-  if (typeof fn !== 'function') {
-    throw new TypeError('The listener must be a function');
-  }
-
-  var listener = new EE(fn, context || emitter, once)
-    , evt = prefix ? prefix + event : event;
-
-  if (!emitter._events[evt]) emitter._events[evt] = listener, emitter._eventsCount++;
-  else if (!emitter._events[evt].fn) emitter._events[evt].push(listener);
-  else emitter._events[evt] = [emitter._events[evt], listener];
-
-  return emitter;
-}
-
-/**
- * Clear event by name.
- *
- * @param {EventEmitter} emitter Reference to the `EventEmitter` instance.
- * @param {(String|Symbol)} evt The Event name.
- * @private
- */
-function clearEvent(emitter, evt) {
-  if (--emitter._eventsCount === 0) emitter._events = new Events();
-  else delete emitter._events[evt];
-}
-
-/**
- * Minimal `EventEmitter` interface that is molded against the Node.js
- * `EventEmitter` interface.
- *
- * @constructor
- * @public
- */
-function EventEmitter() {
-  this._events = new Events();
-  this._eventsCount = 0;
-}
-
-/**
- * Return an array listing the events for which the emitter has registered
- * listeners.
- *
- * @returns {Array}
- * @public
- */
-EventEmitter.prototype.eventNames = function eventNames() {
-  var names = []
-    , events
-    , name;
-
-  if (this._eventsCount === 0) return names;
-
-  for (name in (events = this._events)) {
-    if (has.call(events, name)) names.push(prefix ? name.slice(1) : name);
-  }
-
-  if (Object.getOwnPropertySymbols) {
-    return names.concat(Object.getOwnPropertySymbols(events));
-  }
-
-  return names;
-};
-
-/**
- * Return the listeners registered for a given event.
- *
- * @param {(String|Symbol)} event The event name.
- * @returns {Array} The registered listeners.
- * @public
- */
-EventEmitter.prototype.listeners = function listeners(event) {
-  var evt = prefix ? prefix + event : event
-    , handlers = this._events[evt];
-
-  if (!handlers) return [];
-  if (handlers.fn) return [handlers.fn];
-
-  for (var i = 0, l = handlers.length, ee = new Array(l); i < l; i++) {
-    ee[i] = handlers[i].fn;
-  }
-
-  return ee;
-};
-
-/**
- * Return the number of listeners listening to a given event.
- *
- * @param {(String|Symbol)} event The event name.
- * @returns {Number} The number of listeners.
- * @public
- */
-EventEmitter.prototype.listenerCount = function listenerCount(event) {
-  var evt = prefix ? prefix + event : event
-    , listeners = this._events[evt];
-
-  if (!listeners) return 0;
-  if (listeners.fn) return 1;
-  return listeners.length;
-};
-
-/**
- * Calls each of the listeners registered for a given event.
- *
- * @param {(String|Symbol)} event The event name.
- * @returns {Boolean} `true` if the event had listeners, else `false`.
- * @public
- */
-EventEmitter.prototype.emit = function emit(event, a1, a2, a3, a4, a5) {
-  var evt = prefix ? prefix + event : event;
-
-  if (!this._events[evt]) return false;
-
-  var listeners = this._events[evt]
-    , len = arguments.length
-    , args
-    , i;
-
-  if (listeners.fn) {
-    if (listeners.once) this.removeListener(event, listeners.fn, undefined, true);
-
-    switch (len) {
-      case 1: return listeners.fn.call(listeners.context), true;
-      case 2: return listeners.fn.call(listeners.context, a1), true;
-      case 3: return listeners.fn.call(listeners.context, a1, a2), true;
-      case 4: return listeners.fn.call(listeners.context, a1, a2, a3), true;
-      case 5: return listeners.fn.call(listeners.context, a1, a2, a3, a4), true;
-      case 6: return listeners.fn.call(listeners.context, a1, a2, a3, a4, a5), true;
-    }
-
-    for (i = 1, args = new Array(len -1); i < len; i++) {
-      args[i - 1] = arguments[i];
-    }
-
-    listeners.fn.apply(listeners.context, args);
-  } else {
-    var length = listeners.length
-      , j;
-
-    for (i = 0; i < length; i++) {
-      if (listeners[i].once) this.removeListener(event, listeners[i].fn, undefined, true);
-
-      switch (len) {
-        case 1: listeners[i].fn.call(listeners[i].context); break;
-        case 2: listeners[i].fn.call(listeners[i].context, a1); break;
-        case 3: listeners[i].fn.call(listeners[i].context, a1, a2); break;
-        case 4: listeners[i].fn.call(listeners[i].context, a1, a2, a3); break;
-        default:
-          if (!args) for (j = 1, args = new Array(len -1); j < len; j++) {
-            args[j - 1] = arguments[j];
-          }
-
-          listeners[i].fn.apply(listeners[i].context, args);
-      }
-    }
-  }
-
-  return true;
-};
-
-/**
- * Add a listener for a given event.
- *
- * @param {(String|Symbol)} event The event name.
- * @param {Function} fn The listener function.
- * @param {*} [context=this] The context to invoke the listener with.
- * @returns {EventEmitter} `this`.
- * @public
- */
-EventEmitter.prototype.on = function on(event, fn, context) {
-  return addListener(this, event, fn, context, false);
-};
-
-/**
- * Add a one-time listener for a given event.
- *
- * @param {(String|Symbol)} event The event name.
- * @param {Function} fn The listener function.
- * @param {*} [context=this] The context to invoke the listener with.
- * @returns {EventEmitter} `this`.
- * @public
- */
-EventEmitter.prototype.once = function once(event, fn, context) {
-  return addListener(this, event, fn, context, true);
-};
-
-/**
- * Remove the listeners of a given event.
- *
- * @param {(String|Symbol)} event The event name.
- * @param {Function} fn Only remove the listeners that match this function.
- * @param {*} context Only remove the listeners that have this context.
- * @param {Boolean} once Only remove one-time listeners.
- * @returns {EventEmitter} `this`.
- * @public
- */
-EventEmitter.prototype.removeListener = function removeListener(event, fn, context, once) {
-  var evt = prefix ? prefix + event : event;
-
-  if (!this._events[evt]) return this;
-  if (!fn) {
-    clearEvent(this, evt);
-    return this;
-  }
-
-  var listeners = this._events[evt];
-
-  if (listeners.fn) {
-    if (
-      listeners.fn === fn &&
-      (!once || listeners.once) &&
-      (!context || listeners.context === context)
-    ) {
-      clearEvent(this, evt);
-    }
-  } else {
-    for (var i = 0, events = [], length = listeners.length; i < length; i++) {
-      if (
-        listeners[i].fn !== fn ||
-        (once && !listeners[i].once) ||
-        (context && listeners[i].context !== context)
-      ) {
-        events.push(listeners[i]);
-      }
-    }
-
-    //
-    // Reset the array, or remove it completely if we have no more listeners.
-    //
-    if (events.length) this._events[evt] = events.length === 1 ? events[0] : events;
-    else clearEvent(this, evt);
-  }
-
-  return this;
-};
-
-/**
- * Remove all listeners, or those of the specified event.
- *
- * @param {(String|Symbol)} [event] The event name.
- * @returns {EventEmitter} `this`.
- * @public
- */
-EventEmitter.prototype.removeAllListeners = function removeAllListeners(event) {
-  var evt;
-
-  if (event) {
-    evt = prefix ? prefix + event : event;
-    if (this._events[evt]) clearEvent(this, evt);
-  } else {
-    this._events = new Events();
-    this._eventsCount = 0;
-  }
-
-  return this;
-};
-
-//
-// Alias methods names because people roll like that.
-//
-EventEmitter.prototype.off = EventEmitter.prototype.removeListener;
-EventEmitter.prototype.addListener = EventEmitter.prototype.on;
-
-//
-// Expose the prefix.
-//
-EventEmitter.prefixed = prefix;
-
-//
-// Allow `EventEmitter` to be imported as module namespace.
-//
-EventEmitter.EventEmitter = EventEmitter;
-
-//
-// Expose the module.
-//
-if (true) {
-  module.exports = EventEmitter;
-}
-
-
 /***/ }),
 
 /***/ 42868:
@@ -49442,6 +49149,7 @@ function runMigrations(db) {
     ensureCredentialsTable(db);
     ensureCredentialsLabelAndDefaultColumns(db);
     ensureModelConfigCredentialIdColumn(db);
+    ensureModelConfigEnabledColumn(db);
     ensureAgentConfigsToolCredentialsColumn(db);
     seedAgentConfigs(db);
     backfillDeveloperInteractiveTerminalTools(db);
@@ -49606,6 +49314,11 @@ function ensureThreadChannelSummariesTable(db) {
     if (!cols.some((column)=>column.name === "summary_before_seq")) {
         db.exec("ALTER TABLE thread_channel_summaries ADD COLUMN summary_before_seq INTEGER");
     }
+    // Stored topic segments (JSON array) so the next compaction can merge new
+    // activity into them instead of re-summarising the channel from scratch.
+    if (!cols.some((column)=>column.name === "topics")) {
+        db.exec("ALTER TABLE thread_channel_summaries ADD COLUMN topics TEXT");
+    }
 }
 // ADR-0041. Immutable per-assistant-turn snapshot of LLM usage. Written once
 // alongside addMessage(...,"assistant",...) and never updated, so the
@@ -50428,6 +50141,14 @@ function ensureModelConfigCredentialIdColumn(db) {
         db.exec("ALTER TABLE model_configs ADD COLUMN credential_id TEXT");
     }
 }
+// ADR-0102: disabled model configs stay saved but are hidden from model
+// selection, routing, and default fallback. Existing rows default to enabled.
+function ensureModelConfigEnabledColumn(db) {
+    const cols = db.prepare("PRAGMA table_info(model_configs)").all();
+    if (!cols.some((c)=>c.name === "enabled")) {
+        db.exec("ALTER TABLE model_configs ADD COLUMN enabled INTEGER NOT NULL DEFAULT 1");
+    }
+}
 // Idempotent backfill: for each model_config still carrying an inline
 // `api_key` (and no `credential_id` yet), create a credential row and
 // link by id. Strips the api_key / base_url / extra_headers fields from
@@ -97262,9 +96983,8 @@ const geminiProvider = {
 };
 
 ;// ./lib/providers/github-copilot-auth.ts
-// GitHub Copilot device-flow login. Lets users sign in with their Copilot
-// subscription instead of pasting a PAT (which can't be exchanged for a
-// Copilot session token and gets rate-limited on the Models REST API).
+// GitHub Copilot device-flow login. The legacy PAT path depended on GitHub
+// Models, which has been retired; use this flow for Copilot Chat access.
 //
 // Flow (RFC 8628):
 //   1. POST github.com/login/device/code with the VS Code Copilot client_id.
@@ -97437,17 +97157,17 @@ function pickGitHubCompatOptions(params) {
     return out;
 }
 const tokenCache = new Map();
-function isLikelyGitHubPat(token) {
-    return token.startsWith("ghp_") || token.startsWith("github_pat_") || token.startsWith("gho_");
+function isGitHubPat(token) {
+    return token.startsWith("ghp_") || token.startsWith("github_pat_");
 }
-async function getCopilotToken(pat) {
-    if (!pat) throw new Error("GitHub Copilot: no API key configured for token exchange.");
-    const cached = tokenCache.get(pat);
+async function exchangeCopilotSessionToken(githubToken) {
+    if (!githubToken) throw new Error("GitHub Copilot: no API key configured for token exchange.");
+    const cached = tokenCache.get(githubToken);
     if (cached && cached.expiresAt - Date.now() > 60000) return cached.token;
-    tokenCache.delete(pat);
+    tokenCache.delete(githubToken);
     const res = await fetch("https://api.github.com/copilot_internal/v2/token", {
         headers: {
-            Authorization: `token ${pat}`,
+            Authorization: `token ${githubToken}`,
             "User-Agent": "Jarela/1.0"
         },
         signal: AbortSignal.timeout(30000)
@@ -97455,17 +97175,17 @@ async function getCopilotToken(pat) {
     if (!res.ok) {
         const body = await error_readErrorBody(res);
         if (res.status === 401) {
-            throw new Error(`GitHub Copilot: token exchange failed (401). ` + `Ensure your PAT has the "copilot" scope and that you have an active Copilot subscription. ` + `Details: ${body}`);
+            throw new Error(`GitHub Copilot: token exchange failed (401). ` + `Check that this GitHub account has an active Copilot subscription and the credential is valid. ` + `Details: ${body}`);
         }
         if (res.status === 404) {
-            throw new Error("GitHub Copilot token exchange endpoint was not found for this credential. " + "Personal Access Tokens are not accepted directly by Copilot chat. " + "Use a Copilot session token in params.copilot_session_token, or a credential that supports token exchange.");
+            throw new Error("GitHub Copilot could not exchange this credential for a session token. " + "Use the in-app device-flow sign-in or set params.copilot_session_token.");
         }
         throw new Error(`GitHub Copilot: token exchange failed (${res.status}): ${body}`);
     }
     const json = await res.json();
     if (!json.token) throw new Error("GitHub Copilot: token exchange returned no token");
     const expiresAt = json.expires_at ? new Date(json.expires_at).getTime() : Date.now() + 28 * 60000;
-    tokenCache.set(pat, {
+    tokenCache.set(githubToken, {
         token: json.token,
         expiresAt
     });
@@ -97496,7 +97216,6 @@ async function resolveCopilotAuth(params) {
     const explicitSessionToken = params.copilot_session_token?.trim();
     if (explicitSessionToken && explicitSessionToken.length > 0) {
         return {
-            kind: "copilot-api",
             baseURL: params.base_url ?? "https://api.githubcopilot.com",
             apiKey: explicitSessionToken,
             headers: {
@@ -97506,9 +97225,8 @@ async function resolveCopilotAuth(params) {
     }
     const oauthToken = getStoredOAuthToken();
     if (oauthToken) {
-        const token = await getCopilotToken(oauthToken);
+        const token = await exchangeCopilotSessionToken(oauthToken);
         return {
-            kind: "copilot-api",
             baseURL: params.base_url ?? "https://api.githubcopilot.com",
             apiKey: token,
             headers: {
@@ -97516,23 +97234,14 @@ async function resolveCopilotAuth(params) {
             }
         };
     }
-    if (apiKey && isLikelyGitHubPat(apiKey)) {
-        return {
-            kind: "models-rest",
-            baseURL: params.base_url ?? "https://models.github.ai/inference",
-            apiKey,
-            headers: {
-                Accept: "application/vnd.github+json",
-                "X-GitHub-Api-Version": "2026-03-10"
-            }
-        };
+    if (apiKey && isGitHubPat(apiKey)) {
+        throw new Error("GitHub Copilot: this provider's GitHub PAT route used GitHub Models, which has been retired. " + "Use the in-app device-flow sign-in or set copilot_session_token.");
     }
     if (!apiKey) {
         throw new Error("GitHub Copilot: not signed in. Use the in-app device-flow login, or set api_key / copilot_session_token.");
     }
-    const token = await getCopilotToken(apiKey);
+    const token = await exchangeCopilotSessionToken(apiKey);
     return {
-        kind: "copilot-api",
         baseURL: params.base_url ?? "https://api.githubcopilot.com",
         apiKey: token,
         headers: {
@@ -97543,14 +97252,9 @@ async function resolveCopilotAuth(params) {
 // Anthropic SDK client pointed at Copilot's native `/v1/messages` endpoint.
 // Copilot accepts the Anthropic request shape (including `cache_control`
 // ephemeral breakpoints) for Claude-family models when called with a
-// session token. The PAT-only `models.github.ai` fallback does NOT expose
-// this endpoint, so we surface a clear error there instead of silently
-// downgrading to a path that strips the cache markers.
+// Copilot session token.
 async function resolvedAnthropicClient(params) {
     const auth = await resolveCopilotAuth(params);
-    if (auth.kind !== "copilot-api") {
-        throw new Error("GitHub Copilot: Claude models require a Copilot session token (OAuth or copilot_session_token). " + "Personal Access Tokens route to GitHub Models REST, which does not expose the native Messages API.");
-    }
     return new Anthropic({
         // The SDK requires an apiKey field; we authenticate via authToken
         // (Authorization: Bearer ...) per Copilot's contract. The empty
@@ -98499,6 +98203,7 @@ const ENV_DEFAULTS = {
     streamParseTripwire: 6,
     recallBudgetMs: 1500,
     warmSummaryBudgetMs: 5000,
+    compactionTimeoutMs: 10 * 60000,
     maxThreadMessages: 1000,
     maxSessionArchives: 50,
     // tools
@@ -98704,6 +98409,17 @@ const ENV_SCHEMA = [
         agentWritable: false,
         min: 60000
     },
+    {
+        name: "JARELA_COMPACTION_TIMEOUT_MS",
+        type: "int",
+        default: ENV_DEFAULTS.compactionTimeoutMs,
+        description: "Deadline for one warm-context compaction of a thread; a late result is discarded and the thread is released.",
+        category: "agent",
+        tier: "B",
+        requiresRestart: false,
+        agentWritable: false,
+        min: 30000
+    },
     {
         name: "JARELA_RUN_REGISTRY_TTL_MS",
         type: "int",
@@ -99352,6 +99068,7 @@ function getConfig() {
         streamParseTripwire: parsePositiveInt(env.JARELA_STREAM_PARSE_TRIPWIRE, ENV_DEFAULTS.streamParseTripwire),
         recallBudgetMs: parseNonNegativeInt(env.JARELA_RECALL_BUDGET_MS, ENV_DEFAULTS.recallBudgetMs),
         warmSummaryBudgetMs: parseNonNegativeInt(env.JARELA_WARM_SUMMARY_BUDGET_MS, ENV_DEFAULTS.warmSummaryBudgetMs),
+        compactionTimeoutMs: parsePositiveInt(env.JARELA_COMPACTION_TIMEOUT_MS, ENV_DEFAULTS.compactionTimeoutMs),
         maxThreadMessages: parsePositiveInt(env.JARELA_MAX_THREAD_MESSAGES, ENV_DEFAULTS.maxThreadMessages),
         maxSessionArchives: parsePositiveInt(env.JARELA_MAX_SESSION_ARCHIVES, ENV_DEFAULTS.maxSessionArchives),
         // tools
@@ -102982,6 +102699,14 @@ const model_config_now = ()=>new Date().toISOString();
 function withModelConfigMutation(name, operation) {
     return withKeyedMutation(`model-config:${name}`, operation);
 }
+class ModelConfigStateError extends Error {
+    constructor(message, status){
+        super(message), this.status = status;
+    }
+}
+function isModelConfigEnabled(cfg) {
+    return !!cfg && cfg.enabled !== 0;
+}
 // `params` holds the provider API key alongside hyperparameters and is
 // stored encrypted at rest (ADR-0005). Decrypt before returning rows.
 function model_config_decryptRow(row) {
@@ -102994,18 +102719,74 @@ function listModelConfigs() {
     const rows = db_getDb().prepare("SELECT * FROM model_configs ORDER BY is_default DESC, name ASC").all();
     return rows.map(model_config_decryptRow);
 }
+/** Model configs that may be offered for selection or routing. */ function listEnabledModelConfigs() {
+    return listModelConfigs().filter(isModelConfigEnabled);
+}
 function getModelConfig(name) {
     const row = db_getDb().prepare("SELECT * FROM model_configs WHERE name=?").get(name) ?? null;
     return row ? model_config_decryptRow(row) : null;
 }
 function getDefaultModelConfig() {
     const db = db_getDb();
-    const row = db.prepare("SELECT * FROM model_configs WHERE is_default=1 LIMIT 1").get() ?? null;
+    const row = db.prepare("SELECT * FROM model_configs WHERE is_default=1 AND enabled=1 LIMIT 1").get() ?? null;
     if (row) return model_config_decryptRow(row);
-    const fallback = db.prepare("SELECT * FROM model_configs ORDER BY name ASC LIMIT 1").get() ?? null;
+    const fallback = db.prepare("SELECT * FROM model_configs WHERE enabled=1 ORDER BY name ASC LIMIT 1").get() ?? null;
     return fallback ? model_config_decryptRow(fallback) : null;
 }
-function upsertModelConfig(name, provider, model_id, params, is_default, credential_id = null) {
+/**
+ * Resolve the config a run should use: the named config when it exists and is
+ * enabled, otherwise the workspace default. A disabled assignment therefore
+ * falls back without being cleared, so re-enabling restores it.
+ */ function resolveRunnableModelConfig(name) {
+    const named = name ? getModelConfig(name) : null;
+    if (named && isModelConfigEnabled(named)) return named;
+    return getDefaultModelConfig();
+}
+/** Atomically make `name` the only default model config. */ function setDefaultModelConfig(name) {
+    return withDbTransaction(()=>{
+        const db = getDb();
+        const target = getModelConfig(name);
+        if (!target) throw new ModelConfigStateError(`Model config "${name}" not found`, 404);
+        if (!isModelConfigEnabled(target)) {
+            throw new ModelConfigStateError(`Model config "${name}" is disabled; enable it before making it the default`, 409);
+        }
+        const t = model_config_now();
+        db.prepare("UPDATE model_configs SET is_default=0, updated_at=? WHERE is_default=1 AND name<>?").run(t, name);
+        db.prepare("UPDATE model_configs SET is_default=1, updated_at=? WHERE name=?").run(t, name);
+        return getModelConfig(name);
+    });
+}
+/**
+ * Enable or disable a model config. Disabling the default promotes the
+ * alphabetically-first other enabled config in the same transaction, and the
+ * last enabled config cannot be disabled so runs always have a model.
+ */ function setModelConfigEnabled(name, enabled) {
+    return withDbTransaction(()=>{
+        const db = getDb();
+        const target = getModelConfig(name);
+        if (!target) throw new ModelConfigStateError(`Model config "${name}" not found`, 404);
+        if (isModelConfigEnabled(target) === enabled) return target;
+        const t = model_config_now();
+        if (enabled) {
+            db.prepare("UPDATE model_configs SET enabled=1, updated_at=? WHERE name=?").run(t, name);
+            return getModelConfig(name);
+        }
+        const next = db.prepare("SELECT name FROM model_configs WHERE enabled=1 AND name<>? ORDER BY name ASC LIMIT 1").get(name);
+        if (!next?.name) {
+            throw new ModelConfigStateError("At least one model config must stay enabled", 409);
+        }
+        db.prepare("UPDATE model_configs SET enabled=0, is_default=0, updated_at=? WHERE name=?").run(t, name);
+        if (target.is_default === 1) {
+            db.prepare("UPDATE model_configs SET is_default=1, updated_at=? WHERE name=?").run(t, next.name);
+        }
+        return getModelConfig(name);
+    });
+}
+/**
+ * Insert or update a model config. `is_default` undefined keeps the current
+ * flag (false for new rows); true atomically clears every other default and
+ * re-enables the row, because the default must always be selectable.
+ */ function upsertModelConfig(name, provider, model_id, params, is_default, credential_id = null) {
     return withDbTransaction(()=>{
         const t = model_config_now();
         const existing = getModelConfig(name);
@@ -103021,9 +102802,11 @@ function upsertModelConfig(name, provider, model_id, params, is_default, credent
             ...decodeInlineParams(existing),
             ...params
         };
+        const finalDefault = is_default ?? existing?.is_default === 1;
+        const finalEnabled = finalDefault || !existing || isModelConfigEnabled(existing);
         const db = getDb();
-        if (is_default) db.prepare("UPDATE model_configs SET is_default=0").run();
-        db.prepare("INSERT OR REPLACE INTO model_configs (name,provider,model_id,params,is_default,credential_id,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?)").run(name, provider, model_id, encrypt(JSON.stringify(mergedParams)), is_default ? 1 : 0, finalCredId, created_at, t);
+        if (finalDefault) db.prepare("UPDATE model_configs SET is_default=0 WHERE name<>?").run(name);
+        db.prepare("INSERT OR REPLACE INTO model_configs (name,provider,model_id,params,is_default,enabled,credential_id,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?)").run(name, provider, model_id, encrypt(JSON.stringify(mergedParams)), finalDefault ? 1 : 0, finalEnabled ? 1 : 0, finalCredId, created_at, t);
         return getModelConfig(name);
     });
 }
@@ -103036,10 +102819,10 @@ function deleteModelConfig(name) {
         // Automatically reset any agent pointing to this deleted model config to NULL (automatic / default model)
         db.prepare("UPDATE agent_configs SET model_config_name = NULL WHERE model_config_name = ?").run(name);
         // Avoid the "no default" state: if the deleted row was the default and any
-        // other rows remain, promote the alphabetically-first remaining row so
+        // other enabled rows remain, promote the alphabetically-first one so
         // agents that fall back to the default keep working.
         if (wasDefault) {
-            const next = db.prepare("SELECT name FROM model_configs ORDER BY name ASC LIMIT 1").get();
+            const next = db.prepare("SELECT name FROM model_configs WHERE enabled=1 ORDER BY name ASC LIMIT 1").get();
             if (next?.name) db.prepare("UPDATE model_configs SET is_default=1 WHERE name=?").run(next.name);
         }
         return true;
@@ -105446,14 +105229,14 @@ const integrations_INTEGRATIONS = {
     "github-copilot": {
         label: "GitHub Copilot",
         category: "llm",
-        description: "Routes chat-completion requests through your Copilot subscription. Paste a GitHub PAT " + "with `copilot` scope from github.com/settings/tokens, or run the device-flow sign-in in " + "the Models panel.",
+        description: "Routes chat-completion requests through your Copilot subscription. Use the device-flow " + "sign-in in the Models panel; legacy GitHub PAT authentication is no longer supported.",
         fields: [
             {
                 key: "api_key",
-                label: "GitHub PAT",
-                placeholder: "ghp_… or github_pat_…",
+                label: "Legacy GitHub PAT (unsupported)",
+                placeholder: "Use Models panel sign-in",
                 secret: true,
-                required: true
+                required: false
             }
         ]
     },
@@ -105723,6 +105506,7 @@ function saveIntegration(name, incoming) {
             if (f.required && !v.trim()) return {
                 error: `"${f.key}" cannot be empty`
             };
+            if (!v.trim()) continue;
             merged[f.key] = v;
             if (existing[f.key] !== v) touched.push(f.key);
         }
@@ -107804,57 +107588,6 @@ function interceptionPrefixFromParamType(paramType) {
 
 /***/ }),
 
-/***/ 60190:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-/**
- * Percent-encode every character other than horizontal tab and printable ASCII
- * so a value can be safely serialized into an HTTP header.
- *
- * Node's `validateHeaderValue` and `fetch`'s ByteString conversion accept
- * different character ranges. Restricting values to `\t\x20-\x7e` produces a
- * conservative representation that both can serialize. Characters outside a
- * transport's accepted range (Hebrew, Arabic, Chinese, emoji, …) would
- * otherwise throw `ERR_INVALID_CHAR` or a `TypeError`, which crashes ISR or
- * fails a cache read on every affected request.
- *
- * Cache tags are encoded at the public boundaries — tag construction
- * (`getImplicitTags`, `validateTags`) and invalidation input
- * (`revalidatePath`, `revalidateTag`, `updateTag`) — so storage, comparison,
- * and the wire all see the same canonical form.
- *
- * The class is narrower than either transport accepts. Everything inside it
- * passes through byte-for-byte, including `,`, `/`, `%`, `[`, `]`, `_`, `-` and
- * `\t`, which preserves the comma-separated header format and the
- * dynamic-segment markers in derived tags (`_N_T_/[slug]/page`).
- *
- * Properties:
- * - Fast-path: input that already fits the class is returned unchanged. This
- *   makes the encoder idempotent on already-encoded `%xx` sequences.
- * - Matches *runs* of out-of-class code units so surrogate pairs (e.g. an
- *   emoji) are handed to `encodeURIComponent` as a complete code point — a
- *   per-code-unit regex would split the pair and throw `URIError`.
- */ 
-Object.defineProperty(exports, "__esModule", ({
-    value: true
-}));
-Object.defineProperty(exports, "encodeHeaderSafe", ({
-    enumerable: true,
-    get: function() {
-        return encodeHeaderSafe;
-    }
-}));
-const OUT_OF_CLASS_CHAR = /[^\t\x20-\x7e]/;
-const OUT_OF_CLASS_RUN = /[^\t\x20-\x7e]+/g;
-function encodeHeaderSafe(value) {
-    return OUT_OF_CLASS_CHAR.test(value) ? value.replace(OUT_OF_CLASS_RUN, (run)=>encodeURIComponent(run)) : value;
-}
-
-//# sourceMappingURL=encode-header-safe.js.map
-
-/***/ }),
-
 /***/ 61081:
 /***/ ((module) => {
 
@@ -109672,6 +109405,350 @@ function getRelativeURL(url, base) {
 } //# sourceMappingURL=relativize-url.js.map
 
 
+/***/ }),
+
+/***/ 65232:
+/***/ ((module) => {
+
+"use strict";
+
+
+var has = Object.prototype.hasOwnProperty
+  , prefix = '~';
+
+/**
+ * Constructor to create a storage for our `EE` objects.
+ * An `Events` instance is a plain object whose properties are event names.
+ *
+ * @constructor
+ * @private
+ */
+function Events() {}
+
+//
+// We try to not inherit from `Object.prototype`. In some engines creating an
+// instance in this way is faster than calling `Object.create(null)` directly.
+// If `Object.create(null)` is not supported we prefix the event names with a
+// character to make sure that the built-in object properties are not
+// overridden or used as an attack vector.
+//
+if (Object.create) {
+  Events.prototype = Object.create(null);
+
+  //
+  // This hack is needed because the `__proto__` property is still inherited in
+  // some old browsers like Android 4, iPhone 5.1, Opera 11 and Safari 5.
+  //
+  if (!new Events().__proto__) prefix = false;
+}
+
+/**
+ * Representation of a single event listener.
+ *
+ * @param {Function} fn The listener function.
+ * @param {*} context The context to invoke the listener with.
+ * @param {Boolean} [once=false] Specify if the listener is a one-time listener.
+ * @constructor
+ * @private
+ */
+function EE(fn, context, once) {
+  this.fn = fn;
+  this.context = context;
+  this.once = once || false;
+}
+
+/**
+ * Add a listener for a given event.
+ *
+ * @param {EventEmitter} emitter Reference to the `EventEmitter` instance.
+ * @param {(String|Symbol)} event The event name.
+ * @param {Function} fn The listener function.
+ * @param {*} context The context to invoke the listener with.
+ * @param {Boolean} once Specify if the listener is a one-time listener.
+ * @returns {EventEmitter}
+ * @private
+ */
+function addListener(emitter, event, fn, context, once) {
+  if (typeof fn !== 'function') {
+    throw new TypeError('The listener must be a function');
+  }
+
+  var listener = new EE(fn, context || emitter, once)
+    , evt = prefix ? prefix + event : event;
+
+  if (!emitter._events[evt]) emitter._events[evt] = listener, emitter._eventsCount++;
+  else if (!emitter._events[evt].fn) emitter._events[evt].push(listener);
+  else emitter._events[evt] = [emitter._events[evt], listener];
+
+  return emitter;
+}
+
+/**
+ * Clear event by name.
+ *
+ * @param {EventEmitter} emitter Reference to the `EventEmitter` instance.
+ * @param {(String|Symbol)} evt The Event name.
+ * @private
+ */
+function clearEvent(emitter, evt) {
+  if (--emitter._eventsCount === 0) emitter._events = new Events();
+  else delete emitter._events[evt];
+}
+
+/**
+ * Minimal `EventEmitter` interface that is molded against the Node.js
+ * `EventEmitter` interface.
+ *
+ * @constructor
+ * @public
+ */
+function EventEmitter() {
+  this._events = new Events();
+  this._eventsCount = 0;
+}
+
+/**
+ * Return an array listing the events for which the emitter has registered
+ * listeners.
+ *
+ * @returns {Array}
+ * @public
+ */
+EventEmitter.prototype.eventNames = function eventNames() {
+  var names = []
+    , events
+    , name;
+
+  if (this._eventsCount === 0) return names;
+
+  for (name in (events = this._events)) {
+    if (has.call(events, name)) names.push(prefix ? name.slice(1) : name);
+  }
+
+  if (Object.getOwnPropertySymbols) {
+    return names.concat(Object.getOwnPropertySymbols(events));
+  }
+
+  return names;
+};
+
+/**
+ * Return the listeners registered for a given event.
+ *
+ * @param {(String|Symbol)} event The event name.
+ * @returns {Array} The registered listeners.
+ * @public
+ */
+EventEmitter.prototype.listeners = function listeners(event) {
+  var evt = prefix ? prefix + event : event
+    , handlers = this._events[evt];
+
+  if (!handlers) return [];
+  if (handlers.fn) return [handlers.fn];
+
+  for (var i = 0, l = handlers.length, ee = new Array(l); i < l; i++) {
+    ee[i] = handlers[i].fn;
+  }
+
+  return ee;
+};
+
+/**
+ * Return the number of listeners listening to a given event.
+ *
+ * @param {(String|Symbol)} event The event name.
+ * @returns {Number} The number of listeners.
+ * @public
+ */
+EventEmitter.prototype.listenerCount = function listenerCount(event) {
+  var evt = prefix ? prefix + event : event
+    , listeners = this._events[evt];
+
+  if (!listeners) return 0;
+  if (listeners.fn) return 1;
+  return listeners.length;
+};
+
+/**
+ * Calls each of the listeners registered for a given event.
+ *
+ * @param {(String|Symbol)} event The event name.
+ * @returns {Boolean} `true` if the event had listeners, else `false`.
+ * @public
+ */
+EventEmitter.prototype.emit = function emit(event, a1, a2, a3, a4, a5) {
+  var evt = prefix ? prefix + event : event;
+
+  if (!this._events[evt]) return false;
+
+  var listeners = this._events[evt]
+    , len = arguments.length
+    , args
+    , i;
+
+  if (listeners.fn) {
+    if (listeners.once) this.removeListener(event, listeners.fn, undefined, true);
+
+    switch (len) {
+      case 1: return listeners.fn.call(listeners.context), true;
+      case 2: return listeners.fn.call(listeners.context, a1), true;
+      case 3: return listeners.fn.call(listeners.context, a1, a2), true;
+      case 4: return listeners.fn.call(listeners.context, a1, a2, a3), true;
+      case 5: return listeners.fn.call(listeners.context, a1, a2, a3, a4), true;
+      case 6: return listeners.fn.call(listeners.context, a1, a2, a3, a4, a5), true;
+    }
+
+    for (i = 1, args = new Array(len -1); i < len; i++) {
+      args[i - 1] = arguments[i];
+    }
+
+    listeners.fn.apply(listeners.context, args);
+  } else {
+    var length = listeners.length
+      , j;
+
+    for (i = 0; i < length; i++) {
+      if (listeners[i].once) this.removeListener(event, listeners[i].fn, undefined, true);
+
+      switch (len) {
+        case 1: listeners[i].fn.call(listeners[i].context); break;
+        case 2: listeners[i].fn.call(listeners[i].context, a1); break;
+        case 3: listeners[i].fn.call(listeners[i].context, a1, a2); break;
+        case 4: listeners[i].fn.call(listeners[i].context, a1, a2, a3); break;
+        default:
+          if (!args) for (j = 1, args = new Array(len -1); j < len; j++) {
+            args[j - 1] = arguments[j];
+          }
+
+          listeners[i].fn.apply(listeners[i].context, args);
+      }
+    }
+  }
+
+  return true;
+};
+
+/**
+ * Add a listener for a given event.
+ *
+ * @param {(String|Symbol)} event The event name.
+ * @param {Function} fn The listener function.
+ * @param {*} [context=this] The context to invoke the listener with.
+ * @returns {EventEmitter} `this`.
+ * @public
+ */
+EventEmitter.prototype.on = function on(event, fn, context) {
+  return addListener(this, event, fn, context, false);
+};
+
+/**
+ * Add a one-time listener for a given event.
+ *
+ * @param {(String|Symbol)} event The event name.
+ * @param {Function} fn The listener function.
+ * @param {*} [context=this] The context to invoke the listener with.
+ * @returns {EventEmitter} `this`.
+ * @public
+ */
+EventEmitter.prototype.once = function once(event, fn, context) {
+  return addListener(this, event, fn, context, true);
+};
+
+/**
+ * Remove the listeners of a given event.
+ *
+ * @param {(String|Symbol)} event The event name.
+ * @param {Function} fn Only remove the listeners that match this function.
+ * @param {*} context Only remove the listeners that have this context.
+ * @param {Boolean} once Only remove one-time listeners.
+ * @returns {EventEmitter} `this`.
+ * @public
+ */
+EventEmitter.prototype.removeListener = function removeListener(event, fn, context, once) {
+  var evt = prefix ? prefix + event : event;
+
+  if (!this._events[evt]) return this;
+  if (!fn) {
+    clearEvent(this, evt);
+    return this;
+  }
+
+  var listeners = this._events[evt];
+
+  if (listeners.fn) {
+    if (
+      listeners.fn === fn &&
+      (!once || listeners.once) &&
+      (!context || listeners.context === context)
+    ) {
+      clearEvent(this, evt);
+    }
+  } else {
+    for (var i = 0, events = [], length = listeners.length; i < length; i++) {
+      if (
+        listeners[i].fn !== fn ||
+        (once && !listeners[i].once) ||
+        (context && listeners[i].context !== context)
+      ) {
+        events.push(listeners[i]);
+      }
+    }
+
+    //
+    // Reset the array, or remove it completely if we have no more listeners.
+    //
+    if (events.length) this._events[evt] = events.length === 1 ? events[0] : events;
+    else clearEvent(this, evt);
+  }
+
+  return this;
+};
+
+/**
+ * Remove all listeners, or those of the specified event.
+ *
+ * @param {(String|Symbol)} [event] The event name.
+ * @returns {EventEmitter} `this`.
+ * @public
+ */
+EventEmitter.prototype.removeAllListeners = function removeAllListeners(event) {
+  var evt;
+
+  if (event) {
+    evt = prefix ? prefix + event : event;
+    if (this._events[evt]) clearEvent(this, evt);
+  } else {
+    this._events = new Events();
+    this._eventsCount = 0;
+  }
+
+  return this;
+};
+
+//
+// Alias methods names because people roll like that.
+//
+EventEmitter.prototype.off = EventEmitter.prototype.removeListener;
+EventEmitter.prototype.addListener = EventEmitter.prototype.on;
+
+//
+// Expose the prefix.
+//
+EventEmitter.prefixed = prefix;
+
+//
+// Allow `EventEmitter` to be imported as module namespace.
+//
+EventEmitter.EventEmitter = EventEmitter;
+
+//
+// Expose the module.
+//
+if (true) {
+  module.exports = EventEmitter;
+}
+
+
 /***/ }),
 
 /***/ 65621:
@@ -109707,7 +109784,7 @@ const readEnv = (env) => {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-const EventEmitter = __webpack_require__(42851);
+const EventEmitter = __webpack_require__(65232);
 const p_timeout_1 = __webpack_require__(36288);
 const priority_queue_1 = __webpack_require__(69833);
 // eslint-disable-next-line @typescript-eslint/no-empty-function