@cjhyy/code-shell-core 0.5.0-rc.2 → 0.6.0-rc.10

package/dist/credentials/use-gate.d.ts

@@ -0,0 +1,56 @@
+/**
+ * CredentialUseGate — 凭证取用前的轻量三档审批(凭证模块第二期 §5)。
+ *
+ * AI 的 `UseCredential` 工具在把某条凭证的值/cookies.txt 交给命令**之前**过这道门:
+ *   1. **全自动**:settings `credentialUse.autoApprove === true` → 直接放行,不弹。
+ *   2. **本会话记住**:用户上次选了「本会话记住」→ 该凭证 id 进内存 allow 集 → 后续放行。
+ *   3. **默认弹审批**:经 `askUser`(InteractiveApprovalBackend)问一次。
+ *
+ * 关键决策(见设计稿 §5 + memory project_permission_session_cache):
+ * - 本会话记住**按凭证 id 键**,不按工具名 —— 否则一次批准会放行对无关凭证的取用。
+ * - 会话 allow 集是**纯内存**(关 app 即忘),由 Engine 持有并注入,故 gate 本身无模块级单例,
+ *   多 Engine 并发互不干扰、可整块外移。
+ *
+ * 边界:gate 只依赖 `askUser`(既有审批后端)+ 一个内存 Set + settings 读取,不耦合 core 其它部分。
+ */
+/** AI 取用一条凭证的请求(供审批文案 + 记忆键)。 */
+export interface CredentialUseRequest {
+    /** 凭证 id(记忆键)。 */
+    id: string;
+    /** 展示名(审批文案)。 */
+    label: string;
+    /** 可选用途(审批文案)。 */
+    purpose?: string;
+}
+export type CredentialUseDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: "denied" | "no-ui";
+};
+/** 本会话已批准的凭证 id 集(纯内存,Engine 持有并跨 turn 复用)。 */
+export type SessionCredentialAllow = Set<string>;
+/** 审批问询函数(对接 ToolContext.askUser;返回用户所选 label)。 */
+export type CredentialAskFn = (question: string, opts: {
+    header?: string;
+    options: {
+        label: string;
+        description: string;
+        tone?: "ok" | "danger" | "neutral";
+    }[];
+    optionsOnly: true;
+}) => Promise<string>;
+export interface CredentialUseGateDeps {
+    /** settings `credentialUse.autoApprove`(全局总闸)。 */
+    autoApprove: boolean;
+    /** 该凭证自身的逐条「AI 可自动取用」标志(Credential.autoUseByAI);命中即放行。 */
+    credentialAutoUse?: boolean;
+    /** 本会话 allow 集(内存,可变;gate 命中「本会话记住」时写入)。 */
+    sessionAllow: SessionCredentialAllow;
+    /** 审批问询(undefined → 无 UI,headless 直接拒)。 */
+    ask?: CredentialAskFn;
+}
+/**
+ * 过门并返回是否放行。命中「本会话记住」会写入 `deps.sessionAllow`。
+ */
+export declare function credentialUseGate(req: CredentialUseRequest, deps: CredentialUseGateDeps): Promise<CredentialUseDecision>;

package/dist/credentials/use-gate.js

@@ -0,0 +1,52 @@
+/**
+ * CredentialUseGate — 凭证取用前的轻量三档审批(凭证模块第二期 §5)。
+ *
+ * AI 的 `UseCredential` 工具在把某条凭证的值/cookies.txt 交给命令**之前**过这道门:
+ *   1. **全自动**:settings `credentialUse.autoApprove === true` → 直接放行,不弹。
+ *   2. **本会话记住**:用户上次选了「本会话记住」→ 该凭证 id 进内存 allow 集 → 后续放行。
+ *   3. **默认弹审批**:经 `askUser`(InteractiveApprovalBackend)问一次。
+ *
+ * 关键决策(见设计稿 §5 + memory project_permission_session_cache):
+ * - 本会话记住**按凭证 id 键**,不按工具名 —— 否则一次批准会放行对无关凭证的取用。
+ * - 会话 allow 集是**纯内存**(关 app 即忘),由 Engine 持有并注入,故 gate 本身无模块级单例,
+ *   多 Engine 并发互不干扰、可整块外移。
+ *
+ * 边界:gate 只依赖 `askUser`(既有审批后端)+ 一个内存 Set + settings 读取,不耦合 core 其它部分。
+ */
+const ALLOW_ONCE = "允许本次";
+const ALLOW_SESSION = "本会话都允许";
+const DENY = "拒绝";
+/**
+ * 过门并返回是否放行。命中「本会话记住」会写入 `deps.sessionAllow`。
+ */
+export async function credentialUseGate(req, deps) {
+    // 1. 全自动(全局总闸,或该凭证逐条开了「AI 可自动取用」)
+    if (deps.autoApprove || deps.credentialAutoUse)
+        return { allowed: true };
+    // 2. 本会话记住
+    if (deps.sessionAllow.has(req.id))
+        return { allowed: true };
+    // 3. 默认弹审批
+    if (!deps.ask)
+        return { allowed: false, reason: "no-ui" };
+    const purpose = req.purpose?.trim();
+    const question = purpose
+        ? `AI 想用凭证「${req.label}」(${purpose}),是否允许?`
+        : `AI 想用凭证「${req.label}」,是否允许?`;
+    const choice = await deps.ask(question, {
+        header: "凭证取用",
+        options: [
+            { label: ALLOW_ONCE, description: "仅本次取用该凭证", tone: "ok" },
+            { label: ALLOW_SESSION, description: "本会话内该凭证不再询问(关 app 后失效)", tone: "ok" },
+            { label: DENY, description: "拒绝本次取用", tone: "danger" },
+        ],
+        optionsOnly: true,
+    });
+    if (choice === ALLOW_SESSION) {
+        deps.sessionAllow.add(req.id);
+        return { allowed: true };
+    }
+    if (choice === ALLOW_ONCE)
+        return { allowed: true };
+    return { allowed: false, reason: "denied" };
+}

package/dist/data/model-metadata.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Hand-maintained model metadata for direct-provider models and onboarding
+ * picker tuning, extracted out of onboarding.ts so updating a model's
+ * max-output / context-window or the picker vendor list is a data edit
+ * (model-metadata.json) rather than a code change.
+ *
+ * Scope: only what the build-time OpenRouter snapshot does NOT cover —
+ * direct-provider ids (no "vendor/" prefix) for the metadata tables, plus the
+ * curated OpenRouter vendor ordering for the picker. OpenRouter "vendor/model"
+ * ids get their context/max-output from the snapshot (see data/openrouter-*).
+ *
+ * Loaded with createRequire so the bundled JSON ships in dist (the build copies
+ * src/data/*.json → dist/data/), matching static-catalogs.ts.
+ */
+export interface OpenRouterVendor {
+    prefix: string;
+    take: number;
+}
+/** Per-1M-token pricing (USD). Mirrors cost-tracker's ModelPricing. */
+export interface ModelPricing {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+}
+/**
+ * Onboarding provider catalog entry. Pure data — the onboarding flow's logic
+ * (key validation, model registration, env detection) lives in onboarding.ts
+ * and consumes this shape. Lives here so the catalog is a data edit.
+ */
+export interface ProviderDef {
+    id: string;
+    name: string;
+    envKey: string;
+    provider: string;
+    baseUrl: string;
+    keyUrl: string;
+    keyPrefix: string;
+    /**
+     * The catalog of model IDs to register for this provider. The first entry
+     * doubles as the zero-config default — auto-activated when the user boots
+     * with just an env key (no onboarding). Users override in the wizard or via
+     * `/model`.
+     */
+    models: string[];
+    /** When true, skip API key prompt (e.g. local providers like Ollama). */
+    noKey?: boolean;
+}
+/** Known max output tokens for direct-provider models (id → tokens). */
+export declare const KNOWN_MAX_OUTPUT: Record<string, number>;
+/** Known context window sizes for direct-provider models (id → tokens). */
+export declare const KNOWN_CONTEXT_WINDOWS: Record<string, number>;
+/**
+ * Curated vendors and how many of their newest models to surface in the
+ * onboarding picker. Order matters — first vendors appear first.
+ */
+export declare const OPENROUTER_VENDORS: readonly OpenRouterVendor[];
+/**
+ * Model-id prefix → env var holding a Vertex region override. First matching
+ * prefix wins (order matters); the resolver reads `process.env[name]` and falls
+ * back to the default region when unset. Consumed by envUtils.getVertexRegionForModel.
+ */
+export declare const VERTEX_REGION_OVERRIDES: ReadonlyArray<readonly [string, string]>;
+/**
+ * Per-model pricing for direct-provider ids (USD per 1M tokens), resolved to
+ * full ModelPricing (input/output from data, cacheRead/cacheWrite derived).
+ * OpenRouter vendor/model ids price from the build-time snapshot instead.
+ */
+export declare const MODEL_PRICING: Record<string, ModelPricing>;
+/** Fallback pricing for models absent from MODEL_PRICING and the snapshot. */
+export declare const DEFAULT_PRICING: ModelPricing;
+/**
+ * Onboarding provider catalog. First entry (openrouter) doubles as the
+ * zero-config default; each entry's models[0] is that provider's default pick.
+ * Consumed by onboarding.ts (key validation / model registration / env detect).
+ */
+export declare const PROVIDERS: readonly ProviderDef[];

package/dist/data/model-metadata.js

@@ -0,0 +1,56 @@
+/**
+ * Hand-maintained model metadata for direct-provider models and onboarding
+ * picker tuning, extracted out of onboarding.ts so updating a model's
+ * max-output / context-window or the picker vendor list is a data edit
+ * (model-metadata.json) rather than a code change.
+ *
+ * Scope: only what the build-time OpenRouter snapshot does NOT cover —
+ * direct-provider ids (no "vendor/" prefix) for the metadata tables, plus the
+ * curated OpenRouter vendor ordering for the picker. OpenRouter "vendor/model"
+ * ids get their context/max-output from the snapshot (see data/openrouter-*).
+ *
+ * Loaded with createRequire so the bundled JSON ships in dist (the build copies
+ * src/data/*.json → dist/data/), matching static-catalogs.ts.
+ */
+import { createRequire } from "node:module";
+const requireJson = createRequire(import.meta.url);
+const METADATA = requireJson("./model-metadata.json");
+/**
+ * Derive a full ModelPricing from an [input, output] pair, applying the
+ * standard cache-price heuristic (read = 10% of input, write = 125% of input).
+ * This is the same derivation the old `pricing()` helper in cost-tracker used;
+ * the previously-explicit Anthropic cacheRead/cacheWrite values equalled this
+ * heuristic exactly, so moving every entry to a pair causes zero value drift.
+ */
+function pricingFromPair([input, output]) {
+    return { input, output, cacheRead: input * 0.1, cacheWrite: input * 1.25 };
+}
+/** Known max output tokens for direct-provider models (id → tokens). */
+export const KNOWN_MAX_OUTPUT = METADATA.knownMaxOutput;
+/** Known context window sizes for direct-provider models (id → tokens). */
+export const KNOWN_CONTEXT_WINDOWS = METADATA.knownContextWindows;
+/**
+ * Curated vendors and how many of their newest models to surface in the
+ * onboarding picker. Order matters — first vendors appear first.
+ */
+export const OPENROUTER_VENDORS = METADATA.openRouterVendors;
+/**
+ * Model-id prefix → env var holding a Vertex region override. First matching
+ * prefix wins (order matters); the resolver reads `process.env[name]` and falls
+ * back to the default region when unset. Consumed by envUtils.getVertexRegionForModel.
+ */
+export const VERTEX_REGION_OVERRIDES = METADATA.vertexRegionOverrides;
+/**
+ * Per-model pricing for direct-provider ids (USD per 1M tokens), resolved to
+ * full ModelPricing (input/output from data, cacheRead/cacheWrite derived).
+ * OpenRouter vendor/model ids price from the build-time snapshot instead.
+ */
+export const MODEL_PRICING = Object.fromEntries(Object.entries(METADATA.pricing).map(([id, pair]) => [id, pricingFromPair(pair)]));
+/** Fallback pricing for models absent from MODEL_PRICING and the snapshot. */
+export const DEFAULT_PRICING = pricingFromPair(METADATA.pricingDefault);
+/**
+ * Onboarding provider catalog. First entry (openrouter) doubles as the
+ * zero-config default; each entry's models[0] is that provider's default pick.
+ * Consumed by onboarding.ts (key validation / model registration / env detect).
+ */
+export const PROVIDERS = METADATA.providers;

package/dist/data/model-metadata.json

@@ -0,0 +1,216 @@
+{
+  "_comment": "Hand-maintained metadata for direct-provider models (ids without a 'vendor/' prefix) and onboarding picker tuning. OpenRouter 'vendor/model' ids get their metadata from the build-time openrouter snapshot instead; these tables only cover what the snapshot doesn't. Edit this file (no code change) when a vendor ships a new direct-provider model or you want to tune the picker. Consumed by data/model-metadata.ts.",
+  "knownMaxOutput": {
+    "anthropic/claude-opus-4.7": 32000,
+    "anthropic/claude-opus-4-7": 32000,
+    "claude-opus-4-7": 32000,
+    "anthropic/claude-sonnet-4.6": 16000,
+    "anthropic/claude-sonnet-4-6": 16000,
+    "claude-sonnet-4-6": 16000,
+    "anthropic/claude-haiku-4.5": 8192,
+    "anthropic/claude-haiku-4-5": 8192,
+    "claude-haiku-4-5": 8192,
+    "openai/gpt-5": 32000,
+    "openai/gpt-5-mini": 32000,
+    "openai/gpt-5-nano": 16000,
+    "gpt-5": 32000,
+    "gpt-5-mini": 32000,
+    "gpt-5-nano": 16000,
+    "openai/gpt-4o": 16384,
+    "gpt-4o": 16384,
+    "openai/o4-mini": 100000,
+    "o4-mini": 100000,
+    "openai/o3": 100000,
+    "o3": 100000,
+    "google/gemini-2.5-pro": 65536,
+    "google/gemini-2.5-flash": 65536,
+    "gemini-2.5-pro": 65536,
+    "gemini-2.5-flash": 65536,
+    "gemini-2.0-flash": 8192,
+    "deepseek/deepseek-v3.2": 8192,
+    "deepseek/deepseek-r1": 8192,
+    "deepseek-v4-flash": 8192,
+    "deepseek-v4-pro": 65536,
+    "deepseek-chat": 8192,
+    "qwen/qwen3-coder": 16384,
+    "meta-llama/llama-4-maverick": 32000
+  },
+  "knownContextWindows": {
+    "deepseek-v4-pro": 1000000,
+    "deepseek-v4-flash": 1000000,
+    "deepseek-chat": 1000000,
+    "deepseek/deepseek-chat": 1000000,
+    "deepseek/deepseek-v4-pro": 1000000,
+    "deepseek/deepseek-v4-flash": 1000000
+  },
+  "openRouterVendors": [
+    { "prefix": "anthropic/", "take": 4 },
+    { "prefix": "openai/", "take": 5 },
+    { "prefix": "google/", "take": 3 },
+    { "prefix": "deepseek/", "take": 3 },
+    { "prefix": "x-ai/", "take": 2 },
+    { "prefix": "qwen/", "take": 2 },
+    { "prefix": "meta-llama/", "take": 2 },
+    { "prefix": "mistralai/", "take": 1 }
+  ],
+  "vertexRegionOverrides": [
+    ["claude-haiku-4-5", "VERTEX_REGION_CLAUDE_HAIKU_4_5"],
+    ["claude-3-5-haiku", "VERTEX_REGION_CLAUDE_3_5_HAIKU"],
+    ["claude-3-5-sonnet", "VERTEX_REGION_CLAUDE_3_5_SONNET"],
+    ["claude-3-7-sonnet", "VERTEX_REGION_CLAUDE_3_7_SONNET"],
+    ["claude-opus-4-1", "VERTEX_REGION_CLAUDE_4_1_OPUS"],
+    ["claude-opus-4", "VERTEX_REGION_CLAUDE_4_0_OPUS"],
+    ["claude-sonnet-4-6", "VERTEX_REGION_CLAUDE_4_6_SONNET"],
+    ["claude-sonnet-4-5", "VERTEX_REGION_CLAUDE_4_5_SONNET"],
+    ["claude-sonnet-4", "VERTEX_REGION_CLAUDE_4_0_SONNET"]
+  ],
+  "_pricingComment": "Per-1M-token USD pricing [input, output] for direct-provider models (no vendor/ snapshot). cacheRead/cacheWrite are derived by the loader: cacheRead = input*0.1, cacheWrite = input*1.25 (matches the original pricing() helper; verified the prior explicit Anthropic cacheRead/cacheWrite equalled this heuristic exactly). 'default' is the fallback for unknown models. OpenRouter vendor/model ids price from the build-time snapshot, not here.",
+  "pricingDefault": [3, 15],
+  "pricing": {
+    "claude-opus-4.6": [15, 75],
+    "claude-opus-4-6": [15, 75],
+    "claude-opus-4.5": [15, 75],
+    "claude-opus-4.1": [15, 75],
+    "claude-opus-4": [15, 75],
+    "claude-sonnet-4.6": [3, 15],
+    "claude-sonnet-4-6": [3, 15],
+    "claude-sonnet-4.5": [3, 15],
+    "claude-sonnet-4": [3, 15],
+    "claude-3.7-sonnet": [3, 15],
+    "claude-3-7-sonnet": [3, 15],
+    "claude-3.5-haiku": [0.8, 4],
+    "claude-haiku-4.5": [1, 5],
+    "claude-haiku-4-5": [1, 5],
+    "gpt-5.4": [5, 20],
+    "gpt-5.4-mini": [1.5, 6],
+    "gpt-5.4-pro": [10, 40],
+    "gpt-5": [5, 20],
+    "gpt-4o": [2.5, 10],
+    "gpt-4o-mini": [0.15, 0.6],
+    "gpt-4.1": [2, 8],
+    "gpt-4.1-mini": [0.4, 1.6],
+    "o4-mini": [1.1, 4.4],
+    "o3": [10, 40],
+    "o3-mini": [1.1, 4.4],
+    "gemini-2.5-pro": [1.25, 10],
+    "gemini-2.5-pro-preview": [1.25, 10],
+    "gemini-2.5-flash": [0.15, 0.6],
+    "gemini-3.1-pro-preview": [2, 10],
+    "gemini-3-flash-preview": [0.15, 0.6],
+    "gemini-2.0-flash": [0.1, 0.4],
+    "deepseek-v4-flash": [0.126, 0.252],
+    "deepseek-v4-pro": [0.5, 2],
+    "deepseek-v3.2": [0.14, 0.28],
+    "deepseek-chat": [0.14, 0.28],
+    "deepseek-r1": [0.55, 2.19],
+    "deepseek-reasoner": [0.55, 2.19],
+    "qwen3-coder": [0.3, 0.6],
+    "qwen3-235b-a22b": [0.3, 1.2],
+    "qwen3-30b-a3b": [0.1, 0.3],
+    "qwen3-max": [0.5, 2],
+    "llama-4-maverick": [0.2, 0.8],
+    "llama-4-scout": [0.15, 0.4],
+    "devstral-medium": [0.5, 1.5],
+    "mistral-large": [2, 6],
+    "devstral-small": [0.1, 0.3]
+  },
+  "_providersComment": "Onboarding provider catalog (consumed by onboarding.ts). First entry (openrouter) doubles as the zero-config default; its model list is ordered so models[0] is the default pick. 'provider' is the adapterKind. Edit this (no code change) to add/retune a provider in the first-run wizard. name 文案随之在此(原 onboarding hardcoded 中文).",
+  "providers": [
+    {
+      "id": "openrouter",
+      "name": "OpenRouter (推荐 — 支持所有模型)",
+      "envKey": "OPENROUTER_API_KEY",
+      "provider": "openai",
+      "baseUrl": "https://openrouter.ai/api/v1",
+      "keyUrl": "https://openrouter.ai/keys",
+      "keyPrefix": "sk-or-",
+      "models": [
+        "anthropic/claude-sonnet-4.6",
+        "anthropic/claude-opus-4.7",
+        "anthropic/claude-haiku-4.5",
+        "openai/gpt-5",
+        "openai/gpt-5-mini",
+        "openai/gpt-4o",
+        "openai/o4-mini",
+        "openai/o3",
+        "google/gemini-2.5-pro",
+        "google/gemini-2.5-flash",
+        "deepseek/deepseek-chat",
+        "deepseek/deepseek-reasoner",
+        "qwen/qwen3-coder",
+        "meta-llama/llama-4-maverick"
+      ]
+    },
+    {
+      "id": "anthropic",
+      "name": "Anthropic (直连 Claude API)",
+      "envKey": "ANTHROPIC_API_KEY",
+      "provider": "anthropic",
+      "baseUrl": "https://api.anthropic.com",
+      "keyUrl": "https://console.anthropic.com/settings/keys",
+      "keyPrefix": "sk-ant-",
+      "models": ["claude-sonnet-4-6", "claude-opus-4-7", "claude-haiku-4-5"]
+    },
+    {
+      "id": "openai",
+      "name": "OpenAI",
+      "envKey": "OPENAI_API_KEY",
+      "provider": "openai",
+      "baseUrl": "https://api.openai.com/v1",
+      "keyUrl": "https://platform.openai.com/api-keys",
+      "keyPrefix": "sk-",
+      "models": ["gpt-5", "gpt-5-mini", "gpt-5-nano", "gpt-4o", "o4-mini", "o3"]
+    },
+    {
+      "id": "deepseek",
+      "name": "DeepSeek (官方直连)",
+      "envKey": "DEEPSEEK_API_KEY",
+      "provider": "openai",
+      "baseUrl": "https://api.deepseek.com/v1",
+      "keyUrl": "https://platform.deepseek.com/api_keys",
+      "keyPrefix": "sk-",
+      "models": ["deepseek-v4-pro", "deepseek-v4-flash", "deepseek-chat"]
+    },
+    {
+      "id": "zai",
+      "name": "Z.AI (GLM 官方)",
+      "envKey": "ZAI_API_KEY",
+      "provider": "openai",
+      "baseUrl": "https://api.z.ai/api/paas/v4",
+      "keyUrl": "https://z.ai/manage-apikey/apikey-list",
+      "keyPrefix": "",
+      "models": ["glm-5.1", "glm-4.6", "glm-4.5-air"]
+    },
+    {
+      "id": "gemini",
+      "name": "Google Gemini (官方直连)",
+      "envKey": "GEMINI_API_KEY",
+      "provider": "openai",
+      "baseUrl": "https://generativelanguage.googleapis.com/v1beta/openai",
+      "keyUrl": "https://aistudio.google.com/apikey",
+      "keyPrefix": "",
+      "models": ["gemini-2.5-pro", "gemini-2.5-flash", "gemini-2.0-flash"]
+    },
+    {
+      "id": "ollama",
+      "name": "Ollama (本地，无需 Key)",
+      "envKey": "",
+      "provider": "openai",
+      "baseUrl": "http://localhost:11434/v1",
+      "keyUrl": "https://ollama.com/library",
+      "keyPrefix": "",
+      "models": ["llama3.1", "qwen2.5-coder", "deepseek-r1", "mistral", "gemma3"],
+      "noKey": true
+    },
+    {
+      "id": "custom",
+      "name": "自定义 (任何 OpenAI 兼容 API)",
+      "envKey": "",
+      "provider": "openai",
+      "baseUrl": "",
+      "keyUrl": "",
+      "keyPrefix": "",
+      "models": []
+    }
+  ]
+}

package/dist/data/openrouter-models.d.ts

@@ -1,13 +1,18 @@
 /**
- * Runtime accessor for the OpenRouter model snapshot.
+ * Runtime accessor for the OpenRouter model snapshot (model pricing / context /
+ * modality metadata). Consumers: cost-tracker, model-pool, model-fetcher,
+ * onboarding, and the TUI connect screen.
  *
- * The snapshot is generated at build time by `scripts/sync-models.ts`
- * from https://openrouter.ai/api/v1/models. Reading happens lazily on
- * first call, so the JSON is parsed at most once per process.
+ * The snapshot is a committed JSON file (`openrouter-models.json`), regenerated
+ * manually by `scripts/sync-models.ts` (NOT run automatically during build —
+ * copy-assets ships the existing file). It is `require`d ONCE at module load.
  *
- * If the snapshot is missing or empty (e.g. first checkout before a
- * build, or sync failure with no prior file), accessors return [] and
- * callers should fall back to hardcoded defaults.
+ * If the file is missing at load (e.g. it was deleted, mis-gitignored, or
+ * copy-assets was broken), the require falls back to an EMPTY snapshot instead
+ * of throwing — the whole module would otherwise crash at import, taking down
+ * everything that transitively imports it. Callers already treat an empty
+ * `models: []` as "no metadata, use hardcoded defaults" (see model-fetcher's
+ * static-catalog fallback), so degrading to empty is safe.
  */
 export interface OpenRouterModel {
     id: string;
@@ -25,6 +30,12 @@ interface Snapshot {
     count: number;
     models: OpenRouterModel[];
 }
+/**
+ * Coerce an arbitrary `require`d value into a valid Snapshot, or the empty
+ * snapshot if it's malformed (missing/non-array `models`). Pure + exported so
+ * the missing/corrupt-file degradation is unit-testable without touching disk.
+ */
+export declare function coerceSnapshot(raw: unknown): Snapshot;
 /** Replace the in-memory snapshot for the rest of this process. */
 export declare function setOpenRouterSnapshot(next: Snapshot): void;
 export declare function getOpenRouterSnapshot(): Snapshot;

package/dist/data/openrouter-models.js

@@ -1,18 +1,45 @@
 /**
- * Runtime accessor for the OpenRouter model snapshot.
+ * Runtime accessor for the OpenRouter model snapshot (model pricing / context /
+ * modality metadata). Consumers: cost-tracker, model-pool, model-fetcher,
+ * onboarding, and the TUI connect screen.
  *
- * The snapshot is generated at build time by `scripts/sync-models.ts`
- * from https://openrouter.ai/api/v1/models. Reading happens lazily on
- * first call, so the JSON is parsed at most once per process.
+ * The snapshot is a committed JSON file (`openrouter-models.json`), regenerated
+ * manually by `scripts/sync-models.ts` (NOT run automatically during build —
+ * copy-assets ships the existing file). It is `require`d ONCE at module load.
  *
- * If the snapshot is missing or empty (e.g. first checkout before a
- * build, or sync failure with no prior file), accessors return [] and
- * callers should fall back to hardcoded defaults.
+ * If the file is missing at load (e.g. it was deleted, mis-gitignored, or
+ * copy-assets was broken), the require falls back to an EMPTY snapshot instead
+ * of throwing — the whole module would otherwise crash at import, taking down
+ * everything that transitively imports it. Callers already treat an empty
+ * `models: []` as "no metadata, use hardcoded defaults" (see model-fetcher's
+ * static-catalog fallback), so degrading to empty is safe.
  */
 import { createRequire } from "node:module";
 const requireJson = createRequire(import.meta.url);
-const bundled = requireJson("./openrouter-models.json");
+const EMPTY_SNAPSHOT = { fetchedAt: "", source: "", count: 0, models: [] };
+const bundled = loadBundled();
 let runtimeOverride = null;
+/**
+ * Coerce an arbitrary `require`d value into a valid Snapshot, or the empty
+ * snapshot if it's malformed (missing/non-array `models`). Pure + exported so
+ * the missing/corrupt-file degradation is unit-testable without touching disk.
+ */
+export function coerceSnapshot(raw) {
+    if (raw && typeof raw === "object" && Array.isArray(raw.models)) {
+        return raw;
+    }
+    return EMPTY_SNAPSHOT;
+}
+/** require the committed snapshot once; degrade to empty (never throw) if the
+ *  file is missing/corrupt so importing this module can't crash the process. */
+function loadBundled() {
+    try {
+        return coerceSnapshot(requireJson("./openrouter-models.json"));
+    }
+    catch {
+        return EMPTY_SNAPSHOT;
+    }
+}
 function loadSnapshot() {
     return runtimeOverride ?? bundled;
 }

package/dist/engine/aux-key.d.ts

@@ -0,0 +1,10 @@
+/**
+ * resolveAuxKey — pick the pool key for the background/aux client. Reads the
+ * unified store's settings.defaults.auxText (a connection id, also the pool
+ * key). Empty strings are treated as unset. (legacy settings.auxModelKey 已删除)
+ */
+export declare function resolveAuxKey(settings: {
+    defaults?: {
+        auxText?: string;
+    };
+}): string | undefined;

package/dist/engine/aux-key.js

@@ -0,0 +1,11 @@
+/**
+ * resolveAuxKey — pick the pool key for the background/aux client. Reads the
+ * unified store's settings.defaults.auxText (a connection id, also the pool
+ * key). Empty strings are treated as unset. (legacy settings.auxModelKey 已删除)
+ */
+export function resolveAuxKey(settings) {
+    const unified = settings.defaults?.auxText;
+    if (unified)
+        return unified;
+    return undefined;
+}

package/dist/engine/dynamic-tool-defs.d.ts

@@ -0,0 +1,19 @@
+import type { ToolDefinition } from "../types.js";
+import type { AgentDefinitionRegistry } from "../agent/agent-definition-registry.js";
+/**
+ * Rewrite a single tool definition with the live, per-engine dynamic bits the
+ * static def can't carry (the model only ever sees what we hand it each turn):
+ *
+ * - Agent: append the available-agent-types listing to the description AND
+ *   forward the rebuilt inputSchema. The schema carries the `agent_type` enum
+ *   of loaded role names — forwarding ONLY the description (the prior bug) left
+ *   agent_type a free optional string, so the model silently omitted it and the
+ *   configured roles' model/tools/skills never applied.
+ * - GenerateImage / GenerateVideo: name the configured providers in the
+ *   description (these defs never rebuild inputSchema, so description-only is
+ *   correct and intentional for them).
+ *
+ * Non-matching tools are returned by identity (no allocation). Pure: it never
+ * mutates the input or any shared const.
+ */
+export declare function applyDynamicToolDef(t: ToolDefinition, agentDefinitions: AgentDefinitionRegistry | undefined, guardCwd: string): ToolDefinition;

package/dist/engine/dynamic-tool-defs.js

@@ -0,0 +1,36 @@
+import { agentToolDefWithTypes } from "../tool-system/builtin/agent.js";
+import { generateImageToolDefFor } from "../tool-system/builtin/generate-image.js";
+import { generateVideoToolDefFor } from "../tool-system/builtin/generate-video.js";
+import { useCredentialToolDefFor } from "../credentials/use-credential-tool.js";
+/**
+ * Rewrite a single tool definition with the live, per-engine dynamic bits the
+ * static def can't carry (the model only ever sees what we hand it each turn):
+ *
+ * - Agent: append the available-agent-types listing to the description AND
+ *   forward the rebuilt inputSchema. The schema carries the `agent_type` enum
+ *   of loaded role names — forwarding ONLY the description (the prior bug) left
+ *   agent_type a free optional string, so the model silently omitted it and the
+ *   configured roles' model/tools/skills never applied.
+ * - GenerateImage / GenerateVideo: name the configured providers in the
+ *   description (these defs never rebuild inputSchema, so description-only is
+ *   correct and intentional for them).
+ *
+ * Non-matching tools are returned by identity (no allocation). Pure: it never
+ * mutates the input or any shared const.
+ */
+export function applyDynamicToolDef(t, agentDefinitions, guardCwd) {
+    if (t.name === "Agent") {
+        const def = agentToolDefWithTypes(agentDefinitions);
+        return { ...t, description: def.description, inputSchema: def.inputSchema };
+    }
+    if (t.name === "GenerateImage") {
+        return { ...t, description: generateImageToolDefFor(guardCwd).description };
+    }
+    if (t.name === "GenerateVideo") {
+        return { ...t, description: generateVideoToolDefFor(guardCwd).description };
+    }
+    if (t.name === "UseCredential") {
+        return { ...t, description: useCredentialToolDefFor(guardCwd).description };
+    }
+    return t;
+}