@cleocode/core 2026.6.14 → 2026.6.17

package/dist/llm/plugin-facade.js

@@ -10804,6 +10804,22 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // ── selfimprove query: probe (T11988 — seeded-code-regression scenario) ────────
+      // Pure read-only op that returns `{ probe: 'ok', version: probeVersion() }`.
+      // The `probe-helper.ts` intentionally ships with `probeVersion()` returning `2`
+      // (should be `1`) so the seeded-code-regression scenario replay diverges from its
+      // golden (`version: 1`) and gives the fix-gen LLM stage a real, patchable bug.
+      {
+        gateway: "query",
+        domain: "selfimprove",
+        operation: "probe",
+        description: 'selfimprove.probe (query) \u2014 returns { probe: "ok", version: 1 } (health/version probe). Used by the seeded-code-regression scenario to validate the fix-gen pipeline (T11988).',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
       // ── selfimprove mutate: run (T11889 / T11889-D — the self-dogfooding loop) ──
       // Boots ONE sandbox → replays the named canned scenario → diffs result
       // envelopes vs the golden → on a regression emits ONE leased `selfimprove_dhq`
@@ -11417,6 +11433,31 @@ var init_operations_registry = __esm({
             cli: { positional: true }
           }
         ]
+      },
+      // T11995 — Janitor MVP: orphan process reaper + stale scope/lock/debris sweep
+      {
+        gateway: "mutate",
+        domain: "admin",
+        operation: "janitor.run",
+        description: "admin.janitor.run (mutate) \u2014 run the janitor sweep: reap orphan processes, stop dead cleo-owned scopes, reclaim stale locks, prune tmp debris",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Report planned actions without mutating anything."
+          },
+          {
+            name: "gracePeriodMs",
+            type: "number",
+            required: false,
+            description: "Minimum age (ms) of an unregistered process before reap eligibility (default: 600000)."
+          }
+        ]
       }
     ];
   }
@@ -17608,7 +17649,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join28(chunks, separator) {
+      function join29(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -17616,7 +17657,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join28;
+      _sql.join = join29;
       function identifier(value) {
         return new Name(value);
       }
@@ -20003,7 +20044,7 @@ var init_select2 = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join28) => join28.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join29) => join29.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -23813,7 +23854,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_, v]) => v);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k, join28]) => {
+          return sql.join(withEntries.map(([k, join29]) => {
             const relation = tableConfig.relations[k];
             const isSingle2 = is(relation, One);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -23824,7 +23865,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join28,
+              queryConfig: join29,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter2,
               isNested: true,
@@ -23838,7 +23879,7 @@ var init_dialect = __esm({
               key: k,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join28 !== true && !!join28.where
+              isOptional: (relation.optional ?? false) || join29 !== true && !!join29.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s) => {
               return sql`${sql.raw(this.escapeString(s.key))}, ${s.selection ? sql`${jsonb3}(${sql.identifier(s.key)})` : sql.identifier(s.key)}`;
@@ -24659,7 +24700,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join28) => join28.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join29) => join29.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on = on(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -25348,10 +25389,10 @@ var init_session4 = __esm({
     NodeSQLitePreparedQuery = class extends SQLitePreparedQuery {
       static [entityKind] = "SQLJsPreparedQuery";
       jitMapper;
-      constructor(stmt, query, logger5, fields, executeMethod, useJitMappers, customResultMapper, isRqbV2Query, rqbConfig) {
+      constructor(stmt, query, logger6, fields, executeMethod, useJitMappers, customResultMapper, isRqbV2Query, rqbConfig) {
         super("sync", executeMethod, query);
         this.stmt = stmt;
-        this.logger = logger5;
+        this.logger = logger6;
         this.fields = fields;
         this.useJitMappers = useJitMappers;
         this.customResultMapper = customResultMapper;
@@ -25367,10 +25408,10 @@ var init_session4 = __esm({
       all(placeholderValues = {}) {
         if (this.isRqbV2Query) return this.allRqbV2(placeholderValues);
         const { stmt } = this;
-        const { fields, joinsNotNullableMap, logger: logger5, query, customResultMapper } = this;
+        const { fields, joinsNotNullableMap, logger: logger6, query, customResultMapper } = this;
         if (!fields && !customResultMapper) {
           const params = fillPlaceholders(query.params, placeholderValues);
-          logger5.logQuery(query.sql, params);
+          logger6.logQuery(query.sql, params);
           stmt.setReturnArrays(false);
           return stmt.all(...params);
         }
@@ -25381,9 +25422,9 @@ var init_session4 = __esm({
       }
       allRqbV2(placeholderValues = {}) {
         const { stmt } = this;
-        const { logger: logger5, query, customResultMapper } = this;
+        const { logger: logger6, query, customResultMapper } = this;
         const params = fillPlaceholders(query.params, placeholderValues);
-        logger5.logQuery(query.sql, params);
+        logger6.logQuery(query.sql, params);
         stmt.setReturnArrays(false);
         const rows = stmt.all(...params).map((row) => ({ ...row }));
         return this.useJitMappers ? (this.jitMapper = this.jitMapper ?? makeJitRqbMapper(this.rqbConfig))(rows) : customResultMapper(rows);
@@ -25429,9 +25470,9 @@ var init_session4 = __esm({
 import { DatabaseSync } from "node:sqlite";
 function construct(client, config2 = {}) {
   const dialect = new SQLiteSyncDialect();
-  let logger5;
-  if (config2.logger === true) logger5 = new DefaultLogger();
-  else if (config2.logger !== false) logger5 = config2.logger;
+  let logger6;
+  if (config2.logger === true) logger6 = new DefaultLogger();
+  else if (config2.logger !== false) logger6 = config2.logger;
   let schema;
   if (config2.schema) {
     const tablesConfig = extractTablesRelationalConfig(config2.schema, createTableRelationsHelpers);
@@ -25443,7 +25484,7 @@ function construct(client, config2 = {}) {
   }
   const relations = config2.relations ?? {};
   const db = new NodeSQLiteDatabase("sync", dialect, new NodeSQLiteSession(client, dialect, relations, schema, {
-    logger: logger5,
+    logger: logger6,
     useJitMappers: jitCompatCheck(config2.jit)
   }), relations, schema);
   db.$client = client;
@@ -40041,8 +40082,6 @@ __export(config_exports, {
   setConfigValue: () => setConfigValue
 });
 import { existsSync as existsSync16 } from "node:fs";
-import { mkdir as mkdir3, writeFile } from "node:fs/promises";
-import { dirname as dirname8 } from "node:path";
 function getNestedValue(obj, path) {
   const parts = path.split(".");
   let current = obj;
@@ -40165,9 +40204,7 @@ function parseConfigValue(value) {
 async function setConfigValue(key, value, cwd, opts) {
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
   if (!existsSync16(configPath)) {
-    const dir = dirname8(configPath);
-    await mkdir3(dir, { recursive: true });
-    await writeFile(configPath, "{}", "utf-8");
+    await atomicWriteJson(configPath, {});
   }
   const config2 = await readJson(configPath) ?? {};
   const parsedValue = parseConfigValue(value);
@@ -40179,9 +40216,7 @@ async function applyStrictnessPreset(preset, cwd, opts) {
   const definition = STRICTNESS_PRESETS[preset];
   const configPath = opts?.global ? getGlobalConfigPath() : getConfigPath(cwd);
   if (!existsSync16(configPath)) {
-    const dir = dirname8(configPath);
-    await mkdir3(dir, { recursive: true });
-    await writeFile(configPath, "{}", "utf-8");
+    await atomicWriteJson(configPath, {});
   }
   const config2 = await readJson(configPath) ?? {};
   for (const [key, value] of Object.entries(definition.values)) {
@@ -40210,6 +40245,7 @@ var init_config = __esm({
     "use strict";
     init_fallback_model();
     init_paths();
+    init_atomic();
     init_json2();
     DEFAULTS = {
       version: "2.10.0",
@@ -40320,6 +40356,12 @@ var init_config = __esm({
       // (T10383). The active runtime itself ships in T10512.
       leadRollup: {
         mode: "passive"
+      },
+      // T11984: daemon lifecycle — postinstall respects operator state by default.
+      // Set daemon.autoStart = false (via global config.json) for a persistent
+      // opt-out that survives npm upgrades.
+      daemon: {
+        autoStart: true
       }
     };
     ENV_MAP = {
@@ -41544,15 +41586,27 @@ var init_credentials2 = __esm({
 });
 
 // packages/core/src/llm/credentials-store.ts
+var credentials_store_exports = {};
+__export(credentials_store_exports, {
+  _resetPermsWarningForTests: () => _resetPermsWarningForTests,
+  _resetRoundRobinForTests: () => _resetRoundRobinForTests,
+  addCredential: () => addCredential,
+  credentialsStorePath: () => credentialsStorePath,
+  getCredentialByLabel: () => getCredentialByLabel,
+  listCredentials: () => listCredentials,
+  pickCredentialForProvider: () => pickCredentialForProvider,
+  pickCredentialForProviderSync: () => pickCredentialForProviderSync,
+  removeCredential: () => removeCredential
+});
 import { chmodSync, existsSync as existsSync22, mkdirSync as mkdirSync7, readFileSync as readFileSync13, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname9, join as join23 } from "node:path";
+import { dirname as dirname8, join as join23 } from "node:path";
 import { getCleoHome as getCleoHome7 } from "@cleocode/paths";
 function credentialsStorePath() {
   return join23(getCleoHome7(), "llm-credentials.json");
 }
 function ensureFileInitialized(path) {
   if (existsSync22(path)) return;
-  const dir = dirname9(path);
+  const dir = dirname8(path);
   if (!existsSync22(dir)) {
     mkdirSync7(dir, { recursive: true, mode: 448 });
   } else {
@@ -41587,6 +41641,9 @@ function checkPermsOnRead(path) {
   } catch {
   }
 }
+function _resetPermsWarningForTests() {
+  _warnedLoosePerms = false;
+}
 function emptyStore() {
   return { version: 1, defaultStrategy: "priorityWithFallback", credentials: [] };
 }
@@ -41629,6 +41686,9 @@ function isStoredCredential(value) {
   if (typeof accessToken !== "string") return false;
   return true;
 }
+function _resetRoundRobinForTests() {
+  _rrIndex.clear();
+}
 function eligibleForProvider(data, provider, preferLabel) {
   const now = Date.now();
   const all = data.credentials.filter((c) => {
@@ -41732,6 +41792,35 @@ async function addCredential(input) {
   clearAnthropicKeyCache();
   return inserted;
 }
+async function removeCredential(provider, label) {
+  const path = credentialsStorePath();
+  const snapshot = readStoreSync();
+  if (!snapshot.credentials.some((c) => c.provider === provider && c.label === label)) {
+    return false;
+  }
+  ensureFileInitialized(path);
+  let removed = false;
+  await withLock2(
+    path,
+    (current) => {
+      const data = current ?? emptyStore();
+      if (data.version !== 1 || !Array.isArray(data.credentials)) {
+        return emptyStore();
+      }
+      const before = data.credentials.length;
+      data.credentials = data.credentials.filter(
+        (c) => !(c.provider === provider && c.label === label)
+      );
+      removed = data.credentials.length < before;
+      data.defaultStrategy ??= "priorityWithFallback";
+      return data;
+    },
+    // SECURITY (S-01/S-02): see addCredential for rationale.
+    { mode: 384 }
+  );
+  if (removed) clearAnthropicKeyCache();
+  return removed;
+}
 async function pickCredentialForProvider(provider, opts = {}) {
   return pickCredentialForProviderSync(provider, opts);
 }
@@ -41871,7 +41960,7 @@ var init_gemini = __esm({
 // packages/core/src/llm/stable-device-id.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync23, mkdirSync as mkdirSync8, readFileSync as readFileSync14, renameSync as renameSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname10, join as join24 } from "node:path";
+import { dirname as dirname9, join as join24 } from "node:path";
 import { getCleoHome as getCleoHome8 } from "@cleocode/paths";
 function getStableDeviceId() {
   if (_cachedDeviceId !== null) return _cachedDeviceId;
@@ -41888,7 +41977,7 @@ function getStableDeviceId() {
   }
   const fresh = randomUUID2();
   try {
-    const dir = dirname10(path);
+    const dir = dirname9(path);
     if (!existsSync23(dir)) {
       mkdirSync8(dir, { recursive: true });
     }
@@ -42034,11 +42123,11 @@ var init_ollama = __esm({
       displayName: "Ollama (local)",
       authTypes: ["api_key"],
       baseUrl: "http://localhost:11434",
-      defaultModel: "llama3",
+      defaultModel: "gemma4:e4b",
       aliases: ["ollama-local"],
       // Hermes-parity routing/catalog fields (T11756). Local on-device tier.
       tier: "local",
-      defaultAuxModel: "llama3",
+      defaultAuxModel: "gemma4:e2b",
       defaultMaxTokens: 2048,
       envVars: ["OLLAMA_API_KEY", "OLLAMA_BASE_URL"],
       supportsThinkingBudget: false
@@ -42272,6 +42361,15 @@ var init_loader = __esm({
 });
 
 // packages/core/src/llm/provider-registry/index.ts
+var provider_registry_exports = {};
+__export(provider_registry_exports, {
+  _resetRegistryForTesting: () => _resetRegistryForTesting,
+  discoverPlugins: () => discoverPlugins,
+  ensureDiscovered: () => ensureDiscovered,
+  getProviderProfile: () => getProviderProfile,
+  listProviders: () => listProviders,
+  registerProvider: () => registerProvider
+});
 function registerProvider(profile) {
   const key = profile.name.toLowerCase();
   _registry.set(key, profile);
@@ -42294,12 +42392,25 @@ async function ensureDiscovered() {
   }
   return _discoveryPromise;
 }
+async function discoverPlugins() {
+  return ensureDiscovered();
+}
 async function getProviderProfile(name15) {
   await ensureDiscovered();
   const key = name15.toLowerCase();
   const canonical = _aliases.get(key) ?? key;
   return _registry.get(canonical);
 }
+async function listProviders() {
+  await ensureDiscovered();
+  const profiles = [..._registry.values()];
+  return profiles.sort((a, b) => a.name.localeCompare(b.name));
+}
+function _resetRegistryForTesting() {
+  _registry.clear();
+  _aliases.clear();
+  _discoveryPromise = null;
+}
 var _registry, _aliases, _discoveryPromise, BUILTIN_PROFILES;
 var init_provider_registry = __esm({
   "packages/core/src/llm/provider-registry/index.ts"() {
@@ -42424,6 +42535,60 @@ function isInCooldown(credential) {
 function sortByPriorityDesc(entries) {
   return [...entries].sort((a, b) => b.priority - a.priority);
 }
+async function refreshExpiredOAuthForProvider(provider) {
+  const entries = await listCredentials(provider);
+  const now = Date.now();
+  let attempted = 0;
+  let refreshed = 0;
+  let lastError = null;
+  for (const entry of entries) {
+    if (entry.authType !== "oauth") continue;
+    if (!entry.refreshToken) continue;
+    if (entry.disabled === true) continue;
+    const isExpiredOrNearExpiry = typeof entry.expiresAt === "number" && entry.expiresAt > 0 && entry.expiresAt <= now + PROACTIVE_REFRESH_FLOOR_MS;
+    if (!isExpiredOrNearExpiry) continue;
+    const key = `${provider}::${entry.label}`;
+    const negExpiry = _refreshNegativeCache.get(key);
+    if (typeof negExpiry === "number" && now < negExpiry) {
+      attempted += 1;
+      lastError = lastError ?? new Error(
+        `OAuth refresh suppressed for ${provider}::${entry.label} (negative cache active)`
+      );
+      continue;
+    }
+    attempted += 1;
+    let inFlight = _refreshInFlight.get(key);
+    if (!inFlight) {
+      const pool = new CredentialPool(provider);
+      const expiresAtBefore = entry.expiresAt;
+      inFlight = pool.proactiveRefresh(entry.label).then(async (wasAttempted) => {
+        if (!wasAttempted) {
+          return true;
+        }
+        const after = await getCredentialByLabel(provider, entry.label);
+        const didAdvance = after !== null && typeof after.expiresAt === "number" && after.expiresAt > (expiresAtBefore ?? 0);
+        if (!didAdvance) {
+          throw new Error(
+            `OAuth refresh token exchange failed for ${provider}::${entry.label} \u2014 the stored token may be revoked. Run \`cleo login ${provider}\` to re-authenticate.`
+          );
+        }
+        return true;
+      }).finally(() => {
+        _refreshInFlight.delete(key);
+      });
+      _refreshInFlight.set(key, inFlight);
+    }
+    try {
+      await inFlight;
+      refreshed += 1;
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      _refreshNegativeCache.set(key, Date.now() + REFRESH_NEGATIVE_CACHE_TTL_MS);
+    }
+  }
+  const actionableHint = attempted > 0 && refreshed === 0 && lastError !== null ? `OAuth refresh failed for provider '${provider}'. Run \`cleo login ${provider}\` to re-authenticate.` : null;
+  return { attempted, refreshed, lastError, actionableHint };
+}
 function debugLog(msg, ...rest) {
   if (process.env["CLEO_DEBUG"]) {
     console.debug(`[cleo:credential-pool] ${msg}`, ...rest);
@@ -42435,7 +42600,7 @@ function getCredentialPool() {
   }
   return _singleton;
 }
-var COOLDOWN_AUTH_MS, COOLDOWN_RATE_LIMIT_MS, COOLDOWN_DEFAULT_MS, PROACTIVE_REFRESH_FLOOR_MS, PoolExhaustedError, CredentialPool, POOL_SEED_CACHE_TTL_MS, UnifiedCredentialPool, _singleton;
+var COOLDOWN_AUTH_MS, COOLDOWN_RATE_LIMIT_MS, COOLDOWN_DEFAULT_MS, PROACTIVE_REFRESH_FLOOR_MS, PoolExhaustedError, _refreshInFlight, REFRESH_NEGATIVE_CACHE_TTL_MS, _refreshNegativeCache, CredentialPool, POOL_SEED_CACHE_TTL_MS, UnifiedCredentialPool, _singleton;
 var init_credential_pool = __esm({
   "packages/core/src/llm/credential-pool.ts"() {
     "use strict";
@@ -42472,6 +42637,9 @@ var init_credential_pool = __esm({
       /** Stable LAFS error code. */
       code = "E_LLM_POOL_EXHAUSTED";
     };
+    _refreshInFlight = /* @__PURE__ */ new Map();
+    REFRESH_NEGATIVE_CACHE_TTL_MS = 3e4;
+    _refreshNegativeCache = /* @__PURE__ */ new Map();
     CredentialPool = class {
       /**
        * @param provider - The LLM transport this pool manages.
@@ -43232,6 +43400,38 @@ var init_error_classifier = __esm({
 });
 
 // packages/core/src/llm/catalog-cache.ts
+import {
+  existsSync as existsSync25,
+  mkdirSync as mkdirSync10,
+  readdirSync as readdirSync6,
+  readFileSync as readFileSync15,
+  statSync as statSync8,
+  symlinkSync,
+  unlinkSync as unlinkSync7,
+  writeFileSync as writeFileSync9
+} from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join27 } from "node:path";
+function getCatalogDir() {
+  if (process.env["CLEO_DATA_DIR"]) {
+    return join27(process.env["CLEO_DATA_DIR"], "llm-catalog");
+  }
+  const xdg = process.env["XDG_DATA_HOME"] ?? join27(homedir4(), ".local", "share");
+  return join27(xdg, "cleo", "llm-catalog");
+}
+function findLatestCacheFile(dir) {
+  if (!existsSync25(dir)) return null;
+  const files = readdirSync6(dir).filter((f) => f.endsWith("-models.json")).map((f) => ({ name: f, mtime: statSync8(join27(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  return files.length > 0 ? join27(dir, files[0].name) : null;
+}
+function readCacheFile(filePath) {
+  try {
+    const raw = readFileSync15(filePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
 var init_catalog_cache = __esm({
   "packages/core/src/llm/catalog-cache.ts"() {
     "use strict";
@@ -43239,16 +43439,16 @@ var init_catalog_cache = __esm({
 });
 
 // packages/core/src/llm/model-metadata.ts
-import { readFileSync as readFileSync15 } from "node:fs";
-import { dirname as dirname11, join as join27 } from "node:path";
+import { readFileSync as readFileSync16 } from "node:fs";
+import { dirname as dirname10, join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function getCuratedTable() {
   if (_curated !== void 0) {
     return _curated;
   }
-  const thisDir = dirname11(fileURLToPath3(import.meta.url));
-  const jsonPath = join27(thisDir, "curated-models.json");
-  const raw = JSON.parse(readFileSync15(jsonPath, "utf-8"));
+  const thisDir = dirname10(fileURLToPath3(import.meta.url));
+  const jsonPath = join28(thisDir, "curated-models.json");
+  const raw = JSON.parse(readFileSync16(jsonPath, "utf-8"));
   _curated = raw.models;
   return _curated;
 }
@@ -46088,7 +46288,69 @@ var init_chat_completions = __esm({
 });
 
 // packages/core/src/llm/transports/codex-responses.ts
-import { OpenAI as OpenAIClient } from "openai";
+function resolveCodexUrl(baseUrl) {
+  const DEFAULT_BASE = "https://chatgpt.com/backend-api";
+  const raw = baseUrl?.trim() ? baseUrl.trim() : DEFAULT_BASE;
+  const normalized = raw.replace(/\/+$/, "");
+  if (normalized.endsWith("/codex/responses")) return normalized;
+  if (normalized.endsWith("/codex")) return `${normalized}/responses`;
+  return `${normalized}/codex/responses`;
+}
+async function buildHttpError(res) {
+  let bodyDetail = "";
+  try {
+    const text3 = await res.text();
+    if (text3) {
+      try {
+        const parsed = JSON.parse(text3);
+        const err = parsed["error"];
+        bodyDetail = err?.["message"] ?? text3;
+      } catch {
+        bodyDetail = text3;
+      }
+    }
+  } catch {
+  }
+  return bodyDetail ? `${res.status} ${bodyDetail}` : `${res.status} status code (no body)`;
+}
+function buildInputItems(request) {
+  const items = [];
+  for (const msg of request.messages) {
+    if (msg.role === "tool") {
+      items.push({
+        type: "function_call_output",
+        call_id: msg.toolUseId ?? `call_${Date.now().toString(36)}`,
+        output: extractTextContent3(msg)
+      });
+      continue;
+    }
+    const contentItems = buildContentList(msg);
+    if (contentItems.length === 1 && contentItems[0]?.["type"] === "input_text") {
+      items.push({
+        type: "message",
+        role: msg.role === "assistant" ? "assistant" : "user",
+        content: contentItems[0]["text"]
+      });
+    } else {
+      items.push({
+        type: "message",
+        role: msg.role === "assistant" ? "assistant" : "user",
+        content: contentItems
+      });
+    }
+  }
+  return items;
+}
+function buildTools(tools) {
+  if (!tools || tools.length === 0) return [];
+  return tools.map((t) => ({
+    type: "function",
+    name: t.name,
+    description: t.description,
+    parameters: t.inputSchema,
+    strict: false
+  }));
+}
 function extractTextContent3(message) {
   if (typeof message.content === "string") return message.content;
   return message.content.filter(
@@ -46108,38 +46370,77 @@ function buildContentList(message) {
     return { type: "input_image", image_url: imageUrl, detail: "auto" };
   });
 }
-function extractTextFromOutput(output) {
-  const parts = [];
-  for (const item of output) {
-    const it = item;
-    if (it["type"] !== "message") continue;
-    const content = it["content"];
-    if (!Array.isArray(content)) continue;
-    for (const part of content) {
-      if (part["type"] === "output_text" && typeof part["text"] === "string") {
-        parts.push(part["text"]);
-      }
-    }
-  }
-  return parts.join("");
-}
 function extractToolCallsFromOutput(output) {
   const calls = [];
   for (const item of output) {
-    const it = item;
-    if (it["type"] !== "function_call") continue;
+    if (item["type"] !== "function_call") continue;
     calls.push({
-      id: typeof it["call_id"] === "string" ? it["call_id"] : null,
-      name: typeof it["name"] === "string" ? it["name"] : "unknown",
-      arguments: typeof it["arguments"] === "string" ? it["arguments"] : "{}",
+      id: typeof item["call_id"] === "string" ? item["call_id"] : null,
+      name: typeof item["name"] === "string" ? item["name"] : "unknown",
+      arguments: typeof item["arguments"] === "string" ? item["arguments"] : "{}",
       providerData: {
-        call_id: it["call_id"],
-        response_item_id: it["id"]
+        call_id: item["call_id"],
+        response_item_id: item["id"]
       }
     });
   }
   return calls;
 }
+function normalizeUsage(usage) {
+  const inputTokens = usage["input_tokens"] ?? 0;
+  const outputTokens = usage["output_tokens"] ?? 0;
+  const normalized = { inputTokens, outputTokens };
+  const details = usage["input_tokens_details"];
+  const cached2 = details?.["cached_tokens"];
+  if (typeof cached2 === "number" && cached2 > 0) {
+    normalized.cachedTokens = cached2;
+  }
+  return normalized;
+}
+async function* parseSSE(body, signal) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const onAbort = () => {
+    void reader.cancel().catch(() => void 0);
+  };
+  signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    while (true) {
+      if (signal?.aborted) throw new Error("Request was aborted");
+      const { done, value } = await reader.read();
+      if (signal?.aborted) throw new Error("Request was aborted");
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let idx = buffer.indexOf("\n\n");
+      while (idx !== -1) {
+        const chunk = buffer.slice(0, idx);
+        buffer = buffer.slice(idx + 2);
+        const dataLines = chunk.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim());
+        if (dataLines.length > 0) {
+          const data = dataLines.join("\n").trim();
+          if (data && data !== "[DONE]") {
+            try {
+              yield JSON.parse(data);
+            } catch {
+            }
+          }
+        }
+        idx = buffer.indexOf("\n\n");
+      }
+    }
+  } finally {
+    signal?.removeEventListener("abort", onAbort);
+    try {
+      await reader.cancel();
+    } catch {
+    }
+    try {
+      reader.releaseLock();
+    } catch {
+    }
+  }
+}
 var CodexResponsesTransport;
 var init_codex_responses = __esm({
   "packages/core/src/llm/transports/codex-responses.ts"() {
@@ -46156,111 +46457,207 @@ var init_codex_responses = __esm({
        * @see ADR-072 §Type lock-in
        */
       apiMode = "codex_responses";
-      /** Underlying OpenAI SDK client. */
-      _client;
+      /** API key / OAuth bearer token. */
+      _apiKey;
+      /**
+       * Resolved endpoint URL (the full `/codex/responses` path).
+       * Derived once at construction so the URL normalisation runs once.
+       */
+      _endpointUrl;
+      /** Extra headers merged into every request (auth, originator, etc.). */
+      _defaultHeaders;
       /**
        * Construct a CodexResponsesTransport.
        *
-       * @param opts - Construction options including provider, API key, and
-       *   optional base URL / default headers.
+       * @param opts - Construction options: provider, API key, optional base URL
+       *   and default headers (auth + Cloudflare-bypass headers for OAuth callers).
        */
       constructor(opts) {
         this.provider = opts.provider;
-        this._client = new OpenAIClient({
-          apiKey: opts.apiKey,
-          baseURL: opts.baseUrl,
-          defaultHeaders: opts.defaultHeaders
-        });
+        this._apiKey = opts.apiKey;
+        this._endpointUrl = resolveCodexUrl(opts.baseUrl);
+        this._defaultHeaders = opts.defaultHeaders ?? {};
       }
+      // ---------------------------------------------------------------------------
+      // LlmTransport — complete()
+      // ---------------------------------------------------------------------------
       /**
-       * Execute a single completion using the OpenAI Responses API.
+       * Execute a single (non-streaming) completion using the Responses API.
        *
-       * Maps the provider-neutral {@link TransportRequest} to
-       * `openai.responses.create()` and normalizes the {@link Response} into a
-       * {@link NormalizedResponse}.
+       * The Codex ChatGPT backend mandates `stream: true` on every request and
+       * returns `400 {"detail":"Stream must be set to true"}` for `stream: false`.
+       * This method therefore always sends `stream: true` with
+       * `Accept: text/event-stream`, internally consumes the SSE stream, and
+       * aggregates text deltas + tool calls + usage into a {@link NormalizedResponse}
+       * — identical to calling `stream()` and collecting all chunks.
        *
        * @param request - Provider-neutral request parameters.
        * @param _ctx - Transport context (unused; `request.signal` handles abort).
        * @returns Normalized response envelope.
        */
       async complete(request, _ctx) {
-        const input = this._buildInputItems(request);
-        const tools = this._buildTools(request.tools);
-        const params = {
-          model: request.model,
-          input,
-          max_output_tokens: request.maxTokens,
-          temperature: request.temperature ?? 0.7
+        const body = this._buildBody(request, true);
+        const headers = this._buildHeaders(true);
+        const res = await fetch(this._endpointUrl, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body),
+          signal: request.signal
+        });
+        if (!res.ok) {
+          throw new Error(await buildHttpError(res));
+        }
+        if (!res.body) {
+          throw new Error("codex_responses: response body is null (no SSE stream)");
+        }
+        const textParts = [];
+        const toolCalls = [];
+        let finalUsage = null;
+        let finishReason = null;
+        let responseId = null;
+        let responseModel = null;
+        for await (const event of parseSSE(res.body, request.signal)) {
+          const evType = event["type"];
+          if (evType === "response.output_text.delta") {
+            const delta = event["delta"];
+            if (delta) textParts.push(delta);
+            continue;
+          }
+          if (evType === "response.output_item.done") {
+            const item = event["item"];
+            if (item?.["type"] === "function_call") {
+              toolCalls.push({
+                id: typeof item["call_id"] === "string" ? item["call_id"] : null,
+                name: typeof item["name"] === "string" ? item["name"] : "unknown",
+                arguments: typeof item["arguments"] === "string" ? item["arguments"] : "{}",
+                providerData: {
+                  call_id: item["call_id"],
+                  response_item_id: item["id"]
+                }
+              });
+            }
+            continue;
+          }
+          if (evType === "response.completed") {
+            const completedResponse = event["response"];
+            if (completedResponse) {
+              finishReason = completedResponse["status"] ?? "completed";
+              responseId = completedResponse["id"] ?? null;
+              responseModel = completedResponse["model"] ?? null;
+              const usage = completedResponse["usage"];
+              if (usage) finalUsage = normalizeUsage(usage);
+              const output = completedResponse["output"] ?? [];
+              const embeddedCalls = extractToolCallsFromOutput(
+                output
+              );
+              if (embeddedCalls.length > 0 && toolCalls.length === 0) {
+                toolCalls.push(...embeddedCalls);
+              }
+            }
+            break;
+          }
+          if (evType === "response.failed" || evType === "response.incomplete") {
+            const failedResponse = event["response"];
+            if (failedResponse) {
+              finishReason = failedResponse["status"] ?? evType;
+              const usage = failedResponse["usage"];
+              if (usage) finalUsage = normalizeUsage(usage);
+            }
+            break;
+          }
+          if (evType === "error") {
+            const code = event["code"];
+            const message = event["message"];
+            throw new Error(`Codex error: ${message ?? code ?? JSON.stringify(event)}`);
+          }
+        }
+        const content = textParts.join("") || null;
+        return {
+          id: responseId ?? `resp-${Date.now().toString(36)}`,
+          model: responseModel ?? request.model,
+          content,
+          toolCalls: toolCalls.length > 0 ? toolCalls : null,
+          stopReason: finishReason ?? "completed",
+          usage: finalUsage ?? { inputTokens: 0, outputTokens: 0 },
+          providerData: {
+            codex_response_id: responseId
+          },
+          raw: {}
         };
-        if (request.system) params["instructions"] = request.system;
-        if (tools.length > 0) params["tools"] = tools;
-        const response = await this._client.responses.create(
-          params,
-          { signal: request.signal }
-        );
-        return this._normalize(response, request.model);
       }
+      // ---------------------------------------------------------------------------
+      // LlmTransport — stream()
+      // ---------------------------------------------------------------------------
       /**
-       * Stream a completion using the OpenAI Responses API SSE stream.
+       * Stream a completion using the Responses API SSE stream.
        *
        * Yields {@link NormalizedDelta} chunks from `response.output_text.delta`
-       * events. The final delta is emitted when `response.completed` fires and
-       * carries `stopReason` and `usage`.
+       * events parsed from the raw SSE stream.  The final delta carries
+       * `stopReason` and `usage` from `response.completed`.
+       *
+       * Wire shape:
+       * - `store: false` (required — codex backend rejects absent or true)
+       * - `stream: true`
+       * - `Accept: text/event-stream`
+       * - `OpenAI-Beta: responses=experimental`
        *
        * @param request - Provider-neutral request parameters.
        * @param _ctx - Transport context (unused; `request.signal` handles abort).
        * @returns Async iterable of normalized delta chunks.
        */
       async *stream(request, _ctx) {
-        const input = this._buildInputItems(request);
-        const tools = this._buildTools(request.tools);
-        const params = {
-          model: request.model,
-          input,
-          max_output_tokens: request.maxTokens,
-          temperature: request.temperature ?? 0.7,
-          stream: true
-        };
-        if (request.system) params["instructions"] = request.system;
-        if (tools.length > 0) params["tools"] = tools;
-        const responseStream = await this._client.responses.create(
-          params,
-          { signal: request.signal }
-        );
+        const body = this._buildBody(request, true);
+        const headers = this._buildHeaders(true);
+        const res = await fetch(this._endpointUrl, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body),
+          signal: request.signal
+        });
+        if (!res.ok) {
+          throw new Error(await buildHttpError(res));
+        }
+        if (!res.body) {
+          throw new Error("codex_responses: response body is null (no SSE stream)");
+        }
         let finishReason = null;
         let finalUsage = null;
-        for await (const event of responseStream) {
-          const ev = event;
-          const evType = ev["type"];
+        for await (const event of parseSSE(res.body, request.signal)) {
+          const evType = event["type"];
           if (evType === "response.output_text.delta") {
-            const delta = ev["delta"];
+            const delta = event["delta"];
             if (delta) {
               yield { text: delta, reasoning: "", stopReason: null, usage: null };
             }
             continue;
           }
           if (evType === "response.completed") {
-            const completedResponse = ev["response"] ?? null;
+            const completedResponse = event["response"];
             if (completedResponse) {
-              finishReason = completedResponse.status ?? "completed";
-              const usage = completedResponse.usage;
+              finishReason = completedResponse["status"] ?? "completed";
+              const usage = completedResponse["usage"];
               if (usage) {
-                finalUsage = this._normalizeUsage(usage);
+                finalUsage = normalizeUsage(usage);
               }
             }
             break;
           }
           if (evType === "response.failed" || evType === "response.incomplete") {
-            const failedResponse = ev["response"] ?? null;
+            const failedResponse = event["response"];
             if (failedResponse) {
-              finishReason = failedResponse.status ?? evType;
-              const usage = failedResponse.usage;
+              finishReason = failedResponse["status"] ?? evType;
+              const usage = failedResponse["usage"];
               if (usage) {
-                finalUsage = this._normalizeUsage(usage);
+                finalUsage = normalizeUsage(usage);
               }
             }
             break;
           }
+          if (evType === "error") {
+            const code = event["code"];
+            const message = event["message"];
+            throw new Error(`Codex error: ${message ?? code ?? JSON.stringify(event)}`);
+          }
         }
         yield {
           text: "",
@@ -46270,128 +46667,60 @@ var init_codex_responses = __esm({
         };
       }
       // ---------------------------------------------------------------------------
-      // Input items construction
+      // Private helpers
       // ---------------------------------------------------------------------------
       /**
-       * Convert provider-neutral messages to the Responses API `input` array.
+       * Build the HTTP headers for a Codex request.
        *
-       * Mapping rules:
-       * - `user` / `assistant` string messages → `EasyInputMessage` with `type:'message'`.
-       * - `user` / `assistant` multimodal blocks → content list with `input_text` /
-       *   `input_image` items.
-       * - `tool` messages (role=`'tool'`) → `function_call_output` items using
-       *   `toolUseId` as `call_id`.
+       * Merges the auth/cloudflare headers from `_defaultHeaders` with the
+       * mandatory Codex-specific headers:
+       * - `OpenAI-Beta: responses=experimental`
+       * - `content-type: application/json`
+       * - `accept: text/event-stream` (always — both complete() and stream() use SSE)
        *
-       * Multi-turn tool replay: when an assistant message's raw content is a
-       * `function_call` JSON envelope (injected by the agent loop after a tool
-       * call round-trip), the item is converted to a `function_call` input item
-       * so the Responses API can continue the conversation.
+       * The Authorization header is injected only if not already present in
+       * `_defaultHeaders` (OAuth callers pre-set it via buildCodexOAuthHeaders).
        *
-       * @param request - Full transport request.
-       * @returns Responses API input items array.
+       * @param streaming - Whether this is a streaming (SSE) or completion call.
+       * @returns Plain string record of all request headers.
        */
-      _buildInputItems(request) {
-        const items = [];
-        for (const msg of request.messages) {
-          if (msg.role === "tool") {
-            items.push({
-              type: "function_call_output",
-              call_id: msg.toolUseId ?? `call_${Date.now().toString(36)}`,
-              output: typeof msg.content === "string" ? msg.content : extractTextContent3(msg)
-            });
-            continue;
-          }
-          const contentItems = buildContentList(msg);
-          if (contentItems.length === 1 && contentItems[0]?.["type"] === "input_text") {
-            items.push({
-              type: "message",
-              role: msg.role === "assistant" ? "assistant" : "user",
-              content: contentItems[0]["text"]
-            });
-          } else {
-            items.push({
-              type: "message",
-              role: msg.role === "assistant" ? "assistant" : "user",
-              content: contentItems
-            });
-          }
+      _buildHeaders(streaming) {
+        const headers = {
+          ...this._defaultHeaders,
+          "OpenAI-Beta": "responses=experimental",
+          "content-type": "application/json",
+          accept: streaming ? "text/event-stream" : "application/json"
+        };
+        const hasAuth = Object.keys(headers).some((k) => k.toLowerCase() === "authorization");
+        if (!hasAuth) {
+          headers["Authorization"] = `Bearer ${this._apiKey}`;
         }
-        return items;
-      }
-      // ---------------------------------------------------------------------------
-      // Tool conversion
-      // ---------------------------------------------------------------------------
-      /**
-       * Convert provider-neutral tool definitions to the Responses API
-       * `{type: 'function', name, description, parameters, strict}` shape.
-       *
-       * @param tools - Provider-neutral tool definitions (may be undefined).
-       * @returns Responses API tool objects, or empty array.
-       */
-      _buildTools(tools) {
-        if (!tools || tools.length === 0) return [];
-        return tools.map((t) => ({
-          type: "function",
-          name: t.name,
-          description: t.description,
-          parameters: t.inputSchema,
-          strict: false
-        }));
+        return headers;
       }
-      // ---------------------------------------------------------------------------
-      // Response normalization
-      // ---------------------------------------------------------------------------
       /**
-       * Normalize an OpenAI Responses API {@link Response} into a
-       * {@link NormalizedResponse}.
+       * Build the JSON request body for a Codex Responses API call.
        *
-       * Mapping rules:
-       * - `content` — from `response.output_text` shortcut (SDK convenience
-       *   property that aggregates all output_text parts).
-       * - `toolCalls` — from `output` items of `type: 'function_call'`.
-       * - `stopReason` — from `response.status` (completed / failed / incomplete).
-       * - `usage` — `input_tokens` → `inputTokens`, `output_tokens` → `outputTokens`.
-       * - `cachedTokens` — from `usage.input_tokens_details.cached_tokens`.
-       * - `raw` — unmodified SDK response.
+       * Mandatory fields per the Codex backend:
+       * - `store: false`   — backend rejects absent or `true`.
+       * - `instructions`   — system prompt (defaulting to empty string when absent).
+       * - `input`          — array of Responses API input items.
        *
-       * @param response - Raw Responses API response object.
-       * @param requestedModel - Model string from the originating request.
-       * @returns Normalized response envelope.
-       */
-      _normalize(response, requestedModel) {
-        const content = response.output_text && response.output_text.length > 0 ? response.output_text : extractTextFromOutput(response.output);
-        const toolCalls = extractToolCallsFromOutput(response.output);
-        const usage = this._normalizeUsage(response.usage ?? null);
-        return {
-          id: response.id ?? `resp-${Date.now().toString(36)}`,
-          model: String(response.model ?? requestedModel),
-          content: content || null,
-          toolCalls: toolCalls.length > 0 ? toolCalls : null,
-          stopReason: response.status ?? "completed",
-          usage,
-          providerData: {
-            codex_response_id: response.id
-          },
-          raw: response
-        };
-      }
-      /**
-       * Normalize OpenAI Responses API usage into {@link NormalizedUsage}.
-       *
-       * @param usage - Raw usage object (may be null when the API omits it).
-       * @returns Normalized usage with optional `cachedTokens`.
+       * @param request - Provider-neutral request.
+       * @param streaming - Whether to enable SSE streaming.
+       * @returns Serialisable request body.
        */
-      _normalizeUsage(usage) {
-        if (!usage) return { inputTokens: 0, outputTokens: 0 };
-        const normalized = {
-          inputTokens: usage.input_tokens ?? 0,
-          outputTokens: usage.output_tokens ?? 0
+      _buildBody(request, streaming) {
+        const body = {
+          model: request.model,
+          input: buildInputItems(request),
+          instructions: request.system ?? "",
+          store: false,
+          stream: streaming
         };
-        const cached2 = usage.input_tokens_details?.cached_tokens;
-        if (typeof cached2 === "number" && cached2 > 0) {
-          normalized.cachedTokens = cached2;
-        }
-        return normalized;
+        if (request.temperature != null) body.temperature = request.temperature;
+        const tools = buildTools(request.tools);
+        if (tools.length > 0) body.tools = tools;
+        return body;
       }
     };
   }
@@ -75237,6 +75566,318 @@ var init_model_runner = __esm({
   }
 });
 
+// packages/core/src/llm/catalog-model-resolver.ts
+var catalog_model_resolver_exports = {};
+__export(catalog_model_resolver_exports, {
+  _resetCatalogModelResolverCache: () => _resetCatalogModelResolverCache,
+  catalogKeyForProvider: () => catalogKeyForProvider,
+  listProviderModels: () => listProviderModels,
+  resolveProviderDefaultModel: () => resolveProviderDefaultModel,
+  validateModelForProvider: () => validateModelForProvider
+});
+function getDiskCatalog() {
+  if (_catalog !== void 0) return _catalog;
+  const dir = getCatalogDir();
+  const latest = findLatestCacheFile(dir);
+  if (!latest) {
+    _catalog = null;
+    return null;
+  }
+  _catalog = readCacheFile(latest);
+  return _catalog;
+}
+function resolveProviderDefaultModel(providerCatalogKey, catalogOverride) {
+  const catalog = catalogOverride ?? getDiskCatalog();
+  if (!catalog) return null;
+  const provider = catalog[providerCatalogKey];
+  if (!provider?.models) return null;
+  let latestId = null;
+  let latestDate = "";
+  for (const [id, entry] of Object.entries(provider.models)) {
+    const rd = entry.release_date;
+    if (!rd) continue;
+    if (rd > latestDate) {
+      latestDate = rd;
+      latestId = id;
+    }
+  }
+  return latestId;
+}
+function validateModelForProvider(model, providerCatalogKey, catalogOverride) {
+  const catalog = catalogOverride ?? getDiskCatalog();
+  if (!catalog) {
+    return { valid: true, reason: "catalog-unavailable" };
+  }
+  const provider = catalog[providerCatalogKey];
+  if (!provider?.models) {
+    return { valid: true, reason: "provider-not-in-catalog" };
+  }
+  const found = Object.hasOwn(provider.models, model);
+  return { valid: found, reason: found ? "found" : "not-found" };
+}
+function listProviderModels(providerCatalogKey, limit = 12, catalogOverride) {
+  const catalog = catalogOverride ?? getDiskCatalog();
+  if (!catalog) return [];
+  const provider = catalog[providerCatalogKey];
+  if (!provider?.models) return [];
+  const entries = Object.entries(provider.models);
+  const sorted = [...entries].sort(([, a], [, b]) => {
+    const da = a.release_date ?? "";
+    const db = b.release_date ?? "";
+    if (da === db) return 0;
+    return db.localeCompare(da);
+  });
+  return sorted.slice(0, Math.max(0, limit)).map(([id]) => id);
+}
+function catalogKeyForProvider(providerName) {
+  const PROVIDER_KEY_MAP = {
+    gemini: "google"
+    // CLEO name → models.dev key overrides only (identical mappings are omitted)
+  };
+  return PROVIDER_KEY_MAP[providerName.toLowerCase()] ?? providerName.toLowerCase();
+}
+function _resetCatalogModelResolverCache() {
+  _catalog = void 0;
+}
+var _catalog;
+var init_catalog_model_resolver = __esm({
+  "packages/core/src/llm/catalog-model-resolver.ts"() {
+    "use strict";
+    init_catalog_cache();
+  }
+});
+
+// packages/core/src/llm/cross-provider-selector.ts
+import { totalmem } from "node:os";
+async function probeOllamaAlive(baseUrl) {
+  const cached2 = _ollamaProbeCache.get(baseUrl);
+  if (cached2 && Date.now() - cached2.checkedAt < OLLAMA_PROBE_TTL_MS) {
+    return cached2.alive;
+  }
+  let alive = false;
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), OLLAMA_PROBE_TIMEOUT_MS);
+    try {
+      const res = await fetch(baseUrl, { signal: controller.signal });
+      alive = res.ok || res.status < 500;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  } catch {
+    alive = false;
+  }
+  _ollamaProbeCache.set(baseUrl, { alive, checkedAt: Date.now() });
+  return alive;
+}
+function ollamaDefaultModelForTier(tier, ramBytesOverride) {
+  const ramBytes = ramBytesOverride ?? totalmem();
+  const gb = ramBytes / 1024 ** 3;
+  if (gb >= 8) {
+    return tier === "fast" || tier === "local" ? "gemma4:e2b" : "gemma4:e4b";
+  }
+  if (gb >= 4) {
+    return "gemma4:e2b";
+  }
+  logger4.warn(
+    { ramGb: gb.toFixed(1), tier },
+    "cross-provider-selector: RAM < 4 GB; selecting qwen2:0.5b (proof-of-life only \u2014 not suitable for production)"
+  );
+  return "qwen2:0.5b";
+}
+function isProvisioned(provider) {
+  if (provider === "ollama") {
+    if (process.env["OLLAMA_HOST"]?.trim()) return true;
+    const stored = pickCredentialForProviderSync(provider, { strategy: "priorityOnly" });
+    return stored !== null;
+  }
+  const cred = resolveCredentials(provider);
+  return (cred.apiKey?.trim().length ?? 0) > 0;
+}
+function scoreProvider(provider, providerTier, taskTier, ollamaAlive, costInputPerMillion) {
+  let score = TIER_BASE[providerTier];
+  if (taskTier === "frontier" && providerTier === "frontier") {
+    score += TASK_MATCH_BONUS_FRONTIER;
+  } else if ((taskTier === "fast" || taskTier === "local") && (providerTier === "fast" || providerTier === "local")) {
+    score += TASK_MATCH_BONUS_FAST;
+  }
+  if (providerTier === "local" && ollamaAlive) {
+    score += LOCALITY_BONUS;
+  }
+  if ((providerTier === "frontier" || providerTier === "standard") && provider !== "ollama") {
+    score += PROVISIONED_CLOUD_BIAS;
+  }
+  const penalty = Math.min(Math.floor(costInputPerMillion / 10), MAX_COST_PENALTY);
+  score -= penalty;
+  return score;
+}
+function roleTierFor(role) {
+  switch (role) {
+    case "consolidation":
+    case "judgement":
+    case "hygiene":
+      return "frontier";
+    case "extraction":
+    case "derivation":
+      return "standard";
+    default:
+      return "fast";
+  }
+}
+async function selectBestProvisioned(role, opts) {
+  const taskTier = roleTierFor(role);
+  for (const id of BUILTIN_PROVIDER_IDS) {
+    const creds = await listCredentials(id);
+    const hasExpiredOAuth = creds.some(
+      (c) => c.authType === "oauth" && c.refreshToken && typeof c.expiresAt === "number" && c.expiresAt > 0 && c.expiresAt <= Date.now()
+    );
+    if (!hasExpiredOAuth) continue;
+    try {
+      const result = await refreshExpiredOAuthForProvider(id);
+      if (result.actionableHint) {
+        logger4.warn(
+          { provider: id, hint: result.actionableHint },
+          "cross-provider-selector: OAuth refresh-on-use failed \u2014 credential will be excluded from resolution"
+        );
+      } else if (result.refreshed > 0) {
+        logger4.debug(
+          { provider: id, refreshed: result.refreshed },
+          "cross-provider-selector: renewed expired OAuth credential via refresh-on-use"
+        );
+      }
+    } catch {
+    }
+  }
+  const provisionedIds = [];
+  for (const id of BUILTIN_PROVIDER_IDS) {
+    if (isProvisioned(id)) {
+      provisionedIds.push(id);
+    }
+  }
+  if (provisionedIds.length === 0) {
+    logger4.warn(
+      {
+        providers_checked: BUILTIN_PROVIDER_IDS.slice(),
+        reason: "no-provisioned-provider",
+        role,
+        projectRoot: opts.projectRoot
+      },
+      "resolveLLMForSystem: no provider has a usable credential; returning null-credential envelope"
+    );
+    return null;
+  }
+  const { getProviderProfile: getProviderProfile2 } = await Promise.resolve().then(() => (init_provider_registry(), provider_registry_exports));
+  const { resolveProviderDefaultModel: resolveProviderDefaultModel2, catalogKeyForProvider: catalogKeyForProvider2 } = await Promise.resolve().then(() => (init_catalog_model_resolver(), catalog_model_resolver_exports));
+  const { pickCredentialForProvider: pickCredentialForProvider2 } = await Promise.resolve().then(() => (init_credentials_store(), credentials_store_exports));
+  const ollamaProvisioned = provisionedIds.includes("ollama");
+  let ollamaAlive = false;
+  if (ollamaProvisioned) {
+    const profile = await getProviderProfile2("ollama");
+    const ollamaBase = profile?.baseUrl ?? "http://localhost:11434";
+    ollamaAlive = await probeOllamaAlive(ollamaBase);
+  }
+  const scored = [];
+  for (const id of provisionedIds) {
+    const profile = await getProviderProfile2(id);
+    const tier = profile?.tier ?? "standard";
+    const costInput = 0;
+    const score = scoreProvider(id, tier, taskTier, ollamaAlive, costInput);
+    const storedCred = await pickCredentialForProvider2(id, { strategy: "priorityOnly" });
+    const credentialPriority = storedCred?.priority ?? Number.MAX_SAFE_INTEGER;
+    scored.push({ id, tier, score, credentialPriority });
+  }
+  scored.sort((a, b) => {
+    if (b.score !== a.score) return b.score - a.score;
+    return a.credentialPriority - b.credentialPriority;
+  });
+  const winner = scored[0];
+  if (!winner) return null;
+  let model;
+  if (winner.id === "ollama") {
+    const ollamaProfile2 = await getProviderProfile2("ollama");
+    const ramBytes = totalmem();
+    const gb = ramBytes / 1024 ** 3;
+    if (gb >= 8) {
+      model = (winner.tier === "fast" || taskTier === "fast" ? ollamaProfile2?.defaultAuxModel : ollamaProfile2?.defaultModel) ?? ollamaDefaultModelForTier(winner.tier);
+    } else if (gb >= 4) {
+      model = ollamaProfile2?.defaultAuxModel ?? "gemma4:e2b";
+    } else {
+      model = ollamaDefaultModelForTier(winner.tier, ramBytes);
+    }
+    const catalogKey = catalogKeyForProvider2(winner.id);
+    const catalogModel = resolveProviderDefaultModel2(catalogKey);
+    if (!catalogModel?.startsWith("gemma4")) {
+      logger4.info(
+        { provider: "ollama", selectedModel: model },
+        "cross-provider-selector: gemma4 family not in catalog snapshot \u2014 run `cleo llm refresh-catalog` to pull latest"
+      );
+    }
+  } else {
+    try {
+      const catalogKey = catalogKeyForProvider2(winner.id);
+      const catalogModel = resolveProviderDefaultModel2(catalogKey);
+      const profileModel = (await getProviderProfile2(winner.id))?.defaultModel;
+      model = catalogModel ?? profileModel ?? "unknown";
+    } catch {
+      model = (await getProviderProfile2(winner.id))?.defaultModel ?? "unknown";
+    }
+  }
+  logger4.debug(
+    {
+      winner: winner.id,
+      score: winner.score,
+      taskTier,
+      model,
+      provisionedCount: provisionedIds.length
+    },
+    "cross-provider-selector: selected best provisioned provider"
+  );
+  return {
+    provider: winner.id,
+    model,
+    credentialLabel: void 0,
+    source: "cross-provider"
+  };
+}
+var logger4, BUILTIN_PROVIDER_IDS, TIER_BASE, PROVISIONED_CLOUD_BIAS, LOCALITY_BONUS, TASK_MATCH_BONUS_FRONTIER, TASK_MATCH_BONUS_FAST, MAX_COST_PENALTY, OLLAMA_PROBE_TIMEOUT_MS, OLLAMA_PROBE_TTL_MS, _ollamaProbeCache;
+var init_cross_provider_selector = __esm({
+  "packages/core/src/llm/cross-provider-selector.ts"() {
+    "use strict";
+    init_logger2();
+    init_credential_pool();
+    init_credentials2();
+    init_credentials_store();
+    logger4 = getLogger("llm-cross-provider-selector");
+    BUILTIN_PROVIDER_IDS = [
+      "anthropic",
+      "openai",
+      "gemini",
+      "moonshot",
+      "openrouter",
+      "bedrock",
+      "deepseek",
+      "xai",
+      "groq",
+      "kimi-code",
+      "ollama"
+    ];
+    TIER_BASE = {
+      frontier: 100,
+      standard: 70,
+      fast: 50,
+      local: 120
+    };
+    PROVISIONED_CLOUD_BIAS = 60;
+    LOCALITY_BONUS = 30;
+    TASK_MATCH_BONUS_FRONTIER = 20;
+    TASK_MATCH_BONUS_FAST = 15;
+    MAX_COST_PENALTY = 10;
+    OLLAMA_PROBE_TIMEOUT_MS = 200;
+    OLLAMA_PROBE_TTL_MS = 3e4;
+    _ollamaProbeCache = /* @__PURE__ */ new Map();
+  }
+});
+
 // packages/core/src/llm/sealed-credential.ts
 function tokenPreview(token, authType) {
   const prefix = authType === "oauth" ? "oat-\u2026" : "\u2026";
@@ -75285,14 +75926,14 @@ function getRegisteredSystemDefault(key) {
   if (!isResolvableSystemDefault(record2.defaults)) return void 0;
   return record2.defaults;
 }
-var logger4, REGISTRY;
+var logger5, REGISTRY;
 var init_system_of_use_registry = __esm({
   "packages/core/src/llm/system-of-use-registry.ts"() {
     "use strict";
     init_src();
     init_logger2();
     init_system_key();
-    logger4 = getLogger("llm-system-of-use-registry");
+    logger5 = getLogger("llm-system-of-use-registry");
     REGISTRY = /* @__PURE__ */ new Map();
   }
 });
@@ -75380,7 +76021,7 @@ function resolveRegisteredSystemDefault(llm, systemKey) {
   }
   return void 0;
 }
-function selectProviderModel(llm, role, systemKey, profileOverride) {
+async function selectProviderModel(llm, role, systemKey, profileOverride, projectRoot) {
   const roleEntry = llm?.roles?.[role];
   const pinnedProfile = resolveNamedProfile(llm, profileOverride, "profile");
   if (pinnedProfile) return pinnedProfile;
@@ -75409,6 +76050,15 @@ function selectProviderModel(llm, role, systemKey, profileOverride) {
   if (defaultProfile) return defaultProfile;
   const registeredDefault = resolveRegisteredSystemDefault(llm, systemKey);
   if (registeredDefault) return registeredDefault;
+  try {
+    const crossProviderResult = await selectBestProvisioned(role, {
+      projectRoot: projectRoot ?? ""
+    });
+    if (crossProviderResult !== null) {
+      return crossProviderResult;
+    }
+  } catch {
+  }
   return {
     provider: IMPLICIT_FALLBACK_PROVIDER,
     model: IMPLICIT_FALLBACK_MODEL,
@@ -75468,11 +76118,12 @@ async function resolveLLMForRole(role, opts) {
     config2 = void 0;
   }
   const llmBlock = readLlmBlock(config2);
-  const { provider, model, credentialLabel, source } = selectProviderModel(
+  const { provider, model, credentialLabel, source } = await selectProviderModel(
     llmBlock,
     role,
     opts?.systemKey,
-    opts?.profileOverride
+    opts?.profileOverride,
+    projectRoot
   );
   const { credential, usedLabel } = await resolveCredentialForRole(
     provider,
@@ -75550,6 +76201,7 @@ var init_role_resolver = __esm({
     init_credential_pool();
     init_credentials2();
     init_credentials_store();
+    init_cross_provider_selector();
     init_fallback_model();
     init_sealed_credential();
     init_system_of_use_registry();