@dbx-tools/cli 0.9.60 → 0.9.64

package/lib/src/model-gateway/server.d.ts

@@ -5,9 +5,12 @@
  */
 import { server } from "@databricks/appkit";
 import { type ModelGatewayOptions } from "@dbx-tools/shared-model-gateway/options";
+import type express from "express";
 type AppKitServerOptions = NonNullable<Parameters<typeof server>[0]>;
 /** Resolve AppKit server settings for the loopback model gateway. */
 export declare function modelGatewayServerOptions(options?: ModelGatewayOptions): AppKitServerOptions;
+/** Require one bearer token without retaining or logging request credentials. */
+export declare function gatewayBearerMiddleware(token: string): express.RequestHandler;
 /** Start the foreground model gateway and keep its AppKit server active. */
 export declare function startModelGateway(options?: ModelGatewayOptions): Promise<void>;
 export {};

package/lib/src/model-gateway/server.js

@@ -3,9 +3,10 @@
  *
  * @module
  */
+import { createHash, timingSafeEqual } from "node:crypto";
 import { createApp, server } from "@databricks/appkit";
-import { modelGateway } from "@dbx-tools/appkit-model-gateway/plugin";
-import { sendHealth } from "@dbx-tools/appkit-model-gateway/routes";
+import { ModelGateway } from "@dbx-tools/appkit-model-gateway";
+import { sendHealth, sendInference, sendModels } from "@dbx-tools/appkit-model-gateway/routes";
 import { workspaceClient } from "@dbx-tools/databricks";
 import { resolveModelGatewayOptions, } from "@dbx-tools/shared-model-gateway/options";
 /** Resolve AppKit server settings for the loopback model gateway. */
@@ -19,22 +20,54 @@ function appKitServerOptions(options) {
         port: options.listen.port,
     };
 }
+/** Require one bearer token without retaining or logging request credentials. */
+export function gatewayBearerMiddleware(token) {
+    const expected = createHash("sha256").update(token).digest();
+    return (request, response, next) => {
+        const authorization = request.header("authorization");
+        const match = /^Bearer\s+(.+)$/i.exec(authorization ?? "");
+        const actual = createHash("sha256")
+            .update(match?.[1] ?? "")
+            .digest();
+        if (match && timingSafeEqual(actual, expected)) {
+            next();
+            return;
+        }
+        response
+            .status(401)
+            .setHeader("www-authenticate", "Bearer")
+            .json({
+            error: {
+                message: "Invalid or missing model-gateway bearer token.",
+                type: "authentication_error",
+                code: "invalid_bearer_token",
+            },
+        });
+    };
+}
 /** Start the foreground model gateway and keep its AppKit server active. */
 export async function startModelGateway(options = {}) {
     const resolved = resolveModelGatewayOptions(options);
+    const gateway = new ModelGateway({
+        ...(resolved.model ? { model: resolved.model } : {}),
+        ...(resolved.modelClass ? { modelClass: resolved.modelClass } : {}),
+    });
     const client = await workspaceClient.createWorkspaceClient({
         ...(resolved.profile ? { profile: resolved.profile } : {}),
     });
     await createApp({
         client,
-        plugins: [modelGateway(), server(appKitServerOptions(resolved))],
+        plugins: [server(appKitServerOptions(resolved))],
         onPluginsReady(appkit) {
             appkit.server.extend((application) => {
+                if (resolved.bearerToken) {
+                    application.use(gatewayBearerMiddleware(resolved.bearerToken));
+                }
                 application.get("/api/healthz", (_request, response) => {
                     sendHealth(response);
                 });
                 application.get("/v1/models", (request, response) => {
-                    void appkit.modelGateway.models(request, response);
+                    void sendModels(gateway, request, response);
                 });
                 for (const [path, protocol] of [
                     ["/v1/chat/completions", "openai-chat"],
@@ -43,11 +76,11 @@ export async function startModelGateway(options = {}) {
                     ["/v1/embeddings", "openai-embeddings"],
                 ]) {
                     application.post(path, (request, response) => {
-                        void appkit.modelGateway.inference(protocol, request, response);
+                        void sendInference(gateway, protocol, request, response);
                     });
                 }
             });
         },
     });
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21vZGVsLWdhdGV3YXkvc2VydmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7O0dBSUc7QUFFSCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ3ZELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSx3Q0FBd0MsQ0FBQztBQUN0RSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sd0NBQXdDLENBQUM7QUFDcEUsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hELE9BQU8sRUFDTCwwQkFBMEIsR0FHM0IsTUFBTSx5Q0FBeUMsQ0FBQztBQUlqRCxxRUFBcUU7QUFDckUsTUFBTSxVQUFVLHlCQUF5QixDQUFDLFVBQStCLEVBQUU7SUFDekUsT0FBTyxtQkFBbUIsQ0FBQywwQkFBMEIsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0FBQ2xFLENBQUM7QUFFRCxTQUFTLG1CQUFtQixDQUFDLE9BQW9DO0lBQy9ELE9BQU87UUFDTCxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7UUFDNUIsSUFBSSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSTtRQUN6QixJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJO0tBQzFCLENBQUM7QUFDSixDQUFDO0FBRUQsNEVBQTRFO0FBQzVFLE1BQU0sQ0FBQyxLQUFLLFVBQVUsaUJBQWlCLENBQUMsVUFBK0IsRUFBRTtJQUN2RSxNQUFNLFFBQVEsR0FBRywwQkFBMEIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNyRCxNQUFNLE1BQU0sR0FBRyxNQUFNLGVBQWUsQ0FBQyxxQkFBcUIsQ0FBQztRQUN6RCxHQUFHLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7S0FDM0QsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxTQUFTLENBQUM7UUFDZCxNQUFNO1FBQ04sT0FBTyxFQUFFLENBQUMsWUFBWSxFQUFFLEVBQUUsTUFBTSxDQUFDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDaEUsY0FBYyxDQUFDLE1BQU07WUFDbkIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRTtnQkFDbkMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsQ0FBQyxRQUFRLEVBQUUsUUFBUSxFQUFFLEVBQUU7b0JBQ3JELFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztnQkFDdkIsQ0FBQyxDQUFDLENBQUM7Z0JBQ0gsV0FBVyxDQUFDLEdBQUcsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUU7b0JBQ2xELEtBQUssTUFBTSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUNyRCxDQUFDLENBQUMsQ0FBQztnQkFDSCxLQUFLLE1BQU0sQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUk7b0JBQzdCLENBQUMsc0JBQXNCLEVBQUUsYUFBYSxDQUFDO29CQUN2QyxDQUFDLGVBQWUsRUFBRSxrQkFBa0IsQ0FBQztvQkFDckMsQ0FBQyxjQUFjLEVBQUUsb0JBQW9CLENBQUM7b0JBQ3RDLENBQUMsZ0JBQWdCLEVBQUUsbUJBQW1CLENBQUM7aUJBQy9CLEVBQUUsQ0FBQztvQkFDWCxXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRTt3QkFDM0MsS0FBSyxNQUFNLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO29CQUNsRSxDQUFDLENBQUMsQ0FBQztnQkFDTCxDQUFDO1lBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogRm9yZWdyb3VuZCBtb2RlbC1nYXRld2F5IHNlcnZlciBvd25lZCBieSB0aGUgQ0xJIHBhY2thZ2UuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IGNyZWF0ZUFwcCwgc2VydmVyIH0gZnJvbSBcIkBkYXRhYnJpY2tzL2FwcGtpdFwiO1xuaW1wb3J0IHsgbW9kZWxHYXRld2F5IH0gZnJvbSBcIkBkYngtdG9vbHMvYXBwa2l0LW1vZGVsLWdhdGV3YXkvcGx1Z2luXCI7XG5pbXBvcnQgeyBzZW5kSGVhbHRoIH0gZnJvbSBcIkBkYngtdG9vbHMvYXBwa2l0LW1vZGVsLWdhdGV3YXkvcm91dGVzXCI7XG5pbXBvcnQgeyB3b3Jrc3BhY2VDbGllbnQgfSBmcm9tIFwiQGRieC10b29scy9kYXRhYnJpY2tzXCI7XG5pbXBvcnQge1xuICByZXNvbHZlTW9kZWxHYXRld2F5T3B0aW9ucyxcbiAgdHlwZSBNb2RlbEdhdGV3YXlPcHRpb25zLFxuICB0eXBlIFJlc29sdmVkTW9kZWxHYXRld2F5T3B0aW9ucyxcbn0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLW1vZGVsLWdhdGV3YXkvb3B0aW9uc1wiO1xuXG50eXBlIEFwcEtpdFNlcnZlck9wdGlvbnMgPSBOb25OdWxsYWJsZTxQYXJhbWV0ZXJzPHR5cGVvZiBzZXJ2ZXI+WzBdPjtcblxuLyoqIFJlc29sdmUgQXBwS2l0IHNlcnZlciBzZXR0aW5ncyBmb3IgdGhlIGxvb3BiYWNrIG1vZGVsIGdhdGV3YXkuICovXG5leHBvcnQgZnVuY3Rpb24gbW9kZWxHYXRld2F5U2VydmVyT3B0aW9ucyhvcHRpb25zOiBNb2RlbEdhdGV3YXlPcHRpb25zID0ge30pOiBBcHBLaXRTZXJ2ZXJPcHRpb25zIHtcbiAgcmV0dXJuIGFwcEtpdFNlcnZlck9wdGlvbnMocmVzb2x2ZU1vZGVsR2F0ZXdheU9wdGlvbnMob3B0aW9ucykpO1xufVxuXG5mdW5jdGlvbiBhcHBLaXRTZXJ2ZXJPcHRpb25zKG9wdGlvbnM6IFJlc29sdmVkTW9kZWxHYXRld2F5T3B0aW9ucyk6IEFwcEtpdFNlcnZlck9wdGlvbnMge1xuICByZXR1cm4ge1xuICAgIGJvZHlMaW1pdDogb3B0aW9ucy5ib2R5TGltaXQsXG4gICAgaG9zdDogb3B0aW9ucy5saXN0ZW4uaG9zdCxcbiAgICBwb3J0OiBvcHRpb25zLmxpc3Rlbi5wb3J0LFxuICB9O1xufVxuXG4vKiogU3RhcnQgdGhlIGZvcmVncm91bmQgbW9kZWwgZ2F0ZXdheSBhbmQga2VlcCBpdHMgQXBwS2l0IHNlcnZlciBhY3RpdmUuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gc3RhcnRNb2RlbEdhdGV3YXkob3B0aW9uczogTW9kZWxHYXRld2F5T3B0aW9ucyA9IHt9KTogUHJvbWlzZTx2b2lkPiB7XG4gIGNvbnN0IHJlc29sdmVkID0gcmVzb2x2ZU1vZGVsR2F0ZXdheU9wdGlvbnMob3B0aW9ucyk7XG4gIGNvbnN0IGNsaWVudCA9IGF3YWl0IHdvcmtzcGFjZUNsaWVudC5jcmVhdGVXb3Jrc3BhY2VDbGllbnQoe1xuICAgIC4uLihyZXNvbHZlZC5wcm9maWxlID8geyBwcm9maWxlOiByZXNvbHZlZC5wcm9maWxlIH0gOiB7fSksXG4gIH0pO1xuICBhd2FpdCBjcmVhdGVBcHAoe1xuICAgIGNsaWVudCxcbiAgICBwbHVnaW5zOiBbbW9kZWxHYXRld2F5KCksIHNlcnZlcihhcHBLaXRTZXJ2ZXJPcHRpb25zKHJlc29sdmVkKSldLFxuICAgIG9uUGx1Z2luc1JlYWR5KGFwcGtpdCkge1xuICAgICAgYXBwa2l0LnNlcnZlci5leHRlbmQoKGFwcGxpY2F0aW9uKSA9PiB7XG4gICAgICAgIGFwcGxpY2F0aW9uLmdldChcIi9hcGkvaGVhbHRoelwiLCAoX3JlcXVlc3QsIHJlc3BvbnNlKSA9PiB7XG4gICAgICAgICAgc2VuZEhlYWx0aChyZXNwb25zZSk7XG4gICAgICAgIH0pO1xuICAgICAgICBhcHBsaWNhdGlvbi5nZXQoXCIvdjEvbW9kZWxzXCIsIChyZXF1ZXN0LCByZXNwb25zZSkgPT4ge1xuICAgICAgICAgIHZvaWQgYXBwa2l0Lm1vZGVsR2F0ZXdheS5tb2RlbHMocmVxdWVzdCwgcmVzcG9uc2UpO1xuICAgICAgICB9KTtcbiAgICAgICAgZm9yIChjb25zdCBbcGF0aCwgcHJvdG9jb2xdIG9mIFtcbiAgICAgICAgICBbXCIvdjEvY2hhdC9jb21wbGV0aW9uc1wiLCBcIm9wZW5haS1jaGF0XCJdLFxuICAgICAgICAgIFtcIi92MS9yZXNwb25zZXNcIiwgXCJvcGVuYWktcmVzcG9uc2VzXCJdLFxuICAgICAgICAgIFtcIi92MS9tZXNzYWdlc1wiLCBcImFudGhyb3BpYy1tZXNzYWdlc1wiXSxcbiAgICAgICAgICBbXCIvdjEvZW1iZWRkaW5nc1wiLCBcIm9wZW5haS1lbWJlZGRpbmdzXCJdLFxuICAgICAgICBdIGFzIGNvbnN0KSB7XG4gICAgICAgICAgYXBwbGljYXRpb24ucG9zdChwYXRoLCAocmVxdWVzdCwgcmVzcG9uc2UpID0+IHtcbiAgICAgICAgICAgIHZvaWQgYXBwa2l0Lm1vZGVsR2F0ZXdheS5pbmZlcmVuY2UocHJvdG9jb2wsIHJlcXVlc3QsIHJlc3BvbnNlKTtcbiAgICAgICAgICB9KTtcbiAgICAgICAgfVxuICAgICAgfSk7XG4gICAgfSxcbiAgfSk7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21vZGVsLWdhdGV3YXkvc2VydmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7O0dBSUc7QUFFSCxPQUFPLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUMxRCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ3ZELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUMvRCxPQUFPLEVBQUUsVUFBVSxFQUFFLGFBQWEsRUFBRSxVQUFVLEVBQUUsTUFBTSx3Q0FBd0MsQ0FBQztBQUMvRixPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDeEQsT0FBTyxFQUNMLDBCQUEwQixHQUczQixNQUFNLHlDQUF5QyxDQUFDO0FBS2pELHFFQUFxRTtBQUNyRSxNQUFNLFVBQVUseUJBQXlCLENBQUMsVUFBK0IsRUFBRTtJQUN6RSxPQUFPLG1CQUFtQixDQUFDLDBCQUEwQixDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7QUFDbEUsQ0FBQztBQUVELFNBQVMsbUJBQW1CLENBQUMsT0FBb0M7SUFDL0QsT0FBTztRQUNMLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztRQUM1QixJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJO1FBQ3pCLElBQUksRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUk7S0FDMUIsQ0FBQztBQUNKLENBQUM7QUFFRCxpRkFBaUY7QUFDakYsTUFBTSxVQUFVLHVCQUF1QixDQUFDLEtBQWE7SUFDbkQsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUM3RCxPQUFPLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsRUFBRTtRQUNqQyxNQUFNLGFBQWEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ3RELE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLElBQUksQ0FBQyxhQUFhLElBQUksRUFBRSxDQUFDLENBQUM7UUFDM0QsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQzthQUNoQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO2FBQ3hCLE1BQU0sRUFBRSxDQUFDO1FBQ1osSUFBSSxLQUFLLElBQUksZUFBZSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQy9DLElBQUksRUFBRSxDQUFDO1lBQ1AsT0FBTztRQUNULENBQUM7UUFDRCxRQUFRO2FBQ0wsTUFBTSxDQUFDLEdBQUcsQ0FBQzthQUNYLFNBQVMsQ0FBQyxrQkFBa0IsRUFBRSxRQUFRLENBQUM7YUFDdkMsSUFBSSxDQUFDO1lBQ0osS0FBSyxFQUFFO2dCQUNMLE9BQU8sRUFBRSxnREFBZ0Q7Z0JBQ3pELElBQUksRUFBRSxzQkFBc0I7Z0JBQzVCLElBQUksRUFBRSxzQkFBc0I7YUFDN0I7U0FDRixDQUFDLENBQUM7SUFDUCxDQUFDLENBQUM7QUFDSixDQUFDO0FBRUQsNEVBQTRFO0FBQzVFLE1BQU0sQ0FBQyxLQUFLLFVBQVUsaUJBQWlCLENBQUMsVUFBK0IsRUFBRTtJQUN2RSxNQUFNLFFBQVEsR0FBRywwQkFBMEIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNyRCxNQUFNLE9BQU8sR0FBRyxJQUFJLFlBQVksQ0FBQztRQUMvQixHQUFHLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDcEQsR0FBRyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0tBQ3BFLENBQUMsQ0FBQztJQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sZUFBZSxDQUFDLHFCQUFxQixDQUFDO1FBQ3pELEdBQUcsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztLQUMzRCxDQUFDLENBQUM7SUFDSCxNQUFNLFNBQVMsQ0FBQztRQUNkLE1BQU07UUFDTixPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUMsbUJBQW1CLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUNoRCxjQUFjLENBQUMsTUFBTTtZQUNuQixNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFO2dCQUNuQyxJQUFJLFFBQVEsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDekIsV0FBVyxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztnQkFDakUsQ0FBQztnQkFDRCxXQUFXLENBQUMsR0FBRyxDQUFDLGNBQWMsRUFBRSxDQUFDLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRTtvQkFDckQsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO2dCQUN2QixDQUFDLENBQUMsQ0FBQztnQkFDSCxXQUFXLENBQUMsR0FBRyxDQUFDLFlBQVksRUFBRSxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRTtvQkFDbEQsS0FBSyxVQUFVLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDOUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ0gsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJO29CQUM3QixDQUFDLHNCQUFzQixFQUFFLGFBQWEsQ0FBQztvQkFDdkMsQ0FBQyxlQUFlLEVBQUUsa0JBQWtCLENBQUM7b0JBQ3JDLENBQUMsY0FBYyxFQUFFLG9CQUFvQixDQUFDO29CQUN0QyxDQUFDLGdCQUFnQixFQUFFLG1CQUFtQixDQUFDO2lCQUMvQixFQUFFLENBQUM7b0JBQ1gsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUU7d0JBQzNDLEtBQUssYUFBYSxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO29CQUMzRCxDQUFDLENBQUMsQ0FBQztnQkFDTCxDQUFDO1lBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogRm9yZWdyb3VuZCBtb2RlbC1nYXRld2F5IHNlcnZlciBvd25lZCBieSB0aGUgQ0xJIHBhY2thZ2UuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IGNyZWF0ZUhhc2gsIHRpbWluZ1NhZmVFcXVhbCB9IGZyb20gXCJub2RlOmNyeXB0b1wiO1xuaW1wb3J0IHsgY3JlYXRlQXBwLCBzZXJ2ZXIgfSBmcm9tIFwiQGRhdGFicmlja3MvYXBwa2l0XCI7XG5pbXBvcnQgeyBNb2RlbEdhdGV3YXkgfSBmcm9tIFwiQGRieC10b29scy9hcHBraXQtbW9kZWwtZ2F0ZXdheVwiO1xuaW1wb3J0IHsgc2VuZEhlYWx0aCwgc2VuZEluZmVyZW5jZSwgc2VuZE1vZGVscyB9IGZyb20gXCJAZGJ4LXRvb2xzL2FwcGtpdC1tb2RlbC1nYXRld2F5L3JvdXRlc1wiO1xuaW1wb3J0IHsgd29ya3NwYWNlQ2xpZW50IH0gZnJvbSBcIkBkYngtdG9vbHMvZGF0YWJyaWNrc1wiO1xuaW1wb3J0IHtcbiAgcmVzb2x2ZU1vZGVsR2F0ZXdheU9wdGlvbnMsXG4gIHR5cGUgTW9kZWxHYXRld2F5T3B0aW9ucyxcbiAgdHlwZSBSZXNvbHZlZE1vZGVsR2F0ZXdheU9wdGlvbnMsXG59IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1tb2RlbC1nYXRld2F5L29wdGlvbnNcIjtcbmltcG9ydCB0eXBlIGV4cHJlc3MgZnJvbSBcImV4cHJlc3NcIjtcblxudHlwZSBBcHBLaXRTZXJ2ZXJPcHRpb25zID0gTm9uTnVsbGFibGU8UGFyYW1ldGVyczx0eXBlb2Ygc2VydmVyPlswXT47XG5cbi8qKiBSZXNvbHZlIEFwcEtpdCBzZXJ2ZXIgc2V0dGluZ3MgZm9yIHRoZSBsb29wYmFjayBtb2RlbCBnYXRld2F5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIG1vZGVsR2F0ZXdheVNlcnZlck9wdGlvbnMob3B0aW9uczogTW9kZWxHYXRld2F5T3B0aW9ucyA9IHt9KTogQXBwS2l0U2VydmVyT3B0aW9ucyB7XG4gIHJldHVybiBhcHBLaXRTZXJ2ZXJPcHRpb25zKHJlc29sdmVNb2RlbEdhdGV3YXlPcHRpb25zKG9wdGlvbnMpKTtcbn1cblxuZnVuY3Rpb24gYXBwS2l0U2VydmVyT3B0aW9ucyhvcHRpb25zOiBSZXNvbHZlZE1vZGVsR2F0ZXdheU9wdGlvbnMpOiBBcHBLaXRTZXJ2ZXJPcHRpb25zIHtcbiAgcmV0dXJuIHtcbiAgICBib2R5TGltaXQ6IG9wdGlvbnMuYm9keUxpbWl0LFxuICAgIGhvc3Q6IG9wdGlvbnMubGlzdGVuLmhvc3QsXG4gICAgcG9ydDogb3B0aW9ucy5saXN0ZW4ucG9ydCxcbiAgfTtcbn1cblxuLyoqIFJlcXVpcmUgb25lIGJlYXJlciB0b2tlbiB3aXRob3V0IHJldGFpbmluZyBvciBsb2dnaW5nIHJlcXVlc3QgY3JlZGVudGlhbHMuICovXG5leHBvcnQgZnVuY3Rpb24gZ2F0ZXdheUJlYXJlck1pZGRsZXdhcmUodG9rZW46IHN0cmluZyk6IGV4cHJlc3MuUmVxdWVzdEhhbmRsZXIge1xuICBjb25zdCBleHBlY3RlZCA9IGNyZWF0ZUhhc2goXCJzaGEyNTZcIikudXBkYXRlKHRva2VuKS5kaWdlc3QoKTtcbiAgcmV0dXJuIChyZXF1ZXN0LCByZXNwb25zZSwgbmV4dCkgPT4ge1xuICAgIGNvbnN0IGF1dGhvcml6YXRpb24gPSByZXF1ZXN0LmhlYWRlcihcImF1dGhvcml6YXRpb25cIik7XG4gICAgY29uc3QgbWF0Y2ggPSAvXkJlYXJlclxccysoLispJC9pLmV4ZWMoYXV0aG9yaXphdGlvbiA/PyBcIlwiKTtcbiAgICBjb25zdCBhY3R1YWwgPSBjcmVhdGVIYXNoKFwic2hhMjU2XCIpXG4gICAgICAudXBkYXRlKG1hdGNoPy5bMV0gPz8gXCJcIilcbiAgICAgIC5kaWdlc3QoKTtcbiAgICBpZiAobWF0Y2ggJiYgdGltaW5nU2FmZUVxdWFsKGFjdHVhbCwgZXhwZWN0ZWQpKSB7XG4gICAgICBuZXh0KCk7XG4gICAgICByZXR1cm47XG4gICAgfVxuICAgIHJlc3BvbnNlXG4gICAgICAuc3RhdHVzKDQwMSlcbiAgICAgIC5zZXRIZWFkZXIoXCJ3d3ctYXV0aGVudGljYXRlXCIsIFwiQmVhcmVyXCIpXG4gICAgICAuanNvbih7XG4gICAgICAgIGVycm9yOiB7XG4gICAgICAgICAgbWVzc2FnZTogXCJJbnZhbGlkIG9yIG1pc3NpbmcgbW9kZWwtZ2F0ZXdheSBiZWFyZXIgdG9rZW4uXCIsXG4gICAgICAgICAgdHlwZTogXCJhdXRoZW50aWNhdGlvbl9lcnJvclwiLFxuICAgICAgICAgIGNvZGU6IFwiaW52YWxpZF9iZWFyZXJfdG9rZW5cIixcbiAgICAgICAgfSxcbiAgICAgIH0pO1xuICB9O1xufVxuXG4vKiogU3RhcnQgdGhlIGZvcmVncm91bmQgbW9kZWwgZ2F0ZXdheSBhbmQga2VlcCBpdHMgQXBwS2l0IHNlcnZlciBhY3RpdmUuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gc3RhcnRNb2RlbEdhdGV3YXkob3B0aW9uczogTW9kZWxHYXRld2F5T3B0aW9ucyA9IHt9KTogUHJvbWlzZTx2b2lkPiB7XG4gIGNvbnN0IHJlc29sdmVkID0gcmVzb2x2ZU1vZGVsR2F0ZXdheU9wdGlvbnMob3B0aW9ucyk7XG4gIGNvbnN0IGdhdGV3YXkgPSBuZXcgTW9kZWxHYXRld2F5KHtcbiAgICAuLi4ocmVzb2x2ZWQubW9kZWwgPyB7IG1vZGVsOiByZXNvbHZlZC5tb2RlbCB9IDoge30pLFxuICAgIC4uLihyZXNvbHZlZC5tb2RlbENsYXNzID8geyBtb2RlbENsYXNzOiByZXNvbHZlZC5tb2RlbENsYXNzIH0gOiB7fSksXG4gIH0pO1xuICBjb25zdCBjbGllbnQgPSBhd2FpdCB3b3Jrc3BhY2VDbGllbnQuY3JlYXRlV29ya3NwYWNlQ2xpZW50KHtcbiAgICAuLi4ocmVzb2x2ZWQucHJvZmlsZSA/IHsgcHJvZmlsZTogcmVzb2x2ZWQucHJvZmlsZSB9IDoge30pLFxuICB9KTtcbiAgYXdhaXQgY3JlYXRlQXBwKHtcbiAgICBjbGllbnQsXG4gICAgcGx1Z2luczogW3NlcnZlcihhcHBLaXRTZXJ2ZXJPcHRpb25zKHJlc29sdmVkKSldLFxuICAgIG9uUGx1Z2luc1JlYWR5KGFwcGtpdCkge1xuICAgICAgYXBwa2l0LnNlcnZlci5leHRlbmQoKGFwcGxpY2F0aW9uKSA9PiB7XG4gICAgICAgIGlmIChyZXNvbHZlZC5iZWFyZXJUb2tlbikge1xuICAgICAgICAgIGFwcGxpY2F0aW9uLnVzZShnYXRld2F5QmVhcmVyTWlkZGxld2FyZShyZXNvbHZlZC5iZWFyZXJUb2tlbikpO1xuICAgICAgICB9XG4gICAgICAgIGFwcGxpY2F0aW9uLmdldChcIi9hcGkvaGVhbHRoelwiLCAoX3JlcXVlc3QsIHJlc3BvbnNlKSA9PiB7XG4gICAgICAgICAgc2VuZEhlYWx0aChyZXNwb25zZSk7XG4gICAgICAgIH0pO1xuICAgICAgICBhcHBsaWNhdGlvbi5nZXQoXCIvdjEvbW9kZWxzXCIsIChyZXF1ZXN0LCByZXNwb25zZSkgPT4ge1xuICAgICAgICAgIHZvaWQgc2VuZE1vZGVscyhnYXRld2F5LCByZXF1ZXN0LCByZXNwb25zZSk7XG4gICAgICAgIH0pO1xuICAgICAgICBmb3IgKGNvbnN0IFtwYXRoLCBwcm90b2NvbF0gb2YgW1xuICAgICAgICAgIFtcIi92MS9jaGF0L2NvbXBsZXRpb25zXCIsIFwib3BlbmFpLWNoYXRcIl0sXG4gICAgICAgICAgW1wiL3YxL3Jlc3BvbnNlc1wiLCBcIm9wZW5haS1yZXNwb25zZXNcIl0sXG4gICAgICAgICAgW1wiL3YxL21lc3NhZ2VzXCIsIFwiYW50aHJvcGljLW1lc3NhZ2VzXCJdLFxuICAgICAgICAgIFtcIi92MS9lbWJlZGRpbmdzXCIsIFwib3BlbmFpLWVtYmVkZGluZ3NcIl0sXG4gICAgICAgIF0gYXMgY29uc3QpIHtcbiAgICAgICAgICBhcHBsaWNhdGlvbi5wb3N0KHBhdGgsIChyZXF1ZXN0LCByZXNwb25zZSkgPT4ge1xuICAgICAgICAgICAgdm9pZCBzZW5kSW5mZXJlbmNlKGdhdGV3YXksIHByb3RvY29sLCByZXF1ZXN0LCByZXNwb25zZSk7XG4gICAgICAgICAgfSk7XG4gICAgICAgIH1cbiAgICAgIH0pO1xuICAgIH0sXG4gIH0pO1xufVxuIl19

package/lib/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/bootstrap.ts","../src/bun.ts","../src/cli.ts","../src/root.ts","../src/appkit/cli.ts","../src/appkit/env-export.ts","../src/auth/cli.ts","../src/auth/options.ts","../src/graphiti/cli.ts","../src/graphiti/options.ts","../src/lakebase-proxy/cancellation.ts","../src/lakebase-proxy/cli.ts","../src/lakebase-proxy/options.ts","../src/lakebase-proxy/protocol.ts","../src/lakebase-proxy/proxy.ts","../src/model-gateway/cli.ts","../src/model-gateway/server.ts","../src/tunnel/app.ts","../src/tunnel/cli.ts","../src/tunnel/options.ts","../src/tunnel/proxy.ts","../index.ts","../bin/dbx-graphiti.ts","../bin/dbx-lakebase-proxy.ts","../bin/dbx-model-gateway.ts","../bin/dbx-tools.ts"],"version":"5.9.3"}
+{"root":["../src/bootstrap.ts","../src/bun.ts","../src/cli.ts","../src/root.ts","../src/appkit/cli.ts","../src/appkit/env-export.ts","../src/auth/cli.ts","../src/auth/options.ts","../src/genie-code/cli.ts","../src/genie-code/config.ts","../src/genie-code/install.ts","../src/genie-code/options.ts","../src/genie-code/runner.ts","../src/genie-code/runtime.ts","../src/graphiti/cli.ts","../src/graphiti/options.ts","../src/lakebase-proxy/cancellation.ts","../src/lakebase-proxy/cli.ts","../src/lakebase-proxy/options.ts","../src/lakebase-proxy/protocol.ts","../src/lakebase-proxy/proxy.ts","../src/model-gateway/cli.ts","../src/model-gateway/server.ts","../src/tunnel/app.ts","../src/tunnel/cli.ts","../src/tunnel/options.ts","../src/tunnel/proxy.ts","../index.ts","../bin/dbx-genie.ts","../bin/dbx-graphiti.ts","../bin/dbx-lakebase-proxy.ts","../bin/dbx-model-gateway.ts","../bin/dbx-tools.ts"],"version":"5.9.3"}

package/package.json

@@ -8,6 +8,7 @@
   },
   "bin": {
     "dbx": "./lib/bin/dbx-tools.js",
+    "dbx-genie": "./lib/bin/dbx-genie.js",
     "dbx-graphiti": "./lib/bin/dbx-graphiti.js",
     "dbx-lakebase-proxy": "./lib/bin/dbx-lakebase-proxy.js",
     "dbx-model-gateway": "./lib/bin/dbx-model-gateway.js",
@@ -33,26 +34,30 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@databricks/appkit": "0.81.0",
-    "@dbx-tools/appkit": "^0.9.60",
-    "@dbx-tools/appkit-model-gateway": "^0.9.60",
-    "@dbx-tools/auth": "^0.9.60",
-    "@dbx-tools/auth-gate": "^0.9.60",
-    "@dbx-tools/cli-args": "^0.9.60",
-    "@dbx-tools/cli-service": "^0.9.60",
-    "@dbx-tools/core": "^0.9.60",
-    "@dbx-tools/databricks": "^0.9.60",
-    "@dbx-tools/email": "^0.9.60",
-    "@dbx-tools/graphiti": "^0.9.60",
-    "@dbx-tools/lakebase": "^0.9.60",
-    "@dbx-tools/postgres": "^0.9.60",
-    "@dbx-tools/shared-auth": "^0.9.60",
-    "@dbx-tools/shared-core": "^0.9.60",
-    "@dbx-tools/shared-email": "^0.9.60",
-    "@dbx-tools/shared-model-gateway": "^0.9.60",
-    "@dbx-tools/tunnel": "^0.9.60",
+    "@dbx-tools/appkit": "^0.9.64",
+    "@dbx-tools/appkit-model-gateway": "^0.9.64",
+    "@dbx-tools/auth": "^0.9.64",
+    "@dbx-tools/auth-gate": "^0.9.64",
+    "@dbx-tools/cli-args": "^0.9.64",
+    "@dbx-tools/cli-service": "^0.9.64",
+    "@dbx-tools/core": "^0.9.64",
+    "@dbx-tools/databricks": "^0.9.64",
+    "@dbx-tools/email": "^0.9.64",
+    "@dbx-tools/graphiti": "^0.9.64",
+    "@dbx-tools/lakebase": "^0.9.64",
+    "@dbx-tools/postgres": "^0.9.64",
+    "@dbx-tools/shared-auth": "^0.9.64",
+    "@dbx-tools/shared-core": "^0.9.64",
+    "@dbx-tools/shared-email": "^0.9.64",
+    "@dbx-tools/shared-genie-code": "^0.9.64",
+    "@dbx-tools/shared-model-gateway": "^0.9.64",
+    "@dbx-tools/tunnel": "^0.9.64",
     "commander": "^15.0.0",
+    "concurrently": "^10.0.3",
+    "get-port": "^7.1.0",
     "http-proxy-3": "^1.23.1",
     "pg": "^8.22.0",
+    "smol-toml": "1.8.0",
     "zod": "4.3.6"
   },
   "main": "./lib/index.js",
@@ -63,6 +68,7 @@
     "types": "./lib/index.d.ts",
     "bin": {
       "dbx": "./lib/bin/dbx-tools.js",
+      "dbx-genie": "./lib/bin/dbx-genie.js",
       "dbx-graphiti": "./lib/bin/dbx-graphiti.js",
       "dbx-lakebase-proxy": "./lib/bin/dbx-lakebase-proxy.js",
       "dbx-model-gateway": "./lib/bin/dbx-model-gateway.js",
@@ -113,6 +119,14 @@
         "types": "./lib/src/graphiti/options.d.ts",
         "default": "./lib/src/graphiti/options.js"
       },
+      "./genie": {
+        "types": "./lib/src/genie-code/cli.d.ts",
+        "default": "./lib/src/genie-code/cli.js"
+      },
+      "./genie/options": {
+        "types": "./lib/src/genie-code/options.d.ts",
+        "default": "./lib/src/genie-code/options.js"
+      },
       "./lakebase-proxy": {
         "types": "./lib/src/lakebase-proxy/cli.d.ts",
         "default": "./lib/src/lakebase-proxy/cli.js"
@@ -140,7 +154,7 @@
       "./package.json": "./package.json"
     }
   },
-  "version": "0.9.60",
+  "version": "0.9.64",
   "types": "./lib/index.d.ts",
   "dbxToolsConfig": {
     "tags": [
@@ -193,6 +207,14 @@
       "types": "./lib/src/graphiti/options.d.ts",
       "default": "./lib/src/graphiti/options.js"
     },
+    "./genie": {
+      "types": "./lib/src/genie-code/cli.d.ts",
+      "default": "./lib/src/genie-code/cli.js"
+    },
+    "./genie/options": {
+      "types": "./lib/src/genie-code/options.d.ts",
+      "default": "./lib/src/genie-code/options.js"
+    },
     "./lakebase-proxy": {
       "types": "./lib/src/lakebase-proxy/cli.d.ts",
       "default": "./lib/src/lakebase-proxy/cli.js"

package/src/auth/cli.ts

@@ -123,10 +123,20 @@ export function buildProgram(
         ...(tokenOptions.login ? {} : { login: false }),
         ...(tokenOptions.forceRefresh ? { refresh: true } : {}),
       });
-      dependencies.writeJson(tokenJson(token));
+      if (tokenOptions.format === "text") dependencies.writeText(token.accessToken);
+      else dependencies.writeJson(tokenJson(token));
     });
   });
 
+  program
+    .command("headers")
+    .description("Return current Databricks authentication headers")
+    .action(async () => {
+      await withAuth(options(), dependencies, async ({ auth }) => {
+        dependencies.writeJson(await auth.headers());
+      });
+    });
+
   program
     .command("profile")
     .description("Print the configured or automatically detected profile")

package/src/auth/options.ts

@@ -48,6 +48,10 @@ export const TokenCommandOptionsSchema = z
   .object({
     forceRefresh: z.boolean().default(false).describe("Refresh the token before returning it."),
     login: z.boolean().default(true).describe("Log in when credentials are missing or invalid."),
+    format: z
+      .enum(["json", "text"])
+      .default("json")
+      .describe("Output structured token metadata or only the access token."),
   })
   .strict()
   .describe("Options for returning a Databricks access token.");

package/src/cli.ts

@@ -59,8 +59,9 @@ export async function prepareAndRunProjen(projenArgs: string[], startDir?: strin
 /**
  * Mount `name` as a command that captures every following token verbatim and
  * hands it to the program `load()` resolves. `helpOption(false)` is what lets
- * `--help` through to the child instead of being answered here, and the child
- * program owns its own flags, so this wrapper never has to restate them.
+ * `--help` through to the child instead of being answered here, and
+ * `passThroughOptions()` keeps unknown flags in that token list so the child
+ * program owns them.
  */
 function addForwardedCommand(
   program: Command,
@@ -73,6 +74,7 @@ function addForwardedCommand(
     .description(description)
     .argument("[args...]", `arguments forwarded to ${name}`)
     .allowUnknownOption()
+    .passThroughOptions()
     .allowExcessArguments()
     .helpOption(false)
     .action(async (args: string[]) => {
@@ -88,6 +90,7 @@ export function buildProgram(name: string = PROGRAM_NAMES[0]): Command {
     .description(
       "Databricks developer tools: workspace lifecycle, AppKit env, auth, tunnels, and local proxies",
     )
+    .enablePositionalOptions()
     .showHelpAfterError()
     .helpOption("-h, --help", `Show ${name} help`);
 
@@ -137,6 +140,13 @@ export function buildProgram(name: string = PROGRAM_NAMES[0]): Command {
     async () => (await import("./model-gateway/cli.ts")).buildProgram,
   );
 
+  addForwardedCommand(
+    program,
+    "genie",
+    "Run managed Genie Code through a local Databricks model gateway",
+    async () => (await import("./genie-code/cli.ts")).buildProgram,
+  );
+
   addForwardedCommand(
     program,
     "graphiti",
@@ -150,16 +160,17 @@ export function buildProgram(name: string = PROGRAM_NAMES[0]): Command {
 /** Build the complete command tree used for generated documentation. */
 export async function buildDocumentationProgram(name: string = PROGRAM_NAMES[0]): Promise<Command> {
   const program = buildProgram(name);
-  (program.commands as Command[]).splice(
-    1,
-    program.commands.length - 1,
+  const children = [
     (await import("./appkit/cli.ts")).buildProgram("appkit"),
     (await import("./auth/cli.ts")).buildProgram("auth"),
     (await import("./tunnel/cli.ts")).buildProgram("tunnel"),
     (await import("./lakebase-proxy/cli.ts")).buildProgram("lakebase-proxy"),
     (await import("./model-gateway/cli.ts")).buildProgram("model-gateway"),
+    (await import("./genie-code/cli.ts")).buildProgram("genie"),
     (await import("./graphiti/cli.ts")).buildProgram("graphiti"),
-  );
+  ];
+  (program.commands as Command[]).splice(1, program.commands.length - 1);
+  for (const child of children) program.addCommand(child);
   return program;
 }
 

package/src/genie-code/cli.ts

@@ -0,0 +1,58 @@
+/**
+ * Managed `dbx genie` command.
+ *
+ * @module
+ */
+
+import { addArgs, parseArgs } from "@dbx-tools/cli-args";
+import { Command } from "commander";
+
+import { GenieCodeCliOptionsSchema, type GenieCodeCliOptions } from "./options.ts";
+import { runGenieCode } from "./runtime.ts";
+
+/** Injectable managed Genie execution boundary for parser tests and embedding. */
+export interface GenieCodeCliDependencies {
+  run(input: {
+    cwd: string;
+    genieArgs: readonly string[];
+    options: GenieCodeCliOptions;
+  }): Promise<void>;
+}
+
+const DEFAULT_DEPENDENCIES: GenieCodeCliDependencies = {
+  run: runGenieCode,
+};
+
+/** Build the managed Genie Code command without executing it. */
+export function buildProgram(
+  name = "dbx genie",
+  dependencies: GenieCodeCliDependencies = DEFAULT_DEPENDENCIES,
+): Command {
+  const program = addArgs(
+    new Command()
+      .name(name)
+      .description("Run Genie Code through an authenticated local Databricks model gateway")
+      .argument(
+        "[genieArgs...]",
+        "arguments and unknown flags forwarded to Genie Code; wrapper options may be separated with --",
+      )
+      .allowUnknownOption()
+      .passThroughOptions()
+      .allowExcessArguments()
+      .showHelpAfterError(),
+    GenieCodeCliOptionsSchema,
+  );
+  program.action(async (genieArgs: string[]) => {
+    await dependencies.run({
+      cwd: process.cwd(),
+      genieArgs,
+      options: parseArgs(program, GenieCodeCliOptionsSchema),
+    });
+  });
+  return program;
+}
+
+/** Parse argv and run managed Genie Code. */
+export async function runCli(argv: string[]): Promise<void> {
+  await buildProgram().parseAsync(argv);
+}

package/src/genie-code/config.ts

@@ -0,0 +1,157 @@
+/**
+ * Generate one persistent Genie Code home per exact profile-model pairing.
+ *
+ * @module
+ */
+
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { withFileLock } from "@dbx-tools/core/file-lock";
+import { object } from "@dbx-tools/shared-core";
+import {
+  GenieCodeBaseConfigSchema,
+  GenieCodeConfigSchema,
+  GenieCodeProviderOverlaySchema,
+  type GenieCodeBaseConfig,
+  type GenieCodeConfig,
+  type GenieCodeProviderOverlay,
+} from "@dbx-tools/shared-genie-code/config";
+import { genieCodeHomeName } from "@dbx-tools/shared-genie-code/options";
+import { parse, stringify } from "smol-toml";
+
+/** Provider identifier written to the base and invocation overlay configurations. */
+export const GENIE_CODE_GATEWAY_PROVIDER = "dbx_tools_model_gateway";
+
+/** Inputs used to update a persistent home and create one invocation overlay. */
+export interface WriteGenieCodeConfigOptions {
+  bearerToken: string;
+  gatewayBaseUrl: string;
+  homeDirectory?: string;
+  model: string;
+  profile: string;
+  projectDirectory: string;
+}
+
+/** Stable persistent home for one exact Databricks profile. */
+export interface GenieCodeProfileHome {
+  configPath: string;
+  home: string;
+  name: string;
+}
+
+/** Persistent profile home and invocation-specific model-provider overlay. */
+export interface GenieCodeHome extends GenieCodeProfileHome {
+  overlayName: string;
+  overlayPath: string;
+}
+
+/** Derive the stable home for one exact Databricks profile. */
+export function genieCodeHome(
+  profile: string,
+  homeDirectory: string = homedir(),
+): GenieCodeProfileHome {
+  const digest = createHash("sha256").update(profile).digest("hex").slice(0, 12);
+  const name = genieCodeHomeName({ profile, digest });
+  const home = join(homeDirectory, ".dbx-tools", "genie", "profiles", name);
+  return { name, home, configPath: join(home, "config.toml") };
+}
+
+/** Render the persistent profile-model configuration. */
+export function genieCodeBaseConfig(
+  options: WriteGenieCodeConfigOptions,
+  existingProjects: Readonly<Record<string, unknown>> = {},
+): GenieCodeBaseConfig {
+  const projects = Object.fromEntries(
+    Object.entries(existingProjects).filter(
+      ([, value]) => object.isRecord(value) && value.trust_level === "trusted",
+    ),
+  );
+  return GenieCodeBaseConfigSchema.parse({
+    databricks_profile: options.profile,
+    projects: {
+      ...projects,
+      [resolve(options.projectDirectory)]: {
+        trust_level: "trusted",
+      },
+    },
+  });
+}
+
+/** Render the invocation-specific guarded provider configuration. */
+export function genieCodeProviderOverlay(
+  options: WriteGenieCodeConfigOptions,
+): GenieCodeProviderOverlay {
+  return GenieCodeProviderOverlaySchema.parse({
+    model_provider: GENIE_CODE_GATEWAY_PROVIDER,
+    model: options.model,
+    model_providers: {
+      [GENIE_CODE_GATEWAY_PROVIDER]: {
+        name: "dbx-tools model gateway",
+        base_url: options.gatewayBaseUrl,
+        wire_api: "responses",
+        requires_openai_auth: false,
+        supports_websockets: false,
+        http_headers: {
+          Authorization: `Bearer ${options.bearerToken}`,
+          Originator: "codex",
+        },
+      },
+    },
+    tui: {
+      model_availability_nux: {
+        [options.model]: 1,
+      },
+    },
+  });
+}
+
+/** Render the merged configuration used by validation and tests. */
+export function genieCodeConfig(options: WriteGenieCodeConfigOptions): GenieCodeConfig {
+  return GenieCodeConfigSchema.parse({
+    ...genieCodeBaseConfig(options),
+    ...genieCodeProviderOverlay(options),
+  });
+}
+
+async function existingProjects(path: string): Promise<Record<string, unknown>> {
+  try {
+    const value = parse(await readFile(path, "utf8"));
+    return object.isRecord(value.projects) ? value.projects : {};
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") return {};
+    throw error;
+  }
+}
+
+async function writePrivateToml(path: string, value: unknown): Promise<void> {
+  const staged = join(dirname(path), `.${randomUUID()}.toml`);
+  try {
+    await writeFile(staged, stringify(value), { mode: 0o600 });
+    await chmod(staged, 0o600);
+    await rename(staged, path);
+  } finally {
+    await rm(staged, { force: true });
+  }
+}
+
+/** Update the persistent base config and write one private invocation overlay. */
+export async function writeGenieCodeConfig(
+  options: WriteGenieCodeConfigOptions,
+): Promise<GenieCodeHome> {
+  const base = genieCodeHome(options.profile, options.homeDirectory);
+  const overlayName = `dbx-${randomUUID().replaceAll("-", "")}`;
+  const destination = {
+    ...base,
+    overlayName,
+    overlayPath: join(base.home, `${overlayName}.config.toml`),
+  };
+  await mkdir(destination.home, { recursive: true });
+  await withFileLock(["genie-code-config", destination.configPath], async () => {
+    const projects = await existingProjects(destination.configPath);
+    await writePrivateToml(destination.configPath, genieCodeBaseConfig(options, projects));
+  });
+  await writePrivateToml(destination.overlayPath, genieCodeProviderOverlay(options));
+  return destination;
+}

package/src/genie-code/install.ts

@@ -0,0 +1,103 @@
+/**
+ * Install the pinned multi-file Genie Code runtime under dbx-tools ownership.
+ *
+ * @module
+ */
+
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { bin } from "@dbx-tools/core";
+import { GENIE_CODE_VERSION } from "@dbx-tools/shared-genie-code/options";
+
+interface GenieCodeAsset {
+  target: string;
+  sha256: string;
+}
+
+const GENIE_CODE_ASSETS = {
+  "darwin:arm64": {
+    target: "aarch64-apple-darwin",
+    sha256: "78cc7e358c8bfc62d6da26364c762be37fc2e2a10b7e83f21a3b166f901f528e",
+  },
+  "darwin:x64": {
+    target: "x86_64-apple-darwin",
+    sha256: "2021b8b27ec3116fc015c1676b5f65c3ce11d57f1dff9c302aae135f6e4f1a5f",
+  },
+  "linux:arm64": {
+    target: "aarch64-unknown-linux-musl",
+    sha256: "dfd278c267dde43e1fe7e7d7a0da8d7a1a148cdf3d2004bd30b351645c4fe0a7",
+  },
+  "linux:x64": {
+    target: "x86_64-unknown-linux-musl",
+    sha256: "e3d9a55f6d51bdc745eda4744fb827ba1df6dacf1069518f7347a59f48c89430",
+  },
+  "win32:arm64": {
+    target: "aarch64-pc-windows-msvc",
+    sha256: "aeac95bd0148f942194270ba932245cec32e98da67292ba7b008bcab675ba7f8",
+  },
+  "win32:x64": {
+    target: "x86_64-pc-windows-msvc",
+    sha256: "c9f92c8d60273250262527bca525451501c4e8351e59927a1686c305be29a922",
+  },
+} as const satisfies Record<string, GenieCodeAsset>;
+
+/** Host overrides used by installation tests and embedded callers. */
+export interface InstallGenieCodeOptions {
+  homeDirectory?: string;
+  platform?: NodeJS.Platform;
+  architecture?: NodeJS.Architecture;
+}
+
+/** Resolve the pinned release asset for one supported host. */
+export function genieCodeAsset(
+  platform: NodeJS.Platform = process.platform,
+  architecture: NodeJS.Architecture = process.arch,
+): GenieCodeAsset {
+  const asset = GENIE_CODE_ASSETS[`${platform}:${architecture}` as keyof typeof GENIE_CODE_ASSETS];
+  if (!asset) {
+    throw new Error(
+      `Genie Code ${GENIE_CODE_VERSION} does not support ${platform}/${architecture}`,
+    );
+  }
+  return asset;
+}
+
+/** Install and return the shared Genie Code package entrypoint. */
+export async function installGenieCode(
+  options: InstallGenieCodeOptions = {},
+): Promise<bin.BinContext> {
+  const platform = options.platform ?? process.platform;
+  const asset = genieCodeAsset(platform, options.architecture ?? process.arch);
+  const executable = platform === "win32" ? "genie.exe" : "genie";
+  const helper = platform === "win32" ? "genie-code-mode-host.exe" : "genie-code-mode-host";
+  const entrypoint = join("bin", executable);
+  const root = join(
+    options.homeDirectory ?? homedir(),
+    ".dbx-tools",
+    "genie",
+    "releases",
+    `${GENIE_CODE_VERSION}-${asset.target}`,
+  );
+  const destination: bin.BinContext = {
+    root,
+    binDir: join(root, dirname(entrypoint)),
+    path: join(root, entrypoint),
+  };
+  const url =
+    `https://github.com/databricks/genie-code-cli/releases/download/v${GENIE_CODE_VERSION}/` +
+    `genie-package-${asset.target}.tar.gz`;
+  return bin.ensure(
+    "genie",
+    { url, sha256: asset.sha256 },
+    {
+      destination,
+      minVersion: "0.1.0",
+      versionParser: ({ stdout }) =>
+        stdout.trim() === `genie ${GENIE_CODE_VERSION}` ? "0.1.0" : undefined,
+      package: {
+        entrypoint,
+        requiredPaths: ["genie-package.json", join("bin", helper), "genie-path", "genie-resources"],
+      },
+    },
+  );
+}