@dmrlzz/davecode 0.4.0 → 0.5.1

package/dist/{ChatApp-BO7QMBWD.js → ChatApp-YMHKIAAH.js}

@@ -1,10 +1,10 @@
 import {
   formatTaskTree,
   summaryLine
-} from "./chunk-MOK5D3XJ.js";
+} from "./chunk-6SHOBL2X.js";
 import {
   brandBanner
-} from "./chunk-ROIUTNQV.js";
+} from "./chunk-K5AA65RS.js";
 import {
   Spinner
 } from "./chunk-5LKOJBUL.js";
@@ -15,7 +15,7 @@ import {
 import {
   emptyUsage,
   renderAccounts
-} from "./chunk-GZJ6JSO7.js";
+} from "./chunk-ZNUNYYN6.js";
 import {
   bar,
   formatTokens,
@@ -25,9 +25,9 @@ import {
   visibleWidth
 } from "./chunk-SF5ZEAP4.js";
 import "./chunk-QA3O6RA2.js";
-import "./chunk-DZ2FDABF.js";
+import "./chunk-JFWMLYV7.js";
 import "./chunk-7XVXEO7U.js";
-import "./chunk-3Q2KCXLN.js";
+import "./chunk-HENE4DA6.js";
 import "./chunk-MC7RIPL7.js";
 
 // src/tui/ChatApp.tsx
@@ -1042,4 +1042,4 @@ function ChatApp(props) {
 export {
   ChatApp
 };
-//# sourceMappingURL=ChatApp-BO7QMBWD.js.map
+//# sourceMappingURL=ChatApp-YMHKIAAH.js.map

package/dist/{account-UGNLJPQ4.js → account-5QFYCVYM.js}

@@ -7,9 +7,9 @@ import {
   loginCommand,
   logoutCommand,
   signIn
-} from "./chunk-GHDOUII5.js";
+} from "./chunk-IOATP7KH.js";
 import "./chunk-7XVXEO7U.js";
-import "./chunk-3Q2KCXLN.js";
+import "./chunk-HENE4DA6.js";
 export {
   accountCommand,
   accountsEnabled,
@@ -20,4 +20,4 @@ export {
   logoutCommand,
   signIn
 };
-//# sourceMappingURL=account-UGNLJPQ4.js.map
+//# sourceMappingURL=account-5QFYCVYM.js.map

package/dist/{accounts-NM7IWP53.js → accounts-756BMMAL.js}

@@ -11,14 +11,14 @@ import {
   loginArgs,
   renderAccountList,
   subscriptionFromFlags
-} from "./chunk-CWBVNS3L.js";
-import "./chunk-Z6NQDJEN.js";
+} from "./chunk-JSRPO2AR.js";
+import "./chunk-6WUVR3R2.js";
 import "./chunk-IC3TDONV.js";
 import "./chunk-SF5ZEAP4.js";
 import "./chunk-QA3O6RA2.js";
-import "./chunk-DZ2FDABF.js";
+import "./chunk-JFWMLYV7.js";
 import "./chunk-7XVXEO7U.js";
-import "./chunk-3Q2KCXLN.js";
+import "./chunk-HENE4DA6.js";
 import "./chunk-MC7RIPL7.js";
 export {
   accountsAdd,
@@ -34,4 +34,4 @@ export {
   renderAccountList,
   subscriptionFromFlags
 };
-//# sourceMappingURL=accounts-NM7IWP53.js.map
+//# sourceMappingURL=accounts-756BMMAL.js.map

package/dist/{budget-INAW6FXD.js → budget-PGSNCVVK.js}

@@ -1,6 +1,6 @@
 import {
   openAccounts
-} from "./chunk-Z6NQDJEN.js";
+} from "./chunk-6WUVR3R2.js";
 import {
   bar,
   levelStyle,
@@ -13,11 +13,11 @@ import {
 } from "./chunk-QA3O6RA2.js";
 import {
   detectProjectRoot
-} from "./chunk-DZ2FDABF.js";
+} from "./chunk-JFWMLYV7.js";
 import {
   EXIT
 } from "./chunk-7XVXEO7U.js";
-import "./chunk-3Q2KCXLN.js";
+import "./chunk-HENE4DA6.js";
 import "./chunk-MC7RIPL7.js";
 
 // src/commands/budget.ts
@@ -112,4 +112,4 @@ export {
   budgetCommand,
   renderBudget
 };
-//# sourceMappingURL=budget-INAW6FXD.js.map
+//# sourceMappingURL=budget-PGSNCVVK.js.map

package/dist/{chat-U4QJQ7M6.js → chat-D3T4YG5D.js}

@@ -4,19 +4,19 @@ import {
   currentAccount,
   describeUser,
   signIn
-} from "./chunk-GHDOUII5.js";
+} from "./chunk-IOATP7KH.js";
 import {
   accountsLogin
-} from "./chunk-CWBVNS3L.js";
+} from "./chunk-JSRPO2AR.js";
 import {
   openAccounts
-} from "./chunk-Z6NQDJEN.js";
+} from "./chunk-6WUVR3R2.js";
 import {
   PromptCancelledError
 } from "./chunk-IC3TDONV.js";
 import {
   brandBanner
-} from "./chunk-ROIUTNQV.js";
+} from "./chunk-K5AA65RS.js";
 import "./chunk-SF5ZEAP4.js";
 import {
   readPreferences,
@@ -28,7 +28,7 @@ import {
   findGateway,
   startRuntime,
   which
-} from "./chunk-DZ2FDABF.js";
+} from "./chunk-JFWMLYV7.js";
 import {
   CliError,
   EXIT
@@ -38,7 +38,7 @@ import {
   VERSION,
   loadConfig,
   writeGlobalRouting
-} from "./chunk-3Q2KCXLN.js";
+} from "./chunk-HENE4DA6.js";
 import {
   createTheme
 } from "./chunk-MC7RIPL7.js";
@@ -328,7 +328,7 @@ async function runChat(ctx, opts, projectRoot) {
     const [{ render }, { createElement }, { ChatApp }] = await Promise.all([
       import("ink"),
       import("react"),
-      import("./ChatApp-BO7QMBWD.js")
+      import("./ChatApp-YMHKIAAH.js")
     ]);
     const instance = render(
       createElement(ChatApp, {
@@ -356,4 +356,4 @@ async function runChat(ctx, opts, projectRoot) {
 export {
   chatCommand
 };
-//# sourceMappingURL=chat-U4QJQ7M6.js.map
+//# sourceMappingURL=chat-D3T4YG5D.js.map

package/dist/{chunk-MOK5D3XJ.js → chunk-6SHOBL2X.js}

@@ -7,7 +7,7 @@ import {
   nextTask,
   summarize,
   topologicalOrder
-} from "./chunk-3Q2KCXLN.js";
+} from "./chunk-HENE4DA6.js";
 
 // src/lib/task-tree.ts
 function statusGlyph(theme, task, blocked) {
@@ -111,4 +111,4 @@ export {
   formatTaskTree,
   formatTaskDetail
 };
-//# sourceMappingURL=chunk-MOK5D3XJ.js.map
+//# sourceMappingURL=chunk-6SHOBL2X.js.map

package/dist/{chunk-Z6NQDJEN.js → chunk-6WUVR3R2.js}

@@ -2,13 +2,14 @@ import {
   accountCreateSchema,
   accountPatchSchema,
   findGateway
-} from "./chunk-DZ2FDABF.js";
+} from "./chunk-JFWMLYV7.js";
 import {
   CliError
 } from "./chunk-7XVXEO7U.js";
 import {
-  createEngine
-} from "./chunk-3Q2KCXLN.js";
+  createEngine,
+  endpointRebindIssue
+} from "./chunk-HENE4DA6.js";
 
 // src/lib/accounts-backend.ts
 import { z } from "zod";
@@ -53,6 +54,11 @@ var LocalAccounts = class {
     const existing = this.engine.accounts.get(id);
     if (!existing) throw notFound(id);
     const { secret, ...fields } = parsed.data;
+    const rebind = endpointRebindIssue(existing, fields.config, secret !== void 0);
+    if (rebind)
+      throw new CliError(rebind, {
+        hint: "Pass the key again with --secret-env or --secret-stdin."
+      });
     const update = { ...fields };
     const enabled = fields.enabled ?? existing.enabled;
     if (!enabled) {
@@ -177,4 +183,4 @@ export {
   openAccounts,
   resolveAccount
 };
-//# sourceMappingURL=chunk-Z6NQDJEN.js.map
+//# sourceMappingURL=chunk-6WUVR3R2.js.map

package/dist/chunk-6WUVR3R2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/accounts-backend.ts"],"sourcesContent":["import {\n  type Account,\n  type AccountConnection,\n  type AccountUpdateInput,\n  type BudgetSnapshot,\n  createEngine,\n  type DaveConfig,\n  type Engine,\n  endpointRebindIssue,\n  type ProviderKind,\n  type QuotaLimits,\n  type SubscriptionInfo,\n} from '@davecode/core';\nimport { accountCreateSchema, accountPatchSchema } from '@davecode/server';\nimport { z } from 'zod';\nimport { findGateway, type GatewayClient } from '../client';\nimport { CliError } from '../errors';\n\n/** Body of `POST /api/accounts` (secret is write-only). */\nexport interface AccountCreate {\n  provider: ProviderKind;\n  label: string;\n  enabled?: boolean;\n  priority?: number;\n  weight?: number;\n  limits?: QuotaLimits;\n  config?: Record<string, unknown>;\n  subscription?: SubscriptionInfo;\n  secret?: string;\n}\n\nexport type AccountPatch = Partial<Omit<AccountCreate, 'provider' | 'subscription'>> & {\n  /** Replaces the subscription details; `null` clears them. */\n  subscription?: SubscriptionInfo | null;\n};\n\n/**\n * Account operations against a running gateway (so the dashboard sees the change live) or, when\n * none is running, directly against `state.db` with the same validation and audit trail.\n */\nexport interface AccountsBackend {\n  readonly kind: 'gateway' | 'local';\n  readonly config: DaveConfig;\n  list(): Promise<Account[]>;\n  get(id: string): Promise<Account | undefined>;\n  create(input: AccountCreate): Promise<Account>;\n  update(id: string, patch: AccountPatch): Promise<Account>;\n  remove(id: string): Promise<void>;\n  /** Subscription details and remaining capacity per account. */\n  budget(): Promise<BudgetSnapshot>;\n  /** Whether the account's API key or vendor CLI login is in place. */\n  connection(id: string): Promise<AccountConnection>;\n  close(): void;\n}\n\nfunction invalid(error: z.ZodError): CliError {\n  return new CliError(`Invalid account: ${z.prettifyError(error)}`);\n}\n\nexport class LocalAccounts implements AccountsBackend {\n  readonly kind = 'local' as const;\n\n  constructor(readonly engine: Engine) {}\n\n  get config(): DaveConfig {\n    return this.engine.config;\n  }\n\n  async list(): Promise<Account[]> {\n    return this.engine.accounts.list();\n  }\n\n  async get(id: string): Promise<Account | undefined> {\n    return this.engine.accounts.get(id);\n  }\n\n  async create(input: AccountCreate): Promise<Account> {\n    const parsed = accountCreateSchema.safeParse(input);\n    if (!parsed.success) throw invalid(parsed.error);\n    const { secret, ...fields } = parsed.data;\n    const { accounts, keyring, audit, db } = this.engine;\n    return db.transaction(() => {\n      const created = accounts.create(fields);\n      if (secret !== undefined) keyring.set(created.id, secret);\n      audit.record({\n        actor: 'cli',\n        action: 'account.create',\n        target: created.id,\n        details: { provider: created.provider, label: created.label, hasSecret: !!secret },\n      });\n      return created;\n    })();\n  }\n\n  async update(id: string, patch: AccountPatch): Promise<Account> {\n    const parsed = accountPatchSchema.safeParse(patch);\n    if (!parsed.success) throw invalid(parsed.error);\n    const existing = this.engine.accounts.get(id);\n    if (!existing) throw notFound(id);\n    const { secret, ...fields } = parsed.data;\n    // The machine's owner may set any config key, but a stored secret still never follows an\n    // account to a different endpoint without being supplied again.\n    const rebind = endpointRebindIssue(existing, fields.config, secret !== undefined);\n    if (rebind)\n      throw new CliError(rebind, {\n        hint: 'Pass the key again with --secret-env or --secret-stdin.',\n      });\n    const update: AccountUpdateInput = { ...fields };\n    const enabled = fields.enabled ?? existing.enabled;\n    if (!enabled) {\n      update.status = 'disabled';\n    } else if (fields.enabled === true || secret !== undefined) {\n      update.status = 'active';\n      update.cooldownUntil = null;\n      update.lastError = null;\n    }\n    const { accounts, keyring, audit, db } = this.engine;\n    return db.transaction(() => {\n      const updated = accounts.update(id, update)!;\n      if (secret !== undefined) keyring.set(id, secret);\n      audit.record({\n        actor: 'cli',\n        action: 'account.update',\n        target: id,\n        details: { fields: Object.keys(fields), secretChanged: secret !== undefined },\n      });\n      return updated;\n    })();\n  }\n\n  async remove(id: string): Promise<void> {\n    const { accounts, sandboxes, chromium, audit } = this.engine;\n    if (!accounts.delete(id)) throw notFound(id);\n    for (const cleanup of [() => sandboxes.remove(id), () => chromium.remove(id)]) {\n      try {\n        cleanup();\n      } catch {\n        // A leftover directory is harmless; the account row is gone.\n      }\n    }\n    audit.record({ actor: 'cli', action: 'account.delete', target: id });\n  }\n\n  /** Quota windows are rebuilt from state.db; provider-reported limits live in the gateway only. */\n  async budget(): Promise<BudgetSnapshot> {\n    return this.engine.budget.snapshot();\n  }\n\n  async connection(id: string): Promise<AccountConnection> {\n    const account = this.engine.accounts.get(id);\n    if (!account) throw notFound(id);\n    return this.engine.connections.check(account);\n  }\n\n  close(): void {\n    this.engine.close();\n  }\n}\n\nexport class GatewayAccounts implements AccountsBackend {\n  readonly kind = 'gateway' as const;\n\n  constructor(\n    readonly client: GatewayClient,\n    readonly config: DaveConfig,\n  ) {}\n\n  async list(): Promise<Account[]> {\n    return (await this.client.get<{ accounts: Account[] }>('/api/accounts')).accounts;\n  }\n\n  async get(id: string): Promise<Account | undefined> {\n    return (await this.list()).find((a) => a.id === id);\n  }\n\n  async create(input: AccountCreate): Promise<Account> {\n    return (await this.client.post<{ account: Account }>('/api/accounts', input)).account;\n  }\n\n  async update(id: string, patch: AccountPatch): Promise<Account> {\n    return (\n      await this.client.patch<{ account: Account }>(\n        `/api/accounts/${encodeURIComponent(id)}`,\n        patch,\n      )\n    ).account;\n  }\n\n  async remove(id: string): Promise<void> {\n    await this.client.delete(`/api/accounts/${encodeURIComponent(id)}`);\n  }\n\n  async budget(): Promise<BudgetSnapshot> {\n    return (await this.client.get<{ budget: BudgetSnapshot }>('/api/budget')).budget;\n  }\n\n  async connection(id: string): Promise<AccountConnection> {\n    return (\n      await this.client.get<{ connection: AccountConnection }>(\n        `/api/accounts/${encodeURIComponent(id)}/connection`,\n      )\n    ).connection;\n  }\n\n  close(): void {}\n}\n\nfunction notFound(id: string): CliError {\n  return new CliError(`No account with id ${JSON.stringify(id)}`, {\n    hint: 'List accounts with `davecode accounts list`.',\n  });\n}\n\n/** Prefer the running gateway; fall back to the local database. */\nexport async function openAccounts(options: {\n  home: string;\n  env: NodeJS.ProcessEnv;\n  projectRoot?: string;\n  /** Skip the gateway probe (tests, or `--local`). */\n  local?: boolean;\n}): Promise<AccountsBackend> {\n  const engine = createEngine({\n    home: options.home,\n    env: options.env,\n    ...(options.projectRoot ? { projectRoot: options.projectRoot } : {}),\n  });\n  if (!options.local) {\n    const gateway = await findGateway(engine.config).catch(() => undefined);\n    if (gateway) {\n      const config = engine.config;\n      engine.close();\n      return new GatewayAccounts(gateway.client, config);\n    }\n  }\n  return new LocalAccounts(engine);\n}\n\n/** Resolve an account by exact id, or by unique label/id prefix for convenience. */\nexport async function resolveAccount(backend: AccountsBackend, ref: string): Promise<Account> {\n  const accounts = await backend.list();\n  const exact = accounts.find((a) => a.id === ref);\n  if (exact) return exact;\n  const matches = accounts.filter(\n    (a) => a.label.toLowerCase() === ref.toLowerCase() || a.id.startsWith(ref),\n  );\n  if (matches.length === 1) return matches[0]!;\n  if (matches.length > 1) {\n    throw new CliError(`${JSON.stringify(ref)} matches ${matches.length} accounts`, {\n      hint: `Use the full id: ${matches.map((a) => a.id).join(', ')}`,\n    });\n  }\n  throw notFound(ref);\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,SAAS,SAAS;AAyClB,SAAS,QAAQ,OAA6B;AAC5C,SAAO,IAAI,SAAS,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE;AAClE;AAEO,IAAM,gBAAN,MAA+C;AAAA,EAGpD,YAAqB,QAAgB;AAAhB;AAAA,EAAiB;AAAA,EAAjB;AAAA,EAFZ,OAAO;AAAA,EAIhB,IAAI,SAAqB;AACvB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,MAAM,OAA2B;AAC/B,WAAO,KAAK,OAAO,SAAS,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,IAAI,IAA0C;AAClD,WAAO,KAAK,OAAO,SAAS,IAAI,EAAE;AAAA,EACpC;AAAA,EAEA,MAAM,OAAO,OAAwC;AACnD,UAAM,SAAS,oBAAoB,UAAU,KAAK;AAClD,QAAI,CAAC,OAAO,QAAS,OAAM,QAAQ,OAAO,KAAK;AAC/C,UAAM,EAAE,QAAQ,GAAG,OAAO,IAAI,OAAO;AACrC,UAAM,EAAE,UAAU,SAAS,OAAO,GAAG,IAAI,KAAK;AAC9C,WAAO,GAAG,YAAY,MAAM;AAC1B,YAAM,UAAU,SAAS,OAAO,MAAM;AACtC,UAAI,WAAW,OAAW,SAAQ,IAAI,QAAQ,IAAI,MAAM;AACxD,YAAM,OAAO;AAAA,QACX,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,QAAQ,QAAQ;AAAA,QAChB,SAAS,EAAE,UAAU,QAAQ,UAAU,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC,OAAO;AAAA,MACnF,CAAC;AACD,aAAO;AAAA,IACT,CAAC,EAAE;AAAA,EACL;AAAA,EAEA,MAAM,OAAO,IAAY,OAAuC;AAC9D,UAAM,SAAS,mBAAmB,UAAU,KAAK;AACjD,QAAI,CAAC,OAAO,QAAS,OAAM,QAAQ,OAAO,KAAK;AAC/C,UAAM,WAAW,KAAK,OAAO,SAAS,IAAI,EAAE;AAC5C,QAAI,CAAC,SAAU,OAAM,SAAS,EAAE;AAChC,UAAM,EAAE,QAAQ,GAAG,OAAO,IAAI,OAAO;AAGrC,UAAM,SAAS,oBAAoB,UAAU,OAAO,QAAQ,WAAW,MAAS;AAChF,QAAI;AACF,YAAM,IAAI,SAAS,QAAQ;AAAA,QACzB,MAAM;AAAA,MACR,CAAC;AACH,UAAM,SAA6B,EAAE,GAAG,OAAO;AAC/C,UAAM,UAAU,OAAO,WAAW,SAAS;AAC3C,QAAI,CAAC,SAAS;AACZ,aAAO,SAAS;AAAA,IAClB,WAAW,OAAO,YAAY,QAAQ,WAAW,QAAW;AAC1D,aAAO,SAAS;AAChB,aAAO,gBAAgB;AACvB,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,EAAE,UAAU,SAAS,OAAO,GAAG,IAAI,KAAK;AAC9C,WAAO,GAAG,YAAY,MAAM;AAC1B,YAAM,UAAU,SAAS,OAAO,IAAI,MAAM;AAC1C,UAAI,WAAW,OAAW,SAAQ,IAAI,IAAI,MAAM;AAChD,YAAM,OAAO;AAAA,QACX,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,OAAO,KAAK,MAAM,GAAG,eAAe,WAAW,OAAU;AAAA,MAC9E,CAAC;AACD,aAAO;AAAA,IACT,CAAC,EAAE;AAAA,EACL;AAAA,EAEA,MAAM,OAAO,IAA2B;AACtC,UAAM,EAAE,UAAU,WAAW,UAAU,MAAM,IAAI,KAAK;AACtD,QAAI,CAAC,SAAS,OAAO,EAAE,EAAG,OAAM,SAAS,EAAE;AAC3C,eAAW,WAAW,CAAC,MAAM,UAAU,OAAO,EAAE,GAAG,MAAM,SAAS,OAAO,EAAE,CAAC,GAAG;AAC7E,UAAI;AACF,gBAAQ;AAAA,MACV,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,OAAO,EAAE,OAAO,OAAO,QAAQ,kBAAkB,QAAQ,GAAG,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,MAAM,SAAkC;AACtC,WAAO,KAAK,OAAO,OAAO,SAAS;AAAA,EACrC;AAAA,EAEA,MAAM,WAAW,IAAwC;AACvD,UAAM,UAAU,KAAK,OAAO,SAAS,IAAI,EAAE;AAC3C,QAAI,CAAC,QAAS,OAAM,SAAS,EAAE;AAC/B,WAAO,KAAK,OAAO,YAAY,MAAM,OAAO;AAAA,EAC9C;AAAA,EAEA,QAAc;AACZ,SAAK,OAAO,MAAM;AAAA,EACpB;AACF;AAEO,IAAM,kBAAN,MAAiD;AAAA,EAGtD,YACW,QACA,QACT;AAFS;AACA;AAAA,EACR;AAAA,EAFQ;AAAA,EACA;AAAA,EAJF,OAAO;AAAA,EAOhB,MAAM,OAA2B;AAC/B,YAAQ,MAAM,KAAK,OAAO,IAA6B,eAAe,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAM,IAAI,IAA0C;AAClD,YAAQ,MAAM,KAAK,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AAAA,EACpD;AAAA,EAEA,MAAM,OAAO,OAAwC;AACnD,YAAQ,MAAM,KAAK,OAAO,KAA2B,iBAAiB,KAAK,GAAG;AAAA,EAChF;AAAA,EAEA,MAAM,OAAO,IAAY,OAAuC;AAC9D,YACE,MAAM,KAAK,OAAO;AAAA,MAChB,iBAAiB,mBAAmB,EAAE,CAAC;AAAA,MACvC;AAAA,IACF,GACA;AAAA,EACJ;AAAA,EAEA,MAAM,OAAO,IAA2B;AACtC,UAAM,KAAK,OAAO,OAAO,iBAAiB,mBAAmB,EAAE,CAAC,EAAE;AAAA,EACpE;AAAA,EAEA,MAAM,SAAkC;AACtC,YAAQ,MAAM,KAAK,OAAO,IAAgC,aAAa,GAAG;AAAA,EAC5E;AAAA,EAEA,MAAM,WAAW,IAAwC;AACvD,YACE,MAAM,KAAK,OAAO;AAAA,MAChB,iBAAiB,mBAAmB,EAAE,CAAC;AAAA,IACzC,GACA;AAAA,EACJ;AAAA,EAEA,QAAc;AAAA,EAAC;AACjB;AAEA,SAAS,SAAS,IAAsB;AACtC,SAAO,IAAI,SAAS,sBAAsB,KAAK,UAAU,EAAE,CAAC,IAAI;AAAA,IAC9D,MAAM;AAAA,EACR,CAAC;AACH;AAGA,eAAsB,aAAa,SAMN;AAC3B,QAAM,SAAS,aAAa;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,KAAK,QAAQ;AAAA,IACb,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,CAAC,QAAQ,OAAO;AAClB,UAAM,UAAU,MAAM,YAAY,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AACtE,QAAI,SAAS;AACX,YAAM,SAAS,OAAO;AACtB,aAAO,MAAM;AACb,aAAO,IAAI,gBAAgB,QAAQ,QAAQ,MAAM;AAAA,IACnD;AAAA,EACF;AACA,SAAO,IAAI,cAAc,MAAM;AACjC;AAGA,eAAsB,eAAe,SAA0B,KAA+B;AAC5F,QAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,QAAM,QAAQ,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG;AAC/C,MAAI,MAAO,QAAO;AAClB,QAAM,UAAU,SAAS;AAAA,IACvB,CAAC,MAAM,EAAE,MAAM,YAAY,MAAM,IAAI,YAAY,KAAK,EAAE,GAAG,WAAW,GAAG;AAAA,EAC3E;AACA,MAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,CAAC;AAC1C,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI,SAAS,GAAG,KAAK,UAAU,GAAG,CAAC,YAAY,QAAQ,MAAM,aAAa;AAAA,MAC9E,MAAM,oBAAoB,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,QAAM,SAAS,GAAG;AACpB;","names":[]}

package/dist/{chunk-3Q2KCXLN.js → chunk-HENE4DA6.js}

@@ -116,7 +116,7 @@ import { z as z8 } from "zod";
 import { randomBytes as randomBytes7 } from "crypto";
 import { createServer } from "http";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes8 } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname6, join as join6 } from "path";
 import { z as z9 } from "zod";
 import { z as z10 } from "zod";
@@ -155,6 +155,8 @@ var ENDPOINTS = {
   }
 };
 var PENDING_MS = 10 * 6e4;
+var PENDING_MAX = 1e3;
+var PENDING_PER_PEER = 20;
 var SESSION_MS = 8 * 60 * 6e4;
 var random = () => randomBytes(32).toString("base64url");
 var digest = (value) => createHash("sha256").update(value).digest("base64url");
@@ -200,10 +202,29 @@ var LoginService = class {
   logout(session) {
     if (session) this.sessions.delete(digest(session));
   }
-  begin(provider) {
+  /**
+   * Start a sign-in. `peer` is the connection's address as the HTTP server sees it (never a
+   * forwarded header unless the server was configured to trust its proxy). Unfinished sign-ins
+   * never block a new one: each peer keeps a few, and when the table is full the oldest goes.
+   */
+  begin(provider, peer = "unknown") {
     this.prune();
     const client = this.options.providers[provider];
-    if (!client || this.pending.size >= 1e3) throw new LoginError();
+    if (!client) throw new LoginError();
+    let mine = 0;
+    for (const value of this.pending.values()) if (value.peer === peer) mine++;
+    for (const [key, value] of this.pending) {
+      if (mine < PENDING_PER_PEER) break;
+      if (value.peer === peer) {
+        this.pending.delete(key);
+        mine--;
+      }
+    }
+    while (this.pending.size >= PENDING_MAX) {
+      const oldest = this.pending.keys().next().value;
+      if (oldest === void 0) break;
+      this.pending.delete(oldest);
+    }
     const state = random();
     const binding = random();
     const verifier = random();
@@ -211,6 +232,7 @@ var LoginService = class {
       provider,
       binding: digest(binding),
       verifier,
+      peer,
       expires: this.now() + PENDING_MS
     });
     const url = new URL(ENDPOINTS[provider].authorize);
@@ -1471,6 +1493,53 @@ ${message}`, options);
     this.source = source;
   }
 };
+var PROJECT_SETTABLE_KEYS = {
+  logLevel: true,
+  routing: true,
+  goal: true,
+  runner: {
+    maxRepairCycles: true,
+    branchPrefix: true,
+    baseBranch: true,
+    route: true,
+    executor: true,
+    pullRequests: true,
+    commitBrain: true,
+    commandTimeoutMs: true,
+    idlePollMs: true,
+    maxIterations: true,
+    maxTaskTokens: true,
+    validate: true,
+    claudeCli: { accountId: true, model: true, timeoutMs: true },
+    judge: { kind: true, model: true, threshold: true }
+  }
+};
+function filterProjectLayer(layer) {
+  const dropped = [];
+  const walk = (value, tree, prefix) => {
+    const out = {};
+    for (const [key, v] of Object.entries(value)) {
+      const rule = Object.hasOwn(tree, key) ? tree[key] : void 0;
+      const path8 = prefix ? `${prefix}.${key}` : key;
+      if (rule === true) {
+        out[key] = v;
+      } else if (rule && isPlainObject(v)) {
+        const inner = walk(v, rule, path8);
+        if (Object.keys(inner).length > 0) out[key] = inner;
+      } else {
+        dropped.push(path8);
+      }
+    }
+    return out;
+  };
+  return { allowed: walk(layer, PROJECT_SETTABLE_KEYS, ""), dropped };
+}
+var warned = /* @__PURE__ */ new Set();
+function defaultWarn(message) {
+  if (warned.has(message)) return;
+  warned.add(message);
+  process.emitWarning(message, "DaveCodeConfigWarning");
+}
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1483,7 +1552,7 @@ function deepMerge(base, override) {
   }
   return out;
 }
-function readLayer(path8) {
+function readLayer(path8, project) {
   let raw;
   try {
     raw = readFileSync(path8, "utf8");
@@ -1498,9 +1567,15 @@ function readLayer(path8) {
     throw new ConfigError(path8, `malformed JSON: ${err.message}`, { cause: err });
   }
   if (!isPlainObject(parsed)) throw new ConfigError(path8, "expected a JSON object");
-  const result = configSchema.safeParse(parsed);
+  let layer = parsed;
+  if (project) {
+    const { allowed, dropped } = filterProjectLayer(parsed);
+    if (dropped.length > 0) project(dropped);
+    layer = allowed;
+  }
+  const result = configSchema.safeParse(layer);
   if (!result.success) throw new ConfigError(path8, z4.prettifyError(result.error));
-  return parsed;
+  return layer;
 }
 var TRUE_VALUES = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
 var FALSE_VALUES = /* @__PURE__ */ new Set(["0", "false", "no", "off", ""]);
@@ -1558,7 +1633,14 @@ function loadConfig(options = {}) {
   const globalLayer = readLayer(globalPaths(home).config);
   if (globalLayer) merged = deepMerge(merged, globalLayer);
   if (options.projectRoot) {
-    const projectLayer = readLayer(projectPaths(options.projectRoot).config);
+    const projectFile = projectPaths(options.projectRoot).config;
+    const warn = options.onWarning ?? defaultWarn;
+    const projectLayer = readLayer(
+      projectFile,
+      (dropped) => warn(
+        `Ignored ${dropped.join(", ")} in ${projectFile}: project config cannot set these keys. Set them in your user config (~/.davecode/config.json) or with DAVECODE_* environment variables.`
+      )
+    );
     if (projectLayer) merged = deepMerge(merged, projectLayer);
   }
   merged = deepMerge(merged, envLayer(env));
@@ -3875,6 +3957,76 @@ function createProviders(options = {}) {
   ];
   return new Map(providers.map((p) => [p.kind, p]));
 }
+var ENDPOINT_CONFIG_KEYS = ["baseUrl"];
+var MODEL_KEYS = ["models", "defaultModel"];
+var API_CONFIG_KEYS = {
+  anthropic: ["baseUrl", ...MODEL_KEYS],
+  openai: ["baseUrl", "includeUsage", ...MODEL_KEYS],
+  gemini: ["baseUrl", ...MODEL_KEYS],
+  "openai-compatible": ["baseUrl", "includeUsage", ...MODEL_KEYS],
+  "claude-cli": [...MODEL_KEYS],
+  "codex-cli": [...MODEL_KEYS],
+  "gemini-cli": [...MODEL_KEYS],
+  "antigravity-cli": [...MODEL_KEYS],
+  "gemini-web": ["models"]
+};
+function isStringList(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string" && v.length > 0);
+}
+function apiConfigIssues(provider, config, existing = {}) {
+  const allowed = API_CONFIG_KEYS[provider];
+  const issues = [];
+  for (const [key, value] of Object.entries(config)) {
+    if (!allowed.includes(key)) {
+      if (key in existing && JSON.stringify(existing[key]) === JSON.stringify(value)) continue;
+      issues.push(
+        `config.${key} cannot be set through the API for ${provider} accounts` + (allowed.length > 0 ? ` (allowed: ${allowed.join(", ")})` : "")
+      );
+      continue;
+    }
+    if (key === "baseUrl") {
+      if (typeof value !== "string" || !isHttpUrl(value)) {
+        issues.push("config.baseUrl must be an http(s) URL without embedded credentials");
+      }
+    } else if (key === "models") {
+      if (!isStringList(value)) issues.push("config.models must be a list of model ids");
+    } else if (key === "defaultModel") {
+      if (typeof value !== "string" || !value) issues.push("config.defaultModel must be a string");
+    } else if (key === "includeUsage" && typeof value !== "boolean") {
+      issues.push("config.includeUsage must be true or false");
+    }
+  }
+  return issues;
+}
+function isHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+function mergeApiConfig(provider, existing, incoming) {
+  const allowed = API_CONFIG_KEYS[provider];
+  const kept = Object.fromEntries(
+    Object.entries(existing).filter(([key]) => !allowed.includes(key))
+  );
+  return { ...kept, ...incoming };
+}
+function endpointOf(config) {
+  return ENDPOINT_CONFIG_KEYS.map((key) => {
+    const value = config[key];
+    return typeof value === "string" ? value.trim().replace(/\/+$/, "") : "";
+  }).join("\n");
+}
+function endpointChanged(existing, next) {
+  return endpointOf(existing) !== endpointOf(next);
+}
+function endpointRebindIssue(existing, nextConfig, secretSupplied) {
+  if (!nextConfig || secretSupplied || !existing.hasSecret) return void 0;
+  if (!endpointChanged(existing.config, nextConfig)) return void 0;
+  return "Changing the endpoint of an account that has a stored secret requires sending the secret again in the same request";
+}
 var EXPERIMENTAL_PROVIDER_KINDS = ["gemini-web"];
 var SUBSCRIPTION_PROVIDER_KINDS = [
   "claude-cli",
@@ -3883,7 +4035,7 @@ var SUBSCRIPTION_PROVIDER_KINDS = [
   "antigravity-cli",
   "gemini-web"
 ];
-var VERSION = "0.4.0";
+var VERSION = "0.5.1";
 var QUOTA_WINDOWS = ["1m", "5h", "24h"];
 var WINDOW_MS = {
   "1m": 6e4,
@@ -8070,12 +8222,14 @@ function accountService(env = process.env) {
 }
 var OAUTH_PROVIDERS = ["google", "github"];
 var AccountError = class extends Error {
-  constructor(message, status) {
+  constructor(message, status, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "AccountError";
   }
   status;
+  code;
 };
 var userSchema = z8.object({
   id: z8.string().min(1),
@@ -8211,7 +8365,8 @@ var AccountClient = class {
       const detail = error.success ? error.data.error_description ?? error.data.msg ?? error.data.message : void 0;
       throw new AccountError(
         detail ?? `Sign-in failed (HTTP ${response.status}).`,
-        response.status
+        response.status,
+        error.success ? error.data.error : void 0
       );
     }
     return raw;
@@ -8299,6 +8454,16 @@ async function startAccountLogin(options) {
 }
 var AAD = Buffer.from("davecode-account", "utf8");
 var REFRESH_MARGIN_MS = 6e4;
+var LOCK_STALE_MS = 6e4;
+var LOCK_WAIT_MS = 3e4;
+var LOCK_POLL_MS = 50;
+var INVALID_TOKEN_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  "refresh_token_not_found",
+  "refresh_token_already_used",
+  "session_not_found",
+  "session_expired"
+]);
 var fileSchema = z9.object({
   v: z9.literal(1),
   iv: z9.string(),
@@ -8375,22 +8540,67 @@ var AccountStore = class {
    * or when the service revoked the session; offline, an unexpired session is still returned.
    */
   async current(client, now = Date.now()) {
-    const session = this.load();
-    if (!session) return void 0;
-    if (session.expiresAt - REFRESH_MARGIN_MS > now) return session;
+    const first = this.load();
+    if (!first) return void 0;
+    if (first.expiresAt - REFRESH_MARGIN_MS > now) return first;
+    const release = await this.lock();
     try {
-      const fresh = await client.refresh(session.refreshToken);
-      this.save(fresh);
-      return fresh;
-    } catch (err) {
-      if (err instanceof AccountError && err.status !== void 0 && err.status < 500) {
-        this.clear();
-        return void 0;
+      const session = this.load();
+      if (!session) return void 0;
+      if (session.expiresAt - REFRESH_MARGIN_MS > now) return session;
+      try {
+        const fresh = await client.refresh(session.refreshToken);
+        this.save(fresh);
+        return fresh;
+      } catch (err) {
+        if (isInvalidToken(err)) {
+          if (this.load()?.refreshToken === session.refreshToken) this.clear();
+          return this.load();
+        }
+        return session;
       }
-      return session;
+    } finally {
+      release();
+    }
+  }
+  /**
+   * A cross-process lock: a file created exclusively next to account.json. A lock older than
+   * LOCK_STALE_MS belongs to a process that died, and is taken over. After LOCK_WAIT_MS the
+   * refresh goes ahead without it (the service tolerates two refreshes racing).
+   */
+  async lock() {
+    const path8 = `${this.path}.lock`;
+    const owner = `${process.pid}:${randomBytes8(8).toString("hex")}`;
+    mkdirSync7(dirname6(path8), { recursive: true });
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    for (; ; ) {
+      try {
+        writeFileSync3(path8, owner, { flag: "wx", mode: 384 });
+        return () => {
+          try {
+            if (readFileSync3(path8, "utf8") === owner) rmSync3(path8, { force: true });
+          } catch {
+          }
+        };
+      } catch (err) {
+        if (err.code !== "EEXIST" && !isWindowsBusy(err))
+          return () => void 0;
+      }
+      try {
+        if (Date.now() - statSync2(path8).mtimeMs > LOCK_STALE_MS) rmSync3(path8, { force: true });
+      } catch {
+      }
+      if (Date.now() >= deadline) return () => void 0;
+      await new Promise((resolve5) => setTimeout(resolve5, LOCK_POLL_MS));
     }
   }
 };
+function isInvalidToken(err) {
+  if (!(err instanceof AccountError) || err.status === void 0) return false;
+  if (err.code) return INVALID_TOKEN_CODES.has(err.code);
+  return err.status === 400 || err.status === 401;
+}
+var isWindowsBusy = (err) => ["EPERM", "EBUSY"].includes(err.code ?? "");
 var BRAND_MARK_SVG = '<svg viewBox="0 0 1214 1214" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><path fill="currentColor" fill-rule="evenodd" d="M324.3 1096.5C324.6 1095.4 326.5 1088.3 328.5 1080.8C341.4 1031.3 375.8 953.4 419.7 874.0C445.8 826.9 448.4 822.4 471.8 783.0C501.5 733.1 530.1 687.6 556.4 648.5C563.7 637.5 569.7 628.4 569.5 628.2C569.4 628.1 563.1 631.7 555.4 636.3C513.8 661.4 468.0 683.9 411.0 707.5C337.2 737.9 321.7 744.7 296.0 757.2C241.9 783.5 199.1 809.4 152.0 844.3C119.5 868.4 98.8 885.9 71.3 912.4C64.0 919.5 58.0 925.0 58.0 924.7C58.0 923.1 64.7 902.4 68.8 891.0C116.1 762.1 215.0 644.2 351.0 554.8C385.2 532.3 411.6 516.9 445.5 499.4C521.4 460.4 589.4 435.7 636.0 430.0C676.8 425.1 715.1 437.0 743.9 463.6C763.4 481.6 779.0 509.9 785.2 538.5C787.7 550.1 788.7 579.7 787.1 592.5C782.6 626.4 769.7 661.5 746.5 702.0C717.7 752.5 675.6 806.9 627.0 856.4C599.5 884.4 575.9 905.4 542.5 931.6C510.0 957.1 500.7 964.2 432.5 1015.0C409.4 1032.3 382.6 1052.5 373.0 1060.0C354.5 1074.4 327.4 1095.5 325.1 1097.4C324.0 1098.3 323.8 1098.1 324.3 1096.5ZM783.2 1017.8C797.1 999.5 820.2 966.0 831.7 947.5C868.5 888.3 888.8 840.5 903.4 778.5C917.9 716.9 921.2 643.7 912.0 591.0C904.6 549.3 889.7 511.9 866.7 477.5C856.6 462.3 853.1 457.8 837.4 439.6C817.4 416.6 806.6 402.0 800.5 389.5C793.6 375.5 791.7 368.1 791.7 356.0C791.7 335.3 799.3 319.6 819.0 299.9C849.7 269.2 900.2 247.9 956.8 241.9C963.0 241.2 967.7 240.3 967.3 239.9C966.1 238.8 948.5 236.3 933.0 234.9C913.6 233.2 875.2 234.3 859.0 237.0C839.7 240.2 827.8 242.9 813.0 247.5C753.9 265.9 700.6 300.9 659.2 348.5C648.9 360.4 636.6 376.5 632.4 383.5C630.3 387.1 629.0 388.2 624.7 389.6C603.8 396.4 554.6 417.6 513.5 437.5C447.6 469.4 395.4 496.8 341.5 528.1L337.5 530.4L339.5 527.9C340.6 526.6 346.2 520.3 352.0 514.0C374.4 489.6 390.2 470.8 411.2 443.5C429.3 419.9 444.6 398.2 488.5 333.5C510.5 301.0 529.1 278.0 550.9 256.3C593.0 214.1 640.3 183.6 691.5 165.5C727.7 152.8 756.5 147.7 792.5 147.7C854.3 147.8 906.4 164.9 954.1 200.6C967.5 210.8 974.1 214.6 981.5 217.0C991.4 220.1 1022.1 231.9 1038.5 238.8C1061.9 248.7 1099.0 267.4 1097.7 268.7C1097.4 268.9 1089.3 268.5 1079.7 267.9C1033.7 264.7 984.5 274.1 946.2 293.4C932.3 300.4 915.0 313.0 903.4 324.5C881.0 346.6 870.0 369.6 870.0 394.4C870.0 413.7 876.8 433.1 894.7 465.2C908.8 490.3 914.6 501.1 922.8 517.5C961.3 594.3 980.0 662.5 980.0 725.4C980.0 770.9 967.3 818.9 944.4 860.4C927.6 890.8 912.0 911.0 882.5 940.6C856.5 966.7 828.5 989.7 797.0 1010.7C779.6 1022.2 780.0 1022.0 783.2 1017.8Z"/></svg>';
 var LOGO_ART = [
   "           \u2584\u2584\u2584\u2588\u2584\u2584\u2584",
@@ -9462,6 +9672,8 @@ export {
   routeSchema,
   configSchema,
   ConfigError,
+  PROJECT_SETTABLE_KEYS,
+  filterProjectLayer,
   deepMerge,
   envLayer,
   loadConfig,
@@ -9486,6 +9698,12 @@ export {
   OpenAIProvider,
   OpenAICompatibleProvider,
   createProviders,
+  ENDPOINT_CONFIG_KEYS,
+  API_CONFIG_KEYS,
+  apiConfigIssues,
+  mergeApiConfig,
+  endpointChanged,
+  endpointRebindIssue,
   EXPERIMENTAL_PROVIDER_KINDS,
   SUBSCRIPTION_PROVIDER_KINDS,
   VERSION,
@@ -9605,4 +9823,4 @@ export {
   GoalStore,
   createGoalService
 };
-//# sourceMappingURL=chunk-3Q2KCXLN.js.map
+//# sourceMappingURL=chunk-HENE4DA6.js.map