@duckmind/dm-darwin-x64 0.43.4 → 0.43.8

package/extensions/dm-subagents/src/runs/shared/mcp-direct-tool-allowlist.ts

@@ -1,365 +0,0 @@
-import { createHash } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { getAgentDir, getProjectConfigDir } from "../../shared/utils.ts";
-
-const CACHE_VERSION = 1;
-const CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
-const BUILTIN_TOOL_NAMES = new Set(["read", "bash", "edit", "write", "grep", "find", "ls", "mcp"]);
-const GENERIC_GLOBAL_CONFIG_PATH = path.join(os.homedir(), ".config", "mcp", "mcp.json");
-const IMPORT_PATHS = {
-	cursor: [path.join(os.homedir(), ".cursor", "mcp.json")],
-	"claude-code": [
-		path.join(os.homedir(), ".claude", "mcp.json"),
-		path.join(os.homedir(), ".claude.json"),
-		path.join(os.homedir(), ".claude", "claude_desktop_config.json"),
-	],
-	"claude-desktop": [path.join(os.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json")],
-	codex: [path.join(os.homedir(), ".codex", "config.json")],
-	windsurf: [path.join(os.homedir(), ".windsurf", "mcp.json")],
-	vscode: [".vscode/mcp.json"],
-} as const;
-
-type ToolPrefix = "server" | "none" | "short";
-type ImportKind = keyof typeof IMPORT_PATHS;
-
-interface ServerEntry {
-	command?: string;
-	args?: string[];
-	env?: Record<string, string>;
-	cwd?: string;
-	url?: string;
-	headers?: Record<string, string>;
-	auth?: "oauth" | "bearer" | false;
-	bearerToken?: string;
-	bearerTokenEnv?: string;
-	exposeResources?: boolean;
-	excludeTools?: string[];
-	directTools?: boolean | string[];
-}
-
-interface McpConfig {
-	mcpServers: Record<string, ServerEntry>;
-	imports?: ImportKind[];
-	settings?: {
-		toolPrefix?: ToolPrefix;
-		directTools?: boolean;
-	};
-}
-
-interface CachedTool {
-	name?: string;
-}
-
-interface CachedResource {
-	uri?: string;
-	name?: string;
-}
-
-interface ServerCacheEntry {
-	configHash?: string;
-	tools?: CachedTool[];
-	resources?: CachedResource[];
-	cachedAt?: number;
-}
-
-interface MetadataCache {
-	version: number;
-	servers: Record<string, ServerCacheEntry>;
-}
-
-export function resolveMcpDirectToolNames(mcpDirectTools: string[] | undefined, cwd = process.cwd()): string[] {
-	if (!mcpDirectTools?.length) return [];
-
-	try {
-		const config = loadMcpConfig(cwd);
-		const cache = loadMetadataCache();
-		if (!cache) return [];
-		return resolveDirectToolNames(config, cache, getToolPrefix(config.settings?.toolPrefix), mcpDirectTools);
-	} catch {
-		return [];
-	}
-}
-
-function loadMetadataCache(): MetadataCache | null {
-	const cachePath = path.join(getAgentDir(), "mcp-cache.json");
-	let parsed: unknown;
-	try {
-		parsed = JSON.parse(fs.readFileSync(cachePath, "utf-8"));
-	} catch {
-		return null;
-	}
-
-	if (!parsed || typeof parsed !== "object") return null;
-	const raw = parsed as Record<string, unknown>;
-	if (raw.version !== CACHE_VERSION || !raw.servers || typeof raw.servers !== "object" || Array.isArray(raw.servers)) {
-		return null;
-	}
-	return raw as unknown as MetadataCache;
-}
-
-function loadMcpConfig(cwd: string): McpConfig {
-	let config: McpConfig = { mcpServers: {} };
-	for (const sourcePath of getConfigPaths(cwd)) {
-		const loaded = readConfig(sourcePath);
-		if (!loaded) continue;
-		config = mergeConfigs(config, expandImports(loaded, cwd));
-	}
-	return config;
-}
-
-function getConfigPaths(cwd: string): string[] {
-	const piGlobalPath = path.join(getAgentDir(), "mcp.json");
-	const projectPath = path.resolve(cwd, ".mcp.json");
-	const projectPiPath = path.resolve(getProjectConfigDir(cwd), "mcp.json");
-	const sources: string[] = [];
-	if (GENERIC_GLOBAL_CONFIG_PATH !== piGlobalPath) sources.push(GENERIC_GLOBAL_CONFIG_PATH);
-	sources.push(piGlobalPath);
-	if (projectPath !== piGlobalPath) sources.push(projectPath);
-	if (projectPiPath !== piGlobalPath && projectPiPath !== projectPath) sources.push(projectPiPath);
-	return sources;
-}
-
-function readConfig(configPath: string): McpConfig | null {
-	let parsed: unknown;
-	try {
-		parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-	} catch {
-		return null;
-	}
-	return validateConfig(parsed);
-}
-
-function validateConfig(raw: unknown): McpConfig {
-	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { mcpServers: {} };
-	const obj = raw as Record<string, unknown>;
-	const servers = obj.mcpServers ?? obj["mcp-servers"] ?? {};
-	return {
-		mcpServers: servers && typeof servers === "object" && !Array.isArray(servers) ? servers as Record<string, ServerEntry> : {},
-		imports: Array.isArray(obj.imports) ? obj.imports.filter((value): value is ImportKind => isImportKind(value)) : undefined,
-		settings: obj.settings && typeof obj.settings === "object" && !Array.isArray(obj.settings)
-			? obj.settings as McpConfig["settings"]
-			: undefined,
-	};
-}
-
-function mergeConfigs(base: McpConfig, next: McpConfig): McpConfig {
-	const imports = [...(base.imports ?? []), ...(next.imports ?? [])];
-	return {
-		mcpServers: { ...base.mcpServers, ...next.mcpServers },
-		imports: imports.length ? [...new Set(imports)] : undefined,
-		settings: next.settings ? { ...base.settings, ...next.settings } : base.settings,
-	};
-}
-
-function expandImports(config: McpConfig, cwd: string): McpConfig {
-	if (!config.imports?.length) return config;
-
-	const importedServers: Record<string, ServerEntry> = {};
-	for (const importKind of config.imports) {
-		const importPath = resolveImportPath(importKind, cwd);
-		if (!importPath) continue;
-		let imported: unknown;
-		try {
-			imported = JSON.parse(fs.readFileSync(importPath, "utf-8"));
-		} catch {
-			continue;
-		}
-		for (const [name, definition] of Object.entries(extractServers(imported, importKind))) {
-			if (!importedServers[name]) importedServers[name] = definition;
-		}
-	}
-
-	return {
-		imports: config.imports,
-		settings: config.settings,
-		mcpServers: { ...importedServers, ...config.mcpServers },
-	};
-}
-
-function resolveImportPath(importKind: ImportKind, cwd: string): string | null {
-	for (const candidate of IMPORT_PATHS[importKind]) {
-		const fullPath = candidate.startsWith(".") ? path.resolve(cwd, candidate) : candidate;
-		if (fs.existsSync(fullPath)) return fullPath;
-	}
-	return null;
-}
-
-function extractServers(config: unknown, kind: ImportKind): Record<string, ServerEntry> {
-	if (!config || typeof config !== "object" || Array.isArray(config)) return {};
-	const obj = config as Record<string, unknown>;
-	const servers = kind === "cursor" || kind === "windsurf" || kind === "vscode"
-		? obj.mcpServers ?? obj["mcp-servers"]
-		: obj.mcpServers;
-	return servers && typeof servers === "object" && !Array.isArray(servers) ? servers as Record<string, ServerEntry> : {};
-}
-
-function resolveDirectToolNames(config: McpConfig, cache: MetadataCache, prefix: ToolPrefix, envOverride: string[]): string[] {
-	const names: string[] = [];
-	const seenNames = new Set<string>();
-	const { servers: selectedServers, tools: selectedTools } = parseSelections(envOverride);
-
-	for (const [serverName, definition] of Object.entries(config.mcpServers)) {
-		const serverCache = cache.servers[serverName];
-		if (!isServerCacheValid(serverCache, definition)) continue;
-
-		const toolFilter = selectedServers.has(serverName)
-			? true
-			: selectedTools.get(serverName);
-		if (!toolFilter) continue;
-
-		for (const tool of Array.isArray(serverCache.tools) ? serverCache.tools : []) {
-			if (typeof tool?.name !== "string" || !tool.name) continue;
-			if (toolFilter !== true && !toolFilter.has(tool.name)) continue;
-			if (isToolExcluded(tool.name, serverName, prefix, definition.excludeTools)) continue;
-			const prefixedName = formatToolName(tool.name, serverName, prefix);
-			if (BUILTIN_TOOL_NAMES.has(prefixedName) || seenNames.has(prefixedName)) continue;
-			seenNames.add(prefixedName);
-			names.push(prefixedName);
-		}
-
-		if (definition.exposeResources === false) continue;
-		for (const resource of Array.isArray(serverCache.resources) ? serverCache.resources : []) {
-			if (typeof resource?.name !== "string" || !resource.name || typeof resource.uri !== "string" || !resource.uri) continue;
-			const baseName = `get_${resourceNameToToolName(resource.name)}`;
-			if (toolFilter !== true && !toolFilter.has(baseName)) continue;
-			if (isToolExcluded(baseName, serverName, prefix, definition.excludeTools)) continue;
-			const prefixedName = formatToolName(baseName, serverName, prefix);
-			if (BUILTIN_TOOL_NAMES.has(prefixedName) || seenNames.has(prefixedName)) continue;
-			seenNames.add(prefixedName);
-			names.push(prefixedName);
-		}
-	}
-
-	return names;
-}
-
-function parseSelections(selections: string[]): { servers: Set<string>; tools: Map<string, Set<string>> } {
-	const servers = new Set<string>();
-	const tools = new Map<string, Set<string>>();
-	for (let item of selections) {
-		item = item.replace(/\/+$/, "");
-		if (item.includes("/")) {
-			const [server, tool] = item.split("/", 2);
-			if (server && tool) {
-				if (!tools.has(server)) tools.set(server, new Set());
-				tools.get(server)!.add(tool);
-			} else if (server) {
-				servers.add(server);
-			}
-		} else if (item) {
-			servers.add(item);
-		}
-	}
-	return { servers, tools };
-}
-
-function isServerCacheValid(entry: ServerCacheEntry | undefined, definition: ServerEntry): entry is ServerCacheEntry {
-	if (!entry || entry.configHash !== computeMcpServerHash(definition)) return false;
-	if (!entry.cachedAt || typeof entry.cachedAt !== "number") return false;
-	return Date.now() - entry.cachedAt <= CACHE_MAX_AGE_MS;
-}
-
-export function computeMcpServerHash(definition: ServerEntry): string {
-	const identity: Record<string, unknown> = {
-		command: definition.command,
-		args: definition.args,
-		env: interpolateEnvRecord(definition.env),
-		cwd: resolveConfigPath(definition.cwd),
-		url: definition.url,
-		headers: interpolateEnvRecord(definition.headers),
-		auth: definition.auth,
-		bearerToken: resolveBearerToken(definition),
-		bearerTokenEnv: definition.bearerTokenEnv,
-		exposeResources: definition.exposeResources,
-		excludeTools: definition.excludeTools,
-	};
-	return createHash("sha256").update(stableStringify(identity)).digest("hex");
-}
-
-function getToolPrefix(value: unknown): ToolPrefix {
-	return value === "none" || value === "short" || value === "server" ? value : "server";
-}
-
-function isImportKind(value: unknown): value is ImportKind {
-	return typeof value === "string" && Object.hasOwn(IMPORT_PATHS, value);
-}
-
-function getServerPrefix(serverName: string, mode: ToolPrefix): string {
-	if (mode === "none") return "";
-	if (mode === "short") {
-		const short = serverName.replace(/-?mcp$/i, "").replace(/-/g, "_");
-		return short || "mcp";
-	}
-	return serverName.replace(/-/g, "_");
-}
-
-function formatToolName(toolName: string, serverName: string, prefix: ToolPrefix): string {
-	const serverPrefix = getServerPrefix(serverName, prefix);
-	return serverPrefix ? `${serverPrefix}_${toolName}` : toolName;
-}
-
-function isToolExcluded(toolName: string, serverName: string, prefix: ToolPrefix, excludeTools: unknown): boolean {
-	if (!Array.isArray(excludeTools) || excludeTools.length === 0) return false;
-	const candidates = new Set([
-		normalizeToolName(toolName),
-		normalizeToolName(formatToolName(toolName, serverName, prefix)),
-		normalizeToolName(formatToolName(toolName, serverName, "server")),
-		normalizeToolName(formatToolName(toolName, serverName, "short")),
-	]);
-	return excludeTools.some((excluded) => typeof excluded === "string" && candidates.has(normalizeToolName(excluded)));
-}
-
-function normalizeToolName(value: string): string {
-	return value.replace(/-/g, "_");
-}
-
-function resourceNameToToolName(name: string): string {
-	let result = name
-		.replace(/[^a-zA-Z0-9]/g, "_")
-		.replace(/_+/g, "_")
-		.replace(/^_+/, "")
-		.replace(/_+$/, "")
-		.toLowerCase();
-	if (!result || /^\d/.test(result)) result = `resource${result ? `_${result}` : ""}`;
-	return result;
-}
-
-function interpolateEnvRecord(values: Record<string, string> | undefined): Record<string, string> | undefined {
-	if (!values || typeof values !== "object" || Array.isArray(values)) return undefined;
-	const resolved: Record<string, string> = {};
-	for (const [key, value] of Object.entries(values)) {
-		if (typeof value === "string") resolved[key] = interpolateEnvVars(value);
-	}
-	return resolved;
-}
-
-function interpolateEnvVars(value: string): string {
-	return value
-		.replace(/\$\{(\w+)\}/g, (_, name: string) => process.env[name] ?? "")
-		.replace(/\$env:(\w+)/g, (_, name: string) => process.env[name] ?? "");
-}
-
-function resolveConfigPath(value: string | undefined): string | undefined {
-	if (typeof value !== "string") return undefined;
-	const resolved = interpolateEnvVars(value);
-	if (resolved === "~") return os.homedir();
-	if (resolved.startsWith("~/") || resolved.startsWith("~\\")) return path.join(os.homedir(), resolved.slice(2));
-	return resolved;
-}
-
-function resolveBearerToken(definition: Pick<ServerEntry, "bearerToken" | "bearerTokenEnv">): string | undefined {
-	if (typeof definition.bearerToken === "string") return interpolateEnvVars(definition.bearerToken);
-	return typeof definition.bearerTokenEnv === "string" ? process.env[definition.bearerTokenEnv] : undefined;
-}
-
-function stableStringify(value: unknown): string {
-	if (value === null || value === undefined || typeof value !== "object") {
-		const serialized = JSON.stringify(value);
-		return serialized === undefined ? "undefined" : serialized;
-	}
-	if (Array.isArray(value)) return `[${value.map((entry) => stableStringify(entry)).join(",")}]`;
-	const obj = value as Record<string, unknown>;
-	return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(obj[key])}`).join(",")}}`;
-}

package/extensions/dm-subagents/src/runs/shared/model-fallback.ts

@@ -1,292 +0,0 @@
-import type { ModelInfo as AvailableModelInfo } from "../../shared/model-info.ts";
-import type { Usage } from "../../shared/types.ts";
-import { checkModelScope, type ModelScopeConfig, type ModelScopeViolation, type ModelSource } from "./model-scope.ts";
-
-export type { AvailableModelInfo };
-
-interface ModelAttemptSummary {
-	model: string;
-	success: boolean;
-	exitCode?: number | null;
-	error?: string;
-	usage?: Usage;
-}
-
-export function splitThinkingSuffix(model: string): { baseModel: string; thinkingSuffix: string } {
-	const colonIdx = model.lastIndexOf(":");
-	if (colonIdx === -1) return { baseModel: model, thinkingSuffix: "" };
-	return {
-		baseModel: model.substring(0, colonIdx),
-		thinkingSuffix: model.substring(colonIdx),
-	};
-}
-
-/** Sentinel model value requesting that a subagent inherit the parent session's model. */
-export const INHERIT_MODEL = "inherit";
-
-/** Minimal shape of the parent session's in-memory model (`ctx.model`). */
-export interface ParentModel {
-	provider: string;
-	id: string;
-}
-
-/**
- * Normalize a model id or provider segment for fuzzy comparison: case-fold,
- * treat dots/underscores as dashes (so `4.5` matches `4-5`), and collapse
- * repeated separators. Pure.
- */
-export function normalizeModelSegment(segment: string): string {
-	return segment
-		.toLowerCase()
-		.replace(/[._]+/g, "-")
-		.replace(/-+/g, "-")
-		.replace(/^-|-$/g, "");
-}
-
-function isPlausibleDateStamp(year: string, month: string, day: string): boolean {
-	const yyyy = Number(year);
-	const mm = Number(month);
-	const dd = Number(day);
-	return yyyy >= 1900 && yyyy <= 2099 && mm >= 1 && mm <= 12 && dd >= 1 && dd <= 31;
-}
-
-/** Drop a trailing date stamp (`-20251001` or `-2025-10-01`) so dated and undated ids match. Pure. */
-function stripTrailingDateStamp(segment: string): string {
-	const dashed = /^(.*)-(\d{4})-(\d{2})-(\d{2})$/.exec(segment);
-	if (dashed && isPlausibleDateStamp(dashed[2]!, dashed[3]!, dashed[4]!)) return dashed[1]!;
-	const compact = /^(.*)-(\d{4})(\d{2})(\d{2})$/.exec(segment);
-	if (compact && isPlausibleDateStamp(compact[2]!, compact[3]!, compact[4]!)) return compact[1]!;
-	return segment;
-}
-
-function resolveBaseModelCandidate(
-	baseModel: string,
-	availableModels: AvailableModelInfo[],
-	preferredProvider?: string,
-): string | undefined {
-	if (baseModel.includes("/")) {
-		const exact = availableModels.find((entry) => entry.fullId === baseModel);
-		if (exact) return exact.fullId;
-	} else {
-		const exactMatches = availableModels.filter((entry) => entry.id === baseModel);
-		if (preferredProvider) {
-			const preferredMatch = exactMatches.find((entry) => entry.provider === preferredProvider);
-			if (preferredMatch) return preferredMatch.fullId;
-		}
-		if (exactMatches.length === 1) return exactMatches[0]!.fullId;
-	}
-
-	return fuzzyResolveModel(baseModel, availableModels, preferredProvider);
-}
-
-/**
- * Fuzzy-resolve a base model id (thinking suffix already stripped) against the
- * registry, tolerating separator, case, and optional date-stamp differences so
- * users do not have to spell provider/model exactly. A qualified `provider/id`
- * query only matches within the named provider — this never silently switches
- * providers for security/cost-sensitive configs. Returns the matched `fullId`,
- * or `undefined` when there is no match or the match is ambiguous across
- * providers (and no `preferredProvider` disambiguates). Pure.
- */
-export function fuzzyResolveModel(
-	baseModel: string,
-	availableModels: AvailableModelInfo[],
-	preferredProvider?: string,
-): string | undefined {
-	let queryProvider: string | undefined;
-	let queryIdRaw = baseModel;
-	const slashIdx = baseModel.indexOf("/");
-	if (slashIdx !== -1) {
-		queryProvider = normalizeModelSegment(baseModel.slice(0, slashIdx));
-		queryIdRaw = baseModel.slice(slashIdx + 1);
-	} else {
-		const providerSeparators = [":", "."];
-		for (const separator of providerSeparators) {
-			const separatorIdx = baseModel.indexOf(separator);
-			if (separatorIdx <= 0) continue;
-			const providerPart = normalizeModelSegment(baseModel.slice(0, separatorIdx));
-			if (!availableModels.some((entry) => normalizeModelSegment(entry.provider) === providerPart)) continue;
-			queryProvider = providerPart;
-			queryIdRaw = baseModel.slice(separatorIdx + 1);
-			break;
-		}
-	}
-	const queryId = normalizeModelSegment(queryIdRaw);
-	const queryIdNoDate = stripTrailingDateStamp(queryId);
-
-	const candidates = availableModels.filter((entry) => {
-		const entryId = normalizeModelSegment(entry.id);
-		if (entryId !== queryId && stripTrailingDateStamp(entryId) !== queryIdNoDate) return false;
-		if (queryProvider !== undefined && normalizeModelSegment(entry.provider) !== queryProvider) return false;
-		return true;
-	});
-	if (candidates.length === 0) return undefined;
-	if (preferredProvider) {
-		const preferredProviderNorm = normalizeModelSegment(preferredProvider);
-		const preferred = candidates.find((entry) => normalizeModelSegment(entry.provider) === preferredProviderNorm);
-		if (preferred) return preferred.fullId;
-	}
-	if (candidates.length === 1) return candidates[0]!.fullId;
-	return undefined;
-}
-
-/**
- * Resolve a possibly-loose model id to a canonical `provider/id` (plus any
- * thinking suffix). Exact registry matches win; fuzzy normalization
- * (separator/case/date-stamp via {@link fuzzyResolveModel}) is a fallback so
- * spelling differences still resolve. Never switches providers for a qualified
- * query. Pure.
- */
-export function resolveModelCandidate(
-	model: string | undefined,
-	availableModels: AvailableModelInfo[] | undefined,
-	preferredProvider?: string,
-): string | undefined {
-	if (!model) return undefined;
-	if (!availableModels || availableModels.length === 0) return model;
-
-	const resolvedWhole = resolveBaseModelCandidate(model, availableModels, preferredProvider);
-	if (resolvedWhole) return resolvedWhole;
-
-	const { baseModel, thinkingSuffix } = splitThinkingSuffix(model);
-	if (!thinkingSuffix) return model;
-	const resolvedBase = resolveBaseModelCandidate(baseModel, availableModels, preferredProvider);
-	if (resolvedBase) return `${resolvedBase}${thinkingSuffix}`;
-	return model;
-}
-
-export interface ResolveSubagentModelOverrideOptions {
-	/** When set with `enforce: true`, out-of-scope models are rejected. */
-	scope?: ModelScopeConfig;
-	/** Origin of the requested model: explicit caller-supplied (hard error) vs inherited (warn). Defaults to `"inherited"`. */
-	source?: ModelSource;
-	/** Called for warn-severity violations instead of `console.warn`. */
-	onWarn?: (violation: ModelScopeViolation) => void;
-}
-
-function defaultScopeWarn(violation: ModelScopeViolation): void {
-	console.warn(`[dm-subagents] ${violation.message}`);
-}
-
-/**
- * Resolve the `--model` override passed to a spawned subagent.
- *
- * When no model is requested (`undefined`, `false`, empty, or the `"inherit"`
- * sentinel), the child must inherit the parent session's *in-memory* model
- * (`provider/id`) instead of being left to resolve its own model. Without an
- * explicit `provider/id`, the child falls back to the global
- * `~/.dm/agent/settings.json` default, which is shared across every open PI
- * session — so a different session that last changed its model in the TUI would
- * silently contaminate this session's subagents (see issue #266). Passing an
- * explicit `provider/id` keeps each session's children isolated to that
- * session's model.
- *
- * An explicitly requested model string is resolved via {@link resolveModelCandidate}.
- * When `options.scope.enforce` is on, an out-of-scope resolved model throws for
- * an explicit (`source: "explicit"`) request and warns for an inherited one.
- */
-export function resolveSubagentModelOverride(
-	requestedModel: string | boolean | undefined,
-	parentModel: ParentModel | undefined,
-	availableModels: AvailableModelInfo[] | undefined,
-	preferredProvider?: string,
-	options?: ResolveSubagentModelOverrideOptions,
-): string | undefined {
-	const trimmed = typeof requestedModel === "string" ? requestedModel.trim() : "";
-	const explicit = trimmed && trimmed !== INHERIT_MODEL ? trimmed : undefined;
-	let resolved: string | undefined;
-	if (explicit === undefined) {
-		resolved = parentModel ? `${parentModel.provider}/${parentModel.id}` : undefined;
-	} else {
-		resolved = resolveModelCandidate(explicit, availableModels, preferredProvider);
-	}
-	if (resolved && options?.scope?.enforce) {
-		const source: ModelSource = explicit === undefined ? "inherited" : (options.source ?? "inherited");
-		const violation = checkModelScope(resolved, options.scope, source);
-		if (violation) {
-			if (violation.severity === "error") throw new Error(violation.message);
-			(options.onWarn ?? defaultScopeWarn)(violation);
-		}
-	}
-	return resolved;
-}
-
-export interface BuildModelCandidatesOptions {
-	/** Fallback models are inherited agent config and warn, rather than error, when out of scope. */
-	scope?: ModelScopeConfig;
-	onWarn?: (violation: ModelScopeViolation) => void;
-}
-
-export function buildModelCandidates(
-	primaryModel: string | undefined,
-	fallbackModels: string[] | undefined,
-	availableModels: AvailableModelInfo[] | undefined,
-	preferredProvider?: string,
-	options?: BuildModelCandidatesOptions,
-): string[] {
-	const seen = new Set<string>();
-	const candidates: string[] = [];
-	const rawCandidates = [primaryModel, ...(fallbackModels ?? [])];
-	for (let index = 0; index < rawCandidates.length; index++) {
-		const raw = rawCandidates[index];
-		if (!raw) continue;
-		const normalized = resolveModelCandidate(raw.trim(), availableModels, preferredProvider);
-		if (!normalized || seen.has(normalized)) continue;
-		if (index > 0 && options?.scope?.enforce) {
-			const violation = checkModelScope(normalized, options.scope, "inherited");
-			if (violation) (options.onWarn ?? defaultScopeWarn)(violation);
-		}
-		seen.add(normalized);
-		candidates.push(normalized);
-	}
-	return candidates;
-}
-
-const RETRYABLE_MODEL_FAILURE_PATTERNS = [
-	/rate\s*limit/i,
-	/too many requests/i,
-	/\b429\b/,
-	/quota/i,
-	/billing/i,
-	/credit/i,
-	/auth(?:entication)?/i,
-	/unauthori[sz]ed/i,
-	/forbidden/i,
-	/api key/i,
-	/token expired/i,
-	/invalid key/i,
-	/provider.*unavailable/i,
-	/model.*unavailable/i,
-	/model.*disabled/i,
-	/model.*not found/i,
-	/unknown model/i,
-	/overloaded/i,
-	/service unavailable/i,
-	/temporar(?:ily)? unavailable/i,
-	/connection refused/i,
-	/fetch failed/i,
-	/network error/i,
-	/socket hang up/i,
-	/upstream/i,
-	/timed? out/i,
-	/timeout/i,
-	/\b502\b/,
-	/\b503\b/,
-	/\b504\b/,
-	/cold.?start/i,
-	/empty response/i,
-	/no output/i,
-	/model.*(?:load|fail|error)/i,
-];
-
-export function isRetryableModelFailure(error: string | undefined): boolean {
-	if (!error) return false;
-	return RETRYABLE_MODEL_FAILURE_PATTERNS.some((pattern) => pattern.test(error));
-}
-
-export function formatModelAttemptNote(attempt: ModelAttemptSummary, nextModel?: string): string {
-	const failure = attempt.error?.trim() || `exit ${attempt.exitCode ?? 1}`;
-	return nextModel
-		? `[fallback] ${attempt.model} failed: ${failure}. Retrying with ${nextModel}.`
-		: `[fallback] ${attempt.model} failed: ${failure}.`;
-}