@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-XTXYIISX.js

@@ -0,0 +1,1104 @@
+import {
+  buildChildProcessEnv
+} from "./chunk-MEMSY6VY.js";
+import {
+  resolveProviderReleaseStatus
+} from "./chunk-VBNCKCCI.js";
+import {
+  isSkipAuthEnvActive
+} from "./chunk-33IGPPUI.js";
+import {
+  formatSandboxCapabilityFailure,
+  probeProviderSandboxCapability
+} from "./chunk-3H4MWYIC.js";
+import {
+  lookupAuthOutcome
+} from "./chunk-PPZESPJT.js";
+import {
+  resolveClaudeBackend,
+  synthesizeClaudeBackendEnv
+} from "./chunk-H3HGMISG.js";
+import {
+  CODEX_API_KEY_ENV_VARS,
+  shouldPassCodexApiKeys
+} from "./chunk-CJBSZX3F.js";
+import {
+  resolveProviderCliCommand
+} from "./chunk-KKQKWAMF.js";
+import {
+  ProviderRegistry
+} from "./chunk-QJ6OEH4K.js";
+import {
+  LAUNCH_INHERITANCE_DIR_ENV,
+  LAUNCH_INHERITANCE_ENV,
+  deliversBuildSet,
+  excludesAgentGlobals,
+  formatLaunchInheritance,
+  isNativeAsk,
+  readInheritanceDir,
+  readLaunchInheritance
+} from "./chunk-43OKHTW4.js";
+import {
+  formatLinuxHostClassNote,
+  resolveLinuxHostClass
+} from "./chunk-V2TVPO3X.js";
+import {
+  scopeChildEnvForProvider
+} from "./chunk-WGQAXLNA.js";
+import {
+  BUILD_SKIP_READINESS_PREFLIGHT,
+  BUILD_STRICT_READINESS,
+  readRawEnv
+} from "./chunk-7VRJHTGZ.js";
+
+// src/core/providers/readiness.ts
+import { constants as fsConstants } from "fs";
+import { access } from "fs/promises";
+import path from "path";
+import { execa } from "execa";
+
+// src/core/providers/provider-execution-env.ts
+var DEFAULT_BLOCKED_CREDENTIAL_KEYS = [
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AWS_ACCESS_KEY_ID",
+  "GITHUB_TOKEN",
+  "GH_TOKEN",
+  // A GitHub credential alias read by Build's own environment helpers; only
+  // copilot re-admits it (below), like the two GitHub tokens above.
+  "COPILOT_TOKEN",
+  // The npm publish/registry token rides the generic NPM_ prefix. No provider
+  // CLI needs it, so provider children never receive it (Build-owned children
+  // built directly with buildChildProcessEnv keep it for registry access).
+  "NPM_TOKEN"
+];
+var GROK_ADMITTED_ENV_KEYS = ["XAI_API_KEY", "GROK_CODE_XAI_API_KEY", "GROK_HOME"];
+var GROK_COMPAT_OFF = Object.fromEntries(
+  ["CLAUDE", "CURSOR", "CODEX"].flatMap(
+    (source) => ["AGENTS", "HOOKS", "MCPS", "RULES", "SKILLS"].map((kind) => [
+      `GROK_${source}_${kind}_ENABLED`,
+      "false"
+    ])
+  )
+);
+var OPENCODE_API_KEY_ENV_VARS = ["SYNTHETIC_API_KEY", "ZAI_API_KEY", "ZHIPU_API_KEY"];
+function shouldIsolateHostConfiguration(options) {
+  return options.isolateHostConfiguration === true || options.executionIntent === "analysis";
+}
+function mergeExecutionEnv(baseEnv, overrides) {
+  const merged = { ...baseEnv };
+  if (!overrides) {
+    return merged;
+  }
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value === void 0 || value === null) {
+      delete merged[key];
+      continue;
+    }
+    merged[key] = value;
+  }
+  return merged;
+}
+var AWS_STATIC_SECRET_KEYS = [
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AWS_ACCESS_KEY_ID"
+];
+var PROVIDER_ENV_POLICIES = {
+  claude: {
+    // Forwarding is not routing: Claude still selects Bedrock via its backend.
+    allowBlockedKeys: ({ effectiveEnv, workingDir }) => resolveClaudeBackend(effectiveEnv, workingDir) === "bedrock" ? [...AWS_STATIC_SECRET_KEYS] : [],
+    normalizeOverrides: ({
+      effectiveEnv,
+      inheritance,
+      isolateHostConfiguration,
+      overrides,
+      workingDir
+    }) => synthesizeClaudeBackendEnv(
+      {
+        ...overrides ?? {},
+        ...isolateHostConfiguration ? { BUILD_CLAUDE_SAFE_MODE: "1" } : {},
+        // Loads the CLAUDE.md in the added inheritance folder (claude/execution/inherited-instructions.ts).
+        ...readInheritanceDir(effectiveEnv) && deliversBuildSet(inheritance) ? { CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD: "1" } : {}
+      },
+      resolveClaudeBackend(effectiveEnv, workingDir)
+    )
+  },
+  cursor: {
+    normalizeOverrides: ({ isolateHostConfiguration, overrides }) => isolateHostConfiguration ? { ...overrides ?? {}, BUILD_CURSOR_APPROVE_MCPS: "0" } : overrides
+  },
+  copilot: {
+    allowBlockedKeys: () => ["GITHUB_TOKEN", "GH_TOKEN", "COPILOT_TOKEN"]
+  },
+  codex: {
+    // Forward AWS env-key secrets always. BUILD_CODEX_BACKEND=bedrock still
+    // required to *route* to Bedrock vs OpenAI.
+    allowBlockedKeys: () => [...AWS_STATIC_SECRET_KEYS],
+    /**
+     * Child-env contract:
+     * - api_key mode (explicit BUILD_CODEX_AUTH_MODE=api_key): preserve keys so they reach the child
+     * - chatgpt_login (default) / other: strip OPENAI_API_KEY, CODEX_API_KEY, CODEX_TOKEN
+     *
+     * Uses the shared shouldPassCodexApiKeys vocabulary so readiness and spawn stay aligned.
+     */
+    finalizeEnv: (env, { effectiveEnv }) => {
+      if (shouldPassCodexApiKeys(effectiveEnv)) {
+        return env;
+      }
+      const filtered = { ...env };
+      for (const key of CODEX_API_KEY_ENV_VARS) {
+        delete filtered[key];
+      }
+      return filtered;
+    }
+  },
+  grok: {
+    additionalAllowedKeys: () => GROK_ADMITTED_ENV_KEYS,
+    // Grok also reads Claude and Cursor instructions, rules, skills, hooks, and MCP
+    // servers by default; a launch that leaves out agent globals switches those off.
+    normalizeOverrides: ({ inheritance, overrides }) => excludesAgentGlobals(inheritance) ? { ...overrides ?? {}, ...GROK_COMPAT_OFF } : overrides
+  },
+  opencode: {
+    // OpenCode has no Bedrock routing switch; it selects Bedrock via --model /
+    // opencode.json. Forward the same AWS env-key secrets native `opencode` sees.
+    allowBlockedKeys: () => [...AWS_STATIC_SECRET_KEYS],
+    additionalAllowedKeys: () => OPENCODE_API_KEY_ENV_VARS
+  }
+};
+function launchInheritanceOverride(inheritance, inheritanceDir, overrides) {
+  if (!inheritance) return overrides;
+  const parent = mergeExecutionEnv(process.env, overrides);
+  const recorded = {};
+  const values = [
+    [LAUNCH_INHERITANCE_ENV, formatLaunchInheritance(inheritance)],
+    [LAUNCH_INHERITANCE_DIR_ENV, inheritanceDir ?? ""]
+  ];
+  for (const [key, value] of values) {
+    if (value || parent[key]) recorded[key] = value;
+  }
+  return Object.keys(recorded).length > 0 ? { ...overrides ?? {}, ...recorded } : overrides;
+}
+function buildProviderExecutionEnv(provider, overrides, options = {}) {
+  const normalizedProvider = provider.toLowerCase();
+  const policy = PROVIDER_ENV_POLICIES[normalizedProvider];
+  const inheritanceOverride = launchInheritanceOverride(
+    options.inheritance,
+    options.inheritanceDir,
+    overrides
+  );
+  const effectiveEnv = mergeExecutionEnv(process.env, inheritanceOverride);
+  const inheritance = options.inheritance ?? readLaunchInheritance(effectiveEnv);
+  const context = {
+    effectiveEnv,
+    inheritance,
+    isolateHostConfiguration: shouldIsolateHostConfiguration(options) && !isNativeAsk(inheritance),
+    overrides: inheritanceOverride,
+    workingDir: options.workingDir
+  };
+  const blockedKeys = /* @__PURE__ */ new Set([
+    ...DEFAULT_BLOCKED_CREDENTIAL_KEYS,
+    ...options.blockedKeys ? Array.from(options.blockedKeys) : []
+  ]);
+  const normalizedOverrides = policy?.normalizeOverrides?.(context) ?? inheritanceOverride;
+  for (const key of policy?.allowBlockedKeys?.(context) ?? []) {
+    blockedKeys.delete(key);
+  }
+  const policyAdditionalKeys = policy?.additionalAllowedKeys?.(context);
+  const childEnv = scopeChildEnvForProvider(
+    buildChildProcessEnv({
+      overrides: normalizedOverrides,
+      additionalAllowedKeys: [
+        ...options.additionalAllowedKeys ? Array.from(options.additionalAllowedKeys) : [],
+        ...policyAdditionalKeys ? Array.from(policyAdditionalKeys) : []
+      ],
+      additionalAllowedPrefixes: options.additionalAllowedPrefixes,
+      blockedKeys,
+      filterOverrides: options.filterOverrides ?? false
+    }),
+    normalizedProvider
+  );
+  return policy?.finalizeEnv?.(childEnv, context) ?? childEnv;
+}
+
+// src/core/providers/readiness.ts
+function isProviderSkipAuthActive(config, env) {
+  const skipEnvVar = config.auth?.skip_env_var;
+  if (!skipEnvVar) {
+    return false;
+  }
+  return isSkipAuthEnvActive(skipEnvVar, env);
+}
+function resolveWriteBoundaryAdvisory(env) {
+  try {
+    const resolution = resolveLinuxHostClass(env ? { env } : {});
+    let detail;
+    if (resolution.hostClass === "desktop-unacked") {
+      detail = "Linux desktop write consent is not recorded. Run build sandbox trust linux --ack-desktop or build sandbox trust linux --host isolated.";
+    } else if (resolution.note) {
+      detail = resolution.note;
+    } else {
+      detail = formatLinuxHostClassNote(resolution) ?? `Host class ${resolution.hostClass} (source=${resolution.source})`;
+    }
+    return {
+      hostClass: resolution.hostClass,
+      source: String(resolution.source),
+      writesAllowed: resolution.writesAllowed,
+      detail
+    };
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthLabel(readiness) {
+  if (readiness.readinessNote === "env-var-auth-assumed") return "assumed-env";
+  switch (readiness.authenticated) {
+    case "yes":
+      return "authenticated";
+    case "no":
+      return "not-authenticated";
+    default:
+      return "unknown";
+  }
+}
+function resolveNamedReadiness(readiness, dryRun) {
+  const executableAvailable = readiness.installed && readiness.cliHealthy;
+  const configured = typeof readiness.configured === "boolean" ? readiness.configured : readiness.reasonCode !== "provider-not-found" && readiness.reasonCode !== "no-cli-channel" && readiness.known !== false;
+  const lastSuccessfulDryRun = dryRun?.fresh ? dryRun.lastSuccessMs : null;
+  const readyForRun = readiness.readinessNote === "env-var-auth-assumed" ? false : readiness.ready;
+  return {
+    configured,
+    authenticated: resolveAuthLabel(readiness),
+    executableAvailable,
+    lastSuccessfulDryRun,
+    readyForRun
+  };
+}
+function resolveProviderParityLabel(readiness, resolved) {
+  const named = resolved ?? resolveNamedReadiness(readiness);
+  if (!named.configured || !readiness.installed) {
+    return "missing";
+  }
+  if (!readiness.cliHealthy && readiness.reasonCode === "cli-unhealthy") {
+    return "installed-unhealthy";
+  }
+  if (!readiness.cliHealthy && readiness.reasonCode !== "cli-present-unprobed") {
+    return "installed-unhealthy";
+  }
+  if (readiness.readinessNote === "env-var-auth-assumed" || named.authenticated === "assumed-env") {
+    return "env-assumed";
+  }
+  if (readiness.ready && named.readyForRun) {
+    return "verified-ready";
+  }
+  if (readiness.authenticated === "no" || named.authenticated === "not-authenticated") {
+    return "auth-no";
+  }
+  return "auth-unknown";
+}
+function resolveAuthEvidence(readiness) {
+  if (readiness.readinessNote === "env-var-auth-assumed") {
+    return {
+      authEvidence: "assumed-env-var",
+      authDetail: "Auth inferred from a configured env var for setup readiness; execution still verifies provider access."
+    };
+  }
+  if (readiness.authenticated === "yes") {
+    return {
+      authEvidence: "provider-reported",
+      authDetail: "Provider readiness reported authentication available."
+    };
+  }
+  if (readiness.authenticated === "no") {
+    return {
+      authEvidence: "reported-missing",
+      authDetail: readiness.reason ?? "Provider readiness reported authentication missing."
+    };
+  }
+  if (readiness.warning?.includes("active auth probe")) {
+    return {
+      authEvidence: "active-unverified",
+      authDetail: readiness.warning ?? "Active auth probe could not verify headless execution; this is not a confirmed credential failure."
+    };
+  }
+  if (readiness.warning || readiness.reason?.includes("Authentication status unknown")) {
+    return {
+      authEvidence: "passive-unknown",
+      authDetail: readiness.warning ?? readiness.reason ?? "Passive readiness could not verify provider-owned authentication state."
+    };
+  }
+  return {
+    authEvidence: "not-collected",
+    authDetail: "Authentication status was not collected for this diagnostic."
+  };
+}
+function classifyProviderReadiness(readiness, resolved) {
+  const auth = resolveAuthEvidence(readiness);
+  const named = resolved ?? resolveNamedReadiness(readiness);
+  if (!named.configured || !readiness.installed) {
+    return {
+      readinessStatus: "unavailable",
+      readinessStatusDetail: readiness.reason ?? "CLI is not installed.",
+      ...auth
+    };
+  }
+  if (!readiness.cliHealthy && readiness.reasonCode !== "cli-present-unprobed") {
+    return {
+      readinessStatus: "broken",
+      readinessStatusDetail: readiness.reason ?? "CLI is installed but failed health probes.",
+      ...auth
+    };
+  }
+  if (readiness.sandboxCapable === false) {
+    const sandboxDetail = readiness.sandboxReason ?? readiness.reason ?? "Execute-tier sandbox/policy probe blocked provider state access.";
+    return {
+      readinessStatus: "installed-but-unverified",
+      readinessStatusDetail: `Readiness caveat: ${sandboxDetail} This is not a broken CLI or confirmed auth failure.`,
+      ...auth
+    };
+  }
+  if (readiness.readinessNote === "env-var-auth-assumed") {
+    return {
+      readinessStatus: "installed-but-unverified",
+      readinessStatusDetail: "CLI is installed and setup readiness is assumed from configured env auth; execution still verifies provider access.",
+      ...auth
+    };
+  }
+  if (readiness.sandboxCapable === true && readiness.authenticated === "no") {
+    return {
+      readinessStatus: "contained-auth-needed",
+      readinessStatusDetail: "CLI is contained and healthy, but authentication is missing.",
+      ...auth
+    };
+  }
+  if (readiness.sandboxCapable === true && readiness.ready) {
+    return {
+      readinessStatus: "contained-ready",
+      readinessStatusDetail: "CLI, auth, and execute-tier containment checks are ready.",
+      ...auth
+    };
+  }
+  if (readiness.authenticated === "no" || resolved?.authenticated === "not-authenticated") {
+    return {
+      readinessStatus: "normal-auth-needed",
+      readinessStatusDetail: "CLI is installed and healthy, but authentication is missing.",
+      ...auth
+    };
+  }
+  if (readiness.ready || resolved?.readyForRun) {
+    return {
+      readinessStatus: "normal-auth-ready",
+      readinessStatusDetail: "CLI is installed and auth readiness evidence is present.",
+      ...auth
+    };
+  }
+  return {
+    readinessStatus: "installed-but-unverified",
+    readinessStatusDetail: readiness.reason ?? "CLI is installed and healthy; auth checked on first run.",
+    ...auth
+  };
+}
+var SETUP_CHECK_READINESS_OPTIONS = {
+  mode: "setup",
+  sandboxProbeMode: "execute"
+};
+function resolveReadinessScopeLabel(readiness, resolved) {
+  if (!readiness.installed) return "unknown";
+  if (!readiness.cliHealthy && readiness.reasonCode !== "cli-present-unprobed") {
+    return "degraded";
+  }
+  if (readiness.sandboxCapable === false) return "degraded";
+  if (readiness.readinessNote === "env-var-auth-assumed") return "assumed";
+  if (readiness.ready && readiness.readinessNote !== "env-var-auth-assumed" || resolved?.readyForRun) {
+    return "execute-ready";
+  }
+  if (readiness.authenticated === "yes" || resolved?.authenticated === "authenticated") {
+    return "authenticated";
+  }
+  if (readiness.authenticated === "no" || resolved?.authenticated === "not-authenticated") {
+    return "auth-needed";
+  }
+  if (readiness.installed) return "installed";
+  return "unknown";
+}
+function resolveReadinessScope(readiness, resolved) {
+  const label = resolveReadinessScopeLabel(readiness, resolved);
+  switch (label) {
+    case "unknown":
+      if (!readiness.installed) {
+        return { label, detail: "CLI not installed" };
+      }
+      if (readiness.authenticated === "no" || resolved?.authenticated === "not-authenticated") {
+        return { label, detail: "Authentication not configured" };
+      }
+      return {
+        label,
+        detail: "CLI installed; auth checked on first run"
+      };
+    case "degraded":
+      if (!readiness.cliHealthy) {
+        return { label, detail: readiness.reason ?? "CLI not healthy" };
+      }
+      if (readiness.sandboxCapable === false) {
+        const sandboxDetail = readiness.sandboxReason ?? readiness.reason ?? "execute-tier sandbox/policy blocked provider state access";
+        return {
+          label,
+          detail: `Readiness caveat: ${sandboxDetail}`
+        };
+      }
+      return { label, detail: readiness.reason ?? "Provider degraded" };
+    case "assumed":
+      return {
+        label,
+        detail: "Assumed from configured env var for setup only; execution still verifies provider access"
+      };
+    case "auth-needed":
+      return { label, detail: "Authentication not configured" };
+    case "installed":
+      return {
+        label,
+        detail: "CLI installed; auth checked on first run"
+      };
+    case "authenticated":
+      return { label, detail: "Authenticated; execute-tier checks incomplete" };
+    case "execute-ready":
+      return { label };
+  }
+}
+function readinessProbeContextForOptions(options = {}) {
+  const modeProbes = options.mode ? readinessProbesForMode(options.mode) : void 0;
+  const cliProbeMode = options.cliProbeMode ?? modeProbes?.cliProbeMode ?? "execute";
+  const authProbeMode = options.probeAuth !== void 0 ? "deferred" : options.authProbeMode ?? modeProbes?.authProbeMode ?? "passive";
+  return {
+    mode: options.mode ?? "execute",
+    cliProbeMode,
+    authProbeMode,
+    sandboxProbeMode: options.sandboxProbeMode ?? (options.mode === "setup" ? "none" : "execute")
+  };
+}
+var EXECUTE_CLI_PROBE_OPTIONS = {
+  timeoutMs: 15e3,
+  retries: 1
+};
+function isCliProbeAlive(probe) {
+  return probe.present && (!probe.healthProbed || probe.healthy);
+}
+function readinessProbesForMode(mode) {
+  switch (mode) {
+    case "setup":
+      return { cliProbeMode: "execute", authProbeMode: "passive" };
+    case "execute":
+      return { cliProbeMode: "execute", authProbeMode: "passive" };
+  }
+}
+function formatAuthReadinessReason(displayName, authenticated, authProbeMode, authNote) {
+  if (authenticated === "yes") return void 0;
+  if (authenticated === "no") {
+    return authNote ? `Authentication missing. ${authNote}` : "Authentication missing";
+  }
+  if (authProbeMode === "active") {
+    const detail = authNote ? ` Detail: ${authNote}` : "";
+    return `${displayName} active auth probe could not verify headless execution; this is not a confirmed credential failure. Check provider runtime, sandbox, and CLI diagnostics.${detail}`;
+  }
+  return "Authentication status unknown; runtime will defer to the provider CLI.";
+}
+var ProviderNotReadyError = class extends Error {
+  provider;
+  readiness;
+  constructor(readiness, message = formatProviderNotReadyMessage(readiness)) {
+    super(message);
+    this.name = "ProviderNotReadyError";
+    this.provider = readiness.provider;
+    this.readiness = readiness;
+  }
+};
+var DEFAULT_CLI_PROBE_ARGS = [
+  ["--version"],
+  ["-v"],
+  ["--help"]
+];
+var CLI_PRESENT_PATTERNS = [
+  /unknown (flag|option|argument)/i,
+  /unrecognized (flag|option|argument)/i,
+  /invalid (flag|option|argument)/i,
+  /no such option/i
+];
+async function pathIsExecutable(filePath) {
+  try {
+    await access(filePath, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pathEntries() {
+  return (process.env.PATH ?? "").split(path.delimiter).map((entry) => entry.trim()).filter(Boolean);
+}
+function providerSupportsCli(config) {
+  if (config.id === "openrouter") return false;
+  if (!config.cli?.command || config.cli.command === "N/A") return false;
+  if (!Array.isArray(config.channels)) return true;
+  return config.channels.includes("cli");
+}
+async function probeProviderCliOnce(command, preferredArgs, prefixArgs, timeoutMs, env) {
+  const probeArgs = [
+    ...preferredArgs && preferredArgs.length > 0 ? [Array.from(preferredArgs)] : [],
+    ...DEFAULT_CLI_PROBE_ARGS
+  ];
+  let lastErrorMessage;
+  let sawUnknownFlag = false;
+  const timeoutResult = {
+    present: true,
+    healthy: false,
+    healthProbed: true,
+    degradedReason: `CLI probe timed out after ${timeoutMs}ms`
+  };
+  for (const args of probeArgs) {
+    let deadlineExpired = false;
+    let closePipes;
+    try {
+      const child = execa(command, [...prefixArgs ?? [], ...args], {
+        timeout: timeoutMs,
+        env,
+        extendEnv: false
+      });
+      if (timeoutMs > 0) {
+        closePipes = setTimeout(() => {
+          deadlineExpired = true;
+          for (const stream of [child.stdout, child.stderr]) stream?.destroy();
+        }, timeoutMs);
+      }
+      await child;
+      if (deadlineExpired) return timeoutResult;
+      return { present: true, healthy: true, healthProbed: true };
+    } catch (error) {
+      const err = error;
+      if (deadlineExpired || err.timedOut) return timeoutResult;
+      const message = err?.message ?? "";
+      const stderr = err?.stderr ?? "";
+      const combined = `${message}
+${stderr}`;
+      const isNotFound = err?.code === "ENOENT" || /spawn .* ENOENT/i.test(message) || /\bENOENT\b/i.test(message) || /command not found/i.test(combined) || /is not recognized as an internal or external command/i.test(combined);
+      if (isNotFound) {
+        return { present: false, healthy: false, healthProbed: true };
+      }
+      if (CLI_PRESENT_PATTERNS.some((pattern) => pattern.test(combined))) {
+        sawUnknownFlag = true;
+        continue;
+      }
+      lastErrorMessage = (stderr || message).trim() || lastErrorMessage;
+    } finally {
+      if (closePipes) clearTimeout(closePipes);
+    }
+  }
+  return {
+    present: true,
+    healthy: false,
+    healthProbed: true,
+    degradedReason: lastErrorMessage ?? (sawUnknownFlag ? "CLI found but did not accept version/help probes" : "CLI found but failed to respond to version/help probes")
+  };
+}
+async function probeProviderCli(command, preferredArgs, prefixArgs, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const maxAttempts = (options.retries ?? 0) + 1;
+  const env = buildProviderExecutionEnv(options.providerId ?? "", options.env);
+  let lastResult = { present: false, healthy: false };
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    lastResult = await probeProviderCliOnce(command, preferredArgs, prefixArgs, timeoutMs, env);
+    if (lastResult.present && lastResult.healthy) {
+      return lastResult;
+    }
+    if (!lastResult.present) {
+      return lastResult;
+    }
+  }
+  return lastResult;
+}
+async function probeProviderCliPresence(command, prefixArgs, options = {}) {
+  if (prefixArgs && prefixArgs.length > 0) {
+    return probeProviderCli(command, ["--version"], prefixArgs, options);
+  }
+  if (path.isAbsolute(command) || command.includes(path.sep)) {
+    return await pathIsExecutable(command) ? { present: true, healthy: false, healthProbed: false } : { present: false, healthy: false, healthProbed: false };
+  }
+  for (const entry of pathEntries()) {
+    const candidate = path.join(entry, command);
+    if (await pathIsExecutable(candidate)) {
+      return { present: true, healthy: false, healthProbed: false };
+    }
+  }
+  return { present: false, healthy: false, healthProbed: false };
+}
+function isSetupTierReadiness(options) {
+  if (options.mode === "setup") return true;
+  if (options.mode === "execute") return false;
+  return options.cliProbeMode === "presence" && options.authProbeMode !== "active";
+}
+function readConfiguredEnvValue(env, key) {
+  return env ? env[key] : process.env[key];
+}
+function hasConfiguredEnvVarAuth(config, env) {
+  const envVars = config.auth?.env_vars ?? [];
+  return envVars.some((key) => {
+    const value = readConfiguredEnvValue(env, key);
+    return typeof value === "string" && value.trim().length > 0;
+  });
+}
+function resolveEnvVarAuthReadinessPromotion(_providerId, config, authenticated, sandboxBlocked, options) {
+  if (authenticated !== "unknown" || sandboxBlocked) return void 0;
+  if (readRawEnv(BUILD_STRICT_READINESS) === "1") return void 0;
+  if (!hasConfiguredEnvVarAuth(config, options.authProbeEnv)) return void 0;
+  return "env-var-auth-assumed";
+}
+function normalizePassiveAuthForEnvVarPromotion(providerId, config, authenticated, authProbeMode, options) {
+  if (!isSetupTierReadiness(options)) return authenticated;
+  if (authenticated !== "no") return authenticated;
+  if (authProbeMode === "active") return authenticated;
+  if (providerId !== "opencode") return authenticated;
+  if (!hasConfiguredEnvVarAuth(config, options.authProbeEnv)) return authenticated;
+  return "unknown";
+}
+function shouldProbeSandboxCapability(executeTier, options) {
+  if (options.sandboxProbeMode === "none") return false;
+  if (options.probeSandboxCapability) return true;
+  if (options.sandboxProbeMode === "execute") {
+    const runningUnderVitest2 = Boolean(process.env.VITEST || process.env.VITEST_WORKER_ID) || process.env.NODE_ENV === "test";
+    return !runningUnderVitest2;
+  }
+  if (!executeTier) return false;
+  const runningUnderVitest = Boolean(process.env.VITEST || process.env.VITEST_WORKER_ID) || process.env.NODE_ENV === "test";
+  return !runningUnderVitest;
+}
+async function probeProviderAuthReadinessPassive(providerId, config, env) {
+  if (isProviderSkipAuthActive(config, env)) return "yes";
+  const { invokeProviderAuthState } = await import("./invoke-provider-auth-NEWEIHCI.js");
+  return invokeProviderAuthState(providerId, env ? { mode: "passive", env } : "passive");
+}
+async function probeProviderAuthReadiness(providerId, config, options = {}) {
+  return (await probeProviderAuthReadinessDetailed(providerId, config, options)).state;
+}
+async function probeProviderAuthReadinessDetailed(providerId, config, options = {}) {
+  const providerConfig = config ?? ProviderRegistry.getProviderConfig(providerId);
+  const mode = options.mode ?? "passive";
+  if (mode === "passive") {
+    const state = await probeProviderAuthReadinessPassive(providerId, providerConfig, options.env);
+    if (state === "no") return { state };
+    const cached = await lookupAuthOutcome(providerId, options.env ? { env: options.env } : {});
+    return cached && !cached.stale && cached.contextMatches && cached.entry.result === "ok" ? { state: "yes", evidence: "execution" } : { state };
+  }
+  if (isProviderSkipAuthActive(providerConfig, options.env)) return { state: "yes" };
+  const { invokeProviderAuthReadiness } = await import("./invoke-provider-auth-NEWEIHCI.js");
+  try {
+    return await invokeProviderAuthReadiness(
+      providerId,
+      options.env ? { mode: "active", env: options.env } : "active"
+    );
+  } catch {
+    return { state: "unknown" };
+  }
+}
+async function getProviderReadiness(providerId, options = {}) {
+  let config;
+  try {
+    config = options.providers?.find((provider) => provider.id === providerId) ?? ProviderRegistry.getProviderConfig(providerId);
+  } catch (error) {
+    return {
+      provider: providerId,
+      displayName: providerId,
+      known: false,
+      configured: false,
+      installed: false,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      order: 99,
+      reasonCode: "provider-not-found",
+      reason: error instanceof Error ? error.message : "Provider not found"
+    };
+  }
+  const installCommand = config.cli?.install_command;
+  const normalizedProviderId = config.id ?? providerId;
+  const displayName = config.display_name ?? normalizedProviderId;
+  const order = config.order ?? 99;
+  const experimental = resolveProviderReleaseStatus(config) === "experimental";
+  if (!providerSupportsCli(config)) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: false,
+      installed: false,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "no-cli-channel",
+      reason: "Provider does not expose a local CLI execution channel"
+    };
+  }
+  let cli;
+  try {
+    cli = (options.resolveCliCommand ?? resolveProviderCliCommand)(normalizedProviderId);
+  } catch (error) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: true,
+      installed: false,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "cli-resolve-failed",
+      reason: error instanceof Error ? error.message : "Provider CLI could not be resolved"
+    };
+  }
+  const modeProbes = options.mode ? readinessProbesForMode(options.mode) : void 0;
+  const cliProbeMode = options.cliProbeMode ?? modeProbes?.cliProbeMode;
+  const authProbeMode = options.authProbeMode ?? modeProbes?.authProbeMode;
+  const executeTier = options.mode === "execute" || options.mode === void 0 && cliProbeMode === "execute";
+  const healthProbeRequested = cliProbeMode === "execute";
+  const setupTier = isSetupTierReadiness(options);
+  const cliProbeOptions = {
+    ...healthProbeRequested ? EXECUTE_CLI_PROBE_OPTIONS : {},
+    providerId: normalizedProviderId,
+    env: options.authProbeEnv
+  };
+  const probe = options.probeCli !== void 0 ? await options.probeCli(cli.command, ["--version"], cli.prefixArgs) : cliProbeMode === "presence" ? await probeProviderCliPresence(cli.command, cli.prefixArgs, cliProbeOptions) : await probeProviderCli(cli.command, ["--version"], cli.prefixArgs, cliProbeOptions);
+  if (!probe.present) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: true,
+      installed: false,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      command: cli.command,
+      prefixArgs: cli.prefixArgs,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "cli-not-installed",
+      reason: "CLI is not installed"
+    };
+  }
+  const healthProbed = probe.healthProbed === true || probe.healthy === true;
+  const presenceOnly = cliProbeMode === "presence" && !healthProbed && !probe.healthy;
+  if (!probe.healthy && !presenceOnly) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: true,
+      installed: true,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      command: cli.command,
+      prefixArgs: cli.prefixArgs,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "cli-unhealthy",
+      reason: probe.degradedReason ?? "CLI found but failed health probes"
+    };
+  }
+  const cliHealthy = probe.healthy;
+  const presentUnprobed = presenceOnly;
+  const sandboxCapability = shouldProbeSandboxCapability(executeTier, options) ? options.probeSandboxCapability ? options.probeSandboxCapability(normalizedProviderId) : probeProviderSandboxCapability(normalizedProviderId, {
+    env: options.authProbeEnv
+  }) : void 0;
+  const sandboxCapable = sandboxCapability?.capable;
+  const sandboxReason = sandboxCapability && !sandboxCapability.capable ? formatSandboxCapabilityFailure(sandboxCapability) : void 0;
+  const sandboxBlocked = sandboxCapable === false;
+  const sandboxDeniedPaths = sandboxCapability?.missing.map((entry) => entry.path);
+  const writeBoundary = resolveWriteBoundaryAdvisory(options.authProbeEnv);
+  if (sandboxBlocked) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: true,
+      installed: true,
+      // Presence-only leaves health unverified; execute probes that reached here were healthy.
+      cliHealthy: !presentUnprobed,
+      authenticated: "unknown",
+      sandboxCapable,
+      ...sandboxReason ? { sandboxReason } : {},
+      ...sandboxDeniedPaths && sandboxDeniedPaths.length > 0 ? { sandboxDeniedPaths } : {},
+      ...writeBoundary ? { writeBoundary } : {},
+      ready: false,
+      command: cli.command,
+      prefixArgs: cli.prefixArgs,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "sandbox-blocked",
+      reason: sandboxReason
+    };
+  }
+  const injectedAuthProbe = options.probeAuth;
+  const authReadiness = injectedAuthProbe ? { state: await injectedAuthProbe(normalizedProviderId, config) } : await probeProviderAuthReadinessDetailed(normalizedProviderId, config, {
+    mode: authProbeMode ?? "passive",
+    ...options.authProbeEnv ? { env: options.authProbeEnv } : {}
+  });
+  const rawAuthenticated = authReadiness.state;
+  const normalizedAuthenticated = injectedAuthProbe ? rawAuthenticated : normalizePassiveAuthForEnvVarPromotion(
+    normalizedProviderId,
+    config,
+    rawAuthenticated,
+    authProbeMode,
+    options
+  );
+  const unverifiedEnvAuth = !injectedAuthProbe && authReadiness.evidence !== "execution" && !isProviderSkipAuthActive(config, options.authProbeEnv) && hasConfiguredEnvVarAuth(config, options.authProbeEnv);
+  const authenticated = unverifiedEnvAuth && !(authProbeMode === "active" && normalizedAuthenticated === "no") ? "unknown" : normalizedAuthenticated;
+  const readinessNote = resolveEnvVarAuthReadinessPromotion(
+    normalizedProviderId,
+    config,
+    authenticated,
+    sandboxBlocked,
+    options
+  );
+  const ready = readinessNote !== void 0 ? setupTier && cliHealthy : authenticated === "yes" && !sandboxBlocked && (cliHealthy || !presentUnprobed);
+  const attemptEligible = executeTier && !sandboxBlocked && (authenticated === "unknown" || readinessNote !== void 0) && authenticated !== "no";
+  const authReason = formatAuthReadinessReason(
+    displayName,
+    authenticated,
+    authProbeMode,
+    authReadiness.reason ?? config.auth?.note
+  );
+  const authWarning = authenticated === "unknown" ? authProbeMode === "active" ? `${displayName} active auth probe could not verify headless execution; runtime may still fail in the provider CLI.${authReadiness.reason ? ` Detail: ${authReadiness.reason}` : ""}` : "Auth status was not collected by passive readiness checks; runtime will defer to the provider CLI." : void 0;
+  const reasonCode = (() => {
+    if (ready && readinessNote === void 0) return "ready";
+    if (readinessNote !== void 0) return "env-var-auth-assumed";
+    if (authenticated === "no") return "auth-missing";
+    if (authProbeMode === "active" && authenticated === "unknown") {
+      return "auth-active-unverified";
+    }
+    if (authenticated === "unknown") return "auth-unknown";
+    if (presentUnprobed) return "cli-present-unprobed";
+    return "ready";
+  })();
+  return {
+    provider: normalizedProviderId,
+    displayName,
+    known: true,
+    configured: true,
+    installed: true,
+    cliHealthy,
+    authenticated,
+    ...authProbeMode === "active" && authReadiness.evidence ? { authEvidence: "execution" } : {},
+    ...sandboxCapable !== void 0 ? { sandboxCapable } : {},
+    ...sandboxReason ? { sandboxReason } : {},
+    ...writeBoundary ? { writeBoundary } : {},
+    ready,
+    ...readinessNote ? { readinessNote } : {},
+    ...attemptEligible ? { attemptEligible: true } : {},
+    ...experimental ? { experimental: true } : {},
+    command: cli.command,
+    prefixArgs: cli.prefixArgs,
+    installCommand,
+    authCommand: config.auth?.note,
+    order,
+    reasonCode,
+    reason: ready && readinessNote === void 0 ? void 0 : readinessNote ? "Auth assumed from configured env var; not verified for execute-tier readiness." : authReason,
+    warning: authWarning
+  };
+}
+async function getAllProviderReadiness(options = {}) {
+  const providers = (options.providers ?? ProviderRegistry.getEnabledProviders()).filter(
+    providerSupportsCli
+  );
+  const results = await Promise.all(
+    providers.map((provider) => getProviderReadiness(provider.id, { ...options, providers }))
+  );
+  return results.sort((a, b) => a.order - b.order);
+}
+function selectReadyProvider(readiness) {
+  const ready = readiness.filter((provider) => provider.ready).sort((a, b) => a.order - b.order);
+  if (ready.length === 0) {
+    return { kind: "none", candidates: readiness };
+  }
+  const stable = ready.filter((provider) => !provider.experimental);
+  const candidates = stable.length > 0 ? stable : ready;
+  if (candidates.length === 1 && candidates[0]) {
+    return { kind: "single", provider: candidates[0], candidates };
+  }
+  return { kind: "multiple", candidates };
+}
+function formatProviderSetupGuidance(readiness) {
+  const lines = ["No ready AI provider CLI found.", "", "Install or authenticate one provider:"];
+  const candidates = readiness.length > 0 ? readiness : [];
+  for (const provider of candidates) {
+    const action = provider.installed ? provider.authCommand ?? `Authenticate ${provider.displayName}` : provider.installCommand ?? `Install ${provider.displayName}`;
+    lines.push(`  ${provider.displayName}: ${action}`);
+  }
+  lines.push("", "Run build provider list after setup completes.");
+  return lines.join("\n");
+}
+function formatProviderNotReadyMessage(readiness, options = {}) {
+  if (readiness.sandboxCapable === false) {
+    const roleSuffix = options.role ? ` (${options.role})` : "";
+    const deniedPaths = readiness.sandboxDeniedPaths?.join(", ");
+    const pathLine = deniedPaths ? `Denied path(s): ${deniedPaths}.` : void 0;
+    const reason2 = readiness.sandboxReason ?? readiness.reason ?? "Required state paths are not writable.";
+    return [
+      `${readiness.displayName}${roleSuffix} is blocked by sandbox/policy access, not an auth failure.`,
+      pathLine,
+      reason2,
+      "Action: grant write access to the denied path(s) in the effective sandbox, or run outside the inherited sandbox.",
+      `Run build doctor --provider ${readiness.provider} for execute-tier diagnostics.`
+    ].filter((line) => Boolean(line)).join("\n");
+  }
+  const reason = readiness.reason ?? "provider is not ready";
+  const action = readiness.installed ? readiness.authCommand ?? `Authenticate ${readiness.displayName}` : readiness.installCommand ?? `Install ${readiness.displayName}`;
+  const subject = options.surface === "fusion" ? `Fusion panel member ${readiness.displayName}` : `Configured provider ${readiness.displayName}`;
+  return [
+    `${subject} is not ready: ${reason}.`,
+    `Action: ${action}`,
+    "Run build provider list after setup completes."
+  ].join("\n");
+}
+function isSandboxOnlyReadinessBlock(readiness) {
+  return readiness.sandboxCapable === false && readiness.installed === true && readiness.cliHealthy === true && readiness.authenticated !== "no";
+}
+function shouldBlockOnProviderReadiness(readiness) {
+  if (readiness.ready) {
+    return false;
+  }
+  if (readiness.attemptEligible) {
+    return false;
+  }
+  return true;
+}
+async function assertProviderReady(providerId, options = {}) {
+  if (readRawEnv(BUILD_SKIP_READINESS_PREFLIGHT) === "1") {
+    return getProviderReadiness(providerId, {
+      mode: options.mode ?? "execute",
+      probeAuth: async () => "unknown"
+    });
+  }
+  const readiness = await getProviderReadiness(providerId, {
+    mode: options.mode ?? "execute",
+    probeAuth: async () => "unknown"
+  });
+  if (shouldBlockOnProviderReadiness(readiness)) {
+    throw new ProviderNotReadyError(readiness);
+  }
+  return readiness;
+}
+function isGateReadyProvider(readiness) {
+  if (readiness.ready) return true;
+  return readiness.cliHealthy && readiness.readinessNote === "env-var-auth-assumed";
+}
+function buildRemediation(readiness) {
+  if (isGateReadyProvider(readiness)) return void 0;
+  if (!readiness.configured || !readiness.known) {
+    return `${readiness.displayName}: provider is not configured for local CLI use`;
+  }
+  if (!readiness.installed) {
+    return readiness.installCommand ? `${readiness.displayName}: install with \`${readiness.installCommand}\`` : `${readiness.displayName}: install the provider CLI`;
+  }
+  if (!readiness.cliHealthy && readiness.reasonCode === "cli-unhealthy") {
+    return `${readiness.displayName}: CLI is installed but unhealthy${readiness.reason ? ` (${readiness.reason})` : ""}`;
+  }
+  if (readiness.authenticated === "no") {
+    return readiness.authCommand ? `${readiness.displayName}: authenticate with \`${readiness.authCommand}\`` : `${readiness.displayName}: authenticate the provider CLI`;
+  }
+  if (readiness.authenticated === "unknown") {
+    return `${readiness.displayName}: installed; auth checked on first run; run \`build doctor --probe --provider ${readiness.provider}\` or \`build provider setup\``;
+  }
+  return readiness.reason ? `${readiness.displayName}: ${readiness.reason}` : `${readiness.displayName}: not ready`;
+}
+function toSnapshot(readiness, dryRun) {
+  const resolved = resolveNamedReadiness(readiness, dryRun);
+  const classification = classifyProviderReadiness(readiness, resolved);
+  const scope = resolveReadinessScope(readiness, resolved);
+  return {
+    readiness,
+    resolved,
+    classification,
+    scope,
+    parityLabel: resolveProviderParityLabel(readiness, resolved)
+  };
+}
+async function collectProviderReadinessGate(options = {}) {
+  const baseOptions = options.readinessOptions ?? {
+    mode: "setup",
+    sandboxProbeMode: "none"
+  };
+  let readinessList = await getAllProviderReadiness(baseOptions);
+  if (options.activeAuthWhenNeeded) {
+    readinessList = await Promise.all(
+      readinessList.map(async (entry) => {
+        if (isGateReadyProvider(entry)) return entry;
+        if (!entry.installed) return entry;
+        if (entry.authenticated === "no") return entry;
+        return getProviderReadiness(entry.provider, {
+          ...baseOptions,
+          mode: baseOptions.mode ?? "execute",
+          authProbeMode: "active",
+          cliProbeMode: baseOptions.cliProbeMode ?? "execute",
+          providers: baseOptions.providers,
+          resolveCliCommand: baseOptions.resolveCliCommand,
+          probeCli: baseOptions.probeCli,
+          authProbeEnv: baseOptions.authProbeEnv,
+          probeSandboxCapability: baseOptions.probeSandboxCapability,
+          sandboxProbeMode: baseOptions.sandboxProbeMode
+        });
+      })
+    );
+  }
+  const providers = readinessList.map(
+    (entry) => toSnapshot(entry, options.dryRunForProvider?.(entry.provider))
+  );
+  const readyProviders = providers.filter((entry) => isGateReadyProvider(entry.readiness)).map((entry) => entry.readiness.provider);
+  const readyCount = readyProviders.length;
+  const gateLabel = readyCount === 0 ? "zero-ready" : readyCount === 1 ? "one-ready" : "multi-ready";
+  const requireAtLeastOneReady = options.requireAtLeastOneReady === true;
+  const gatePassed = !requireAtLeastOneReady || readyCount > 0;
+  const remediations = providers.map((entry) => buildRemediation(entry.readiness)).filter((line) => Boolean(line));
+  return {
+    providers,
+    readyCount,
+    readyProviders,
+    gatePassed,
+    gateLabel,
+    remediations
+  };
+}
+
+export {
+  mergeExecutionEnv,
+  buildProviderExecutionEnv,
+  resolveNamedReadiness,
+  resolveProviderParityLabel,
+  classifyProviderReadiness,
+  SETUP_CHECK_READINESS_OPTIONS,
+  resolveReadinessScope,
+  readinessProbeContextForOptions,
+  EXECUTE_CLI_PROBE_OPTIONS,
+  isCliProbeAlive,
+  readinessProbesForMode,
+  ProviderNotReadyError,
+  probeProviderCli,
+  probeProviderCliPresence,
+  probeProviderAuthReadiness,
+  getProviderReadiness,
+  getAllProviderReadiness,
+  selectReadyProvider,
+  formatProviderSetupGuidance,
+  formatProviderNotReadyMessage,
+  isSandboxOnlyReadinessBlock,
+  shouldBlockOnProviderReadiness,
+  assertProviderReady,
+  isGateReadyProvider,
+  collectProviderReadinessGate
+};
+//# sourceMappingURL=chunk-XTXYIISX.js.map