@evident-ai/cli 3.6.1-dev.ebfd455 → 3.6.1-dev.eedc5a9

package/README.md

@@ -125,6 +125,10 @@ Options:
 - `--opencode-config-overlay <path>` — Apply a runner-provided OpenCode config
   before starting OpenCode. Relative paths are resolved from the working directory;
   an existing `opencode.jsonc` is replaced before `opencode.json`.
+- `--auto-configure-credentials-proxy` — Install Evident's generated `evident-*`
+  OpenCode provider entries for the runner's credential pool. This is off by default;
+  without it, the CLI only delivers `EVIDENT_PROXY_TOKEN` and leaves provider
+  configuration to you.
 - `--credential-sync-marker <path>` — Own the interval credential sync and write
   this marker once the shutdown flush has finished, so the runner image's lifecycle
   hooks can wait on it.

package/dist/index.js

@@ -1442,7 +1442,7 @@ import ora4 from "ora";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/lib/telemetry.ts
-var CLI_VERSION = (true ? "3.6.1-dev.ebfd455" : void 0) ?? process.env.npm_package_version ?? "unknown";
+var CLI_VERSION = (true ? "3.6.1-dev.eedc5a9" : void 0) ?? process.env.npm_package_version ?? "unknown";
 function getCliVersion() {
   return CLI_VERSION;
 }
@@ -13920,22 +13920,6 @@ function mergeManagedOpenCodeConfigContent(content, managedProviders) {
   }
   return JSON.stringify({ ...config, provider: { ...provider, ...managedProviders } });
 }
-function removeManagedOpenCodeConfigContent(content) {
-  if (!content?.trim()) return content;
-  const config = parseConfigContent(content);
-  if (typeof config.provider !== "object" || config.provider === null || Array.isArray(config.provider)) {
-    return content;
-  }
-  const provider = { ...config.provider };
-  let changed = false;
-  for (const namespace of CREDENTIAL_PROXY_NATIVE_NAMESPACES) {
-    if (namespace in provider) {
-      delete provider[namespace];
-      changed = true;
-    }
-  }
-  return changed ? JSON.stringify({ ...config, provider }) : content;
-}
 function isFile(filePath) {
   return existsSync2(filePath) && statSync6(filePath).isFile();
 }
@@ -14406,16 +14390,6 @@ function clearLocalSetup(options) {
   const env = options.env ?? process.env;
   (options.store ?? defaultStore).clear(options.agentId);
   delete env.EVIDENT_PROXY_TOKEN;
-  try {
-    const content = removeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT);
-    if (content === void 0) delete env.OPENCODE_CONFIG_CONTENT;
-    else env.OPENCODE_CONFIG_CONTENT = content;
-  } catch (error2) {
-    options.log(
-      "MANAGED-INFERENCE-CLEANUP-PARTIAL: stored credentials were removed, but malformed OPENCODE_CONFIG_CONTENT could not be inspected",
-      "warn"
-    );
-  }
 }
 async function discoverManagedInferenceSetup(options) {
   const headers = requestHeaders(options);
@@ -14453,31 +14427,37 @@ async function post(options, operation, body) {
   }
 }
 function applyCredential(options, credential) {
-  const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
-    inferenceBaseUrl: credential.inferenceBaseUrl,
-    modelDescriptors: credential.modelDescriptors
-  });
-  if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
-    return "Managed setup contains unsupported provider descriptors";
-  }
   const env = options.env ?? process.env;
   let merged;
-  try {
-    merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
-  } catch (error2) {
-    return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+  if (options.autoConfigureCredentialsProxy) {
+    const { config, unsupportedProviders } = buildCredentialProxyNativeConfig({
+      inferenceBaseUrl: credential.inferenceBaseUrl,
+      modelDescriptors: credential.modelDescriptors
+    });
+    if (unsupportedProviders.length > 0 || Object.keys(config.provider).length === 0) {
+      return "Managed setup contains unsupported provider descriptors";
+    }
+    try {
+      merged = mergeManagedOpenCodeConfigContent(env.OPENCODE_CONFIG_CONTENT, config.provider);
+    } catch (error2) {
+      return "OPENCODE_CONFIG_CONTENT is malformed; managed providers were not installed";
+    }
   }
   try {
     (options.store ?? defaultStore).set(options.agentId, credential);
   } catch (error2) {
+    const detail = (error2 instanceof Error ? error2.message : String(error2)).replaceAll(
+      credential.token,
+      "[redacted]"
+    );
     options.log(
-      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation}`,
+      `MANAGED-INFERENCE-STORE-FAILED: runner=${options.agentId} generation=${credential.generation} detail=${redactDiagnosticText(detail)}`,
       "warn"
     );
     return "Managed credentials could not be written to the protected store";
   }
   env.EVIDENT_PROXY_TOKEN = credential.token;
-  env.OPENCODE_CONFIG_CONTENT = merged;
+  if (merged !== void 0) env.OPENCODE_CONFIG_CONTENT = merged;
   return null;
 }
 async function reportManagedInferenceApplyFailure(options, failure) {
@@ -14566,7 +14546,7 @@ async function acknowledgeManagedInferenceSetup(options, preparation) {
   const response = await post(options, "acknowledge", {
     generation: preparation.generation,
     token_id: preparation.tokenId,
-    config_validated: true
+    config_validated: options.autoConfigureCredentialsProxy === true
   });
   if (!response?.ok) {
     throw new Error(
@@ -16369,6 +16349,7 @@ async function run(options) {
       agentId: state.agentId,
       apiUrl: getApiUrlConfig(),
       getAuthHeader: () => state.authHeader,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       log: (message, level = "info") => logActivity(state, {
         type: level === "error" ? "error" : "info",
         level,
@@ -16996,6 +16977,9 @@ program.command("run").description("Connect to Evident and process messages").op
 ).option(
   "--opencode-config-overlay <path>",
   "Apply this runner-provided OpenCode config before starting OpenCode."
+).option(
+  "--auto-configure-credentials-proxy",
+  "Install Evident's generated OpenCode providers for the runner's credential pool (off by default)."
 ).option(
   "--credential-sync-marker <path>",
   "Own the interval credential sync and write this marker once the shutdown flush has finished, so the runner image's lifecycle hooks can wait on it."
@@ -17039,6 +17023,7 @@ program.command("run").description("Connect to Evident and process messages").op
       restoreSessionDb: options.restoreSessionDb,
       restoreRunnerCredentials: options.restoreRunnerCredentials,
       opencodeConfigOverlay: options.opencodeConfigOverlay,
+      autoConfigureCredentialsProxy: options.autoConfigureCredentialsProxy,
       credentialSyncMarker: options.credentialSyncMarker
     });
   }