@fased/fased 0.1.62 → 0.1.65

package/dist/agents/auth-profiles/store.js

@@ -1,4 +1,5 @@
 import { resolveOAuthPath } from "../../config/paths.js";
+import { coerceSecretRef, isSecretRef } from "../../config/types.secrets.js";
 import { loadJsonFile, saveJsonFile } from "../../infra/json-file.js";
 import { AUTH_STORE_LOCK_OPTIONS, AUTH_STORE_VERSION, log } from "./constants.js";
 import { withFileLock } from "../../plugin-sdk/file-lock.js";
@@ -13,6 +14,18 @@ const AUTH_PROFILE_TYPES = new Set([
 	"oauth",
 	"token"
 ]);
+const AUTH_PROFILE_FAILURE_REASONS = new Set([
+	"auth",
+	"auth_permanent",
+	"format",
+	"rate_limit",
+	"overloaded",
+	"billing",
+	"timeout",
+	"model_not_found",
+	"session_expired",
+	"unknown"
+]);
 const runtimeAuthStoreSnapshots = new Map();
 function resolveRuntimeStoreKey(agentDir) {
 	return resolveAuthStorePath(agentDir);
@@ -89,8 +102,78 @@ function normalizeRawCredentialEntry(raw) {
 	}
 	return entry;
 }
-function parseCredentialEntry(raw, fallbackProvider) {
-	if (!raw || typeof raw !== "object") {
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isUsableString(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function isOptionalString(value) {
+	return value === undefined || typeof value === "string";
+}
+function isOptionalFiniteNumber(value) {
+	return value === undefined || typeof value === "number" && Number.isFinite(value);
+}
+function isValidStringMetadata(value) {
+	return value === undefined || isRecord(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function isSupportedStoredSecretRef(value) {
+	if (isSecretRef(value)) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	const keys = Object.keys(value).toSorted();
+	return keys.length === 2 && keys[0] === "id" && keys[1] === "source" && coerceSecretRef(value) !== null;
+}
+function hasValidSecretMaterial(params) {
+	const valueIsValid = isUsableString(params.value) || isSupportedStoredSecretRef(params.value);
+	const refIsValid = isSupportedStoredSecretRef(params.ref);
+	return valueIsValid || refIsValid;
+}
+function isValidCredentialShape(entry, type) {
+	if (!isOptionalString(entry.email)) {
+		return "invalid_shape";
+	}
+	if (type === "api_key") {
+		if (entry.key !== undefined && typeof entry.key !== "string" && !isSupportedStoredSecretRef(entry.key) || entry.keyRef !== undefined && !isSupportedStoredSecretRef(entry.keyRef) || !isValidStringMetadata(entry.metadata)) {
+			return "invalid_shape";
+		}
+		return hasValidSecretMaterial({
+			value: entry.key,
+			ref: entry.keyRef
+		}) ? null : "missing_material";
+	}
+	if (type === "token") {
+		if (entry.token !== undefined && typeof entry.token !== "string" && !isSupportedStoredSecretRef(entry.token) || entry.tokenRef !== undefined && !isSupportedStoredSecretRef(entry.tokenRef) || !isOptionalFiniteNumber(entry.expires)) {
+			return "invalid_shape";
+		}
+		return hasValidSecretMaterial({
+			value: entry.token,
+			ref: entry.tokenRef
+		}) ? null : "missing_material";
+	}
+	if (!isUsableString(entry.access) || !isUsableString(entry.refresh) || typeof entry.expires !== "number" || !Number.isFinite(entry.expires)) {
+		return "missing_material";
+	}
+	for (const field of [
+		"clientId",
+		"enterpriseUrl",
+		"projectId",
+		"accountId"
+	]) {
+		if (!isOptionalString(entry[field])) {
+			return "invalid_shape";
+		}
+	}
+	if (entry.availableModelIds !== undefined && (!Array.isArray(entry.availableModelIds) || !entry.availableModelIds.every((modelId) => isUsableString(modelId)))) {
+		return "invalid_shape";
+	}
+	return null;
+}
+function parseCredentialEntry(raw, fallbackProvider, options) {
+	if (!isRecord(raw)) {
 		return {
 			ok: false,
 			reason: "non_object"
@@ -110,10 +193,21 @@ function parseCredentialEntry(raw, fallbackProvider) {
 			reason: "missing_provider"
 		};
 	}
+	const type = typed.type;
+	if (options?.strict) {
+		const invalidReason = isValidCredentialShape(typed, type);
+		if (invalidReason) {
+			return {
+				ok: false,
+				reason: invalidReason
+			};
+		}
+	}
 	return {
 		ok: true,
 		credential: {
 			...typed,
+			type,
 			provider
 		}
 	};
@@ -133,8 +227,8 @@ function warnRejectedCredentialEntries(source, rejected) {
 		keys: rejected.slice(0, 10).map((entry) => entry.key)
 	});
 }
-function coerceLegacyStore(raw) {
-	if (!raw || typeof raw !== "object") {
+function coerceLegacyStore(raw, options) {
+	if (!isRecord(raw)) {
 		return null;
 	}
 	const record = raw;
@@ -144,7 +238,7 @@ function coerceLegacyStore(raw) {
 	const entries = {};
 	const rejected = [];
 	for (const [key, value] of Object.entries(record)) {
-		const parsed = parseCredentialEntry(value, key);
+		const parsed = parseCredentialEntry(value, key, { strict: options?.rejectInvalidEntries === true });
 		if (!parsed.ok) {
 			rejected.push({
 				key,
@@ -154,22 +248,96 @@ function coerceLegacyStore(raw) {
 		}
 		entries[key] = parsed.credential;
 	}
+	if (options?.rejectInvalidEntries && rejected.length > 0) {
+		return null;
+	}
 	warnRejectedCredentialEntries("auth.json", rejected);
-	return Object.keys(entries).length > 0 ? entries : null;
+	return Object.keys(entries).length > 0 || options?.rejectInvalidEntries ? entries : null;
+}
+function isValidProfileOrder(value) {
+	if (value === undefined) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	return Object.entries(value).every(([provider, profileIds]) => isUsableString(provider) && Array.isArray(profileIds) && profileIds.every((profileId) => isUsableString(profileId)));
+}
+function isValidLastGood(value) {
+	if (value === undefined) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	return Object.entries(value).every(([provider, profileId]) => isUsableString(provider) && isUsableString(profileId));
 }
-function coerceAuthStore(raw) {
-	if (!raw || typeof raw !== "object") {
+function isValidFailureCounts(value) {
+	if (value === undefined) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	return Object.entries(value).every(([reason, count]) => AUTH_PROFILE_FAILURE_REASONS.has(reason) && typeof count === "number" && Number.isFinite(count) && Number.isInteger(count) && count >= 0);
+}
+function isValidUsageStats(value) {
+	if (value === undefined) {
+		return true;
+	}
+	if (!isRecord(value)) {
+		return false;
+	}
+	return Object.entries(value).every(([profileId, stats]) => {
+		if (!isUsableString(profileId) || !isRecord(stats)) {
+			return false;
+		}
+		for (const field of [
+			"lastUsed",
+			"cooldownUntil",
+			"disabledUntil",
+			"lastFailureAt"
+		]) {
+			if (!isOptionalFiniteNumber(stats[field])) {
+				return false;
+			}
+		}
+		if (stats.errorCount !== undefined && (typeof stats.errorCount !== "number" || !Number.isFinite(stats.errorCount) || !Number.isInteger(stats.errorCount) || stats.errorCount < 0)) {
+			return false;
+		}
+		for (const field of ["disabledReason", "cooldownReason"]) {
+			if (stats[field] !== undefined && (typeof stats[field] !== "string" || !AUTH_PROFILE_FAILURE_REASONS.has(stats[field]))) {
+				return false;
+			}
+		}
+		if (!isOptionalString(stats.cooldownModel) || !isValidFailureCounts(stats.failureCounts)) {
+			return false;
+		}
+		return true;
+	});
+}
+function hasValidStoreMetadata(record) {
+	return (record.version === undefined || typeof record.version === "number" && Number.isFinite(record.version) && Number.isInteger(record.version) && record.version >= 1 && record.version <= AUTH_STORE_VERSION) && isValidProfileOrder(record.order) && isValidLastGood(record.lastGood) && isValidUsageStats(record.usageStats);
+}
+function coerceAuthStore(raw, options) {
+	if (!isRecord(raw)) {
 		return null;
 	}
 	const record = raw;
-	if (!record.profiles || typeof record.profiles !== "object") {
+	if (!isRecord(record.profiles)) {
+		return null;
+	}
+	if (options?.rejectInvalidEntries && !hasValidStoreMetadata(record)) {
 		return null;
 	}
 	const profiles = record.profiles;
 	const normalized = {};
 	const rejected = [];
 	for (const [key, value] of Object.entries(profiles)) {
-		const parsed = parseCredentialEntry(value);
+		const parsed = !options?.rejectInvalidEntries || isUsableString(key) ? parseCredentialEntry(value, undefined, { strict: options?.rejectInvalidEntries === true }) : {
+			ok: false,
+			reason: "invalid_shape"
+		};
 		if (!parsed.ok) {
 			rejected.push({
 				key,
@@ -179,8 +347,11 @@ function coerceAuthStore(raw) {
 		}
 		normalized[key] = parsed.credential;
 	}
+	if (options?.rejectInvalidEntries && rejected.length > 0) {
+		return null;
+	}
 	warnRejectedCredentialEntries("auth-profiles.json", rejected);
-	const order = record.order && typeof record.order === "object" ? Object.entries(record.order).reduce((acc, [provider, value]) => {
+	const order = options?.rejectInvalidEntries ? record.order : record.order && typeof record.order === "object" ? Object.entries(record.order).reduce((acc, [provider, value]) => {
 		if (!Array.isArray(value)) {
 			return acc;
 		}
@@ -229,27 +400,68 @@ function mergeAuthProfileStores(base, override) {
 		usageStats: mergeRecord(base.usageStats, override.usageStats)
 	};
 }
-function mergeOAuthFileIntoStore(store) {
+function readJsonFileForAuthRuntime(params) {
+	if (!params.strict) {
+		return loadJsonFile(params.pathname);
+	}
+	if (!syncFs.existsSync(params.pathname)) {
+		return undefined;
+	}
+	try {
+		return JSON.parse(syncFs.readFileSync(params.pathname, "utf8"));
+	} catch {
+		throw new Error(`${params.label} is unreadable or contains invalid JSON.`);
+	}
+}
+function mergeOAuthFileIntoStore(store, strict = false) {
 	const oauthPath = resolveOAuthPath();
-	const oauthRaw = loadJsonFile(oauthPath);
-	if (!oauthRaw || typeof oauthRaw !== "object") {
+	const oauthRaw = readJsonFileForAuthRuntime({
+		pathname: oauthPath,
+		label: "OAuth credential store",
+		strict
+	});
+	if (oauthRaw === undefined) {
+		return false;
+	}
+	if (!oauthRaw || typeof oauthRaw !== "object" || Array.isArray(oauthRaw)) {
+		if (strict) {
+			throw new Error("OAuth credential store has an invalid structure.");
+		}
 		return false;
 	}
 	const oauthEntries = oauthRaw;
 	let mutated = false;
-	for (const [provider, creds] of Object.entries(oauthEntries)) {
-		if (!creds || typeof creds !== "object") {
+	for (const [provider, rawCreds] of Object.entries(oauthEntries)) {
+		if (!isRecord(rawCreds)) {
+			if (strict) {
+				throw new Error("OAuth credential store has an invalid credential entry.");
+			}
 			continue;
 		}
+		const creds = rawCreds;
+		let credential;
+		if (strict) {
+			const parsed = parseCredentialEntry({
+				...creds,
+				type: "oauth",
+				provider
+			}, undefined, { strict: true });
+			if (!parsed.ok) {
+				throw new Error("OAuth credential store has an invalid credential entry.");
+			}
+			credential = parsed.credential;
+		} else {
+			credential = {
+				...creds,
+				type: "oauth",
+				provider
+			};
+		}
 		const profileId = `${provider}:default`;
 		if (store.profiles[profileId]) {
 			continue;
 		}
-		store.profiles[profileId] = {
-			type: "oauth",
-			provider,
-			...creds
-		};
+		store.profiles[profileId] = credential;
 		mutated = true;
 	}
 	return mutated;
@@ -261,8 +473,10 @@ function applyLegacyStore(store, legacy) {
 			store.profiles[profileId] = {
 				type: "api_key",
 				provider: String(cred.provider ?? provider),
-				key: cred.key,
-				...cred.email ? { email: cred.email } : {}
+				...cred.key !== undefined ? { key: cred.key } : {},
+				...cred.keyRef ? { keyRef: cred.keyRef } : {},
+				...cred.email ? { email: cred.email } : {},
+				...cred.metadata ? { metadata: cred.metadata } : {}
 			};
 			continue;
 		}
@@ -270,7 +484,8 @@ function applyLegacyStore(store, legacy) {
 			store.profiles[profileId] = {
 				type: "token",
 				provider: String(cred.provider ?? provider),
-				token: cred.token,
+				...cred.token !== undefined ? { token: cred.token } : {},
+				...cred.tokenRef ? { tokenRef: cred.tokenRef } : {},
 				...typeof cred.expires === "number" ? { expires: cred.expires } : {},
 				...cred.email ? { email: cred.email } : {}
 			};
@@ -289,9 +504,20 @@ function applyLegacyStore(store, legacy) {
 		};
 	}
 }
-function loadCoercedStore(authPath) {
-	const raw = loadJsonFile(authPath);
-	return coerceAuthStore(raw);
+function loadCoercedStore(authPath, strict = false) {
+	const raw = readJsonFileForAuthRuntime({
+		pathname: authPath,
+		label: "Auth profile store",
+		strict
+	});
+	if (raw === undefined) {
+		return null;
+	}
+	const store = coerceAuthStore(raw, { rejectInvalidEntries: strict });
+	if (!store && strict) {
+		throw new Error("Auth profile store has an invalid structure or credential entry.");
+	}
+	return store;
 }
 function loadAuthProfileStore() {
 	const authPath = resolveAuthStorePath();
@@ -323,8 +549,9 @@ function loadAuthProfileStore() {
 }
 function loadAuthProfileStoreForAgent(agentDir, options) {
 	const readOnly = options?.readOnly === true;
+	const strict = options?.strict === true;
 	const authPath = resolveAuthStorePath(agentDir);
-	const asStore = loadCoercedStore(authPath);
+	const asStore = loadCoercedStore(authPath, strict);
 	if (asStore) {
 		const synced = shouldSyncExternalCliCredentials(options) ? syncExternalCliCredentials(asStore) : false;
 		if (synced && !readOnly) {
@@ -342,8 +569,16 @@ function loadAuthProfileStoreForAgent(agentDir, options) {
 			return mainStore;
 		}
 	}
-	const legacyRaw = loadJsonFile(resolveLegacyAuthStorePath(agentDir));
-	const legacy = coerceLegacyStore(legacyRaw);
+	const legacyPath = resolveLegacyAuthStorePath(agentDir);
+	const legacyRaw = readJsonFileForAuthRuntime({
+		pathname: legacyPath,
+		label: "Legacy auth profile store",
+		strict
+	});
+	const legacy = coerceLegacyStore(legacyRaw, { rejectInvalidEntries: strict });
+	if (legacyRaw !== undefined && !legacy && strict) {
+		throw new Error("Legacy auth profile store has an invalid structure or credential entry.");
+	}
 	const store = {
 		version: AUTH_STORE_VERSION,
 		profiles: {}
@@ -351,7 +586,7 @@ function loadAuthProfileStoreForAgent(agentDir, options) {
 	if (legacy) {
 		applyLegacyStore(store, legacy);
 	}
-	const mergedOAuth = mergeOAuthFileIntoStore(store);
+	const mergedOAuth = mergeOAuthFileIntoStore(store, strict);
 	const syncedCli = shouldSyncExternalCliCredentials(options) ? syncExternalCliCredentials(store) : false;
 	const forceReadOnly = process.env.FASED_AUTH_STORE_READONLY === "1";
 	const shouldWrite = !readOnly && !forceReadOnly && (legacy !== null || mergedOAuth || syncedCli);
@@ -389,6 +624,7 @@ function loadAuthProfileStoreForRuntime(agentDir, options) {
 function loadAuthProfileStoreForSecretsRuntime(agentDir) {
 	return loadAuthProfileStoreForRuntime(agentDir, {
 		readOnly: true,
+		strict: true,
 		allowKeychainPrompt: false
 	});
 }

package/dist/agents/bash-tools.exec.js

@@ -11,6 +11,7 @@ import { buildSandboxEnv, clampWithDefault, coerceEnv, readEnvInt, resolveSandbo
 import { DEFAULT_MAX_OUTPUT, DEFAULT_PATH, DEFAULT_PENDING_MAX_OUTPUT, applyShellPath, execSchema, normalizeExecAsk, normalizeExecSecurity, normalizeExecTarget, resolveApprovalRunningNoticeMs, resolveExecTarget, runExecProcess, sanitizeHostBaseEnv, validateHostEnv } from "./bash-tools.exec-runtime.js";
 import { processGatewayAllowlist } from "./bash-tools.exec-host-gateway.js";
 import { executeNodeHostCommand } from "./bash-tools.exec-host-node.js";
+import { getActiveSkillEnvOverrides } from "./skills/env-overrides.js";
 import path from "node:path";
 
 //#region src/agents/bash-tools.exec.ts
@@ -260,16 +261,21 @@ function createExecTool(defaults) {
 			}
 			const inheritedBaseEnv = coerceEnv(process.env);
 			const baseEnv = host === "sandbox" ? inheritedBaseEnv : sanitizeHostBaseEnv(inheritedBaseEnv);
+			const trustedSkillEnv = { ...getActiveSkillEnvOverrides() };
 			if (host !== "sandbox" && params.env) {
 				validateHostEnv(params.env);
 			}
-			const mergedEnv = params.env ? {
+			const mergedEnv = {
 				...baseEnv,
-				...params.env
-			} : baseEnv;
+				...params.env,
+				...trustedSkillEnv
+			};
 			const env = sandbox ? buildSandboxEnv({
 				defaultPath: DEFAULT_PATH,
-				paramsEnv: params.env,
+				paramsEnv: {
+					...params.env,
+					...trustedSkillEnv
+				},
 				sandboxEnv: sandbox.env,
 				containerWorkdir: containerWorkdir ?? sandbox.containerWorkdir
 			}) : mergedEnv;

package/dist/agents/current-model-catalog.js

@@ -1,12 +1,12 @@
+import { XIAOMI_BASE_URL, XIAOMI_MODEL_CATALOG } from "../providers/xiaomi-models.js";
+import { BYTEPLUS_BASE_URL, BYTEPLUS_CODING_BASE_URL, BYTEPLUS_CODING_MODEL_CATALOG, BYTEPLUS_MODEL_CATALOG, buildBytePlusModelDefinition } from "./byteplus-models.js";
 import { CLOUDFLARE_AI_GATEWAY_MODEL_CATALOG, buildCloudflareAiGatewayModelDefinition } from "../providers/cloudflare-ai-gateway-shared.js";
+import "./cloudflare-ai-gateway.js";
 import { HUGGINGFACE_BASE_URL, HUGGINGFACE_MODEL_CATALOG, buildHuggingfaceModelDefinition } from "../providers/huggingface-models.js";
 import { SYNTHETIC_BASE_URL, SYNTHETIC_MODEL_CATALOG, buildSyntheticModelDefinition } from "../providers/synthetic-models.js";
 import { TOGETHER_BASE_URL, TOGETHER_MODEL_CATALOG, buildTogetherModelDefinition } from "../providers/together-models.js";
 import { VENICE_BASE_URL, VENICE_MODEL_CATALOG, buildVeniceModelDefinition } from "../providers/venice-models.js";
 import { VERCEL_AI_GATEWAY_MODEL_IDS, buildVercelAiGatewayModelDefinition } from "../providers/vercel-ai-gateway-models.js";
-import { XIAOMI_BASE_URL, XIAOMI_MODEL_CATALOG } from "../providers/xiaomi-models.js";
-import { BYTEPLUS_BASE_URL, BYTEPLUS_CODING_BASE_URL, BYTEPLUS_CODING_MODEL_CATALOG, BYTEPLUS_MODEL_CATALOG, buildBytePlusModelDefinition } from "./byteplus-models.js";
-import "./cloudflare-ai-gateway.js";
 import { buildCopilotModelDefinition, buildCopilotProxyModelDefinition, getDefaultCopilotModelIds, getDefaultCopilotProxyModelIds } from "../providers/github-copilot-models.js";
 import { CHUTES_BASE_URL, CHUTES_MODEL_CATALOG, buildChutesModelDefinition } from "./chutes-models.js";
 import { DOUBAO_BASE_URL, DOUBAO_CODING_BASE_URL, DOUBAO_CODING_MODEL_CATALOG, DOUBAO_MODEL_CATALOG, buildDoubaoModelDefinition } from "./doubao-models.js";

package/dist/agents/memory-search.js

@@ -131,6 +131,7 @@ function mergeConfig(defaults, overrides, agentId) {
 		baseUrl: overrideRemote?.baseUrl ?? defaultRemote?.baseUrl,
 		apiKey: overrideRemote?.apiKey ?? defaultRemote?.apiKey,
 		headers: overrideRemote?.headers ?? defaultRemote?.headers,
+		allowSessionContent: overrideRemote?.allowSessionContent ?? defaultRemote?.allowSessionContent ?? false,
 		batch
 	} : undefined;
 	const fallback = overrides?.fallback ?? defaults?.fallback ?? "none";
@@ -146,7 +147,12 @@ function mergeConfig(defaults, overrides, agentId) {
 		modelPath: overrides?.local?.modelPath ?? defaults?.local?.modelPath,
 		modelCacheDir: overrides?.local?.modelCacheDir ?? defaults?.local?.modelCacheDir
 	};
-	const sources = normalizeSources(overrides?.sources ?? defaults?.sources, sessionMemory);
+	const requestedSources = normalizeSources(overrides?.sources ?? defaults?.sources, sessionMemory);
+	const usesRemoteEmbedding = provider !== "local" && provider !== "ollama";
+	const sources = usesRemoteEmbedding && !remote?.allowSessionContent ? requestedSources.filter((source) => source !== "sessions") : requestedSources;
+	if (sources.length === 0) {
+		sources.push("memory");
+	}
 	const rawPaths = [...defaults?.extraPaths ?? [], ...overrides?.extraPaths ?? []].map((value) => value.trim()).filter(Boolean);
 	const extraPaths = Array.from(new Set(rawPaths));
 	const vector = {

package/dist/agents/model-catalog-access.js

@@ -42,8 +42,7 @@ function buildCredentialScopedAllowedModelSet(params) {
 		cfg: params.cfg,
 		catalog: usableCatalog,
 		defaultProvider: params.defaultProvider,
-		defaultModel: params.defaultModel,
-		additionalAllowedProviders: usableProviders
+		defaultModel: params.defaultModel
 	});
 	const allowedCatalog = filterModelCatalogByProviders(allowed.allowedCatalog, usableProviders);
 	const allowedKeys = new Set(allowedCatalog.map((entry) => modelKey(entry.provider, entry.id)));

package/dist/agents/model-catalog-snapshot.js

@@ -103,7 +103,7 @@ async function resolveCanonicalModelCatalogSnapshot(params) {
 			...model,
 			metadata,
 			available: true,
-			runnable: runnableRefs.size === 0 || runnableRefs.has(modelRef(model)),
+			runnable: authenticated.allowAny || runnableRefs.has(modelRef(model)),
 			recommended: metadata.recommended === true,
 			assignedRoles: assignmentsByRef.get(modelRef(model)) ?? []
 		};

package/dist/agents/model-catalog-source.js

@@ -1,5 +1,5 @@
-import { isOpenAISignInRuntimeModelSupported, isStandardProviderCatalogEntry, listProviderBrandManifests } from "../providers/registry.js";
 import { MODEL_APIS } from "../config/types.models.js";
+import { isOpenAISignInRuntimeModelSupported, isStandardProviderCatalogEntry, listProviderBrandManifests } from "../providers/registry.js";
 import { buildModelCatalogMergeKey, mergeModelCatalogRowsByAuthority, normalizeModelCatalogModelId, normalizeModelCatalogProviderId, normalizeProviderCatalogRows } from "./model-catalog-normalized.js";
 import { CURRENT_MODEL_PROVIDER_CATALOG, listCurrentModelCatalogRows } from "./current-model-catalog.js";
 import { deriveModelMetadata } from "./model-metadata.js";

package/dist/agents/model-metadata.js

@@ -1,6 +1,6 @@
 import { resolveModelThinkingCapability } from "../shared/model-thinking.js";
-import { getProviderBrandManifestForRoute, lookupProviderManifestModelCapability, providerModelRecommendationRank } from "../providers/registry.js";
 import { isPrivateNetworkBaseUrl } from "../utils/private-network-url.js";
+import { getProviderBrandManifestForRoute, lookupProviderManifestModelCapability, providerModelRecommendationRank } from "../providers/registry.js";
 import { lookupRefreshedModelCapability } from "../providers/refreshed-model-capabilities.js";
 
 //#region src/agents/model-metadata.ts

package/dist/agents/model-selection.js

@@ -1,7 +1,6 @@
 import { resolveAgentModelFallbackValues, resolveAgentModelPrimaryValue, toAgentModelListLike } from "../config/model-input.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { resolveAgentConfig, resolveAgentEffectiveModelPrimary } from "./agent-scope.js";
-import { isStandardProviderModelRef } from "../providers/registry.js";
 import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "./defaults.js";
 import { splitTrailingAuthProfile } from "./model-ref-profile.js";
 import { normalizeGoogleModelId } from "./models-config.providers.js";
@@ -418,7 +417,6 @@ function buildAllowedModelSet(params) {
 		defaultModel: params.defaultModel
 	});
 	const catalogKeys = new Set(params.catalog.map((entry) => modelKey(entry.provider, entry.id)));
-	const additionalAllowedProviders = new Set([...params.additionalAllowedProviders ?? []].map((provider) => normalizeProviderId(provider)).filter(Boolean));
 	if (allowAny) {
 		for (const key of defaultKeys) {
 			catalogKeys.add(key);
@@ -449,22 +447,7 @@ function buildAllowedModelSet(params) {
 	for (const key of defaultKeys) {
 		allowedKeys.add(key);
 	}
-	for (const entry of params.catalog) {
-		if (additionalAllowedProviders.has(normalizeProviderId(entry.provider))) {
-			allowedKeys.add(modelKey(entry.provider, entry.id));
-		}
-	}
 	const allowedCatalog = [...params.catalog.filter((entry) => allowedKeys.has(modelKey(entry.provider, entry.id))), ...syntheticCatalogEntries.values()];
-	if (allowedCatalog.length === 0 && allowedKeys.size === 0) {
-		for (const key of defaultKeys) {
-			catalogKeys.add(key);
-		}
-		return {
-			allowAny: true,
-			allowedCatalog: params.catalog,
-			allowedKeys: catalogKeys
-		};
-	}
 	return {
 		allowAny: false,
 		allowedCatalog,
@@ -476,8 +459,7 @@ function getModelRefStatus(params) {
 		cfg: params.cfg,
 		catalog: params.catalog,
 		defaultProvider: params.defaultProvider,
-		defaultModel: params.defaultModel,
-		additionalAllowedProviders: params.additionalAllowedProviders
+		defaultModel: params.defaultModel
 	});
 	const key = modelKey(params.ref.provider, params.ref.model);
 	return {
@@ -509,17 +491,9 @@ function resolveAllowedModelRef(params) {
 		catalog: params.catalog,
 		ref: resolved.ref,
 		defaultProvider: params.defaultProvider,
-		defaultModel: params.defaultModel,
-		additionalAllowedProviders: params.additionalAllowedProviders
+		defaultModel: params.defaultModel
 	});
 	if (!status.allowed) {
-		const additionalAllowedProviders = new Set([...params.additionalAllowedProviders ?? []].map((provider) => normalizeProviderId(provider)));
-		if (additionalAllowedProviders.has(normalizeProviderId(resolved.ref.provider)) && isStandardProviderModelRef(status.key)) {
-			return {
-				ref: resolved.ref,
-				key: status.key
-			};
-		}
 		return { error: `model not allowed: ${status.key}` };
 	}
 	return {

package/dist/agents/models-config.providers.js

@@ -1,19 +1,19 @@
 import { createSubsystemLogger } from "../logging/subsystem.js";
-import { CLOUDFLARE_AI_GATEWAY_MODEL_CATALOG, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "../providers/cloudflare-ai-gateway-shared.js";
-import { HUGGINGFACE_BASE_URL, HUGGINGFACE_MODEL_CATALOG, buildHuggingfaceModelDefinition } from "../providers/huggingface-models.js";
-import { SYNTHETIC_BASE_URL, SYNTHETIC_MODEL_CATALOG, buildSyntheticModelDefinition } from "../providers/synthetic-models.js";
-import { TOGETHER_BASE_URL, TOGETHER_MODEL_CATALOG, buildTogetherModelDefinition } from "../providers/together-models.js";
-import { VENICE_BASE_URL } from "../providers/venice-models.js";
-import { XIAOMI_BASE_URL as XIAOMI_BASE_URL$1, XIAOMI_DEFAULT_MODEL_ID as XIAOMI_DEFAULT_MODEL_ID$1, XIAOMI_MODEL_IDS, buildXiaomiModelDefinition } from "../providers/xiaomi-models.js";
 import { coerceSecretRef } from "../config/types.secrets.js";
 import { DEFAULT_COPILOT_API_BASE_URL, resolveCopilotApiToken } from "../providers/github-copilot-token.js";
+import { XIAOMI_BASE_URL as XIAOMI_BASE_URL$1, XIAOMI_DEFAULT_MODEL_ID as XIAOMI_DEFAULT_MODEL_ID$1, XIAOMI_MODEL_IDS, buildXiaomiModelDefinition } from "../providers/xiaomi-models.js";
 import { normalizeOptionalSecretInput } from "../utils/normalize-secret-input.js";
 import { isPrivateNetworkBaseUrl } from "../utils/private-network-url.js";
 import { ensureAuthProfileStore } from "./auth-profiles/store.js";
 import { listProfilesForProvider } from "./auth-profiles/profiles.js";
 import "./auth-profiles.js";
 import { BYTEPLUS_BASE_URL, BYTEPLUS_CODING_BASE_URL, BYTEPLUS_CODING_MODEL_CATALOG, BYTEPLUS_MODEL_CATALOG, buildBytePlusModelDefinition } from "./byteplus-models.js";
+import { CLOUDFLARE_AI_GATEWAY_MODEL_CATALOG, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "../providers/cloudflare-ai-gateway-shared.js";
 import "./cloudflare-ai-gateway.js";
+import { HUGGINGFACE_BASE_URL, HUGGINGFACE_MODEL_CATALOG, buildHuggingfaceModelDefinition } from "../providers/huggingface-models.js";
+import { SYNTHETIC_BASE_URL, SYNTHETIC_MODEL_CATALOG, buildSyntheticModelDefinition } from "../providers/synthetic-models.js";
+import { TOGETHER_BASE_URL, TOGETHER_MODEL_CATALOG, buildTogetherModelDefinition } from "../providers/together-models.js";
+import { VENICE_BASE_URL } from "../providers/venice-models.js";
 import { DOUBAO_BASE_URL, DOUBAO_CODING_BASE_URL, DOUBAO_CODING_MODEL_CATALOG, DOUBAO_MODEL_CATALOG, buildDoubaoModelDefinition } from "./doubao-models.js";
 import { discoverHuggingfaceModels } from "./huggingface-models.js";
 import "./synthetic-models.js";