@gentbajko/slopify 1.3.1 → 1.4.1

package/dist/host-cli/runtime.js

@@ -0,0 +1,78 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { codexImage } from "../adapters/image/codex.js";
+import { claudeCodeLlm } from "../adapters/llm/claude-code.js";
+import { nodeClaudeCodeModels } from "../adapters/llm/claude-code-models.js";
+import { codexLlm } from "../adapters/llm/codex.js";
+import { nodeCodexModels } from "../adapters/llm/codex-models.js";
+import { geminiLlm } from "../adapters/llm/gemini.js";
+import { nodeGeminiModels } from "../adapters/llm/gemini-models.js";
+import { providerError } from "../kernel/ports/model.js";
+import { createHostStatus } from "./status.js";
+export function createHostRuntime(deps) {
+    const status = createHostStatus(deps);
+    async function command(id) {
+        const ready = await status(id);
+        if (ready.issue || !ready.installed)
+            throw providerError({
+                kind: ready.issueKind === "login" ? "missing_key" : "unavailable",
+                message: ready.issue ?? "The host CLI is unavailable.",
+            });
+        return deps.resolve(id === "codex-image" ? "codex" : id);
+    }
+    const factories = { "claude-code": claudeCodeLlm, codex: codexLlm, gemini: geminiLlm };
+    const models = async (id) => {
+        const binary = await deps.resolve(id);
+        return id === "claude-code"
+            ? nodeClaudeCodeModels(binary)
+            : id === "codex"
+                ? nodeCodexModels(deps.env, binary)
+                : nodeGeminiModels(binary);
+    };
+    return {
+        status,
+        llm: (id) => ({
+            id,
+            capabilities: { streams: true, reportsUsage: true, webSearch: true },
+            models: () => models(id),
+            complete: async function* (request) {
+                request.signal.throwIfAborted();
+                const binary = await command(id);
+                const directory = id === "claude-code" ? await mkdtemp(join(tmpdir(), "slopify-host-claude-")) : undefined;
+                try {
+                    const run = (file, args, signal, options) => deps.run(file, args, signal, {
+                        ...(directory === undefined ? {} : { cwd: directory }),
+                        ...options,
+                        env: options?.env ?? {
+                            ...deps.env,
+                            ...(directory === undefined ? {} : { PWD: directory }),
+                        },
+                    });
+                    yield* factories[id]({ run, binary, readModels: () => models(id) }).complete({
+                        ...request,
+                        ...(id === "codex" && request.thinking !== undefined
+                            ? {
+                                thinkingConfig: {
+                                    effort: request.thinking === "off" ? "none" : request.thinking,
+                                },
+                            }
+                            : {}),
+                    });
+                }
+                finally {
+                    if (directory !== undefined)
+                        await rm(directory, { recursive: true, force: true });
+                }
+            },
+        }),
+        image: {
+            id: "codex-image",
+            models: () => codexImage({ run: deps.run }).models(),
+            generate: async (request) => {
+                const binary = await command("codex-image");
+                return codexImage({ run: deps.run, binary }).generate(request);
+            },
+        },
+    };
+}

package/dist/host-cli/server.js

@@ -0,0 +1,98 @@
+import { chmod, lstat, unlink } from "node:fs/promises";
+import { Server } from "node:http";
+import { connect } from "node:net";
+import { join } from "node:path";
+import { createAdaptorServer } from "@hono/node-server";
+import { hostCliRoutes, hostGate } from "../edge/http/host-cli.js";
+import { hasCode } from "./paths.js";
+export async function startHostServer(options) {
+    const socket = join(options.directory, "cli.sock");
+    if (Buffer.byteLength(socket) > 100)
+        throw new Error("Use a shorter host helper socket path.");
+    const directory = await lstat(options.directory);
+    if (!directory.isDirectory() ||
+        directory.isSymbolicLink() ||
+        (process.getuid && directory.uid !== process.getuid()))
+        throw new Error("Unsafe host helper directory.");
+    try {
+        const existing = await lstat(socket);
+        if (!existing.isSocket() || (process.getuid && existing.uid !== process.getuid()))
+            throw new Error("Unsafe host helper socket.");
+        if (await listening(socket))
+            throw new Error("A host helper is already listening.");
+        await unlink(socket);
+    }
+    catch (error) {
+        if (!hasCode(error, "ENOENT"))
+            throw error;
+    }
+    const gate = hostGate();
+    const app = hostCliRoutes({ ...options, gate });
+    const server = createAdaptorServer({ fetch: app.fetch });
+    if (!(server instanceof Server))
+        throw new Error("Host helper requires HTTP over a Unix socket.");
+    server.headersTimeout = 10_000;
+    server.requestTimeout = 35_000;
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(socket, () => {
+            server.removeListener("error", reject);
+            resolve();
+        });
+    });
+    await chmod(socket, 0o666);
+    const owned = await lstat(socket);
+    let stopping;
+    return {
+        pauseAdmissions: gate.pause,
+        resumeAdmissions: gate.resume,
+        stop: () => {
+            stopping ??= (async () => {
+                gate.stop();
+                await new Promise((resolve) => {
+                    const timer = setTimeout(() => {
+                        server.closeAllConnections();
+                        resolve();
+                    }, 5000);
+                    timer.unref();
+                    server.close(() => {
+                        clearTimeout(timer);
+                        resolve();
+                    });
+                    server.closeIdleConnections();
+                });
+                try {
+                    const current = await lstat(socket);
+                    if (current.ino === owned.ino && current.dev === owned.dev)
+                        await unlink(socket);
+                }
+                catch (error) {
+                    if (!hasCode(error, "ENOENT"))
+                        throw error;
+                }
+            })();
+            return stopping;
+        },
+    };
+}
+function listening(path) {
+    return new Promise((resolve, reject) => {
+        const socket = connect(path);
+        socket.setTimeout(1000);
+        socket.once("connect", () => {
+            socket.destroy();
+            resolve(true);
+        });
+        socket.once("timeout", () => {
+            socket.destroy();
+            reject(new Error("Could not verify existing host socket."));
+        });
+        socket.once("error", (error) => {
+            socket.destroy();
+            if (hasCode(error, "ECONNREFUSED"))
+                resolve(false);
+            else
+                reject(new Error("Could not verify existing host socket."));
+        });
+    });
+}

package/dist/host-cli/service.js

@@ -0,0 +1,200 @@
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { hostRequest, readHostBytes } from "../adapters/host-cli/transport.js";
+import { bridgeLimits, hostHealthSchema } from "../kernel/ports/host-cli.js";
+import { hostEnvironment } from "./environment.js";
+import { hasCode } from "./paths.js";
+const marker = "# Managed by Slopify host CLI bridge, protocol 1";
+export const hostUnit = "slopify-cli-bridge.service";
+function unitArg(value) {
+    if (!isAbsolute(value) || /[\p{Cc}]/u.test(value))
+        throw new Error("Invalid service path.");
+    return JSON.stringify(value.replaceAll("%", "%%"));
+}
+export function serviceUnit(node, entry, root) {
+    return [
+        marker,
+        "[Unit]",
+        "Description=Slopify host CLI bridge",
+        "",
+        "[Service]",
+        "Type=simple",
+        `ExecStart=:${unitArg(node)} ${unitArg(entry)} --state-dir ${unitArg(root)}`,
+        "Restart=on-failure",
+        "RestartSec=2",
+        "KillMode=control-group",
+        "TimeoutStopSec=5",
+        "UMask=0077",
+        "",
+        "[Install]",
+        "WantedBy=default.target",
+        "",
+    ].join("\n");
+}
+export async function privateRead(path, uid) {
+    try {
+        const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const stat = await file.stat();
+            if (!stat.isFile() || stat.uid !== uid || stat.size > 64 * 1024 || (stat.mode & 0o022) !== 0)
+                throw new Error("Unsafe host helper configuration.");
+            const buffer = Buffer.alloc(64 * 1024 + 1);
+            const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+            if (bytesRead > 64 * 1024)
+                throw new Error("Host configuration too large.");
+            return buffer.subarray(0, bytesRead).toString("utf8");
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch (error) {
+        if (hasCode(error, "ENOENT"))
+            return undefined;
+        throw error;
+    }
+}
+export async function privateWrite(path, text) {
+    const temporary = `${path}.${process.pid}.tmp`;
+    const file = await open(temporary, "wx", 0o600);
+    try {
+        await file.writeFile(text);
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+    try {
+        await rename(temporary, path);
+    }
+    finally {
+        await unlink(temporary).catch((error) => {
+            if (!hasCode(error, "ENOENT"))
+                throw error;
+        });
+    }
+}
+export async function helperHealth(root, signal) {
+    try {
+        const response = await hostRequest({
+            directory: join(root, "share"),
+            path: "/v1/health",
+            method: "GET",
+            kind: "metadata",
+            signal: AbortSignal.any([signal, AbortSignal.timeout(1000)]),
+        });
+        if (response.statusCode !== 200) {
+            response.destroy();
+            return undefined;
+        }
+        return hostHealthSchema.parse(JSON.parse((await readHostBytes(response, bridgeLimits.status)).toString("utf8")));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function waitHealth(options, accepting) {
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        options.signal.throwIfAborted();
+        const health = await helperHealth(options.root, options.signal);
+        if (health &&
+            health.accepting === accepting &&
+            (!accepting || health.version === options.version))
+            return health;
+        await delay(100, undefined, { signal: options.signal });
+    }
+    throw new Error("Host helper did not become ready within 30 seconds.");
+}
+export async function ensureHostService(options) {
+    const { root, env, runner, signal, uid } = options;
+    const environment = JSON.stringify(hostEnvironment(env));
+    const directory = join(env.XDG_CONFIG_HOME ?? join(env.HOME ?? "", ".config"), "systemd/user");
+    if (!isAbsolute(directory))
+        throw new Error("Host configuration directory must be absolute.");
+    const unitPath = join(directory, hostUnit);
+    const configPath = join(root, "host-environment.json");
+    const previous = await privateRead(unitPath, uid);
+    const previousConfig = await privateRead(configPath, uid);
+    if (previous !== undefined && !previous.startsWith(`${marker}\n`))
+        throw new Error("An existing host helper service is not owned by Slopify. It was not changed.");
+    const unit = serviceUnit(options.node, options.entry, root);
+    const run = async (file, args, required = true, commandSignal = signal) => {
+        const result = await runner.exec(file, args, commandSignal);
+        if (required && result.code !== 0)
+            throw new Error(`Host helper setup failed (${file}). The existing container was not changed.`);
+        return result;
+    };
+    const fragment = (await run("systemctl", ["--user", "show", hostUnit, "--property=FragmentPath", "--value"])).stdout.trim();
+    if (fragment && fragment !== unitPath)
+        throw new Error("An existing host helper service is not owned by this Slopify installation.");
+    const active = (await run("systemctl", ["--user", "is-active", "--quiet", hostUnit], false)).code === 0;
+    const wasEnabled = (await run("systemctl", ["--user", "is-enabled", "--quiet", hostUnit], false)).code === 0;
+    const current = await helperHealth(root, signal);
+    if (active && (!previous || !current))
+        throw new Error("The running host helper cannot be verified. Check its service before updating; no work was interrupted.");
+    const linger = (await run("loginctl", ["show-user", String(uid), "-p", "Linger", "--value"])).stdout.trim();
+    if (linger !== "yes")
+        await run("loginctl", ["enable-linger", String(uid)]);
+    if (current?.version === options.version &&
+        current.accepting &&
+        previous === unit &&
+        previousConfig === environment) {
+        await run("systemctl", ["--user", "enable", hostUnit]);
+        return;
+    }
+    let paused = false;
+    let replaced = false;
+    try {
+        if (active) {
+            paused = true;
+            await run("systemctl", ["--user", "kill", "--kill-whom=main", "--signal=SIGHUP", hostUnit]);
+            if ((await waitHealth(options, false)).active !== 0)
+                throw new Error("The host helper is doing work. Wait for it to finish before updating.");
+        }
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        const directoryStat = await lstat(directory);
+        if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || directoryStat.uid !== uid)
+            throw new Error("Unsafe user service directory.");
+        replaced = true;
+        await privateWrite(configPath, environment);
+        await privateWrite(unitPath, unit);
+        await run("systemctl", ["--user", "daemon-reload"]);
+        await run("systemctl", ["--user", "enable", hostUnit]);
+        await run("systemctl", ["--user", active ? "restart" : "start", hostUnit]);
+        await waitHealth(options, true);
+        paused = false;
+    }
+    catch (error) {
+        const rollbackSignal = AbortSignal.timeout(35_000);
+        const restore = (args) => run("systemctl", args, true, rollbackSignal);
+        try {
+            if (replaced) {
+                await restore(["--user", "stop", hostUnit]);
+                if (!wasEnabled)
+                    await restore(["--user", "disable", hostUnit]);
+                if (previous === undefined)
+                    await unlink(unitPath);
+                else
+                    await privateWrite(unitPath, previous);
+                if (previousConfig === undefined)
+                    await unlink(configPath);
+                else
+                    await privateWrite(configPath, previousConfig);
+                await restore(["--user", "daemon-reload"]);
+                if (active) {
+                    await restore(["--user", "start", hostUnit]);
+                    await waitHealth({ ...options, signal: rollbackSignal, version: current?.version ?? options.version }, true);
+                }
+            }
+            else if (paused)
+                await restore(["--user", "kill", "--kill-whom=main", "--signal=SIGUSR2", hostUnit]);
+        }
+        catch {
+            throw new Error("Host helper setup failed and rollback needs attention. Check slopify-cli-bridge.service; the Docker container was not changed.");
+        }
+        throw error;
+    }
+}

package/dist/host-cli/status.js

@@ -0,0 +1,134 @@
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import { access, stat } from "node:fs/promises";
+import { delimiter, isAbsolute, join } from "node:path";
+import { z } from "zod";
+import { cliLoginError } from "../adapters/llm/cli-login-error.js";
+import { cliCommand } from "../kernel/cli-command.js";
+import { cliProbeTimeoutMs, readinessFromProbe, } from "../slices/settings/cli-status.js";
+export function hostCommandName(id) {
+    return id === "claude-code" ? "claude" : id === "codex-image" ? "codex" : id;
+}
+export async function resolveHostCommand(id, env) {
+    for (const directory of (env.PATH ?? "").split(delimiter)) {
+        if (!isAbsolute(directory))
+            continue;
+        const path = join(directory, hostCommandName(id));
+        try {
+            await access(path, constants.X_OK);
+            if ((await stat(path)).isFile())
+                return path;
+        }
+        catch (error) {
+            if (!isCode(error, "ENOENT") && !isCode(error, "ENOTDIR") && !isCode(error, "EACCES"))
+                throw error;
+        }
+    }
+    throw Object.assign(new Error("The CLI was not found on the host PATH."), { code: "ENOENT" });
+}
+const authSchema = z.object({ loggedIn: z.boolean() });
+export function parseHostLogin(id, stdout, stderr) {
+    if (id === "gemini")
+        return "unknown";
+    if (id === "codex") {
+        const text = `${stdout}\n${stderr}`.trim();
+        if (/^Not logged in\.?$/i.test(text))
+            return "signed-out";
+        if (/^Logged in using (?:ChatGPT|an API key|API key)\b/i.test(text))
+            return "signed-in";
+        return "unknown";
+    }
+    try {
+        const result = authSchema.safeParse(JSON.parse(stdout));
+        return result.success ? (result.data.loggedIn ? "signed-in" : "signed-out") : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+export async function readHostLogin(binary, id, signal) {
+    if (id === "gemini")
+        return "unknown";
+    const command = cliCommand(binary);
+    return new Promise((resolve) => {
+        execFile(command.file, [...command.args, ...(id === "claude-code" ? ["auth", "status"] : ["login", "status"])], { timeout: cliProbeTimeoutMs, maxBuffer: 64 * 1024, signal, windowsHide: true }, (error, stdout, stderr) => {
+            if (error && (error.killed || typeof error.code !== "number"))
+                return resolve("unknown");
+            resolve(parseHostLogin(id, stdout, stderr));
+        });
+    });
+}
+export function createHostStatus(deps) {
+    const cache = new Map();
+    async function read(id) {
+        let command;
+        try {
+            command = await deps.resolve(id);
+        }
+        catch (error) {
+            return {
+                id,
+                command: hostCommandName(id),
+                installed: false,
+                login: "unknown",
+                issueKind: isCode(error, "ENOENT") ? "missing" : "bridge",
+                issue: "The CLI could not be found on the host. Check its installation, then rerun the Docker launcher.",
+            };
+        }
+        const readiness = readinessFromProbe(await deps.probe(command, ["--version"], cliProbeTimeoutMs), {
+            id,
+            auth: "cli",
+            family: "llm",
+            displayName: id,
+            binary: command,
+            versionArgs: ["--version"],
+        });
+        if (readiness.kind !== "cli")
+            throw new Error("Expected CLI readiness.");
+        const base = {
+            id,
+            command,
+            installed: readiness.installed,
+            ...(readiness.version === undefined ? {} : { version: readiness.version }),
+        };
+        if (!readiness.installed)
+            return {
+                ...base,
+                login: "unknown",
+                issueKind: "missing",
+                issue: "The host CLI did not answer. Check its installation and rerun the Docker launcher.",
+            };
+        if (readiness.issue)
+            return { ...base, login: "unknown", issueKind: "version", issue: readiness.issue };
+        const login = await (deps.login ?? readHostLogin)(command, id, AbortSignal.timeout(cliProbeTimeoutMs));
+        return {
+            ...base,
+            login,
+            ...(login === "signed-out"
+                ? {
+                    issueKind: "login",
+                    issue: cliLoginError(id, "Not logged in")?.message ?? "Sign in on the host.",
+                }
+                : {}),
+        };
+    }
+    return async (id) => {
+        const source = id === "codex-image" ? "codex" : id;
+        let entry = cache.get(source);
+        if (!entry || entry.until <= deps.now()) {
+            const value = read(source);
+            entry = { until: Number.POSITIVE_INFINITY, value };
+            cache.set(source, entry);
+            const current = entry;
+            void value.then(() => {
+                current.until = deps.now() + 5000;
+            }, () => {
+                cache.delete(source);
+            });
+        }
+        return { ...(await entry.value), id };
+    };
+}
+function isCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}

package/dist/kernel/ports/host-cli.js

@@ -0,0 +1,95 @@
+import { z } from "zod";
+import { messageRoles, thinkingModes } from "./llm.js";
+import { providerErrorKinds } from "./model.js";
+export const hostLlmIds = ["claude-code", "codex", "gemini"];
+export const hostCliIds = [...hostLlmIds, "codex-image"];
+export const hostCliProtocol = 1;
+export const bridgeLimits = {
+    request: 16 * 1024 * 1024,
+    status: 64 * 1024,
+    models: 1024 * 1024,
+    frame: 4 * 1024 * 1024,
+    stream: 64 * 1024 * 1024,
+    image: 32 * 1024 * 1024,
+    text: 2 * 1024 * 1024,
+    generation: 5,
+    metadata: 8,
+};
+const short = z
+    .string()
+    .min(1)
+    .max(256)
+    .refine((v) => !/[\p{Cc}]/u.test(v));
+const message = z
+    .object({ role: z.enum(messageRoles), content: z.string().max(bridgeLimits.text) })
+    .strict();
+export const hostLlmSchema = z
+    .object({
+    model: short,
+    messages: z.array(message).min(1).max(128),
+    thinking: z.enum(thinkingModes).optional(),
+    webSearch: z.boolean().optional(),
+})
+    .strict();
+export const hostImageSchema = z
+    .object({
+    model: z.literal("codex-imagegen"),
+    prompt: z.string().min(1).max(bridgeLimits.text),
+    aspect: z.enum(["16:9", "9:16"]),
+})
+    .strict();
+export const hostStatusSchema = z
+    .object({
+    id: z.enum(hostCliIds),
+    command: z.string().max(4096),
+    installed: z.boolean(),
+    version: short.optional(),
+    login: z.enum(["signed-in", "signed-out", "unknown"]),
+    issueKind: z.enum(["missing", "version", "login", "bridge"]).optional(),
+    issue: z.string().max(4096).optional(),
+})
+    .strict();
+export const hostModelsSchema = z
+    .object({
+    models: z
+        .array(z
+        .object({
+        id: short,
+        name: short,
+        group: short.optional(),
+        thinkingModes: z.array(z.enum(thinkingModes)).max(5).optional(),
+    })
+        .strict())
+        .max(1000),
+})
+    .strict();
+export const hostHealthSchema = z
+    .object({
+    protocol: z.literal(hostCliProtocol),
+    version: short,
+    active: z.number().int().min(0).max(bridgeLimits.generation),
+    accepting: z.boolean(),
+})
+    .strict();
+export const hostFaultSchema = z
+    .object({
+    type: z.literal("error"),
+    kind: z.enum(providerErrorKinds),
+    message: z.string().max(4096),
+})
+    .strict();
+export const hostFrameSchema = z.discriminatedUnion("type", [
+    z.object({ type: z.literal("delta"), text: z.string().max(bridgeLimits.frame) }).strict(),
+    z.object({ type: z.literal("activity") }).strict(),
+    z
+        .object({
+        type: z.literal("done"),
+        usage: z
+            .object({ inputTokens: z.number().nonnegative(), outputTokens: z.number().nonnegative() })
+            .strict()
+            .nullable(),
+        finishReason: z.string().max(256).nullable(),
+    })
+        .strict(),
+    hostFaultSchema,
+]);

package/dist/kernel/ports/model.js

@@ -11,6 +11,7 @@ export const providerErrorKinds = [
     // Distinct from `auth`, a key the provider rejected: a bad key runs the whole retry
     // policy, an absent one fails immediately.
     "missing_key",
+    "unavailable",
     "rate_limit",
     "refusal",
     "unsupported",

package/dist/kernel/runner/attempt.js

@@ -15,7 +15,12 @@ export const timeoutMs = {
 // spends the user's money again. The third is a key removed mid-run, which leaves nothing
 // to call with. A key the provider rejected is different: that is an `auth` failure,
 // retried like any other.
-const terminalKinds = ["refusal", "unsupported", "missing_key"];
+const terminalKinds = [
+    "refusal",
+    "unsupported",
+    "missing_key",
+    "unavailable",
+];
 export async function attempt(ctx, call, opts) {
     ctx.signal.throwIfAborted();
     const limit = timeoutMs[opts.kind];
@@ -86,6 +91,10 @@ export async function attempt(ctx, call, opts) {
 }
 // The wrapper is the only place a provider failure is named.
 function classify(error, expired, opts, limit) {
+    // Losing a submitted host request cannot prove that generation never happened.
+    if (isProviderError(error) && error.fault.kind === "unavailable") {
+        return providerError({ kind: "unavailable", message: redact(error.message) });
+    }
     if (expired) {
         const seconds = Math.round(limit / 1000);
         return providerError({

package/dist/main.js

@@ -6,6 +6,7 @@ import ffmpegStatic from "ffmpeg-static";
 import { buildRegistry } from "./adapter-registry.js";
 import { alignSubtitles } from "./adapters/alignment/index.js";
 import { prepareFfmpeg } from "./adapters/ffmpeg.js";
+import { createHostCliClient } from "./adapters/host-cli/index.js";
 import { nodeRunCli } from "./adapters/llm/run-cli.js";
 import { curateRegistry } from "./catalog/registry.js";
 import { createCatalogueStore } from "./catalog/store.js";
@@ -154,12 +155,16 @@ export async function boot(config) {
             post: httpPostEvents(collectorEndpoint(process.env), collectorTimeoutMs),
         }, flushDelayMs);
         const catalogue = createCatalogueStore({ dataDir: paths.dataDir, fetch: globalThis.fetch });
+        const hostCli = process.env.SLOPIFY_CONTAINER === "1" || process.env.SLOPIFY_HOST_CLI_DIR
+            ? createHostCliClient({ directory: process.env.SLOPIFY_HOST_CLI_DIR })
+            : undefined;
         const registry = curateRegistry(buildRegistry({
             db,
             fetch: globalThis.fetch,
             spawn: nodeRunCli,
             clock,
             probe: nodeCliProbe,
+            hostCli,
         }), catalogue);
         const audioPreviews = createAudioPreviewStore();
         const runner = wireRunner({
@@ -265,7 +270,7 @@ export async function boot(config) {
             runner,
             catalogue,
             measureAudio: (path, signal) => probeDurationMs(ffmpeg, path, signal ?? AbortSignal.timeout(30_000), log),
-            providers: () => providerStatuses({ db: updateDb, probe: nodeCliProbe }),
+            providers: () => providerStatuses({ db: updateDb, probe: nodeCliProbe, hostCliStatus: hostCli?.status }),
             modelsFor: modelSources(registry).modelsFor,
             emit: (projectId, event) => hub.emit(projectId, event),
         };
@@ -324,6 +329,7 @@ export async function boot(config) {
             webDist: fileURLToPath(new URL("../dist/web", import.meta.url)),
             flushSoon: flusher.soon,
             probe: nodeCliProbe,
+            hostCliStatus: hostCli?.status,
         });
         const server = await listen(app, config, log);
         const queueTimer = setInterval(() => {