@hasna/switcher 0.1.0

package/dist/cli/index.js

@@ -0,0 +1,759 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/cli.ts
+import { parseArgs } from "util";
+
+// src/domain.ts
+import { z } from "zod";
+var VERSION = "0.1.0";
+var harnessSchema = z.enum(["claude", "codex", "grok", "opencode2"]);
+var protocolSchema = z.enum(["anthropic-messages", "openai-responses", "openai-chat"]);
+var idSchema = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,79}$/);
+var label = z.string().min(1).max(200);
+var envRef = z.string().regex(/^SWITCHER_PROVIDER_[A-Z0-9_]+$/);
+function endpoint(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Fault(400, "invalid_url", "Use an absolute HTTPS URL (HTTP is allowed on loopback).");
+  }
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local) || url.username || url.password || url.search || url.hash)
+    throw new Fault(400, "invalid_url", "URL must use HTTPS, contain no credentials/query/fragment, or use HTTP on loopback.");
+  return url.href.replace(/\/+$/, "");
+}
+var urlSchema = z.string().max(2000).superRefine((v, ctx) => {
+  try {
+    endpoint(v);
+  } catch {
+    ctx.addIssue({ code: "custom", message: "Invalid endpoint URL" });
+  }
+}).transform(endpoint);
+var modelSchema = z.object({
+  id: z.string().min(1).max(300),
+  name: label,
+  description: z.string().max(8000).optional(),
+  contextWindow: z.number().int().positive().optional(),
+  maxOutputTokens: z.number().int().positive().optional(),
+  inputModalities: z.array(z.string().max(50)).max(20).optional(),
+  outputModalities: z.array(z.string().max(50)).max(20).optional(),
+  supportedParameters: z.array(z.string().max(100)).max(100).optional()
+}).strict();
+var providerInputSchema = z.object({
+  id: idSchema,
+  name: label,
+  baseUrl: urlSchema,
+  protocol: protocolSchema,
+  credentialEnv: envRef.optional(),
+  authStyle: z.enum(["bearer", "x-api-key"]).default("bearer"),
+  modelsPath: z.string().regex(/^[a-zA-Z0-9_/-]+$/).max(200).default("models"),
+  manualModels: z.array(modelSchema).max(1e4).default([])
+}).strict().refine((p) => !p.modelsPath.split("/").includes("..") && !p.modelsPath.startsWith("/"), "modelsPath must be relative");
+var profileInputSchema = z.object({
+  id: idSchema,
+  name: label,
+  providerId: idSchema,
+  harness: harnessSchema,
+  model: z.string().min(1).max(300)
+}).strict();
+var runInputSchema = z.object({
+  profileId: idSchema,
+  harness: harnessSchema,
+  model: z.string().min(1).max(300),
+  planToken: z.string().regex(/^[a-f0-9]{64}$/)
+}).strict();
+var runUpdateSchema = z.object({
+  status: z.enum(["exited", "failed", "interrupted"]),
+  exitCode: z.number().int().min(0).max(255)
+}).strict();
+
+class Fault extends Error {
+  status;
+  code;
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+}
+function parse(schema, value) {
+  const result = schema.safeParse(value);
+  if (!result.success)
+    throw new Fault(400, "invalid_request", result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "));
+  return result.data;
+}
+function compatible(harness, protocol) {
+  return harness === "claude" ? protocol === "anthropic-messages" : harness === "codex" ? protocol === "openai-responses" : true;
+}
+function codingEligible(model) {
+  return (!model.outputModalities || model.outputModalities.includes("text")) && (!model.supportedParameters || model.supportedParameters.includes("tools"));
+}
+
+// src/http.ts
+var MAX_BYTES = 16 * 1024 * 1024;
+async function boundedJson(response, maxBytes = MAX_BYTES) {
+  if (!response.body)
+    throw new Fault(502, "invalid_upstream", "Upstream returned no body.");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const item = await reader.read();
+      if (item.done)
+        break;
+      size += item.value.byteLength;
+      if (size > maxBytes)
+        throw new Fault(502, "response_too_large", "Response exceeds the size limit.");
+      chunks.push(item.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+    try {
+      return JSON.parse(new TextDecoder().decode(bytes));
+    } catch {
+      throw new Fault(502, "invalid_upstream", "Upstream returned invalid JSON.");
+    }
+  } finally {
+    await reader.cancel().catch(() => {});
+  }
+}
+
+// src/sdk.ts
+import { resolveCredential } from "@hasna/contracts/client";
+
+class SwitcherError extends Error {
+  status;
+  code;
+  requestId;
+  constructor(status, code, message, requestId) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.requestId = requestId;
+  }
+}
+
+class SwitcherClient {
+  options;
+  baseUrl;
+  constructor(options) {
+    this.baseUrl = endpoint(options.baseUrl).replace(/\/v1$/, "");
+    if (typeof options.apiKey === "string" && (!options.apiKey || /[\r\n]/.test(options.apiKey)))
+      throw new Error("Switcher API key is required.");
+    this.options = { ...options };
+  }
+  async request(method, path, body, options = {}) {
+    if (!/^\/v1\/[a-zA-Z0-9/?&=._%+-]+$/.test(path) || path.includes(".."))
+      throw new Error("Invalid API path.");
+    const apiKey = typeof this.options.apiKey === "function" ? this.options.apiKey() : this.options.apiKey;
+    if (!apiKey || /[\r\n]/.test(apiKey))
+      throw new Error("Switcher API key is required.");
+    const headers = { authorization: `Bearer ${apiKey}`, accept: "application/json" };
+    if (body !== undefined)
+      headers["content-type"] = "application/json";
+    if (method !== "GET")
+      headers["idempotency-key"] = options.idempotencyKey ?? crypto.randomUUID();
+    if (options.version !== undefined)
+      headers["if-match"] = String(options.version);
+    let response;
+    try {
+      response = await (this.options.fetch ?? fetch)(`${this.baseUrl}${path}`, { method, headers, body: body === undefined ? undefined : JSON.stringify(body), redirect: "manual", signal: AbortSignal.timeout(this.options.timeoutMs ?? 120000) });
+    } catch {
+      throw new SwitcherError(0, "connection_failed", "Switcher API request failed; check endpoint and service availability.");
+    }
+    let data;
+    try {
+      data = await boundedJson(response);
+    } catch {
+      throw new SwitcherError(response.status, "invalid_response", "Switcher API returned invalid JSON.");
+    }
+    if (!response.ok)
+      throw new SwitcherError(response.status, data?.error?.code ?? "api_error", data?.error?.message ?? `Switcher API returned HTTP ${response.status}.`, data?.error?.requestId);
+    return data;
+  }
+  query(options = {}) {
+    return new URLSearchParams(Object.entries(options).filter(([, v]) => v !== undefined).map(([k, v]) => [k, String(v)])).toString();
+  }
+  listProviders(options = {}) {
+    return this.request("GET", `/v1/providers?${this.query(options)}`);
+  }
+  getProvider(id) {
+    return this.request("GET", `/v1/providers/${encodeURIComponent(id)}`);
+  }
+  createProvider(input, idempotencyKey) {
+    return this.request("POST", "/v1/providers", input, { idempotencyKey });
+  }
+  updateProvider(input, version, idempotencyKey) {
+    return this.request("PUT", `/v1/providers/${encodeURIComponent(input.id)}`, input, { version, idempotencyKey });
+  }
+  deleteProvider(id, version, idempotencyKey) {
+    return this.request("DELETE", `/v1/providers/${encodeURIComponent(id)}`, undefined, { version, idempotencyKey });
+  }
+  refreshModels(id, idempotencyKey) {
+    return this.request("POST", `/v1/providers/${encodeURIComponent(id)}/refresh`, {}, { idempotencyKey });
+  }
+  listModels(id, options = {}) {
+    return this.request("GET", `/v1/providers/${encodeURIComponent(id)}/models?${this.query(options)}`);
+  }
+  listProfiles(options = {}) {
+    return this.request("GET", `/v1/profiles?${this.query(options)}`);
+  }
+  getProfile(id) {
+    return this.request("GET", `/v1/profiles/${encodeURIComponent(id)}`);
+  }
+  createProfile(input, idempotencyKey) {
+    return this.request("POST", "/v1/profiles", input, { idempotencyKey });
+  }
+  updateProfile(input, version, idempotencyKey) {
+    return this.request("PUT", `/v1/profiles/${encodeURIComponent(input.id)}`, input, { version, idempotencyKey });
+  }
+  deleteProfile(id, version, idempotencyKey) {
+    return this.request("DELETE", `/v1/profiles/${encodeURIComponent(id)}`, undefined, { version, idempotencyKey });
+  }
+  launchPlan(profileId, idempotencyKey) {
+    return this.request("POST", "/v1/launch-plans", { profileId }, { idempotencyKey });
+  }
+  listRuns(options = {}) {
+    return this.request("GET", `/v1/runs?${this.query(options)}`);
+  }
+  getRun(id) {
+    return this.request("GET", `/v1/runs/${encodeURIComponent(id)}`);
+  }
+  createRun(input, idempotencyKey) {
+    return this.request("POST", "/v1/runs", input, { idempotencyKey });
+  }
+  finishRun(id, version, input, idempotencyKey) {
+    return this.request("PATCH", `/v1/runs/${encodeURIComponent(id)}`, input, { version, idempotencyKey });
+  }
+}
+function clientFromEnv(env = process.env) {
+  const credential = () => resolveCredential("switcher", Object.fromEntries(Object.entries(env).filter(([name]) => name === "HASNA_SWITCHER_API_KEY")), { keychain: { enabled: false } })?.apiKey ?? "";
+  if (!env.HASNA_SWITCHER_API_URL || !credential())
+    throw new Error("Set HASNA_SWITCHER_API_URL and HASNA_SWITCHER_API_KEY; no local database fallback is available.");
+  return new SwitcherClient({ baseUrl: env.HASNA_SWITCHER_API_URL, apiKey: credential });
+}
+
+// src/harnesses.ts
+import { mkdir, writeFile } from "fs/promises";
+import { join, isAbsolute } from "path";
+import { createHash, timingSafeEqual } from "crypto";
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execute = promisify(execFile);
+var KEY = "SWITCHER_HARNESS_API_KEY";
+var quote = (value) => JSON.stringify(value);
+async function detectHarness(harness, override) {
+  const executable = override ?? Bun.which(harness) ?? harness;
+  try {
+    const { stdout } = await execute(executable, ["--version"], { timeout: 8000, maxBuffer: 65536 });
+    return { harness, executable, available: true, version: stdout.trim().slice(0, 200) };
+  } catch {
+    return { harness, executable, available: false, version: undefined };
+  }
+}
+var versionAtLeast = (raw, minimum) => {
+  const match = raw?.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match)
+    return false;
+  const actual = match.slice(1).map(Number);
+  for (let i = 0;i < 3; i++) {
+    if (actual[i] > minimum[i])
+      return true;
+    if (actual[i] < minimum[i])
+      return false;
+  }
+  return true;
+};
+async function jsonFile(dir, name, value) {
+  const path = join(dir, name);
+  await writeFile(path, JSON.stringify(value, null, 2) + `
+`, { mode: 384, flag: "wx" });
+  return path;
+}
+function codexModel(model, priority) {
+  return {
+    slug: model.id,
+    display_name: model.name,
+    description: model.description ?? model.id,
+    shell_type: "shell_command",
+    visibility: "list",
+    supported_in_api: true,
+    priority,
+    supported_reasoning_levels: [],
+    default_reasoning_level: null,
+    support_verbosity: false,
+    supports_reasoning_summary_parameter: false,
+    default_verbosity: null,
+    supports_parallel_tool_calls: false,
+    apply_patch_tool_type: null,
+    truncation_policy: { mode: "tokens", limit: 1e4 },
+    experimental_supported_tools: [],
+    context_window: model.contextWindow ?? null,
+    max_context_window: model.contextWindow ?? null,
+    input_modalities: (model.inputModalities ?? ["text"]).filter((m) => m === "text" || m === "image"),
+    prefer_websockets: false,
+    use_responses_lite: false,
+    model_messages: { instructions_template: "You are Codex, a coding assistant. Help the user with their requested work. Follow the user and developer instructions, use the available tools when appropriate, preserve unrelated changes, and report actual results and remaining limitations.", instructions_variables: null }
+  };
+}
+function grokBridge(input) {
+  const token = crypto.randomUUID() + crypto.randomUUID();
+  const expected = createHash("sha256").update(`Bearer ${token}`).digest();
+  const models = new Map(input.models.flatMap((m) => [[m.id, m.id], [grokAlias(input, m.id), m.id]]));
+  let server;
+  const apiBackend = { "anthropic-messages": "messages", "openai-responses": "responses", "openai-chat": "chat_completions" }[input.protocol];
+  const apiPath = { "anthropic-messages": "/messages", "openai-responses": "/responses", "openai-chat": "/chat/completions" }[input.protocol];
+  server = Bun.serve({ hostname: "127.0.0.1", port: 0, maxRequestBodySize: 4 * 1024 * 1024, idleTimeout: 255, async fetch(request) {
+    const auth = request.headers.get("authorization") ?? (request.headers.has("x-api-key") ? `Bearer ${request.headers.get("x-api-key")}` : "");
+    if (!timingSafeEqual(expected, createHash("sha256").update(auth).digest()))
+      return Response.json({ error: { message: "Unauthorized" } }, { status: 401 });
+    const path = new URL(request.url).pathname;
+    if (request.method === "GET" && path === "/v1/api-key")
+      return Response.json({ api_key_blocked: false, api_key_disabled: false, team_blocked: false });
+    if (request.method === "GET" && path === "/v1/models")
+      return Response.json({ data: input.models.map((m) => ({
+        id: grokAlias(input, m.id),
+        model: m.id,
+        name: m.name,
+        description: m.description,
+        base_url: new URL("v1", server.url).href,
+        context_window: m.contextWindow,
+        max_completion_tokens: m.maxOutputTokens,
+        api_backend: apiBackend,
+        env_key: KEY
+      })) });
+    if (request.method !== "POST" || path !== `/v1${apiPath}`)
+      return Response.json({ error: { message: "Unsupported route" } }, { status: 404 });
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json({ error: { message: "Invalid JSON" } }, { status: 400 });
+    }
+    if (!models.has(body.model))
+      return Response.json({ error: { message: "Model is outside this launch catalog" } }, { status: 403 });
+    body.model = models.get(body.model);
+    const headers = { "content-type": "application/json" };
+    if (input.credential)
+      headers[input.authStyle === "x-api-key" ? "x-api-key" : "authorization"] = input.authStyle === "x-api-key" ? input.credential : `Bearer ${input.credential}`;
+    if (input.protocol === "anthropic-messages") {
+      headers["anthropic-version"] = request.headers.get("anthropic-version") ?? "2023-06-01";
+      if (request.headers.has("anthropic-beta"))
+        headers["anthropic-beta"] = request.headers.get("anthropic-beta");
+    }
+    try {
+      const response = await fetch(`${input.baseUrl}${apiPath}`, { method: "POST", headers, body: JSON.stringify(body), redirect: "manual", signal: AbortSignal.any([request.signal, AbortSignal.timeout(240000)]) });
+      if (!response.ok) {
+        await response.body?.cancel();
+        return Response.json({ error: { message: `Provider returned HTTP ${response.status}` } }, { status: response.status >= 300 && response.status < 400 ? 502 : response.status });
+      }
+      return new Response(response.body, { status: response.status, headers: { "content-type": response.headers.get("content-type") ?? "application/json", "cache-control": "no-store" } });
+    } catch {
+      return Response.json({ error: { message: "Provider request failed" } }, { status: 502 });
+    }
+  } });
+  return { baseUrl: new URL("v1", server.url).href, token, cleanup: async () => {
+    await server.stop(true);
+  } };
+}
+function grokAlias(input, model) {
+  return "switcher-" + createHash("sha256").update(JSON.stringify([input.baseUrl, input.protocol])).digest("hex").slice(0, 12) + "/" + model;
+}
+async function prepareNativeLaunch(input) {
+  input = { ...input, baseUrl: endpoint(input.baseUrl) };
+  if (!compatible(input.harness, input.protocol))
+    throw new Error("Harness and provider protocol are incompatible.");
+  if (!isAbsolute(input.stateDir) || !isAbsolute(input.cwd))
+    throw new Error("Launch state and working directories must be absolute.");
+  if (!input.models.length || !input.models.some((m) => m.id === input.model))
+    throw new Error("Selected model is missing from the launch catalog.");
+  if (input.models.some((m) => !codingEligible(m)))
+    throw new Error("Launch catalog contains a model explicitly ineligible for coding.");
+  if (input.credential && /[\r\n]/.test(input.credential))
+    throw new Error("Provider credential contains invalid header characters.");
+  await mkdir(input.stateDir, { recursive: true, mode: 448 });
+  const args = [...input.args ?? []];
+  const env = {};
+  const warnings = [];
+  const configPaths = [];
+  const executable = input.executable ?? input.harness;
+  const missing = input.models.filter((m) => !m.contextWindow).length;
+  if (missing)
+    warnings.push(`${missing} catalog models have no declared context limit; native fallback limits may be inaccurate.`);
+  if (input.harness === "claude") {
+    if (!versionAtLeast(input.version, [2, 1, 242]))
+      throw new Error("Claude Code >=2.1.242 is required for a full native modelPicker.");
+    env.ANTHROPIC_BASE_URL = input.baseUrl.replace(/\/v1$/, "");
+    env.ANTHROPIC_MODEL = input.model;
+    env[input.authStyle === "x-api-key" ? "ANTHROPIC_API_KEY" : "ANTHROPIC_AUTH_TOKEN"] = input.credential ?? "switcher-local-no-auth";
+    const file2 = await jsonFile(input.stateDir, "claude-settings.json", { modelPicker: { replaceBuiltInOptions: true, options: input.models.map((m) => ({ model: m.id, label: m.name, description: m.description?.slice(0, 300) })) } });
+    configPaths.push(file2);
+    warnings.push("Claude managed settings and model allowlists can restrict the generated picker.");
+    return { executable, args: ["--settings", file2, "--model", input.model, ...args], env, configPaths, warnings };
+  }
+  if (input.harness === "codex") {
+    if (!versionAtLeast(input.version, [0, 153, 0]))
+      throw new Error("Codex >=0.153.0 is required by this catalog adapter.");
+    const file2 = await jsonFile(input.stateDir, "codex-models.json", { models: input.models.map(codexModel) });
+    configPaths.push(file2);
+    env[KEY] = input.credential ?? "switcher-local-no-auth";
+    const provider = { name: "Switcher", base_url: input.baseUrl, wire_api: "responses", requires_openai_auth: false };
+    {
+      if (input.authStyle === "x-api-key")
+        provider.env_http_headers = { "x-api-key": KEY };
+      else
+        provider.env_key = KEY;
+    }
+    const toml = Object.entries(provider).map(([k, v]) => `${k} = ${typeof v === "object" ? "{ " + Object.entries(v).map(([key, value]) => `${quote(key)} = ${quote(value)}`).join(", ") + " }" : quote(v)}`).join(", ");
+    const overrides = ["-c", `model_provider="switcher"`, "-c", `model_providers.switcher={ ${toml} }`, "-c", `model_catalog_json=${quote(file2)}`, "-c", `model=${quote(input.model)}`];
+    warnings.push("Codex catalog uses conservative generic tool metadata and a model-neutral coding prompt; provider-specific reasoning is not advertised.");
+    return { executable, args: [...overrides, ...args], env, configPaths, warnings };
+  }
+  if (input.harness === "grok") {
+    if (!versionAtLeast(input.version, [1, 0, 13]))
+      throw new Error("Grok Build >=1.0.13 is required by this remote catalog adapter.");
+    if (args.some((a) => ["--resume", "-r", "--continue", "-c"].includes(a)))
+      throw new Error("Grok resume is not supported by the per-launch bridge yet; start a new session.");
+    const file2 = await jsonFile(input.stateDir, "grok-overlay.json", { models: { default: grokAlias(input, input.model), allowed_models: input.models.map((m) => grokAlias(input, m.id)) } });
+    configPaths.push(file2);
+    const bridge = grokBridge(input);
+    env.GROK_MODELS_BASE_URL = bridge.baseUrl;
+    env.GROK_MODELS_LIST_URL = bridge.baseUrl + "/models";
+    env.GROK_XAI_API_BASE_URL = bridge.baseUrl;
+    env.XAI_API_KEY = bridge.token;
+    env[KEY] = bridge.token;
+    env.GROK_CONFIG_PATH = file2;
+    warnings.push("Grok uses a per-launch loopback catalog/auth bridge; native managed model policies still apply.");
+    return { executable, args: ["--model", grokAlias(input, input.model), ...args], env, configPaths, warnings, cleanup: bridge.cleanup };
+  }
+  if (!input.version?.includes("opencode2") && !versionAtLeast(input.version, [2, 0, 0]))
+    throw new Error("Use the OpenCode 2 executable, not legacy OpenCode.");
+  const providerID = "switcher-" + createHash("sha256").update(input.baseUrl + input.protocol).digest("hex").slice(0, 12);
+  const packageName = { "anthropic-messages": "anthropic", "openai-responses": "openai/responses", "openai-chat": "openai-compatible" }[input.protocol];
+  const models = Object.fromEntries(input.models.map((m) => [m.id, {
+    modelID: m.id,
+    name: m.name,
+    capabilities: { tools: m.supportedParameters?.includes("tools") ?? true, input: m.inputModalities ?? ["text"], output: m.outputModalities ?? ["text"] },
+    limit: { ...m.contextWindow ? { context: m.contextWindow } : {}, ...m.maxOutputTokens ? { output: m.maxOutputTokens } : {} }
+  }]));
+  const settings = { baseURL: input.baseUrl };
+  env[KEY] = input.credential ?? "switcher-local-no-auth";
+  settings.apiKey = `{env:${KEY}}`;
+  const config = { model: `${providerID}/${input.model}`, providers: { [providerID]: { name: "Switcher", env: [KEY], package: `@opencode-ai/ai/providers/${packageName}`, settings, models } } };
+  const file = await jsonFile(input.stateDir, "opencode.json", config);
+  configPaths.push(file);
+  env.OPENCODE_CONFIG = file;
+  env.OPENCODE_CONFIG_CONTENT = JSON.stringify({ model: config.model });
+  const native = args[0] === "run" ? ["run", "--standalone", "--model", `${providerID}/${input.model}`, ...args.slice(1)] : args[0] === "models" ? ["models", "--standalone", ...args.slice(1)] : ["--standalone", ...args];
+  warnings.push("OpenCode 2 uses a standalone server so concurrent launch profiles cannot share provider configuration.");
+  if (input.models.some((m) => !m.supportedParameters || !m.inputModalities || !m.outputModalities))
+    warnings.push("OpenCode requires complete capabilities; unknown fields use text-only/tool-enabled native defaults, not verified provider capabilities.");
+  return { executable, args: native, env, configPaths, warnings };
+}
+async function prepareHarnessLaunch(input) {
+  const reserved = {
+    claude: ["--model", "--settings", "--setting-sources"],
+    codex: ["--model", "-m", "--profile", "-p"],
+    grok: ["--model", "-m", "--oauth"],
+    opencode2: ["--model", "-m", "--server"]
+  };
+  for (let i = 0;i < (input.args ?? []).length; i++) {
+    const arg = input.args[i], flag = arg.split("=")[0];
+    if (reserved[input.harness].includes(flag))
+      throw new Error("Provider/model configuration arguments are reserved by the launch profile; update the profile instead.");
+    if (input.harness === "codex" && (flag === "-c" || flag === "--config" || arg.startsWith("-c"))) {
+      const value = arg === "-c" || arg === "--config" ? input.args[i + 1] ?? "" : arg.replace(/^(-c|--config=)/, "");
+      if (/^(model|model_provider|model_providers|model_catalog_json)([.=]|$)/.test(value.trim()))
+        throw new Error("Codex provider/model configuration must come from the launch profile.");
+    }
+  }
+  const nativeAuth = input.protocol === "anthropic-messages" ? "x-api-key" : "bearer";
+  const adaptAuth = input.harness === "opencode2" && (input.authStyle ?? "bearer") !== nativeAuth;
+  if (input.harness === "opencode2" && (!input.credential || adaptAuth) && (input.args ?? []).some((a) => ["--continue", "-c", "--session", "-s", "--fork"].includes(a.split("=")[0])))
+    throw new Error("OpenCode resume with a temporary auth bridge is not supported yet; start a new session.");
+  if (input.credential && !adaptAuth || input.harness === "grok")
+    return prepareNativeLaunch(input);
+  const bridge = grokBridge({ ...input, baseUrl: endpoint(input.baseUrl) });
+  try {
+    const prepared = await prepareNativeLaunch({ ...input, baseUrl: bridge.baseUrl, credential: bridge.token, authStyle: input.harness === "opencode2" ? nativeAuth : "bearer" });
+    return { ...prepared, cleanup: async () => {
+      await prepared.cleanup?.();
+      await bridge.cleanup();
+    } };
+  } catch (error) {
+    await bridge.cleanup();
+    throw error;
+  }
+}
+
+// src/launcher.ts
+import { spawn } from "child_process";
+import { mkdir as mkdir2, mkdtemp, rm } from "fs/promises";
+import { join as join2, resolve } from "path";
+import { homedir } from "os";
+function childEnvironment(env = process.env) {
+  const allowed = /^(PATH|HOME|USER|LOGNAME|SHELL|TMPDIR|TEMP|TMP|TERM|COLORTERM|LANG|LC_[A-Z_]+|XDG_CONFIG_HOME|XDG_DATA_HOME|XDG_STATE_HOME|XDG_CACHE_HOME|SSH_AUTH_SOCK|GIT_SSH_COMMAND|EDITOR|VISUAL|NO_COLOR|FORCE_COLOR|CODEX_HOME|GROK_HOME|GROK_SANDBOX|GROK_DISABLE_API_KEY_AUTH|CLAUDE_CONFIG_DIR)$/;
+  return Object.fromEntries(Object.entries(env).filter((entry) => allowed.test(entry[0]) && entry[1] !== undefined));
+}
+async function launch(client, profileId, options = {}) {
+  const profile = await client.getProfile(profileId);
+  await client.refreshModels(profile.providerId);
+  const plan = await client.launchPlan(profileId);
+  const detection = await detectHarness(plan.profile.harness, options.executable);
+  if (!detection.available)
+    throw new Error(`Harness ${plan.profile.harness} is not installed; use --executable PATH after installing it.`);
+  const credential = plan.provider.credentialEnv ? process.env[plan.provider.credentialEnv] : undefined;
+  if (plan.provider.credentialEnv && !credential)
+    throw new Error("Provider credential environment reference is not available in this local launcher process.");
+  const root = resolve(options.stateDir ?? join2(process.env.HASNA_SWITCHER_HOME ?? join2(homedir(), ".hasna", "switcher"), "state"));
+  await mkdir2(root, { recursive: true, mode: 448 });
+  const stateDir = await mkdtemp(join2(root, "launch-"));
+  let run;
+  let cleanup;
+  try {
+    const prepared = await prepareHarnessLaunch({
+      harness: plan.profile.harness,
+      baseUrl: plan.provider.baseUrl,
+      protocol: plan.provider.protocol,
+      model: plan.profile.model,
+      models: plan.catalog.models.filter(codingEligible),
+      credential,
+      authStyle: plan.provider.authStyle,
+      executable: options.executable,
+      args: options.args ?? [],
+      stateDir,
+      cwd: resolve(options.cwd ?? process.cwd()),
+      version: detection.version
+    });
+    cleanup = prepared.cleanup;
+    for (const warning of [...plan.warnings, ...prepared.warnings])
+      console.error(`switcher: ${warning}`);
+    run = await client.createRun({ profileId, model: plan.profile.model, harness: plan.profile.harness, planToken: plan.planToken });
+    let interrupted = false;
+    const code = await new Promise((resolveCode, reject) => {
+      const child = spawn(prepared.executable, prepared.args, { cwd: resolve(options.cwd ?? process.cwd()), env: { ...childEnvironment(), ...prepared.env }, stdio: "inherit", shell: false });
+      let killTimer;
+      const forward = (signal) => {
+        interrupted = true;
+        child.kill(signal);
+        killTimer ??= setTimeout(() => child.kill("SIGKILL"), 5000).unref();
+      };
+      const onInt = () => forward("SIGINT");
+      const onTerm = () => forward("SIGTERM");
+      process.on("SIGINT", onInt);
+      process.on("SIGTERM", onTerm);
+      const timeout = options.timeoutMs ? setTimeout(() => forward("SIGTERM"), options.timeoutMs) : undefined;
+      const cleanup2 = () => {
+        process.off("SIGINT", onInt);
+        process.off("SIGTERM", onTerm);
+        if (timeout)
+          clearTimeout(timeout);
+        if (killTimer)
+          clearTimeout(killTimer);
+      };
+      child.once("error", () => {
+        cleanup2();
+        reject(new Error("Harness process could not start; check executable and permissions."));
+      });
+      child.once("exit", (code2, signal) => {
+        cleanup2();
+        resolveCode(code2 ?? (signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 137));
+      });
+    });
+    await client.finishRun(run.id, run.version, { status: interrupted ? "interrupted" : code === 0 ? "exited" : "failed", exitCode: code }, crypto.randomUUID()).catch(() => console.error(`switcher: Harness exited ${code}; final metadata could not be saved for run ${run.id}.`));
+    return code;
+  } catch (error) {
+    if (run)
+      await client.finishRun(run.id, run.version, { status: "failed", exitCode: 1 }).catch(() => console.error("switcher: Could not persist final run status; inspect the run through the API."));
+    throw error;
+  } finally {
+    await cleanup?.();
+    await rm(stateDir, { recursive: true, force: true });
+  }
+}
+
+// src/cli.ts
+var HELP = `switcher \u2014 launch a coding harness with a provider and its model catalog
+
+  switcher providers list [--search TEXT] [--limit N] [--offset N]
+  switcher providers add ID --url URL --protocol PROTOCOL [--credential-env NAME]
+  switcher providers add ID --preset openrouter --protocol PROTOCOL
+  switcher providers get|refresh ID
+  switcher providers update ID --file provider.json --version N
+  switcher providers delete ID --version N
+  switcher models PROVIDER [--refresh] [--search TEXT] [--limit N]
+  switcher profiles list|get [ID]
+  switcher profiles add ID --provider ID --harness HARNESS --model MODEL
+  switcher profiles update ID --file profile.json --version N
+  switcher profiles delete ID --version N
+  switcher launch PROFILE [--cwd DIR] [--executable PATH] [--state-dir DIR]
+                          [--timeout SECONDS] -- [native harness arguments]
+  switcher runs list|get [ID]
+  switcher doctor
+
+HARNESS: claude, codex, grok, opencode2
+PROTOCOL: anthropic-messages, openai-responses, openai-chat
+All data commands require HASNA_SWITCHER_API_URL + HASNA_SWITCHER_API_KEY.
+Provider credential references must start SWITCHER_PROVIDER_.
+--file accepts a JSON object including id; raw credentials are never accepted.
+--json outputs machine-readable records (also the default for data commands).
+switcher --version | --help
+`;
+async function readInput(path) {
+  try {
+    return await Bun.file(path).json();
+  } catch {
+    throw new Error("Input file must be readable, valid JSON.");
+  }
+}
+async function main(args = process.argv.slice(2)) {
+  const split = args.indexOf("--");
+  const nativeArgs = split >= 0 ? args.slice(split + 1) : [];
+  const { values, positionals } = parseArgs({ args: split >= 0 ? args.slice(0, split) : args, allowPositionals: true, options: {
+    help: { type: "boolean" },
+    version: { type: "string" },
+    json: { type: "boolean" },
+    url: { type: "string" },
+    protocol: { type: "string" },
+    preset: { type: "string" },
+    name: { type: "string" },
+    file: { type: "string" },
+    "credential-env": { type: "string" },
+    "auth-style": { type: "string" },
+    provider: { type: "string" },
+    harness: { type: "string" },
+    model: { type: "string" },
+    search: { type: "string" },
+    limit: { type: "string" },
+    offset: { type: "string" },
+    refresh: { type: "boolean" },
+    cwd: { type: "string" },
+    executable: { type: "string" },
+    "state-dir": { type: "string" },
+    timeout: { type: "string" }
+  } });
+  if (values.help || !positionals.length) {
+    console.log(HELP);
+    return;
+  }
+  const [command, action, id] = positionals;
+  const output = (value) => console.log(JSON.stringify(value, null, 2));
+  if (command === "doctor") {
+    const harnesses = await Promise.all(["claude", "codex", "grok", "opencode2"].map((h) => detectHarness(h)));
+    let api = { configured: false };
+    if (process.env.HASNA_SWITCHER_API_URL) {
+      try {
+        await clientFromEnv().listProviders({ limit: 1 });
+        api = { configured: true, reachable: true };
+      } catch {
+        api = { configured: true, reachable: false };
+      }
+    }
+    output({ version: VERSION, harnesses, api, liveVerified: false });
+    return;
+  }
+  const client = clientFromEnv();
+  const page = { limit: values.limit ? Number(values.limit) : undefined, offset: values.offset ? Number(values.offset) : undefined, search: values.search };
+  const currentVersion = () => {
+    const n = Number(values.version);
+    if (!Number.isSafeInteger(n) || n < 1)
+      throw new Error("Use --version N with the record's current version.");
+    return n;
+  };
+  if (command === "launch") {
+    if (!action)
+      throw new Error("A profile ID is required.");
+    const timeoutMs = values.timeout ? Number(values.timeout) * 1000 : undefined;
+    if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0))
+      throw new Error("--timeout must be positive seconds.");
+    process.exitCode = await launch(client, action, { cwd: values.cwd, executable: values.executable, stateDir: values["state-dir"], args: nativeArgs, timeoutMs });
+    return;
+  }
+  if (command === "models" && action) {
+    if (values.refresh)
+      await client.refreshModels(action);
+    output(await client.listModels(action, page));
+    return;
+  }
+  if (command === "runs") {
+    output(action === "get" && id ? await client.getRun(id) : action === "list" ? await client.listRuns(page) : (() => {
+      throw new Error("Use runs list|get ID.");
+    })());
+    return;
+  }
+  if (command === "providers") {
+    if (action === "list") {
+      output(await client.listProviders(page));
+      return;
+    }
+    if (action === "get" && id) {
+      output(await client.getProvider(id));
+      return;
+    }
+    if (action === "refresh" && id) {
+      output(await client.refreshModels(id));
+      return;
+    }
+    if (action === "delete" && id) {
+      output(await client.deleteProvider(id, currentVersion()));
+      return;
+    }
+    if (["add", "update"].includes(action) && id) {
+      if (values.preset && values.preset !== "openrouter")
+        throw new Error("Supported preset: openrouter.");
+      const input = parse(providerInputSchema, values.file ? await readInput(values.file) : {
+        id,
+        name: values.name ?? id,
+        baseUrl: values.url ?? (values.preset === "openrouter" ? "https://openrouter.ai/api/v1" : undefined),
+        protocol: values.protocol,
+        credentialEnv: values["credential-env"],
+        authStyle: values["auth-style"]
+      });
+      if (input.id !== id)
+        throw new Error("File id must match the command id.");
+      output(action === "add" ? await client.createProvider(input) : await client.updateProvider(input, currentVersion()));
+      return;
+    }
+  }
+  if (command === "profiles") {
+    if (action === "list") {
+      output(await client.listProfiles(page));
+      return;
+    }
+    if (action === "get" && id) {
+      output(await client.getProfile(id));
+      return;
+    }
+    if (action === "delete" && id) {
+      output(await client.deleteProfile(id, currentVersion()));
+      return;
+    }
+    if (["add", "update"].includes(action) && id) {
+      const input = parse(profileInputSchema, values.file ? await readInput(values.file) : { id, name: values.name ?? id, providerId: values.provider, harness: values.harness, model: values.model });
+      if (input.id !== id)
+        throw new Error("File id must match the command id.");
+      output(action === "add" ? await client.createProfile(input) : await client.updateProfile(input, currentVersion()));
+      return;
+    }
+  }
+  throw new Error("Unknown command or missing arguments. Run switcher --help.");
+}
+if (import.meta.main) {
+  if (process.argv.slice(2).length === 1 && process.argv[2] === "--version")
+    console.log(VERSION);
+  else
+    main().catch((error) => {
+      console.error(JSON.stringify({ error: error instanceof SwitcherError ? { code: error.code, message: error.message, requestId: error.requestId } : { message: error instanceof Error ? error.message : "Command failed." } }));
+      process.exitCode = 1;
+    });
+}
+export {
+  main
+};