@hearsay-tools/squawk 0.0.0-stage → 0.17.0-dev.5682

package/dist/core/agent-env.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Curated child environments: base toolchain variables, selected-backend variables and trusted
+ * per-run overrides. CEZ_ENV_PASSTHROUGH and CEZ_AGENT_ENV_FULL are host-controlled escape
+ * hatches.
+ */
+import type { AgentBackend } from './agent-runner.ts';
+export declare function looksSecret(name: string): boolean;
+export interface BuildChildEnvOptions {
+    backend: AgentBackend;
+    /** Per-run env (CEZ_HANDOFF_FILE etc.) — always applied, wins over host. */
+    extraEnv?: Record<string, string> | undefined;
+    /** Source env; defaults to `process.env`. */
+    source?: NodeJS.ProcessEnv;
+}
+/** Home locators belong to the cockpit, never to a child process. */
+export declare const HOME_LOCATING_ENV: readonly string[];
+/** Preserve every other name, including host command credentials and escape hatches. */
+export declare function withoutHomeEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Build the curated child environment for a spawned backend. `extraEnv`
+ * (the runner's `spec.env`) is applied last so per-run vars always win.
+ */
+export declare function buildChildEnv(opts: BuildChildEnvOptions): NodeJS.ProcessEnv;
+/**
+ * The curated env for a host command no backend runs: a dev server the owner approved in the
+ * live preview (#781). It is `buildChildEnv` with no backend: the base allowlist, the non-secret `CEZ_*`,
+ * `CEZ_ENV_PASSTHROUGH` and the `CEZ_AGENT_ENV_FULL` escape hatch, but no backend auth, no Bedrock
+ * or Vertex credentials and no `gh` token. The command is model-written (`npm run dev` runs
+ * whatever the agent put in package.json) and runs outside any backend sandbox.
+ */
+export declare function buildCommandEnv(opts?: {
+    extraEnv?: Record<string, string>;
+    source?: NodeJS.ProcessEnv;
+}): NodeJS.ProcessEnv;

package/dist/core/agent-env.js

@@ -0,0 +1,411 @@
+/**
+ * Curated child environments: base toolchain variables, selected-backend variables and trusted
+ * per-run overrides. CEZ_ENV_PASSTHROUGH and CEZ_AGENT_ENV_FULL are host-controlled escape
+ * hatches.
+ */
+import { productEnv } from './product-env.js';
+import { SECRET_NAME_RE } from './secret-redaction.js';
+/**
+ * Env var names are matched case-INSENSITIVELY (#427 review). Windows spells
+ * the essentials `Path`, `SystemRoot`, `ComSpec`, `windir` — an exact-case
+ * `Set.has('PATH')` matched none of them, so every child env on win32 came out
+ * with no PATH and the backend binary could not even be resolved. The child env
+ * still carries each var under the parent's ORIGINAL spelling: Windows tooling
+ * expects `Path`, and normalizing the key would break it just as badly.
+ */
+function upperSet(names) {
+    return new Set(names.map((n) => n.toUpperCase()));
+}
+/** Exact var names always forwarded — non-secret, needed by shells/tools. */
+const BASE_ALLOW_NAMES = upperSet([
+    // Core shell / process identity
+    'PATH',
+    'HOME',
+    'SHELL',
+    'USER',
+    'LOGNAME',
+    'LNAME',
+    'PWD',
+    'OLDPWD',
+    'SHLVL',
+    'HOSTNAME',
+    'HOST',
+    'HOSTTYPE',
+    'MACHTYPE',
+    'OSTYPE',
+    'TMPDIR',
+    'TEMP',
+    'TMP',
+    'TZ',
+    // Locale
+    'LANG',
+    'LANGUAGE',
+    // Terminal / display
+    'TERM',
+    'TERMINFO',
+    'COLORTERM',
+    'COLUMNS',
+    'LINES',
+    'CLICOLOR',
+    'FORCE_COLOR',
+    'NO_COLOR',
+    'DISPLAY',
+    'WAYLAND_DISPLAY',
+    'XAUTHORITY',
+    // ssh agent socket/pid — a path + pid, not a credential (git over ssh)
+    'SSH_AUTH_SOCK',
+    'SSH_AGENT_PID',
+    // Editors / pagers
+    'EDITOR',
+    'VISUAL',
+    'PAGER',
+    'LESS',
+    'MANPATH',
+    'INFOPATH',
+    // Git plumbing that is not a secret
+    'GIT_PAGER',
+    'GIT_EDITOR',
+    'GIT_TERMINAL_PROMPT',
+    'GIT_SSH',
+    'GIT_SSH_COMMAND',
+    'GIT_EXEC_PATH',
+    // Proxies (matching is case-insensitive, so `http_proxy` is covered too)
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'FTP_PROXY',
+    'ALL_PROXY',
+    'NO_PROXY',
+    // Windows equivalents of the above. Without these `nodeSpawn('claude', …)`
+    // cannot resolve or launch the binary at all on win32 — the platform is
+    // supported (open-in-terminal.ts, open-in-app.ts, process-usage.ts) and
+    // package.json carries no `os` restriction. `HOME` is normally unset there;
+    // `USERPROFILE` is its counterpart.
+    'SYSTEMROOT',
+    'SYSTEMDRIVE',
+    'WINDIR',
+    'COMSPEC',
+    'PATHEXT',
+    'USERPROFILE',
+    'HOMEDRIVE',
+    'HOMEPATH',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'PROGRAMDATA',
+    'ALLUSERSPROFILE',
+    'PUBLIC',
+    'PROGRAMFILES',
+    'PROGRAMFILES(X86)',
+    'PROGRAMW6432',
+    'COMMONPROGRAMFILES',
+    'COMMONPROGRAMFILES(X86)',
+    'COMMONPROGRAMW6432',
+    'PSMODULEPATH',
+    'USERNAME',
+    'USERDOMAIN',
+    'COMPUTERNAME',
+    'LOGONSERVER',
+    'SESSIONNAME',
+    'OS',
+    'NUMBER_OF_PROCESSORS',
+    'PROCESSOR_ARCHITECTURE',
+    'PROCESSOR_IDENTIFIER',
+    'PROCESSOR_LEVEL',
+    'PROCESSOR_REVISION',
+]);
+/** Safe prefix families — dev toolchains that agents drive (node, python,
+ *  rust, go, java, …). A name here still drops if it matches a secret
+ *  pattern (e.g. `NODE_AUTH_TOKEN`, `CARGO_REGISTRY_TOKEN`). */
+const BASE_ALLOW_PREFIXES = [
+    'LC_',
+    'XDG_',
+    'LESS_',
+    // Node / JS
+    'NODE_',
+    'NPM_CONFIG_',
+    'NVM_',
+    'PNPM_',
+    'YARN_',
+    'BUN_',
+    'DENO_',
+    'VOLTA_',
+    'FNM_',
+    'COREPACK_',
+    // Python
+    'PYENV',
+    'PYTHON',
+    'PIP_',
+    'PIPENV_',
+    'POETRY_',
+    'VIRTUAL_ENV',
+    'CONDA_',
+    'UV_',
+    // Ruby
+    'RBENV',
+    'RUBY',
+    'GEM_',
+    'BUNDLE_',
+    // Rust
+    'RUSTUP_',
+    'CARGO_',
+    'RUST_',
+    // Go
+    'GOPATH',
+    'GOROOT',
+    'GOBIN',
+    'GOCACHE',
+    'GOMODCACHE',
+    'GOFLAGS',
+    'GOPROXY',
+    'GOPRIVATE',
+    'GOTOOLCHAIN',
+    'GOOS',
+    'GOARCH',
+    'GOENV',
+    'GOWORK',
+    'GO111MODULE',
+    // JVM / Android / Kotlin
+    'JAVA',
+    'JDK_',
+    'MAVEN_',
+    'GRADLE_',
+    'KOTLIN_',
+    'ANDROID_',
+    'SDKMAN_',
+    // .NET / other
+    'DOTNET_',
+    'NUGET_',
+    'SWIFT',
+    'XCODE',
+    'HOMEBREW_',
+    'ASDF_',
+    'MISE_',
+    'COMPOSER_',
+];
+/** The provider credentials a backend that selects models as `provider/model` may need — it can
+ *  be pointed at any of them, so none can be pruned without breaking a legitimate model id. */
+const MULTI_PROVIDER_PREFIXES = [
+    'OPENAI_',
+    'ANTHROPIC_',
+    'AZURE_OPENAI_',
+    'OPENROUTER_',
+    'GROQ_',
+    'MISTRAL_',
+    'GEMINI_',
+    'GOOGLE_GENERATIVE_AI_',
+    'DEEPSEEK_',
+    'XAI_',
+    'PERPLEXITY_',
+    'TOGETHER_',
+    'FIREWORKS_',
+];
+/** Per-backend auth/config the runner genuinely needs, by prefix. */
+const BACKEND_ALLOW_PREFIXES = {
+    claude: ['ANTHROPIC_', 'CLAUDE_'],
+    'claude-cli': ['ANTHROPIC_', 'CLAUDE_'],
+    codex: ['OPENAI_', 'CODEX_', 'AZURE_OPENAI_'],
+    opencode: MULTI_PROVIDER_PREFIXES,
+    cursor: ['CURSOR_'],
+    // pi selects models as `provider/model` (#387), so it needs both its own config and any
+    // provider a configured model id can name — the same set OpenCode gets, for the same reason.
+    // Deliberately NOT `CLAUDE_`: pi is not Claude Code and reads none of its variables, and the
+    // prefix is load-bearing below — it is what unlocks the Bedrock/Vertex cloud credentials, so
+    // granting it here handed pi the whole `AWS_*` / `GOOGLE_CLOUD_*` family on any host that had
+    // set `CLAUDE_CODE_USE_BEDROCK=1` for Claude Code, plus Claude's own config dir.
+    pi: ['PI_', ...MULTI_PROVIDER_PREFIXES],
+    // OMP (Oh My Pi) is pi's fork and selects models the same `provider/model` way, so it gets the
+    // same multi-provider set. Not `CLAUDE_`, for pi's reason above. `OMP_` is its own config and
+    // `PI_` is kept because OMP still reads `PI_CODING_AGENT_DIR` / `PI_CONFIG_DIR`
+    // (OMP v18.4.11; `can1357/oh-my-pi` `docs/environment-variables.md` at main @ 7318a70cf4ed).
+    // The reverse does not hold: pi gets no `OMP_`. Both prefixes also carry a host-exported
+    // `PI_CODING_AGENT_DIR` / `OMP_PROFILE` to every default-account session, which is how a host
+    // value moves the default account (`PROFILE_ENV_VAR` in `agent-profiles.ts`).
+    omp: ['OMP_', 'PI_', ...MULTI_PROVIDER_PREFIXES],
+};
+/** `gh` handoff (draft PRs) works in every backend — the one credential the
+ *  project deliberately keeps in the environment (AGENTS.md "No secrets in
+ *  state files": GITHUB_TOKEN stays in env, never on disk). */
+const GH_ALLOW_NAMES = upperSet([
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+    'GH_HOST',
+    'GH_ENTERPRISE_TOKEN',
+    'GH_CONFIG_DIR',
+]);
+/**
+ * Claude Code can be pointed at Bedrock or Vertex instead of the Anthropic API
+ * by `CLAUDE_CODE_USE_BEDROCK=1` / `CLAUDE_CODE_USE_VERTEX=1`. Those toggles
+ * ride in on the `CLAUDE_` prefix — but the cloud credentials they switch the
+ * SDK over to did not, so hardening the env forwarded the *instruction* to use
+ * Bedrock while dropping the *means*, turning a working setup into a hard auth
+ * failure with no hint (#427 review). Each toggle therefore unlocks exactly the
+ * credentials its own path needs, and only while it is on: with no toggle set
+ * (the default, direct-API posture) `AWS_*` / `GOOGLE_*` stay dropped, which is
+ * the least-privilege behavior #427 asked for in the first place.
+ */
+const BEDROCK_TOGGLE = 'CLAUDE_CODE_USE_BEDROCK';
+const VERTEX_TOGGLE = 'CLAUDE_CODE_USE_VERTEX';
+/** The whole `AWS_` family: the SDK's credential chain reads far more than the
+ *  static keys (SSO/profile/container/web-identity all have their own vars). */
+const BEDROCK_ALLOW_PREFIXES = ['AWS_'];
+const VERTEX_ALLOW_NAMES = upperSet([
+    'GOOGLE_APPLICATION_CREDENTIALS',
+    'CLOUD_ML_REGION',
+    // ANTHROPIC_VERTEX_PROJECT_ID already rides in on the `ANTHROPIC_` prefix.
+]);
+const VERTEX_ALLOW_PREFIXES = ['GOOGLE_CLOUD_'];
+export function looksSecret(name) {
+    return SECRET_NAME_RE.test(name);
+}
+/** Prefixes are authored uppercase; `name` must already be normalized. */
+function matchesPrefix(name, prefixes) {
+    return prefixes.some((p) => name.startsWith(p));
+}
+/** Case-insensitive read of `source` — a win32 fixture may spell it `Path`. */
+function readVar(source, name) {
+    const direct = source[name];
+    if (direct !== undefined)
+        return direct;
+    const upper = name.toUpperCase();
+    for (const [k, v] of Object.entries(source)) {
+        if (k.toUpperCase() === upper)
+            return v;
+    }
+    return undefined;
+}
+/** An opt-in toggle is on unless it is absent/empty/`0`/`false`. */
+function isTruthy(value) {
+    if (value === undefined)
+        return false;
+    const v = value.trim().toLowerCase();
+    return v !== '' && v !== '0' && v !== 'false';
+}
+/** Home locators belong to the cockpit, never to a child process. */
+export const HOME_LOCATING_ENV = ['CEZ_HOME', 'HSQ_HOME'];
+/** Preserve every other name, including host command credentials and escape hatches. */
+export function withoutHomeEnv(env) {
+    return Object.fromEntries(Object.entries(env).filter(([name]) => !HOME_LOCATING_ENV.includes(name.toUpperCase())));
+}
+/**
+ * Build the curated child environment for a spawned backend. `extraEnv`
+ * (the runner's `spec.env`) is applied last so per-run vars always win.
+ */
+export function buildChildEnv(opts) {
+    return curateEnv(opts.source ?? process.env, opts.extraEnv ?? {}, {
+        backendPrefixes: BACKEND_ALLOW_PREFIXES[opts.backend] ?? BACKEND_ALLOW_PREFIXES.claude,
+        gh: true,
+        secretCez: true,
+    });
+}
+/**
+ * The curated env for a host command no backend runs: a dev server the owner approved in the
+ * live preview (#781). It is `buildChildEnv` with no backend: the base allowlist, the non-secret `CEZ_*`,
+ * `CEZ_ENV_PASSTHROUGH` and the `CEZ_AGENT_ENV_FULL` escape hatch, but no backend auth, no Bedrock
+ * or Vertex credentials and no `gh` token. The command is model-written (`npm run dev` runs
+ * whatever the agent put in package.json) and runs outside any backend sandbox.
+ */
+export function buildCommandEnv(opts = {}) {
+    return curateEnv(opts.source ?? process.env, opts.extraEnv ?? {}, { backendPrefixes: [], gh: false, secretCez: false });
+}
+function curateEnv(source, extra, grants) {
+    // Names `extra` is about to define, normalized. The host copy of a var the
+    // per-run env overrides must be DROPPED, not merely shadowed: env names are
+    // matched case-insensitively here (and by Windows itself), so a host `Temp`
+    // and a per-run `TEMP` are the same variable spelled two ways — leaving both
+    // in the child env hands the backend the host value under one of them. That
+    // is exactly the temp-directory bug #785 fixes, so the override has to be
+    // total. `extra` is cezar's own, never a host secret, and always wins.
+    const overridden = upperSet([
+        ...Object.keys(extra).flatMap(name => {
+            const key = name.toUpperCase();
+            return /^(CEZ|HSQ)_/.test(key) ? [`CEZ_${key.slice(4)}`, `HSQ_${key.slice(4)}`] : [key];
+        }),
+        ...HOME_LOCATING_ENV,
+        // Session authority may only come from controller-generated spec.env, never
+        // inherited from a parent agent — even through passthrough or full-env mode.
+        'CEZ_TOOL_TOKEN', 'HSQ_TOOL_TOKEN',
+        'CEZ_TOOL_SOCKET', 'HSQ_TOOL_SOCKET',
+        'CEZ_DELEGATION_TOKEN', 'HSQ_DELEGATION_TOKEN',
+        'CEZ_DELEGATION_URL', 'HSQ_DELEGATION_URL',
+        // The cockpit address (#774) names THIS run's cockpit and project. A nested headless
+        // `cez run` sets none, and must not inherit its parent's: that would let it change
+        // automations in a project it does not belong to.
+        'CEZ_COCKPIT_URL', 'HSQ_COCKPIT_URL',
+        'CEZ_PROJECT_ID', 'HSQ_PROJECT_ID',
+        // hearsay-tools/cezarion#784: the address of THIS session's preview browser. An inherited one
+        // would point a nested agent at its parent's browser.
+        'CEZ_PREVIEW_CDP_URL', 'HSQ_PREVIEW_CDP_URL',
+    ]);
+    // Escape hatch: restore legacy full-inheritance (opt-in, off by default).
+    // Parsed with the same `isTruthy` the Bedrock/Vertex toggles use (#456
+    // review) — an exact `=== '1'` made `CEZ_AGENT_ENV_FULL=true` silently do
+    // nothing, which is a confusing way to fail open-vs-closed.
+    if (isTruthy(productEnv('AGENT_ENV_FULL', source, true))) {
+        const full = {};
+        for (const [name, value] of Object.entries(source)) {
+            if (!overridden.has(name.toUpperCase()))
+                full[name] = value;
+        }
+        return withoutHomeEnv({ ...full, ...extra });
+    }
+    const { backendPrefixes } = grants;
+    const passthrough = upperSet((productEnv('ENV_PASSTHROUGH', source, true) ?? '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean));
+    // Cloud auth is unlocked only by the toggle that needs it, and only for a
+    // backend that is actually given the toggle (`CLAUDE_` prefix) to read.
+    const claudeCloud = backendPrefixes.includes('CLAUDE_');
+    const cloudPrefixes = [];
+    const cloudNames = new Set();
+    if (claudeCloud && isTruthy(readVar(source, BEDROCK_TOGGLE))) {
+        cloudPrefixes.push(...BEDROCK_ALLOW_PREFIXES);
+    }
+    if (claudeCloud && isTruthy(readVar(source, VERTEX_TOGGLE))) {
+        cloudPrefixes.push(...VERTEX_ALLOW_PREFIXES);
+        for (const n of VERTEX_ALLOW_NAMES)
+            cloudNames.add(n);
+    }
+    const out = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        if (overridden.has(name.toUpperCase()))
+            continue; // the per-run value replaces it, whatever the spelling
+        if (allow(name))
+            out[name] = value;
+    }
+    // Per-run env last — it is cezar's own, never a host secret, and must win.
+    for (const [name, value] of Object.entries(extra))
+        out[name] = value;
+    return withoutHomeEnv(out);
+    /** `name` is matched normalized; the caller keeps the original spelling. */
+    function allow(name) {
+        const key = name.toUpperCase();
+        // cezar's own namespace (CEZ_DRY_RUN plumbing, mock hooks, run wiring).
+        // A secret-shaped one (`CEZ_PRIVATE_TOKEN`) reaches a host command only through passthrough.
+        if ((key.startsWith('CEZ_') || key.startsWith('HSQ_')) && (grants.secretCez || !looksSecret(key)))
+            return true;
+        // Backend auth + gh handoff + the cloud creds an active Bedrock/Vertex
+        // toggle needs: forwarded even though they are secrets — the backend cannot
+        // authenticate without them. They are still redacted before anything
+        // reaches the on-disk NDJSON (see secret-redaction.ts).
+        if (grants.gh && GH_ALLOW_NAMES.has(key))
+            return true;
+        if (matchesPrefix(key, backendPrefixes))
+            return true;
+        if (cloudNames.has(key) || matchesPrefix(key, cloudPrefixes))
+            return true;
+        // Explicit opt-in passthrough.
+        if (passthrough.has(key))
+            return true;
+        // Base allowlist — exact names always, prefix families only when the name
+        // is not itself credential-shaped (`NODE_AUTH_TOKEN` never rides in on
+        // `NODE_`, in either spelling — looksSecret sees the normalized name).
+        if (BASE_ALLOW_NAMES.has(key))
+            return true;
+        if (matchesPrefix(key, BASE_ALLOW_PREFIXES) && !looksSecret(key))
+            return true;
+        return false;
+    }
+}
+//# sourceMappingURL=agent-env.js.map

package/dist/core/agent-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-env.js","sourceRoot":"","sources":["../../src/core/agent-env.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,gBAAgB,GAAwB,QAAQ,CAAC;IACrD,gCAAgC;IAChC,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;IACP,KAAK;IACL,QAAQ;IACR,OAAO;IACP,UAAU;IACV,MAAM;IACN,UAAU;IACV,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,KAAK;IACL,IAAI;IACJ,SAAS;IACT,MAAM;IACN,UAAU;IACV,qBAAqB;IACrB,MAAM;IACN,UAAU;IACV,WAAW;IACX,SAAS;IACT,OAAO;IACP,UAAU;IACV,aAAa;IACb,UAAU;IACV,SAAS;IACT,iBAAiB;IACjB,YAAY;IACZ,uEAAuE;IACvE,eAAe;IACf,eAAe;IACf,mBAAmB;IACnB,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,UAAU;IACV,oCAAoC;IACpC,WAAW;IACX,YAAY;IACZ,qBAAqB;IACrB,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,yEAAyE;IACzE,YAAY;IACZ,aAAa;IACb,WAAW;IACX,WAAW;IACX,UAAU;IACV,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,oCAAoC;IACpC,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;IACT,SAAS;IACT,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,QAAQ;IACR,cAAc;IACd,mBAAmB;IACnB,cAAc;IACd,oBAAoB;IACpB,yBAAyB;IACzB,oBAAoB;IACpB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,cAAc;IACd,aAAa;IACb,aAAa;IACb,IAAI;IACJ,sBAAsB;IACtB,wBAAwB;IACxB,sBAAsB;IACtB,iBAAiB;IACjB,oBAAoB;CACrB,CAAC,CAAC;AAEH;;gEAEgE;AAChE,MAAM,mBAAmB,GAAsB;IAC7C,KAAK;IACL,MAAM;IACN,OAAO;IACP,YAAY;IACZ,OAAO;IACP,aAAa;IACb,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,WAAW;IACX,SAAS;IACT,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,aAAa;IACb,QAAQ;IACR,KAAK;IACL,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,YAAY;IACZ,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,aAAa;IACb,yBAAyB;IACzB,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS;IACT,UAAU;IACV,SAAS;IACT,eAAe;IACf,SAAS;IACT,QAAQ;IACR,OAAO;IACP,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,WAAW;CACZ,CAAC;AAEF;+FAC+F;AAC/F,MAAM,uBAAuB,GAAsB;IACjD,SAAS;IACT,YAAY;IACZ,eAAe;IACf,aAAa;IACb,OAAO;IACP,UAAU;IACV,SAAS;IACT,uBAAuB;IACvB,WAAW;IACX,MAAM;IACN,aAAa;IACb,WAAW;IACX,YAAY;CACb,CAAC;AAEF,qEAAqE;AACrE,MAAM,sBAAsB,GAA4C;IACtE,MAAM,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;IACjC,YAAY,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;IACvC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC;IAC7C,QAAQ,EAAE,uBAAuB;IACjC,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,wFAAwF;IACxF,6FAA6F;IAC7F,6FAA6F;IAC7F,6FAA6F;IAC7F,8FAA8F;IAC9F,iFAAiF;IACjF,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,uBAAuB,CAAC;IACvC,+FAA+F;IAC/F,8FAA8F;IAC9F,gFAAgF;IAChF,6FAA6F;IAC7F,yFAAyF;IACzF,8FAA8F;IAC9F,8EAA8E;IAC9E,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,uBAAuB,CAAC;CACjD,CAAC;AAEF;;+DAE+D;AAC/D,MAAM,cAAc,GAAwB,QAAQ,CAAC;IACnD,cAAc;IACd,UAAU;IACV,SAAS;IACT,qBAAqB;IACrB,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C;gFACgF;AAChF,MAAM,sBAAsB,GAAsB,CAAC,MAAM,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAwB,QAAQ,CAAC;IACvD,gCAAgC;IAChC,iBAAiB;IACjB,2EAA2E;CAC5E,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAsB,CAAC,eAAe,CAAC,CAAC;AAEnE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,IAAY,EAAE,QAA2B;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CAAC,MAAyB,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;AAChD,CAAC;AAUD,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAE7E,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,GAAsB;IACnD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE;QAChE,eAAe,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,MAAM;QACtF,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAI,GAAsE,EAAE;IAC1G,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1H,CAAC;AAED,SAAS,SAAS,CAChB,MAAyB,EACzB,KAA6B,EAC7B,MAAoM;IAGpM,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,UAAU,GAAG,QAAQ,CAAC;QAC1B,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC,CAAC;QACF,GAAG,iBAAiB;QACpB,4EAA4E;QAC5E,6EAA6E;QAC7E,gBAAgB,EAAE,gBAAgB;QAClC,iBAAiB,EAAE,iBAAiB;QACpC,sBAAsB,EAAE,sBAAsB;QAC9C,oBAAoB,EAAE,oBAAoB;QAC1C,qFAAqF;QACrF,mFAAmF;QACnF,kDAAkD;QAClD,iBAAiB,EAAE,iBAAiB;QACpC,gBAAgB,EAAE,gBAAgB;QAClC,8FAA8F;QAC9F,sDAAsD;QACtD,qBAAqB,EAAE,qBAAqB;KAC7C,CAAC,CAAC;IAEH,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAsB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9D,CAAC;QACD,OAAO,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IACnC,MAAM,WAAW,GAAG,QAAQ,CAC1B,CAAC,UAAU,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SAChD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;IAEF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,WAAW,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC7D,aAAa,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,WAAW,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5D,aAAa,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,kBAAkB;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS,CAAC,uDAAuD;QACzG,IAAI,KAAK,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC;IACD,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAE3B,4EAA4E;IAC5E,SAAS,KAAK,CAAC,IAAY;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,wEAAwE;QACxE,6FAA6F;QAC7F,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/G,uEAAuE;QACvE,4EAA4E;QAC5E,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,+BAA+B;QAC/B,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/core/agent-model-policy.d.ts

@@ -0,0 +1,11 @@
+import type { Home } from '../home/home.ts';
+/** The server-side switch that makes native agent settings authoritative. */
+export declare const AGENT_MODELS_LOCKED_ENV = "CEZ_AGENT_MODELS_LOCKED";
+/**
+ * Only the exact environment value `1` enables the process-wide lock. The
+ * global workspace config or one repository may additionally opt in with
+ * `"modelsLocked": true`; missing, unreadable, malformed, and false values
+ * preserve ordinary model selection unless another source enables the lock.
+ */
+export declare function agentModelsLocked(repoRoot: string | undefined, env: NodeJS.ProcessEnv | undefined, home: Home): boolean;
+export declare const AGENT_MODELS_LOCKED_ERROR = "agent models are locked \u2014 configure the model in the native coding-agent settings";

package/dist/core/agent-model-policy.js

@@ -0,0 +1,38 @@
+import { readProjectPath } from '../project-paths.js';
+import { productEnv } from './product-env.js';
+import { readFileSync } from 'node:fs';
+import { readHomeFile } from '../home/store.js';
+import { z } from 'zod';
+import { workspaceConfigPath } from '../paths.js';
+/** The server-side switch that makes native agent settings authoritative. */
+export const AGENT_MODELS_LOCKED_ENV = 'CEZ_AGENT_MODELS_LOCKED';
+const modelPolicyConfigSchema = z.object({
+    modelsLocked: z.boolean().optional(),
+}).passthrough();
+/**
+ * Only the exact environment value `1` enables the process-wide lock. The
+ * global workspace config or one repository may additionally opt in with
+ * `"modelsLocked": true`; missing, unreadable, malformed, and false values
+ * preserve ordinary model selection unless another source enables the lock.
+ */
+export function agentModelsLocked(repoRoot, env = process.env, home) {
+    if (productEnv('AGENT_MODELS_LOCKED', env) === '1')
+        return true;
+    const paths = [
+        workspaceConfigPath(env, home),
+        ...(repoRoot ? [readProjectPath(repoRoot, 'config.json')] : []),
+    ];
+    for (const path of paths) {
+        try {
+            const parsed = modelPolicyConfigSchema.safeParse(JSON.parse(path === home.workspaceConfig ? readHomeFile(path) : readFileSync(path, 'utf8')));
+            if (parsed.success && parsed.data.modelsLocked === true)
+                return true;
+        }
+        catch {
+            // Each source is optional and independently degradable.
+        }
+    }
+    return false;
+}
+export const AGENT_MODELS_LOCKED_ERROR = 'agent models are locked — configure the model in the native coding-agent settings';
+//# sourceMappingURL=agent-model-policy.js.map

package/dist/core/agent-model-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-model-policy.js","sourceRoot":"","sources":["../../src/core/agent-model-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA4B,EAC5B,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,IAAU;IAEV,IAAI,UAAU,CAAC,qBAAqB,EAAE,GAAG,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,KAAK,GAAG;QACZ,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAC5F,CAAC;YACF,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GACpC,mFAAmF,CAAC"}

package/dist/core/agent-profiles.d.ts

@@ -0,0 +1,50 @@
+import type { ProviderId } from './provider-auth.ts';
+/**
+ * Pure native account-home mappings. Keep file-catalog knowledge separate from account
+ * relocation. Workspace code resolves saved accounts; runners, auth and terminal handoff consume
+ * this mapping.
+ */
+/**
+ * Account relocation variables used by cezar. null means named accounts are unsupported. omp
+ * takes a profile name; other supported mappings take a folder. Host values define the default;
+ * named overrides apply last. Refuse a named omp folder outside the current profile root.
+ */
+export declare const PROFILE_ENV_VAR: Record<ProviderId, string | null>;
+/** Providers that can carry more than one account — what the UI offers "Add account" for. */
+export declare const PROFILE_CAPABLE_PROVIDERS: readonly ProviderId[];
+export declare function supportsProfiles(provider: ProviderId): boolean;
+/**
+ * Build a provider-specific account override, or an empty object for the discovered default. omp
+ * takes a profile name parsed from its folder. Never emit another provider’s variable.
+ */
+export declare function profileEnv(provider: ProviderId, configDir: string | null | undefined): Record<string, string>;
+/**
+ * The omp profile a folder names, or `null` when it names none.
+ *
+ * A folder names a profile when its parent is called `profiles` and its own name passes every rule
+ * omp applies, so cezar never hands omp a profile it would refuse at startup. `default` is refused
+ * too: omp reads it as "no profile", so a named account under that name would be the default.
+ *
+ * Shape only — whether `profiles/` is the one under omp's CURRENT root needs the environment, and
+ * `ompProfileDirError` (workspace) checks that. Both separators are accepted so a Windows folder
+ * parses on any host.
+ */
+export declare function ompProfileName(dir: string): string | null;
+/** Whether omp accepts `name` as a profile of its own; `default` is omp's "no profile". */
+export declare function isOmpProfileName(name: string): boolean;
+/**
+ * Where the agent keeps its config inside an account folder: the folder itself, except omp, whose
+ * profile folder keeps it in `agent/`. The discovered omp default is ALREADY an agent dir
+ * (`agentHomePaths().omp`), so callers apply this to named accounts only.
+ */
+export declare function profileAgentDir(provider: ProviderId, dir: string): string;
+/**
+ * Does `entries` look like a config dir this provider actually wrote?
+ *
+ * ADVISORY, never a gate. The honest first-run flow for a second account is *add the profile →
+ * Connect → the CLI creates the dir on login*, so refusing an unrecognized directory would break
+ * the very case the feature exists for. The answer drives a warning line in the UI, nothing more.
+ *
+ * Takes the directory listing rather than a path so it stays pure; the caller reads the dir.
+ */
+export declare function looksLikeProfileDir(provider: ProviderId, entries: readonly string[]): boolean;