@iowarp/clio-coder 0.4.4 → 0.4.6

package/dist/{chunk-ELWDPP3Y.js → chunk-4DU2TVI4.js}

@@ -1,28 +1,28 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   discoverAgentRecipes
-} from "./chunk-7UGL4MB5.js";
+} from "./chunk-VAHLPXPY.js";
 import {
   compileFleetExecutionPlan
-} from "./chunk-LTIKRKFL.js";
+} from "./chunk-ZS43Y2FT.js";
 import {
   loadFleetCommands,
   loadFleetContract,
   renderFleetPrompt
-} from "./chunk-OEJSLEPW.js";
+} from "./chunk-3WBALRQH.js";
 import {
   requestExecutionRole,
   withAttemptRole
-} from "./chunk-H7IXIC72.js";
+} from "./chunk-LY4N4TTL.js";
 import {
   normalizeAgentSpec
-} from "./chunk-KFV5L5SK.js";
+} from "./chunk-OQM5IVJY.js";
 import {
   readSettings
-} from "./chunk-GHS5EBTQ.js";
+} from "./chunk-WNGF5AJX.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/cli/fleet-preflight.ts
 init_esm_shims();
@@ -105,4 +105,4 @@ function inspectFleet(name, vars) {
 export {
   inspectFleet
 };
-//# sourceMappingURL=chunk-ELWDPP3Y.js.map
+//# sourceMappingURL=chunk-4DU2TVI4.js.map

package/dist/{chunk-JSD46VO2.js → chunk-4U4TKZFR.js}

@@ -2,27 +2,27 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   createSentinelStripper,
   stripTokenizerSentinels
-} from "./chunk-CFGTUFWB.js";
+} from "./chunk-MCJKEGHO.js";
 import {
   ceilChars,
   estimateAgentMessageTokens,
   toolSchemaChars
-} from "./chunk-NZMNUPZZ.js";
+} from "./chunk-77CZRFTE.js";
 import {
   credentialsPresent
-} from "./chunk-2JH2WHGE.js";
+} from "./chunk-J2FYEQ5L.js";
 import {
   readSettings
-} from "./chunk-GHS5EBTQ.js";
+} from "./chunk-WNGF5AJX.js";
 import {
   warnLegacyNaming
-} from "./chunk-D7E7WCDF.js";
+} from "./chunk-DVNAPPXU.js";
 import {
   getSharedBus
-} from "./chunk-PMZVFWSR.js";
+} from "./chunk-B5ZTR6KZ.js";
 import {
   BusChannels
-} from "./chunk-F4EKGO4N.js";
+} from "./chunk-HL26ADLH.js";
 import {
   CLIO_CONTEXT_WINDOW_WARN_BELOW,
   CLIO_MIN_CONTEXT_WINDOW,
@@ -39,44 +39,44 @@ import {
   registerBuiltinRuntimes,
   requestLmStudioJson,
   resolveLmStudioInstance
-} from "./chunk-6OSVSQL5.js";
+} from "./chunk-WV6TDAPN.js";
 import {
   sleep
-} from "./chunk-EBY63B7G.js";
+} from "./chunk-6EXUUOSN.js";
 import {
   listKnownModelsForRuntime
-} from "./chunk-26QSH3EJ.js";
+} from "./chunk-HHVJNVUJ.js";
 import {
   authNotRequiredStatus,
   openAuthStorage,
   registerClioOAuthProviders,
   resolveAuthTarget,
   targetRequiresAuth
-} from "./chunk-ID64D7PE.js";
+} from "./chunk-HXHFDHB6.js";
 import {
   withStateFileLock
-} from "./chunk-IKCO5N3L.js";
+} from "./chunk-2QPI3TR3.js";
 import {
   require_dist
-} from "./chunk-APJ265NV.js";
+} from "./chunk-B5GGDIHT.js";
 import {
   safeResourceWrite
-} from "./chunk-WEPFGWHJ.js";
+} from "./chunk-ZZFWWYLX.js";
 import {
   getRuntimeRegistry
-} from "./chunk-NUGM5KR6.js";
+} from "./chunk-SRCEQKQS.js";
 import {
   capabilitiesFromCatalogModel,
   getCatalogModelForRuntime,
   mergeCapabilities,
   resolveCostProvenance
-} from "./chunk-5OIVVPHF.js";
+} from "./chunk-TN5FW4XY.js";
 import {
   activateExternalPluginApiBridge,
   calculateEngineCost,
   ensurePiAiRegistered,
   registerEngineApiProvider
-} from "./chunk-YPC6ZR5L.js";
+} from "./chunk-5CMARGPF.js";
 import {
   clioCacheDir,
   clioConfigDir,
@@ -84,11 +84,11 @@ import {
   clioStatePath,
   resolveClioDirs,
   stateRootRemoved
-} from "./chunk-BYP5D4HI.js";
+} from "./chunk-CTTI7G3T.js";
 import {
   __toESM,
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/providers/endpoint-capacity.ts
 init_esm_shims();
@@ -2092,15 +2092,15 @@ function resolveContextWindowDetails(target, runtime, wireModelId, knowledgeBase
   const overrideWindow = positiveWindow(target.capabilities?.contextWindow);
   let effective;
   let source;
-  if (loadedWindow !== void 0) {
+  if (loadedWindow !== void 0 && (overrideWindow === void 0 || loadedWindow <= overrideWindow)) {
     effective = loadedWindow;
     source = "loaded";
-  } else if (probeWindow !== void 0) {
-    effective = probeWindow;
-    source = "probe";
   } else if (overrideWindow !== void 0) {
     effective = overrideWindow;
     source = "target-override";
+  } else if (probeWindow !== void 0) {
+    effective = probeWindow;
+    source = "probe";
   } else if (modelDeclared !== void 0) {
     effective = modelDeclared;
     source = modelDeclaredSource;
@@ -2384,9 +2384,15 @@ var globalDefaultMaxOutputTokens = 0;
 function setGlobalDefaultMaxOutputTokens(value) {
   globalDefaultMaxOutputTokens = Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;
 }
-function resolveReservedOutputTokens(maxOutputTokens) {
-  const limit = typeof maxOutputTokens === "number" && Number.isFinite(maxOutputTokens) && maxOutputTokens > 0 ? maxOutputTokens : DEFAULT_MAX_OUTPUT_TOKENS;
-  return Math.min(limit, DEFAULT_MAX_OUTPUT_TOKENS);
+function resolveReservedOutputTokens(maxOutputTokens, request) {
+  const requested = globalDefaultMaxOutputTokens > 0 ? globalDefaultMaxOutputTokens : DEFAULT_MAX_OUTPUT_TOKENS;
+  const limit = typeof maxOutputTokens === "number" && Number.isFinite(maxOutputTokens) && maxOutputTokens > 0 ? maxOutputTokens : Number.POSITIVE_INFINITY;
+  const ceiling = Math.min(limit, requested);
+  return request && (request.api === "openai-completions" || request.api === "ollama-native") ? clampOutputToRemainingContext(ceiling, request.contextWindow, request.inputTokens) : ceiling;
+}
+function clampOutputToRemainingContext(ceiling, contextWindow, inputTokens) {
+  const available = contextWindow > 0 && Number.isFinite(contextWindow) ? Math.max(1, contextWindow - inputTokens - CONTEXT_BUDGET_SAFETY_TOKENS) : Number.POSITIVE_INFINITY;
+  return Math.min(ceiling, available);
 }
 function estimateInputTokensFromContext(context) {
   const system = context.systemPrompt ? ceilChars(context.systemPrompt.length) : 0;
@@ -2395,16 +2401,14 @@ function estimateInputTokensFromContext(context) {
   return system + messages + tools;
 }
 function remainingContextMaxTokens(model, context, options, limits) {
-  const safety = CONTEXT_BUDGET_SAFETY_TOKENS;
   const inputTokens = estimateInputTokensFromContext(context);
   const configuredContextWindow = model.contextWindow > 0 ? model.contextWindow : Number.POSITIVE_INFINITY;
   const loadedContextWindow = limits?.contextWindow !== void 0 && limits.contextWindow > 0 ? limits.contextWindow : Number.POSITIVE_INFINITY;
   const contextWindow = Math.min(configuredContextWindow, loadedContextWindow);
-  const budget = Number.isFinite(contextWindow) ? Math.max(1, contextWindow - inputTokens - safety) : Number.POSITIVE_INFINITY;
   const modelLimit = model.maxTokens > 0 ? model.maxTokens : Number.POSITIVE_INFINITY;
   const defaultLimit = limits?.maxOutputTokens !== void 0 && limits.maxOutputTokens > 0 ? limits.maxOutputTokens : globalDefaultMaxOutputTokens > 0 ? globalDefaultMaxOutputTokens : model.maxTokens > 0 ? modelLimit : DEFAULT_MAX_OUTPUT_TOKENS;
   const requested = options?.maxTokens ?? defaultLimit;
-  const resolved = Math.min(requested, modelLimit, budget);
+  const resolved = clampOutputToRemainingContext(Math.min(requested, modelLimit), contextWindow, inputTokens);
   return Number.isFinite(resolved) ? resolved : DEFAULT_MAX_OUTPUT_TOKENS;
 }
 
@@ -3672,13 +3676,14 @@ function withLiteLLMRouteFailureAdvice(model, source) {
   (async () => {
     try {
       for await (const event of source) {
-        if (event.type === "error") {
+        if (event.type === "error" && event.reason !== "aborted" && event.error.stopReason !== "aborted") {
           event.error.errorMessage = liteLLMRouteFailureMessage(event.error.errorMessage, metadata2.targetId, model.id);
         }
         advised.push(event);
       }
       advised.end();
     } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") throw err;
       const message = err instanceof Error ? err.message : String(err);
       throw new Error(liteLLMRouteFailureMessage(message, metadata2.targetId, model.id));
     }
@@ -4130,11 +4135,13 @@ function guardMalformedToolCalls(source, model, context) {
   (async () => {
     try {
       for await (const event of source) {
-        if (event.type === "toolcall_end") {
-          const required = requiredByTool.get(event.toolCall.name);
-          if (required && hasEmptyArguments(event.toolCall.arguments)) {
-            const message = malformedToolArgsMessage(model, event.toolCall.name, required);
-            const error = finalErrorFromPartial(event.partial, message);
+        if (event.type === "done" && event.message.stopReason !== "length") {
+          const malformed = event.message.content.find(
+            (block) => block.type === "toolCall" && requiredByTool.has(block.name) && hasEmptyArguments(block.arguments)
+          );
+          if (malformed?.type === "toolCall") {
+            const message = malformedToolArgsMessage(model, malformed.name, requiredByTool.get(malformed.name) ?? []);
+            const error = finalErrorFromPartial(event.message, message);
             guarded.push({ type: "error", reason: "error", error });
             guarded.end(error);
             return;
@@ -5042,4 +5049,4 @@ export {
   resolveCostProvenance2 as resolveCostProvenance,
   ProvidersDomainModule
 };
-//# sourceMappingURL=chunk-JSD46VO2.js.map
+//# sourceMappingURL=chunk-4U4TKZFR.js.map

package/dist/{chunk-FEAXX7B6.js → chunk-4VMV6OS6.js}

@@ -1,13 +1,13 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   appendOutOfTurnUsageRow
-} from "./chunk-JT2RFCC5.js";
+} from "./chunk-E7RF4KBO.js";
 import {
   extractReasoningTokens
-} from "./chunk-NZMNUPZZ.js";
+} from "./chunk-77CZRFTE.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/observability/compaction-usage.ts
 init_esm_shims();
@@ -98,4 +98,4 @@ export {
   recordFailedCompactionCalls,
   summarizeFailedCompactionUsage
 };
-//# sourceMappingURL=chunk-FEAXX7B6.js.map
+//# sourceMappingURL=chunk-4VMV6OS6.js.map

package/dist/{chunk-2ZSONWVL.js → chunk-536HXRFE.js}

@@ -3,37 +3,37 @@ import {
   frontmatterRegion,
   normalizedSkillHash,
   stripProvenanceLines
-} from "./chunk-NDDGJUXD.js";
+} from "./chunk-DNCE23JJ.js";
 import {
   readRootEntries,
   splitYamlFrontmatter,
   stringField
-} from "./chunk-YECAMM3D.js";
+} from "./chunk-U7H5WRG5.js";
 import {
   enabledExtensionResourceRoots
-} from "./chunk-TQAHXW6Y.js";
+} from "./chunk-22PQ4TX4.js";
 import {
-  ToolNames
-} from "./chunk-4NSRCOYP.js";
+  warnLegacyNaming
+} from "./chunk-DVNAPPXU.js";
 import {
   INTEROP_AGENT_KINDS,
   interopSourceRank
-} from "./chunk-KXDSS5WJ.js";
+} from "./chunk-5CY4Q6QI.js";
 import {
-  warnLegacyNaming
-} from "./chunk-D7E7WCDF.js";
+  ToolNames
+} from "./chunk-EHOSNVVM.js";
 import {
   resolvePackageRoot
-} from "./chunk-IWHMRKLL.js";
+} from "./chunk-E3LEPLQ2.js";
 import {
   fsyncDirectory
-} from "./chunk-WEPFGWHJ.js";
+} from "./chunk-ZZFWWYLX.js";
 import {
   clioConfigDir
-} from "./chunk-BYP5D4HI.js";
+} from "./chunk-CTTI7G3T.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/resources/skills/install.ts
 init_esm_shims();
@@ -1254,4 +1254,4 @@ export {
   expandSkillInvocationInput,
   parsePendingSkillRequests
 };
-//# sourceMappingURL=chunk-2ZSONWVL.js.map
+//# sourceMappingURL=chunk-536HXRFE.js.map

package/dist/{chunk-W54I7H25.js → chunk-5A6XR3RJ.js}

@@ -1,25 +1,28 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  isSecretArgKey
+} from "./chunk-EFSEIZE6.js";
 import {
   gitCommitAttributionEnabled,
   reportCommitAttributionDiagnostic,
   withManagedGitCommitAttributionEnvironment
-} from "./chunk-U6TMQNSI.js";
+} from "./chunk-LTR5QCLS.js";
 import {
   clampTimerDelayMs
-} from "./chunk-EBY63B7G.js";
+} from "./chunk-6EXUUOSN.js";
 import {
   AI_AGENT_NAME
-} from "./chunk-6EJMN2Y3.js";
+} from "./chunk-ZTNFYMIO.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/bash-exec.ts
 init_esm_shims();
 import { spawn } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
 var BASH_HARD_CAP_BYTES = 16 * 1024 * 1024;
-var CLIO_CONTROL_ENV_KEYS = ["CLIO_CODER_INTERACTIVE"];
+var CLIO_CONTROL_ENV_KEYS = ["CLIO_CODER_INTERACTIVE", "BASH_ENV", "ENV"];
 var BASH_UPDATE_THROTTLE_MS = 100;
 var SYSTEM_PROGRESS_SCHEDULER = {
   now: Date.now,
@@ -107,8 +110,10 @@ function createBashOutputProgressController(onUpdate, scheduler = SYSTEM_PROGRES
     }
   };
 }
-function buildToolEnv() {
-  const env = { ...process.env };
+function buildToolEnv(source = process.env) {
+  const env = { ...source };
+  for (const key of Object.keys(env))
+    if (isSecretArgKey(key) || key.startsWith("BASH_FUNC_")) Reflect.deleteProperty(env, key);
   env.AI_AGENT = AI_AGENT_NAME;
   for (const key of CLIO_CONTROL_ENV_KEYS) {
     Reflect.deleteProperty(env, key);
@@ -155,12 +160,8 @@ function captureLoginEnv() {
 async function bashSpawnPlan() {
   loginEnvCapture ??= captureLoginEnv();
   const captured = await loginEnvCapture;
-  if (captured === null) return { mode: "-lc", env: buildToolEnv() };
-  const env = { ...process.env, ...captured };
-  env.AI_AGENT = AI_AGENT_NAME;
-  for (const key of CLIO_CONTROL_ENV_KEYS) {
-    Reflect.deleteProperty(env, key);
-  }
+  if (captured === null) return { mode: "-c", env: buildToolEnv() };
+  const env = buildToolEnv({ ...process.env, ...captured });
   return { mode: "-c", env };
 }
 function combineBashOutput(result) {
@@ -182,6 +183,7 @@ async function runBashCommand(command, options = {}) {
     let timeoutId = null;
     let killGraceTimer = null;
     let killSent = false;
+    let pendingClose = null;
     const output = createBashOutputProgressController(options.onUpdate);
     const child = spawn("/bin/bash", [plan.mode, command], {
       ...options.cwd === void 0 ? {} : { cwd: options.cwd },
@@ -206,12 +208,37 @@ async function runBashCommand(command, options = {}) {
       }
       child.kill(signalName);
     };
+    const hasOwnedProcesses = () => {
+      const pid = child.pid;
+      if (pid === void 0) return false;
+      if (process.platform !== "win32") {
+        try {
+          process.kill(-pid, 0);
+          return true;
+        } catch (error) {
+          if (error.code === "EPERM") return true;
+        }
+      }
+      return child.exitCode === null && child.signalCode === null;
+    };
+    const resolveAfterCancellation = (result) => {
+      if (killGraceTimer !== null && hasOwnedProcesses()) {
+        pendingClose = () => resolve(result);
+        return;
+      }
+      clearKillGraceTimer();
+      resolve(result);
+    };
     const killChild = () => {
       if (killSent) return;
       killSent = true;
       sendSignal("SIGTERM");
       killGraceTimer = setTimeout(() => {
-        sendSignal("SIGKILL");
+        killGraceTimer = null;
+        if (hasOwnedProcesses()) sendSignal("SIGKILL");
+        const finish = pendingClose;
+        pendingClose = null;
+        finish?.();
       }, 5e3);
     };
     function onAbort() {
@@ -238,10 +265,9 @@ async function runBashCommand(command, options = {}) {
       if (settled) return;
       settled = true;
       if (timeoutId) clearTimeout(timeoutId);
-      clearKillGraceTimer();
       const finalOutput = output.settle();
       options.signal?.removeEventListener("abort", onAbort);
-      resolve({
+      resolveAfterCancellation({
         error,
         ...finalOutput,
         exitCode: null,
@@ -254,7 +280,6 @@ async function runBashCommand(command, options = {}) {
       if (settled) return;
       settled = true;
       if (timeoutId) clearTimeout(timeoutId);
-      clearKillGraceTimer();
       const finalOutput = output.settle();
       options.signal?.removeEventListener("abort", onAbort);
       const error = code === 0 && signalName === null ? null : {
@@ -263,7 +288,7 @@ async function runBashCommand(command, options = {}) {
         code: code ?? void 0,
         signal: signalName ?? void 0
       };
-      resolve({
+      resolveAfterCancellation({
         error,
         ...finalOutput,
         exitCode: code,
@@ -280,4 +305,4 @@ export {
   combineBashOutput,
   runBashCommand
 };
-//# sourceMappingURL=chunk-W54I7H25.js.map
+//# sourceMappingURL=chunk-5A6XR3RJ.js.map

package/dist/{chunk-YPC6ZR5L.js → chunk-5CMARGPF.js}

@@ -1,10 +1,11 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
+  findEngineEnvKeys,
   getEngineEnvApiKey
-} from "./chunk-YXLYO42X.js";
+} from "./chunk-DXVMLM3Z.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/engine/ai.ts
 init_esm_shims();
@@ -71,6 +72,113 @@ function getEngineModel(provider, modelId) {
   return engineModels.getModel(provider, modelId);
 }
 
+// src/engine/provider-diagnostics.ts
+init_esm_shims();
+import { randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, openSync, writeFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
+function instrumentProviderCall(model, options, invoke) {
+  let effective = options;
+  if (model.api === "anthropic-messages" && options?.cacheRetention === void 0) {
+    const retention = process.env.CLIO_CODER_ANTHROPIC_CACHE_RETENTION;
+    if (retention !== void 0 && retention !== "") {
+      if (retention !== "none" && retention !== "short" && retention !== "long") {
+        throw new Error("CLIO_CODER_ANTHROPIC_CACHE_RETENTION must be none, short, or long");
+      }
+      effective = { ...options, cacheRetention: retention };
+    }
+  }
+  const path = process.env.CLIO_CODER_PROVIDER_DUMP_PATH;
+  if (!path) return invoke(effective);
+  const sink = openDump(path);
+  const payloads = [];
+  const redact = diagnosticSerializer(model, effective);
+  const callId = randomUUID();
+  const onPayload = effective?.onPayload;
+  const instrumented = {
+    ...effective,
+    onPayload: async (payload, currentModel) => {
+      const replacement = await onPayload?.(payload, currentModel);
+      try {
+        payloads.push(JSON.parse(redact(replacement === void 0 ? payload : replacement)));
+      } catch {
+        payloads.push({ diagnosticError: "payload could not be serialized" });
+      }
+      return replacement;
+    }
+  };
+  const finish = (terminal) => {
+    try {
+      writeFileSync(sink, `${redact({ callId, api: model.api, model: model.id, payloads, ...terminal })}
+`, "utf8");
+    } catch {
+      process.emitWarning("Provider diagnostic dump could not be written", { code: "CLIO_CODER_PROVIDER_DUMP_FAILED" });
+    } finally {
+      try {
+        closeSync(sink);
+      } catch {
+        process.emitWarning("Provider diagnostic dump could not be closed", { code: "CLIO_CODER_PROVIDER_DUMP_FAILED" });
+      }
+    }
+  };
+  try {
+    const stream2 = invoke(instrumented);
+    void stream2.result().then(
+      (response) => finish({ response }),
+      (error) => finish({ error: String(error) })
+    );
+    return stream2;
+  } catch (error) {
+    finish({ error: error instanceof Error ? error.message : String(error) });
+    throw error;
+  }
+}
+function openDump(path) {
+  if (!isAbsolute(path)) throw new Error("CLIO_CODER_PROVIDER_DUMP_PATH must be an absolute file path");
+  const fd = openSync(
+    path,
+    constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK,
+    384
+  );
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || (stat.mode & 511) !== 384 || process.getuid !== void 0 && stat.uid !== process.getuid()) {
+      throw new Error("CLIO_CODER_PROVIDER_DUMP_PATH must be an operator-owned regular file with mode 0600");
+    }
+    return fd;
+  } catch (error) {
+    closeSync(fd);
+    throw error;
+  }
+}
+function diagnosticSerializer(model, options) {
+  const secrets = /* @__PURE__ */ new Set();
+  const ambientKeys = (findEngineEnvKeys(model.provider, options?.env) ?? []).map(
+    (name) => options?.env?.[name] || process.env[name]
+  );
+  for (const key of [options?.apiKey, ...ambientKeys]) {
+    if (key && key !== "<authenticated>") secrets.add(key);
+  }
+  for (const headers of [options?.headers, model.headers]) {
+    for (const [key, value] of Object.entries(headers ?? {})) {
+      if (typeof value === "string" && value.length > 0 && /auth|api[-_]?key|cookie|token|secret/iu.test(key)) {
+        secrets.add(value);
+        const token = value.match(/^(?:Bearer|Basic)\s+(.+)$/iu)?.[1];
+        if (token) secrets.add(token);
+      }
+    }
+  }
+  return (value) => {
+    const body = typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(
+      Object.entries(value).filter(([key]) => !/^(?:headers|env|apiKey|api_key|authorization)$/iu.test(key))
+    ) : value;
+    let serialized = JSON.stringify(body);
+    if (serialized === void 0) serialized = "null";
+    for (const secret of secrets) serialized = serialized.replaceAll(JSON.stringify(secret).slice(1, -1), "[REDACTED]");
+    return serialized;
+  };
+}
+
 // src/engine/api-registry.ts
 var registry = /* @__PURE__ */ new Map();
 var builtinInstances = /* @__PURE__ */ new Map();
@@ -145,7 +253,7 @@ function resolved(api) {
 function hasCloudflareAuth(options) {
   return typeof options?.apiKey === "string" && options.apiKey.trim().length > 0 || typeof options?.headers?.["cf-aig-authorization"] === "string";
 }
-function engineStream(model, context, options) {
+function dispatchEngineStream(model, context, options) {
   registerEngineBuiltins();
   if (compatUniverse) return compatUniverse.stream(model, context, options);
   const provider = builtinProvider(model);
@@ -157,7 +265,7 @@ function engineStream(model, context, options) {
   }
   return resolved(model.api).stream(model, context, withEnvApiKey(model, options));
 }
-function engineStreamSimple(model, context, options) {
+function dispatchEngineStreamSimple(model, context, options) {
   registerEngineBuiltins();
   if (compatUniverse) return compatUniverse.streamSimple(model, context, options);
   const provider = builtinProvider(model);
@@ -169,6 +277,12 @@ function engineStreamSimple(model, context, options) {
   }
   return resolved(model.api).streamSimple(model, context, withEnvApiKey(model, options));
 }
+function engineStream(model, context, options) {
+  return instrumentProviderCall(model, options, (effective) => dispatchEngineStream(model, context, effective));
+}
+function engineStreamSimple(model, context, options) {
+  return instrumentProviderCall(model, options, (effective) => dispatchEngineStreamSimple(model, context, effective));
+}
 async function completeEngineSimple(model, context, options) {
   return engineStreamSimple(model, context, options).result();
 }
@@ -360,4 +474,4 @@ export {
   calculateEngineCost,
   registerFauxFromEnv
 };
-//# sourceMappingURL=chunk-YPC6ZR5L.js.map
+//# sourceMappingURL=chunk-5CMARGPF.js.map

package/dist/{chunk-KXDSS5WJ.js → chunk-5CY4Q6QI.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/interop/registry.ts
 init_esm_shims();
@@ -19,7 +19,7 @@ var INTEROP_AGENT_KINDS = [
     instructionFiles: ["CLAUDE.md", ".claude/CLAUDE.md"],
     acp: {
       command: "npx",
-      args: ["-y", "@zed-industries/claude-code-acp"],
+      args: ["-y", "@zed-industries/claude-code-acp@0.16.2"],
       npmPackage: "@zed-industries/claude-code-acp",
       npmPackageBin: "claude-code-acp"
     },
@@ -39,7 +39,7 @@ var INTEROP_AGENT_KINDS = [
     instructionFiles: ["AGENTS.md", "CODEX.md", ".codex/AGENTS.md"],
     acp: {
       command: "npx",
-      args: ["-y", "@agentclientprotocol/codex-acp"],
+      args: ["-y", "@agentclientprotocol/codex-acp@1.10.0"],
       npmPackage: "@agentclientprotocol/codex-acp",
       npmPackageBin: "codex-acp"
     },
@@ -138,4 +138,4 @@ export {
   interopSourceRank,
   foreignAgentDirs
 };
-//# sourceMappingURL=chunk-KXDSS5WJ.js.map
+//# sourceMappingURL=chunk-5CY4Q6QI.js.map

package/dist/{chunk-D4CJV46V.js → chunk-5GZICIYO.js}

@@ -4,10 +4,10 @@ import {
   ensureToolchainRoot,
   findPinnedTool,
   toolchainRoot
-} from "./chunk-QDC3K2U3.js";
+} from "./chunk-K2BLQC5E.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/toolchain/install.ts
 init_esm_shims();
@@ -459,4 +459,4 @@ export {
   installTool,
   installPinnedTool
 };
-//# sourceMappingURL=chunk-D4CJV46V.js.map
+//# sourceMappingURL=chunk-5GZICIYO.js.map