@khorsheed/dsh-local-agent-codex 0.1.0-rc.6

package/lib/types/live-switch.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The settings-driven live-driver switch: owns the active driver generation
+ * and retires old ones on a settings change, without a plugin reload.
+ *
+ * Toggle OFF (or unload): the retiring generation is DRAINED, not killed —
+ * new rounds are refused (the provider's catch falls back to exec), in-flight
+ * rounds finish on their runtime, idle runtimes are reclaimed at once.
+ * Toggling ON builds the next generation lazily (no process until the first
+ * round). Legacy granularity settings are ignored.
+ *
+ * @module @khorsheed/dsh-local-agent-codex — internal, unit-tested directly.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { SettingsFace } from '@khorsheed/dsh-local-agent';
+import type { Config } from './index.ts';
+import { CodexLiveDriver } from './live-driver.ts';
+import type { CodexLiveMirrorGranularity } from './live-driver.ts';
+/** The resolved live settings (schema defaults ← YAML base ← user layer). */
+export interface CodexLiveSettings {
+    live: boolean;
+    liveMirrorGranularity: CodexLiveMirrorGranularity;
+    /** The configured model, when the card or the YAML base names one. */
+    model?: string;
+    /** Model identifiers the card has saved before (its input's suggestions). */
+    recentModels?: readonly string[];
+}
+export declare class LiveDriverSwitch {
+    private readonly ctx;
+    private readonly options;
+    private liveOn;
+    private active;
+    /** Retiring generations still draining their in-flight rounds. */
+    private readonly draining;
+    private readonly unwatch;
+    constructor(ctx: Context, face: SettingsFace<CodexLiveSettings>, options: {
+        sandbox: Config['sandbox'];
+        liveIdleMs?: number;
+        /**
+         * Per-spawn model resolver, handed to every driver generation. Receives
+         * the member's child session id so the session-level override can
+         * outrank the settings value.
+         */
+        model?: (childSessionId: string) => string | undefined;
+    });
+    /**
+     * Resolve the live driver for one round's member (the provider's call
+     * site). A retiring generation still hosting the member gates the new one —
+     * the round falls back to exec rather than double-loading the same codex
+     * thread into two processes.
+     */
+    readonly resolve: (childSessionId: string) => CodexLiveDriver | undefined;
+    /**
+     * The model the member's live runtime bound at spawn (the broker's switch
+     * check): the identifier, undefined for "bound to no model", null for "no
+     * live runtime". Consults only the ACTIVE generation — a draining one is on
+     * its way out anyway.
+     */
+    boundModel(childSessionId: string): string | undefined | null;
+    /**
+     * Retire the member's resident runtime in the active generation so the next
+     * round respawns onto the member's new effective model (the composer's
+     * model switch path; the CLI session itself carries over via thread/resume).
+     */
+    retireRuntime(childSessionId: string): Promise<void>;
+    /** Mirror the resolved settings into the driver generation. */
+    private apply;
+    /** Plugin unload: interrupt whatever survives (disposeAll, not drain). */
+    dispose(): void;
+}
+//# sourceMappingURL=live-switch.d.ts.map

package/lib/types/live-switch.js

@@ -0,0 +1,90 @@
+/**
+ * The settings-driven live-driver switch: owns the active driver generation
+ * and retires old ones on a settings change, without a plugin reload.
+ *
+ * Toggle OFF (or unload): the retiring generation is DRAINED, not killed —
+ * new rounds are refused (the provider's catch falls back to exec), in-flight
+ * rounds finish on their runtime, idle runtimes are reclaimed at once.
+ * Toggling ON builds the next generation lazily (no process until the first
+ * round). Legacy granularity settings are ignored.
+ *
+ * @module @khorsheed/dsh-local-agent-codex — internal, unit-tested directly.
+ */
+import { CodexLiveDriver } from './live-driver.js';
+export class LiveDriverSwitch {
+    ctx;
+    options;
+    liveOn = false;
+    active;
+    /** Retiring generations still draining their in-flight rounds. */
+    draining = new Set();
+    unwatch;
+    constructor(ctx, face, options) {
+        this.ctx = ctx;
+        this.options = options;
+        this.apply(face.get());
+        this.unwatch = face.watch((next) => { this.apply(next); });
+    }
+    /**
+     * Resolve the live driver for one round's member (the provider's call
+     * site). A retiring generation still hosting the member gates the new one —
+     * the round falls back to exec rather than double-loading the same codex
+     * thread into two processes.
+     */
+    resolve = (childSessionId) => {
+        if (this.active === undefined)
+            return undefined;
+        for (const retiring of this.draining) {
+            if (retiring.hasRuntime(childSessionId))
+                return undefined;
+        }
+        return this.active;
+    };
+    /**
+     * The model the member's live runtime bound at spawn (the broker's switch
+     * check): the identifier, undefined for "bound to no model", null for "no
+     * live runtime". Consults only the ACTIVE generation — a draining one is on
+     * its way out anyway.
+     */
+    boundModel(childSessionId) {
+        return this.active?.boundModelOf(childSessionId) ?? null;
+    }
+    /**
+     * Retire the member's resident runtime in the active generation so the next
+     * round respawns onto the member's new effective model (the composer's
+     * model switch path; the CLI session itself carries over via thread/resume).
+     */
+    async retireRuntime(childSessionId) {
+        await this.active?.retireRuntime(childSessionId);
+    }
+    /** Mirror the resolved settings into the driver generation. */
+    apply(next) {
+        if (next.live === this.liveOn) {
+            return;
+        }
+        this.liveOn = next.live;
+        const retiring = this.active;
+        this.active = next.live
+            ? new CodexLiveDriver(this.ctx, {
+                ...this.options.sandbox === undefined ? {} : { sandbox: this.options.sandbox },
+                ...this.options.liveIdleMs === undefined ? {} : { liveIdleMs: this.options.liveIdleMs },
+                ...this.options.model === undefined ? {} : { model: this.options.model },
+            })
+            : undefined;
+        if (retiring !== undefined) {
+            this.draining.add(retiring);
+            void retiring.drain().then(() => { this.draining.delete(retiring); }, (error) => {
+                this.draining.delete(retiring);
+                this.ctx.logger.warn(`local-agent-codex: live driver drain failed: ${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
+    }
+    /** Plugin unload: interrupt whatever survives (disposeAll, not drain). */
+    dispose() {
+        this.unwatch();
+        void this.active?.disposeAll();
+        for (const retiring of this.draining)
+            void retiring.disposeAll();
+        this.draining.clear();
+    }
+}

package/lib/types/model-broker.d.ts

@@ -0,0 +1,102 @@
+/**
+ * The codex harness's model broker: the member-aware model surface the core
+ * gateway routes to (`harnessModel` for the settings card, `memberModel` /
+ * `setMemberModel` for the composer picker). It owns the session-level
+ * override map — shared with the exec provider (which consults it per round)
+ * and the live driver (which binds it at runtime spawn) — and retires a
+ * member's resident runtime when a switch leaves it bound to a different
+ * model, so the NEXT round respawns onto the new one while the codex thread
+ * itself carries over via thread/resume.
+ *
+ * Resolution order is the family's fixed one (first match wins): override →
+ * the delegation's recorded model → the plugin-config `model` (settings) →
+ * the scoped config.toml's own `model` (cliDefault) → the account catalog's
+ * `isDefault` slug (catalogDefault) → the CLI's built-in default, which names
+ * nothing. The catalogDefault layer is the ONE case source `cli-builtin`
+ * carries an `effective` model: the app-server probe marks the account's
+ * compiled default with `isDefault`, so "follow the CLI default" finally has
+ * a name. The `cliDefault` FIELD stays scoped-config-only — the two layers
+ * must stay distinguishable (the file is user-editable, the catalog answer is
+ * the account's). The pickable vocabulary is what the instance actually
+ * knows — settings + cliDefault + the identifiers the scoped config itself
+ * carries (profiles) + the app-server `model/list` account catalog (probed,
+ * cached, best-effort — see model-catalog.ts) + the card's recent-model
+ * memory — never a hardcoded catalog.
+ * @module @khorsheed/dsh-local-agent-codex/model-broker
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { MemberConfigurationAdapter } from '@khorsheed/dsh-local-agent';
+import type { LocalAgentModelBroker, LocalAgentModelInfo, LocalAgentModelDirectory, LocalAgentMemberBinding } from '@khorsheed/dsh-local-agent/types';
+/** Everything the broker reads or drives, injected so the unit specs stay small. */
+export interface CodexModelBrokerDeps {
+    /** Host context carrying the family registry (in-flight reads, delegation records). */
+    readonly ctx: Context;
+    /** The plugin-config `model` resolver — the settings layer, blank reads unset. */
+    readonly settingsModel: () => string | undefined;
+    /** The card's recent-model memory (the suggestion vocabulary's tail). */
+    readonly recentModels: () => readonly string[];
+    /**
+     * The account catalog cache's SYNC read of the scoped home (see
+     * model-catalog.ts): the last completed `model/list` probe's slugs, empty
+     * on a cold cache, re-probing in the background when stale. Sits ahead of
+     * the recent-model memory in the choice vocabulary.
+     */
+    readonly catalog: (homeDir: string, cwd?: string) => readonly string[];
+    /**
+     * The catalog cache's SYNC read of the account's built-in default slug (the
+     * `isDefault` entry of the same probe {@link catalog} serves): the layer
+     * between the scoped config's `model` and the CLI's unnamed default. When
+     * this layer supplies the effective model the source stays `cli-builtin` —
+     * it names the CLI's OWN default, not a configured one.
+     */
+    readonly catalogDefault: (homeDir: string, cwd?: string) => string | undefined;
+    /** The default scope's scoped home; config discovery reads it live. */
+    readonly homeDir: (childSessionId?: string) => string;
+    readonly cwd?: (childSessionId?: string) => string | undefined;
+    readonly directory?: (homeDir: string, cwd?: string) => LocalAgentModelDirectory;
+    readonly refreshDirectory?: (homeDir: string, cwd?: string) => Promise<unknown>;
+    readonly followDirectory?: (homeDir: string, cwd: string | undefined, signal: AbortSignal) => AsyncIterable<LocalAgentModelDirectory>;
+    /** Whether the live driver is on (the member's rounds bind resident runtimes). */
+    readonly live: () => boolean;
+    /**
+     * The session-level overrides this broker owns. Shared by reference with the
+     * exec provider's per-round resolution and the live driver's spawn binding,
+     * so a switch reaches every path without a reload.
+     */
+    readonly overrides: Map<string, string>;
+    /**
+     * The model the member's live runtime bound at spawn: the identifier,
+     * undefined for "bound to no model", null for "no live runtime".
+     */
+    readonly liveBoundModel: (childSessionId: string) => string | undefined | null;
+    /** Retire the member's live runtime; the next round respawns onto the new model. */
+    readonly retireRuntime: (childSessionId: string) => Promise<void>;
+}
+export declare class CodexModelBroker implements LocalAgentModelBroker {
+    private readonly deps;
+    constructor(deps: CodexModelBrokerDeps);
+    configurationAdapter(binding: LocalAgentMemberBinding): MemberConfigurationAdapter;
+    modelDirectory(childSessionId?: string, refresh?: boolean): Promise<LocalAgentModelDirectory>;
+    followModelDirectory(childSessionId: string | undefined, signal: AbortSignal): AsyncIterable<LocalAgentModelDirectory>;
+    /** The member's in-flight rounds (an empty answer on a core that predates the read). */
+    private activeDelegations;
+    /** The model the member's NEXT spawn binds explicitly: override → recorded → settings. */
+    private boundLayer;
+    /**
+     * Read the model surface. The cliDefault and the discovered identifiers come
+     * from the scoped config.toml LIVE (a person-edited file is authoritative);
+     * a read failure degrades that layer to absent, never to a guessed value.
+     * The account catalog comes from the probe cache SYNCHRONOUSLY (a cold
+     * cache reads empty and re-probes in the background — the settings card
+     * re-fetches on open, so it never blocks on a CLI boot).
+     */
+    modelInfo(childSessionId?: string, delegationModel?: string): Promise<LocalAgentModelInfo>;
+    /**
+     * Set (or clear) the member's session-level override. Same-model is a
+     * no-op; a different model with a live runtime bound elsewhere retires the
+     * runtime so the next round respawns (the codex thread resumes). Throws
+     * while a round is in flight — retiring mid-round would kill the run.
+     */
+    setMemberModel(childSessionId: string, model: string | undefined): Promise<void>;
+}
+//# sourceMappingURL=model-broker.d.ts.map

package/lib/types/model-broker.js

@@ -0,0 +1,187 @@
+/**
+ * The codex harness's model broker: the member-aware model surface the core
+ * gateway routes to (`harnessModel` for the settings card, `memberModel` /
+ * `setMemberModel` for the composer picker). It owns the session-level
+ * override map — shared with the exec provider (which consults it per round)
+ * and the live driver (which binds it at runtime spawn) — and retires a
+ * member's resident runtime when a switch leaves it bound to a different
+ * model, so the NEXT round respawns onto the new one while the codex thread
+ * itself carries over via thread/resume.
+ *
+ * Resolution order is the family's fixed one (first match wins): override →
+ * the delegation's recorded model → the plugin-config `model` (settings) →
+ * the scoped config.toml's own `model` (cliDefault) → the account catalog's
+ * `isDefault` slug (catalogDefault) → the CLI's built-in default, which names
+ * nothing. The catalogDefault layer is the ONE case source `cli-builtin`
+ * carries an `effective` model: the app-server probe marks the account's
+ * compiled default with `isDefault`, so "follow the CLI default" finally has
+ * a name. The `cliDefault` FIELD stays scoped-config-only — the two layers
+ * must stay distinguishable (the file is user-editable, the catalog answer is
+ * the account's). The pickable vocabulary is what the instance actually
+ * knows — settings + cliDefault + the identifiers the scoped config itself
+ * carries (profiles) + the app-server `model/list` account catalog (probed,
+ * cached, best-effort — see model-catalog.ts) + the card's recent-model
+ * memory — never a hardcoded catalog.
+ * @module @khorsheed/dsh-local-agent-codex/model-broker
+ */
+import { extendModelDirectory } from '@khorsheed/dsh-local-agent';
+import { listCodexConfigModels, readCodexModel, readCodexReasoningEffort } from './provision.js';
+/** Dedupe the choice vocabulary, dropping unset layers and blanks. */
+function dedupeChoices(layers) {
+    const seen = new Set();
+    const choices = [];
+    for (const layer of layers) {
+        const value = layer?.trim();
+        if (value === undefined || value === '' || seen.has(value))
+            continue;
+        seen.add(value);
+        choices.push(value);
+    }
+    return choices;
+}
+export class CodexModelBroker {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    configurationAdapter(binding) {
+        const home = this.deps.ctx.localAgent.homeDir('codex', binding.scope);
+        const resolve = async (selection) => {
+            let directory = this.deps.directory?.(home, binding.cwd);
+            if (directory?.status === 'loading') {
+                await this.deps.refreshDirectory?.(home, binding.cwd);
+                directory = this.deps.directory?.(home, binding.cwd);
+            }
+            const model = selection.model.mode === 'value' ? selection.model.value
+                : (selection.model.mode === 'inherit' ? binding.model : undefined)
+                    ?? this.deps.settingsModel() ?? await readCodexModel(home)
+                    ?? this.deps.catalogDefault(home, binding.cwd);
+            const entry = directory?.entries.find(entry => entry.value === model);
+            const explicitEffort = selection.effort.mode === 'value' ? selection.effort.value
+                : selection.effort.mode === 'inherit' ? binding.effort : undefined;
+            const effort = explicitEffort ?? await readCodexReasoningEffort(home) ?? entry?.reasoning?.default;
+            if (explicitEffort !== undefined && !entry?.reasoning?.options.some(option => option.value === explicitEffort)) {
+                throw new Error('Codex has not advertised this reasoning effort for the selected model; refresh its native directory');
+            }
+            return { ...model === undefined ? {} : { model }, ...effort === undefined ? {} : { effort } };
+        };
+        return {
+            validate: async (selection) => { await resolve(selection); },
+            prepare: resolve,
+            apply: async (selection) => {
+                const resolved = await resolve(selection);
+                await this.deps.retireRuntime(binding.childSessionId);
+                return resolved;
+            },
+            reconcile: async (state) => {
+                if (this.activeDelegations().includes(binding.childSessionId))
+                    return { active: true, matches: 'unknown', resolved: {} };
+                // No request is replayed: retire any idle process, then arm the
+                // persisted current selection for the next thread/resume + turn/start.
+                await this.deps.retireRuntime(binding.childSessionId);
+                return { active: false, matches: 'current', resolved: await resolve(state.current.selection) };
+            },
+        };
+    }
+    async modelDirectory(childSessionId, refresh = false) {
+        const home = this.deps.homeDir(childSessionId);
+        if (refresh)
+            await this.deps.refreshDirectory?.(home, this.deps.cwd?.(childSessionId));
+        const info = await this.modelInfo(childSessionId, childSessionId === undefined ? undefined : this.deps.ctx.localAgent.getDelegation(childSessionId)?.model);
+        return info.directory ?? { entries: [], complete: false, customInput: true, status: 'unsupported', refreshing: false, revision: 0 };
+    }
+    async *followModelDirectory(childSessionId, signal) {
+        if (this.deps.followDirectory === undefined) {
+            yield await this.modelDirectory(childSessionId);
+            return;
+        }
+        for await (const _snapshot of this.deps.followDirectory(this.deps.homeDir(childSessionId), this.deps.cwd?.(childSessionId), signal)) {
+            yield await this.modelDirectory(childSessionId);
+        }
+    }
+    /** The member's in-flight rounds (an empty answer on a core that predates the read). */
+    activeDelegations() {
+        const registry = this.deps.ctx.localAgent;
+        return typeof registry.activeDelegations === 'function' ? registry.activeDelegations() : [];
+    }
+    /** The model the member's NEXT spawn binds explicitly: override → recorded → settings. */
+    boundLayer(childSessionId) {
+        const override = this.deps.overrides.get(childSessionId);
+        if (override !== undefined)
+            return override;
+        const record = this.deps.ctx.localAgent.getDelegation(childSessionId);
+        const recorded = record?.model?.trim();
+        if (recorded !== undefined && recorded !== '')
+            return recorded;
+        return this.deps.settingsModel();
+    }
+    /**
+     * Read the model surface. The cliDefault and the discovered identifiers come
+     * from the scoped config.toml LIVE (a person-edited file is authoritative);
+     * a read failure degrades that layer to absent, never to a guessed value.
+     * The account catalog comes from the probe cache SYNCHRONOUSLY (a cold
+     * cache reads empty and re-probes in the background — the settings card
+     * re-fetches on open, so it never blocks on a CLI boot).
+     */
+    async modelInfo(childSessionId, delegationModel) {
+        const settings = this.deps.settingsModel();
+        const homeDir = this.deps.homeDir(childSessionId);
+        const [cliDefault, discovered] = await Promise.all([
+            readCodexModel(homeDir).catch(() => undefined),
+            listCodexConfigModels(homeDir).catch(() => []),
+        ]);
+        const override = childSessionId === undefined ? undefined : this.deps.overrides.get(childSessionId);
+        const delegation = delegationModel?.trim() === '' ? undefined : delegationModel;
+        const catalogDefaultRaw = this.deps.catalogDefault(homeDir, this.deps.cwd?.(childSessionId))?.trim();
+        const catalogDefault = catalogDefaultRaw === undefined || catalogDefaultRaw === '' ? undefined : catalogDefaultRaw;
+        const effective = override ?? delegation ?? settings ?? cliDefault ?? catalogDefault;
+        // The catalogDefault layer keeps source `cli-builtin`: it names the CLI's
+        // OWN compiled default (the account's `isDefault` slug), the one case
+        // cli-builtin names a model. `cliDefault` stays scoped-config-only, so
+        // the two layers stay distinguishable downstream.
+        const source = override !== undefined ? 'override'
+            : delegation !== undefined ? 'delegation'
+                : settings !== undefined ? 'settings'
+                    : cliDefault !== undefined ? 'cli-config' : 'cli-builtin';
+        const inFlight = childSessionId !== undefined && this.activeDelegations().includes(childSessionId);
+        return {
+            ...effective === undefined ? {} : { effective },
+            source,
+            ...override === undefined ? {} : { override },
+            ...delegation === undefined ? {} : { delegation },
+            ...settings === undefined ? {} : { settings },
+            ...cliDefault === undefined ? {} : { cliDefault },
+            ...this.deps.directory === undefined ? {} : { directory: extendModelDirectory(this.deps.directory(homeDir, this.deps.cwd?.(childSessionId)), [settings, cliDefault, ...discovered], this.deps.recentModels()) },
+            choices: dedupeChoices([settings, cliDefault, ...discovered, ...this.deps.catalog(homeDir, this.deps.cwd?.(childSessionId)), ...this.deps.recentModels()]),
+            live: this.deps.live(),
+            switchable: !inFlight,
+            ...inFlight ? { reason: '成员有进行中的委派轮次，等其完成后再切换模型' } : {},
+        };
+    }
+    /**
+     * Set (or clear) the member's session-level override. Same-model is a
+     * no-op; a different model with a live runtime bound elsewhere retires the
+     * runtime so the next round respawns (the codex thread resumes). Throws
+     * while a round is in flight — retiring mid-round would kill the run.
+     */
+    async setMemberModel(childSessionId, model) {
+        if (typeof this.deps.ctx.localAgent.setMemberModel === 'function') {
+            return this.deps.ctx.localAgent.setMemberModel(childSessionId, model);
+        }
+        if (this.activeDelegations().includes(childSessionId)) {
+            throw new Error(`subagent-codex: 成员有进行中的委派轮次，等其完成后再切换模型 (child session ${childSessionId})`);
+        }
+        const trimmed = model?.trim();
+        const next = trimmed === undefined || trimmed === '' ? undefined : trimmed;
+        if (this.deps.overrides.get(childSessionId) === next)
+            return;
+        if (next === undefined)
+            this.deps.overrides.delete(childSessionId);
+        else
+            this.deps.overrides.set(childSessionId, next);
+        const bound = this.deps.liveBoundModel(childSessionId);
+        if (bound !== null && bound !== this.boundLayer(childSessionId)) {
+            await this.deps.retireRuntime(childSessionId);
+        }
+    }
+}

package/lib/types/model-catalog.d.ts

@@ -0,0 +1,44 @@
+/** Native app-server model/list discovery. Shared core cache owns refresh,
+ * stale data and subscriptions; this provider owns protocol and pagination. */
+import type { SubprocessHandle, SubprocessSpawnSpec } from '@deepseek-ai/dsh-subprocess';
+import type { LocalAgentModelDirectory } from '@khorsheed/dsh-local-agent/types';
+/** Default overall bound for one catalog probe (spawn → model/list answer). */
+export declare const DEFAULT_CATALOG_PROBE_TIMEOUT_MS = 5000;
+/** Default lifetime of a completed probe's cached answer, per scoped home. */
+export declare const DEFAULT_CATALOG_TTL_MS: number;
+/** Everything the catalog needs, injected so the specs drive a fake app-server. */
+export interface CodexModelCatalogDeps {
+    /** The host's managed spawn — the same seam the live driver spawns through. */
+    readonly spawn: (spec: SubprocessSpawnSpec) => SubprocessHandle;
+    /** Diagnostic sink; a degraded probe warns once, never throws. */
+    readonly warn?: (message: string) => void;
+    /** Overall probe bound; tests inject a small value. */
+    readonly timeoutMs?: number;
+    /** Completed-probe cache lifetime; tests inject a small value. */
+    readonly ttlMs?: number;
+    /** Clock, injectable for the TTL assertions. */
+    readonly now?: () => number;
+}
+/** Synchronous compatibility reads plus a rich, subscribable directory. */
+export declare class CodexModelCatalog {
+    private readonly deps;
+    private readonly timeoutMs;
+    private readonly cache;
+    constructor(deps: CodexModelCatalogDeps);
+    private key;
+    read(homeDir: string, cwd?: string): readonly string[];
+    readDefault(homeDir: string, cwd?: string): string | undefined;
+    directory(homeDir: string, cwd?: string): LocalAgentModelDirectory;
+    follow(homeDir: string, signal: AbortSignal, cwd?: string): AsyncIterable<LocalAgentModelDirectory>;
+    invalidate(homeDir: string, cwd?: string): void;
+    dispose(): void;
+    refresh(homeDir: string, cwd?: string): Promise<readonly string[]>;
+    /**
+     * One bounded probe: spawn the app-server against the scoped home, answer
+     * the initialize handshake exactly as the live driver shapes it, ask
+     * `model/list`, then tear the process down (stdin EOF → grace →
+     * terminate). The overall timeout kills the process on expiry. Failures propagate to the shared cache, which preserves prior data.
+     */
+    private probe;
+}
+//# sourceMappingURL=model-catalog.d.ts.map