@kitman-sh/cli 0.10.74 → 0.10.75

package/dist/{chunk-rt94p780.js → chunk-89547s8p.js}

@@ -1,11 +1,12 @@
 // @bun
 import {
   toJsonValue,
+  isKeyOf,
   isNumber,
   isObject,
   isJsonObject,
   isString
-} from "./chunk-v01c0k6j.js";
+} from "./chunk-tzz4fv17.js";
 import {
   pipeArguments,
   dual,
@@ -19,7 +20,10 @@ import {
   match,
   getOrElse,
   getOrUndefined,
+  liftThrowable,
   flatMap,
+  toArray,
+  filter2,
   Service2,
   Reference,
   fromInputUnsafe,
@@ -50,6 +54,7 @@ import {
   doneUnsafe,
   makeUnsafe6,
   provide,
+  succeed5,
   effect,
   mergeAll,
   die2,
@@ -104,7 +109,7 @@ import {
   sleep,
   raceAllFirst,
   raceFirst,
-  filter2,
+  filter3,
   matchEffect2,
   context,
   provide3,
@@ -136,31 +141,36 @@ import {
   String4,
   Boolean2,
   Struct,
+  Record,
   ArraySchema,
   Union,
   Literals,
   NullOr,
   isPattern,
   Finite,
+  isGreaterThan,
   isGreaterThanOrEqualTo,
   isLessThanOrEqualTo,
   Int,
   isMinLength,
   isMaxLength,
+  NonEmptyString,
   Date2,
   fromJsonString,
   TaggedError2,
+  Json,
   decodeJsonString,
   decodeJsonStringOption,
   encodeJsonStringSync,
   encodePrettyJsonString,
   decodeJsonStringSync,
   encodeUnknownJsonStringSync
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   Id,
-  secretReference
-} from "./chunk-rrnee9mk.js";
+  secretReference,
+  secretPlaceholder
+} from "./chunk-545b129z.js";
 import {
   currentTimeMillis,
   SecureRandom,
@@ -190,9 +200,15 @@ import {
   digestSha256,
   AgentEvent,
   get,
+  post,
   setHeaders,
+  acceptJson,
+  bodyJsonUnsafe,
+  bodyUrlParams,
+  schemaBodyJson,
   filterStatusOk,
   HttpClient,
+  layer4,
   SetupArchive,
   kitMcpSecretNames,
   RunSettled,
@@ -227,7 +243,7 @@ import {
   installCommand,
   checkServicesFile,
   checkServices
-} from "./chunk-g4fvd8r1.js";
+} from "./chunk-bcbne0ek.js";
 import {
   join,
   interrupt,
@@ -267,7 +283,7 @@ import {
   writeSrtSettings2,
   srtStepArgv2,
   srtArgv2
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   writeAgentEnvironmentConfigFile2,
   readManifestSkillPaths2,
@@ -283,8 +299,8 @@ import {
   applyAgentEnvironmentMaterialization2,
   isPathWithin2,
   skillIdentity2
-} from "./chunk-8bhea26e.js";
-import"./chunk-2v7pbpfw.js";
+} from "./chunk-e3dmkypq.js";
+import"./chunk-fqhxxxmp.js";
 import {
   egressAllowed,
   writeSecretRegistry,
@@ -294,7 +310,7 @@ import {
   secretFilter2,
   opaqueTunnelRefusal2,
   isOpaqueConnectReason2
-} from "./chunk-3edjgnxf.js";
+} from "./chunk-b0cscqbw.js";
 import {
   sliceBytes2,
   maxLineBytes2,
@@ -302,23 +318,23 @@ import {
   decodedOption2,
   decoded2,
   readOpencode2
-} from "./chunk-csbf77zs.js";
+} from "./chunk-e8zm8z3a.js";
 import {
   uploadRunFile,
   programLease,
   rpcRunFiles,
   programHostsEnv,
   undeclaredHostsEnv
-} from "./chunk-yzm5s3ng.js";
-import"./chunk-xz1z7j2d.js";
+} from "./chunk-jb01khjp.js";
+import"./chunk-p8g8qyev.js";
 import {
   nextInt
-} from "./chunk-q3c7vmby.js";
+} from "./chunk-76ctrqm6.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-1rry0tsn.js";
-import"./chunk-ggax0n15.js";
+} from "./chunk-98sg1yyd.js";
+import"./chunk-3teaa3qx.js";
 
 // packages/core/src/sync-kit.ts
 import { createHash } from "crypto";
@@ -1614,6 +1630,8 @@ function repositoryUrl(repoBinding) {
 }
 // packages/agent-runtime/src/harness-adapters.ts
 import { homedir } from "os";
+var anthropicHosts = ["api.anthropic.com", "console.anthropic.com", "claude.ai"];
+var githubCopilotHosts = ["api.githubcopilot.com", "*.githubcopilot.com"];
 var HarnessAdapters = [
   {
     id: "claude",
@@ -1628,10 +1646,20 @@ var HarnessAdapters = [
       file: ".credentials.json",
       variable: "CLAUDE_SECURESTORAGE_CONFIG_DIR",
       format: "claude",
+      referenceName: "claude-code-login",
       refreshArgs: ["-p", "/usage", "--setting-sources", "", "--no-session-persistence"],
       renewWithin: "4 minutes"
     },
-    providerHosts: ["api.anthropic.com", "console.anthropic.com", "claude.ai"],
+    providerHosts: anthropicHosts,
+    loginHosts: { claudeAiOauth: anthropicHosts },
+    globalConfig: {
+      file: ".claude.json",
+      variable: "CLAUDE_CONFIG_DIR",
+      keyField: "primaryApiKey",
+      hosts: ["api.anthropic.com"],
+      referenceName: "claude-api-key",
+      links: { projects: ".claude/projects" }
+    },
     effortArgs: ["--effort", "{effort}"],
     autoPermissionArgs: ["--dangerously-skip-permissions"],
     requiredArgs: [
@@ -1710,6 +1738,19 @@ var HarnessAdapters = [
       "generativelanguage.googleapis.com",
       "openrouter.ai"
     ],
+    loginHosts: {
+      anthropic: ["api.anthropic.com"],
+      openai: ["api.openai.com"],
+      "openai-codex": ["chatgpt.com"],
+      google: ["generativelanguage.googleapis.com"],
+      "google-gemini-cli": ["cloudcode-pa.googleapis.com"],
+      "github-copilot": githubCopilotHosts,
+      openrouter: ["openrouter.ai"],
+      groq: ["api.groq.com"],
+      xai: ["api.x.ai"],
+      mistral: ["api.mistral.ai"],
+      cerebras: ["api.cerebras.ai"]
+    },
     effortArgs: ["--thinking", "{effort}"],
     autoPermissionArgs: ["--no-approve"],
     requiredArgs: ["--no-skills"],
@@ -1721,7 +1762,8 @@ var HarnessAdapters = [
       variable: "PI_CODING_AGENT_DIR",
       sessionsVariable: "PI_CODING_AGENT_SESSION_DIR",
       operatorDir: ".pi/agent",
-      copies: ["models.json", "models-store.json"],
+      copies: ["models-store.json"],
+      providers: "models.json",
       login: {
         file: "auth.json",
         refreshArgs: ["auth", "print-bearer-token", "--min-expiry", "15m", "--provider", "{provider}"],
@@ -1754,6 +1796,19 @@ var HarnessAdapters = [
       "opencode.ai",
       "models.dev"
     ],
+    loginHosts: {
+      anthropic: anthropicHosts,
+      openai: ["api.openai.com", "auth.openai.com", "chatgpt.com"],
+      opencode: ["opencode.ai"],
+      google: ["generativelanguage.googleapis.com"],
+      "github-copilot": githubCopilotHosts,
+      openrouter: ["openrouter.ai"],
+      groq: ["api.groq.com"],
+      xai: ["api.x.ai"],
+      mistral: ["api.mistral.ai"],
+      cerebras: ["api.cerebras.ai"]
+    },
+    loginRefreshHosts: { "github-copilot": [...githubCopilotHosts, "api.github.com"] },
     autoPermissionArgs: ["--auto"],
     flagWhereListed: "--standalone",
     mcp: { kind: "config_env", variable: "OPENCODE_CONFIG_CONTENT" },
@@ -1783,6 +1838,12 @@ function kitmanMcpToolTimeout(adapter, seconds) {
   const value = timeout.unit === "ms" ? seconds * 1000 : seconds;
   return timeout.kind === "env" ? { env: Object.fromEntries(timeout.variables.map((variable) => [variable, String(value)])) } : { server: { [timeout.field]: value } };
 }
+var harnessNetworkHosts = (adapter) => [
+  ...new Set([
+    ...adapter?.providerHosts ?? [],
+    ...[adapter?.loginHosts, adapter?.loginRefreshHosts].flatMap((hosts) => Object.values(hosts ?? {}).flat())
+  ])
+];
 var providerKeyHosts = new Map([
   ["ANTHROPIC_API_KEY", ["api.anthropic.com"]],
   ["ANTHROPIC_AUTH_TOKEN", ["api.anthropic.com", "console.anthropic.com", "claude.ai"]],
@@ -1803,18 +1864,53 @@ function resolveHarnessLaunch(input) {
   const launch = input.adapter.env === undefined ? kit : { ...kit, env: { ...input.adapter.env, ...kit.env } };
   const effort = input.effort;
   const effortful = effort === undefined || input.adapter.effortArgs === undefined ? launch : { ...launch, args: [...launch.args, ...input.adapter.effortArgs.map((arg) => arg.replace("{effort}", effort))] };
-  return flagProbedLaunch(input.adapter, sandboxHomeLaunch(input, effortful));
-}
-var sandboxedLaunch = (launch, backend) => launch.sandboxed === undefined ? launch : {
-  ...launch,
-  env: {
-    ...launch.env,
-    ...launch.sandboxed.env,
-    ...backend === "srt" ? { XDG_CONFIG_HOME: launch.sandboxed.configHome } : undefined
-  },
-  loginCopy: launch.sandboxed.login,
-  homeDirectory: launch.sandboxed.homeDirectory
+  return flagProbedLaunch(input.adapter, globalConfigLaunch(input, sandboxHomeLaunch(input, effortful)));
+}
+var sandboxedLaunch = (launch, backend) => {
+  const sandboxed = launch.sandboxed;
+  if (sandboxed === undefined)
+    return launch;
+  const srt = backend === "srt";
+  const config = srt ? sandboxed.globalConfig : undefined;
+  return {
+    ...launch,
+    env: {
+      ...launch.env,
+      ...sandboxed.env,
+      ...srt && sandboxed.configHome !== undefined ? { XDG_CONFIG_HOME: sandboxed.configHome } : undefined,
+      ...config === undefined ? undefined : config.env
+    },
+    ...sandboxed.login === undefined ? undefined : { renewedLogin: sandboxed.login },
+    ...sandboxed.homeDirectory === undefined ? undefined : { homeDirectory: sandboxed.homeDirectory },
+    ...config === undefined ? undefined : { globalConfig: config }
+  };
 };
+function globalConfigLaunch(input, launch) {
+  const config = input.adapter.globalConfig;
+  if (config === undefined)
+    return launch;
+  const home = input.home ?? homedir();
+  const directory = `${input.configDir}/global-config`;
+  return {
+    ...launch,
+    sandboxed: {
+      env: {},
+      ...launch.sandboxed,
+      globalConfig: {
+        env: { [config.variable]: directory },
+        path: `${directory}/${config.file}`,
+        source: `${home}/${config.file}`,
+        keyField: config.keyField,
+        hosts: config.hosts,
+        referenceName: config.referenceName,
+        links: Object.entries(config.links).map(([name, target]) => ({
+          path: `${directory}/${name}`,
+          target: `${home}/${target}`
+        }))
+      }
+    }
+  };
+}
 function sandboxHomeLaunch(input, launch) {
   const { sandboxHome } = input.adapter;
   if (sandboxHome === undefined)
@@ -1828,7 +1924,13 @@ function sandboxHomeLaunch(input, launch) {
       configHome,
       login: {
         path: `${input.configDir}/${sandboxHome.login.path}`,
-        source: `${home}/${sandboxHome.login.source}`
+        source: `${home}/${sandboxHome.login.source}`,
+        format: "opencode",
+        binary: input.adapter.binary,
+        hosts: input.adapter.loginHosts ?? {},
+        refreshTokenHosts: input.adapter.loginRefreshHosts ?? {},
+        referenceName: `${input.adapter.id}-login`,
+        refresh: { args: [], env: {}, within: "10 minutes" }
       },
       homeDirectory: `${configHome}/${sandboxHome.configHomeDirectory}`
     }
@@ -1868,6 +1970,9 @@ function agentDirLaunch(input, launch) {
         path: `${directory}/${agentDir.login.file}`,
         source: `${operator}/${agentDir.login.file}`,
         format: "pi",
+        binary: input.adapter.binary,
+        hosts: input.adapter.loginHosts ?? {},
+        referenceName: `${input.adapter.id}-login`,
         refresh: {
           args: agentDir.login.refreshArgs,
           env: { [agentDir.variable]: operator },
@@ -1878,6 +1983,14 @@ function agentDirLaunch(input, launch) {
         path: `${directory}/${agentDir.settings.file}`,
         source: `${operator}/${agentDir.settings.file}`,
         keys: agentDir.settings.keys
+      },
+      ...agentDir.providers === undefined ? undefined : {
+        providers: {
+          path: `${directory}/${agentDir.providers}`,
+          source: `${operator}/${agentDir.providers}`,
+          hosts: input.adapter.loginHosts ?? {},
+          referenceName: `${input.adapter.id}-provider`
+        }
       }
     }
   };
@@ -1894,6 +2007,9 @@ function renewedLoginLaunch(input, launch) {
       path: directory,
       source: `${input.home ?? homedir()}/${login.operatorDir}/${login.file}`,
       format: login.format,
+      binary: input.adapter.binary,
+      hosts: input.adapter.loginHosts ?? {},
+      referenceName: login.referenceName,
       linksDirectory: true,
       refresh: { args: login.refreshArgs, env: {}, within: login.renewWithin }
     }
@@ -2100,6 +2216,189 @@ function mcpLaunch(input, skillsDir) {
       };
   }
 }
+// packages/agent-runtime/src/opencode-login.ts
+class OpenCodeLoginNotRenewed extends TaggedError("OpenCodeLoginNotRenewed") {
+  get message() {
+    return `OpenCode's ${this.provider} login was not renewed: ${this.reason}`;
+  }
+}
+var StoredCredential = Struct({
+  id: String4,
+  integrationID: String4,
+  label: optionalKey(NullOr(String4)),
+  value: Record(String4, Json),
+  active: optionalKey(Boolean2)
+});
+var decodeExport = decodeUnknownOption(fromJsonString(ArraySchema(Json)));
+var decodeStored = decodeUnknownOption(StoredCredential);
+var RenewableLogin = Struct({
+  type: Literal("oauth"),
+  access: String4,
+  refresh: NonEmptyString,
+  expires: Finite.check(isGreaterThan(0))
+});
+var decodeRenewable = decodeUnknownOption(RenewableLogin);
+var TokenAnswer = Struct({
+  access_token: String4,
+  refresh_token: optionalKey(String4),
+  expires_in: Finite
+});
+var XaiAnswer = Struct({
+  access_token: String4,
+  refresh_token: optionalKey(String4),
+  expires_in: optionalKey(Finite)
+});
+var JwtExpiry = fromJsonString(Struct({ exp: Finite }));
+var decodeJwtExpiry = decodeUnknownOption(JwtExpiry);
+var CopilotAnswer = Struct({ token: String4, expires_at: Finite });
+var legacyCredential = (value) => {
+  const metadata = isJsonObject(value.metadata) ? value.metadata : {};
+  const strings = Object.fromEntries(Object.entries(metadata).filter(([, entry]) => isString(entry)));
+  const carried = Object.keys(strings).length > 0 ? { metadata: strings } : undefined;
+  if (value.type === "oauth")
+    return Object.assign({ type: "oauth", refresh: value.refresh ?? "", access: value.access ?? "", expires: value.expires ?? 0 }, isString(metadata.accountID) ? { accountId: metadata.accountID } : undefined, isString(metadata.enterpriseUrl) ? { enterpriseUrl: metadata.enterpriseUrl } : undefined, carried);
+  return value.type === "key" && isString(value.key) ? Object.assign({ type: "api", key: value.key }, carried) : undefined;
+};
+var activeCredentials = (entries) => {
+  const chosen = {};
+  for (const entry of entries)
+    if (chosen[entry.integrationID] === undefined || entry.active === true && chosen[entry.integrationID]?.active !== true)
+      chosen[entry.integrationID] = entry;
+  return chosen;
+};
+var fileCredentials = (source) => gen(function* () {
+  const text = yield* (yield* FileSystem).readFileString(source).pipe(orElseSucceed(() => ""));
+  const credentials = getOrUndefined(decodeJsonStringOption(text));
+  return isJsonObject(credentials) ? credentials : undefined;
+});
+var openCodeStore = (source) => gen(function* () {
+  const path = yield* Path;
+  const store = path.join(path.dirname(source), "opencode.db");
+  const exists = yield* (yield* FileSystem).exists(store).pipe(orElseSucceed(() => false));
+  return exists ? { env: { XDG_DATA_HOME: path.dirname(path.dirname(source)) } } : undefined;
+});
+var runOpenCode = (binary, store, args) => runCommand2(binary, [...args, "--standalone"], { env: store.env, timeout: "30 seconds" });
+var readOpenCodeLogin = (binary, source) => gen(function* () {
+  const store = yield* openCodeStore(source);
+  const exported = store === undefined ? none() : yield* runOpenCode(binary, store, ["auth", "export"]).pipe(map8(decodeExport), orElseSucceed(() => none()));
+  if (isNone(exported)) {
+    const credentials = yield* fileCredentials(source);
+    return credentials === undefined ? undefined : { credentials };
+  }
+  const stored = activeCredentials(exported.value.flatMap((entry) => toArray(decodeStored(entry))));
+  const credentials = Object.fromEntries(Object.entries(stored).flatMap(([provider, entry]) => {
+    const legacy = legacyCredential(entry.value);
+    return legacy === undefined ? [] : [[provider, legacy]];
+  }));
+  return { credentials, stored };
+});
+var answer = (provider, schema, request) => gen(function* () {
+  const response = yield* (yield* HttpClient).execute(request);
+  const ok = yield* filterStatusOk(response);
+  return yield* schemaBodyJson(schema)(ok);
+}).pipe(mapError2((error) => new OpenCodeLoginNotRenewed({ provider, reason: error.message })));
+var refreshed = (now) => (answered) => ({
+  access: answered.access_token,
+  ...answered.refresh_token === undefined ? undefined : { refresh: answered.refresh_token },
+  expires: now + answered.expires_in * 1000
+});
+var xaiExpiry = (answered, now) => {
+  if (answered.expires_in !== undefined && answered.expires_in > 0)
+    return now + answered.expires_in * 1000;
+  const payload = answered.access_token.split(".")[1];
+  const exp = payload === undefined ? none() : decodeJwtExpiry(Buffer.from(payload, "base64url").toString());
+  return match(exp, { onNone: () => now + 3600000, onSome: ({ exp }) => exp * 1000 });
+};
+var openCodeConsole = "https://opencode.ai/console";
+var consoleServer = (metadata) => (isString(metadata.server) ? metadata.server : openCodeConsole).replace(/^https:\/\/console\.opencode\.ai(?=\/|$)/, openCodeConsole);
+var consoleMetadata = (credential) => isJsonObject(credential) && isJsonObject(credential.metadata) ? credential.metadata : {};
+var openCodeConsoleHosts = (credentials) => {
+  if (credentials?.opencode === undefined)
+    return [];
+  const server = liftThrowable(() => new URL(consoleServer(consoleMetadata(credentials.opencode))))();
+  return match(filter2(server, (url) => url.protocol === "https:"), {
+    onNone: () => [],
+    onSome: (url) => [url.host]
+  });
+};
+var openCodeConsoleKey = (credential) => Object.assign({ type: "api", key: credential.access ?? "" }, isJsonObject(credential.metadata) ? { metadata: credential.metadata } : undefined);
+var renewers = {
+  anthropic: (login, now) => answer("anthropic", TokenAnswer, post("https://platform.claude.com/v1/oauth/token").pipe(bodyJsonUnsafe({
+    grant_type: "refresh_token",
+    refresh_token: login.refresh,
+    client_id: "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
+  }))).pipe(map8(refreshed(now))),
+  openai: (login, now) => answer("openai", TokenAnswer, post("https://auth.openai.com/oauth/token").pipe(bodyUrlParams({
+    grant_type: "refresh_token",
+    refresh_token: login.refresh,
+    client_id: "app_EMoamEEZ73f0CkXaXp7hrann"
+  }))).pipe(map8(refreshed(now))),
+  xai: (login, now) => answer("xai", XaiAnswer, post("https://auth.x.ai/oauth2/token").pipe(acceptJson, bodyUrlParams({
+    grant_type: "refresh_token",
+    refresh_token: login.refresh,
+    client_id: "b1a00492-073a-47ea-816f-4c329264a828"
+  }))).pipe(map8((answered) => ({
+    access: answered.access_token,
+    ...answered.refresh_token === undefined ? undefined : { refresh: answered.refresh_token },
+    expires: xaiExpiry(answered, now)
+  }))),
+  opencode: (login, now, metadata) => answer("opencode", TokenAnswer, post(`${consoleServer(metadata)}/auth/device/token`).pipe(acceptJson, bodyJsonUnsafe({
+    grant_type: "refresh_token",
+    refresh_token: login.refresh,
+    client_id: "opencode-cli"
+  }))).pipe(map8(refreshed(now))),
+  "github-copilot": (login) => answer("github-copilot", CopilotAnswer, get("https://api.github.com/copilot_internal/v2/token").pipe(setHeaders({ authorization: `Bearer ${login.refresh}`, accept: "application/json" }))).pipe(map8((answered) => ({ access: answered.token, expires: answered.expires_at * 1000 })))
+};
+var renewerFor = (provider) => isKeyOf(renewers, provider) ? renewers[provider] : undefined;
+var renewableLogin = (provider, credential) => getOrUndefined(filter2(decodeRenewable(credential), (login) => renewerFor(provider) !== undefined && (provider !== "github-copilot" || login.access !== login.refresh)));
+var renewsOpenCodeCredential = (provider, credential) => renewableLogin(provider, credential) !== undefined;
+var openCodeExpiry = (credentials, provider) => renewableLogin(provider, credentials?.[provider])?.expires;
+var replaceStored = (binary, source, store, stored, value) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const directory = yield* fs.makeTempDirectoryScoped({
+    directory: path.dirname(source),
+    prefix: "kitman-opencode-renewal-"
+  });
+  const file = path.join(directory, "credentials.json");
+  const id = `cred_kitman${(yield* currentTimeMillis).toString(36)}${Math.abs(yield* nextInt).toString(36)}`;
+  yield* fs.writeFileString(file, encodeUnknownJsonStringSync([
+    { id, integrationID: stored.integrationID, label: stored.label ?? "", value, active: true }
+  ]), { mode: 384 });
+  yield* runOpenCode(binary, store, ["auth", "import", file]);
+  yield* runOpenCode(binary, store, ["api", "credential.activate", "--param", `credentialID=${id}`]);
+  yield* runOpenCode(binary, store, ["api", "credential.remove", "--param", `credentialID=${stored.id}`]);
+}).pipe(scoped);
+var replaceInFile = (source, provider, credential) => gen(function* () {
+  const fs = yield* FileSystem;
+  const current = (yield* fileCredentials(source)) ?? {};
+  const next = `${source}.${Math.abs(yield* nextInt)}.kitman-next`;
+  yield* fs.writeFileString(next, encodeUnknownJsonStringSync(Object.assign({}, current, { [provider]: credential })), { mode: 384 });
+  yield* fs.rename(next, source);
+});
+var renewalPermits = new Map;
+var oneRenewalAt = (source) => (effect) => {
+  const permit = renewalPermits.get(source) ?? makeUnsafe3(1);
+  renewalPermits.set(source, permit);
+  return permit.withPermits(1)(effect);
+};
+var renewOpenCodeLogin = (binary, source, provider, seenExpiry) => gen(function* () {
+  const login = yield* readOpenCodeLogin(binary, source);
+  const credential = login?.credentials[provider];
+  const renewable = renewableLogin(provider, credential);
+  const renew = renewerFor(provider);
+  if (login === undefined || renewable === undefined || renew === undefined || !isJsonObject(credential))
+    return yield* new OpenCodeLoginNotRenewed({ provider, reason: "it holds no OAuth login the Runner renews" });
+  if (seenExpiry !== undefined && renewable.expires > seenExpiry)
+    return;
+  const stored = login.stored?.[provider];
+  const metadata = isJsonObject(stored?.value.metadata) ? stored.value.metadata : {};
+  const renewed = yield* renew(renewable, yield* currentTimeMillis, metadata);
+  const tokens = { access: renewed.access, refresh: renewed.refresh ?? renewable.refresh, expires: renewed.expires };
+  const store = yield* openCodeStore(source);
+  yield* (stored === undefined || store === undefined ? replaceInFile(source, provider, Object.assign({}, credential, tokens)) : replaceStored(binary, source, store, stored, Object.assign({}, stored.value, tokens))).pipe(mapError2((error) => new OpenCodeLoginNotRenewed({ provider, reason: error.message })));
+}).pipe(oneRenewalAt(source));
+
 // packages/agent-runtime/src/skill-fits.ts
 import { matchesGlob } from "path";
 var skipped = new Set([".git", "node_modules"]);
@@ -2186,13 +2485,17 @@ var stepSandboxPolicy = (input) => ({
   readDeniedPaths: [
     ...input.policy.readDeniedPaths,
     ...HarnessAdapters.filter((other) => other.id !== input.adapter.id).flatMap((other) => other.auth),
-    ...input.adapter.agentDir === undefined ? [] : [`~/${input.adapter.agentDir.operatorDir}/${input.adapter.agentDir.login.file}`],
+    ...input.adapter.agentDir === undefined ? [] : [
+      input.adapter.agentDir.login.file,
+      ...input.adapter.agentDir.providers === undefined ? [] : [input.adapter.agentDir.providers]
+    ].map((file) => `~/${input.adapter.agentDir?.operatorDir}/${file}`),
     ...input.adapter.renewedLogin === undefined ? [] : [`~/${input.adapter.renewedLogin.operatorDir}/${input.adapter.renewedLogin.file}`],
-    ...input.adapter.sandboxHome === undefined ? [] : [`~/${input.adapter.sandboxHome.login.source}`]
+    ...input.adapter.sandboxHome === undefined ? [] : [`~/${input.adapter.sandboxHome.login.source.replace(/\/[^/]+$/, "")}`],
+    ...input.launch?.globalConfig === undefined ? [] : [input.launch.globalConfig.source]
   ],
   readAllowedPaths: [
     ...input.policy.readAllowedPaths,
-    ...input.adapter.loginFiles ?? [],
+    ...input.launch?.globalConfig === undefined ? input.adapter.loginFiles ?? [] : [],
     input.workspace,
     input.configDir
   ],
@@ -2297,8 +2600,90 @@ var credentialsIn = (source) => gen(function* () {
   const credentials = getOrUndefined(decodeJsonStringOption(text));
   return isJsonObject(credentials) ? credentials : undefined;
 });
+var loginCredentials = (login) => login.format === "opencode" ? map8(readOpenCodeLogin(login.binary, login.source), (read) => read?.credentials) : credentialsIn(login.source);
+var neverExpires = 253402300799000;
 var isOAuth = (credential) => isJsonObject(credential) && credential.type === "oauth";
 var claudeOAuth = "claudeAiOauth";
+var piVariable = /\$(?:([$!])|\{([A-Za-z_]\w*)\}|([A-Za-z_]\w*))?/g;
+var isPiCommand = (value) => value.startsWith("!");
+var piResolved = (value, env = {}) => {
+  if (isPiCommand(value))
+    return;
+  let resolved = true;
+  const text = value.replace(piVariable, (dollar, escaped, braced, bare) => {
+    const name = braced ?? bare;
+    if (name === undefined)
+      return escaped ?? dollar;
+    const found = env[name];
+    if (isString(found) && found !== "")
+      return found;
+    resolved = false;
+    return dollar;
+  });
+  return resolved ? text : undefined;
+};
+var piNames = (value) => isPiCommand(value) ? [] : [...value.matchAll(piVariable)].flatMap((match) => match[2] ?? match[3] ?? []);
+var piConfiguringEnv = new Set([
+  "AWS_BEDROCK_FORCE_CACHE",
+  "AWS_DEFAULT_REGION",
+  "AWS_REGION",
+  "AZURE_OPENAI_API_VERSION",
+  "AZURE_OPENAI_BASE_URL",
+  "AZURE_OPENAI_DEPLOYMENT_NAME_MAP",
+  "AZURE_OPENAI_RESOURCE_NAME",
+  "CLOUDFLARE_ACCOUNT_ID",
+  "CLOUDFLARE_GATEWAY_ID",
+  "GCLOUD_PROJECT",
+  "GOOGLE_CLOUD_LOCATION",
+  "GOOGLE_CLOUD_PROJECT",
+  "PI_CACHE_RETENTION"
+]);
+var piKey = (key, credential) => piResolved(key, isJsonObject(credential.env) ? credential.env : {});
+var withConfiguringEnv = (credential, field) => {
+  if (!isJsonObject(credential.env))
+    return credential;
+  const named = isString(credential[field]) ? piNames(credential[field]) : [];
+  return Object.assign({}, credential, {
+    env: Object.fromEntries(Object.entries(credential.env).filter(([name]) => piConfiguringEnv.has(name) && !named.includes(name)))
+  });
+};
+var referenceNamePattern = /^[A-Za-z0-9_.-]+$/;
+var perProviderPlaceholders = (tokenFields, keyValue = (key) => key, isCommand = () => false) => (credentials, login, reference) => {
+  const kept = [];
+  const tokens = {};
+  const held = (name, token, hosts) => {
+    if (hosts.length > 0)
+      tokens[name] = { value: token, hosts };
+    return secretPlaceholder(token, name);
+  };
+  const placed = Object.entries(credentials).flatMap(([provider, credential]) => {
+    const hosts = login.hosts[provider];
+    const refreshHosts = login.refreshTokenHosts?.[provider];
+    const field = isJsonObject(credential) && isString(credential.type) ? tokenFields[credential.type] : undefined;
+    if (hosts === undefined && refreshHosts === undefined || field === undefined || !isJsonObject(credential) || !isString(credential[field]) || !referenceNamePattern.test(provider))
+      return [];
+    const token = credential.type === "oauth" ? credential[field] : keyValue(credential[field], credential);
+    if (credential.type !== "oauth" && isCommand(credential[field]))
+      return [];
+    if (token === undefined) {
+      kept.push([provider, withConfiguringEnv(credential, field)]);
+      return [];
+    }
+    const name = reference(`${login.referenceName}-${provider}`);
+    const refresh = isOAuth(credential) ? credential.refresh : undefined;
+    const tokenHosts = [...new Set([...hosts ?? [], ...refreshHosts ?? []])];
+    const heldRefresh = !isOAuth(credential) ? undefined : {
+      refresh: refreshHosts !== undefined && isString(refresh) && refresh !== "" ? held(reference(`${login.referenceName}-${provider}-refresh`), refresh, refreshHosts) : ""
+    };
+    return [
+      [
+        provider,
+        Object.assign({}, withConfiguringEnv(credential, field), { [field]: token === "" ? "" : held(name, token, tokenHosts) }, heldRefresh)
+      ]
+    ];
+  });
+  return { held: Object.fromEntries([...kept, ...placed]), tokens };
+};
 var loginFormats = {
   pi: {
     expiry: (credentials, provider) => {
@@ -2309,6 +2694,7 @@ var loginFormats = {
       provider,
       isOAuth(credential) ? Object.assign({}, credential, { refresh: "" }) : credential
     ])),
+    byReference: perProviderPlaceholders({ oauth: "access", api_key: "key" }, piKey, isPiCommand),
     exitMeansRenewed: true
   },
   claude: {
@@ -2320,22 +2706,58 @@ var loginFormats = {
       const credential = credentials[claudeOAuth];
       return isJsonObject(credential) ? { [claudeOAuth]: Object.assign({}, credential, { refreshToken: "" }) } : undefined;
     },
+    byReference: (credentials, login, reference) => {
+      const credential = credentials[claudeOAuth];
+      const hosts = login.hosts[claudeOAuth];
+      if (!isJsonObject(credential) || !isString(credential.accessToken) || hosts === undefined)
+        return;
+      const name = reference(login.referenceName);
+      return {
+        held: { [claudeOAuth]: Object.assign({}, credential, { accessToken: name, refreshToken: "" }) },
+        tokens: { [name]: { value: credential.accessToken, hosts } }
+      };
+    },
+    exitMeansRenewed: false
+  },
+  opencode: {
+    expiry: openCodeExpiry,
+    withoutRefresh: (credentials) => Object.fromEntries(Object.entries(credentials).map(([provider, credential]) => [
+      provider,
+      isOAuth(credential) ? Object.assign({}, credential, { refresh: "" }) : credential
+    ])),
+    byReference: (credentials, login, reference) => {
+      const consoleHosts = [...new Set([...login.hosts.opencode ?? [], ...openCodeConsoleHosts(credentials)])];
+      const withConsole = { ...login, hosts: { ...login.hosts, opencode: consoleHosts } };
+      const placeholders = perProviderPlaceholders({ oauth: "access", api: "key" });
+      const { held, tokens } = placeholders(credentials, withConsole, reference);
+      return {
+        held: Object.fromEntries(Object.entries(held).map(([provider, credential]) => [
+          provider,
+          !isOAuth(credential) ? credential : provider === "opencode" ? openCodeConsoleKey(credential) : renewsOpenCodeCredential(provider, credentials[provider]) ? Object.assign({}, credential, { expires: neverExpires }) : credential
+        ])),
+        tokens
+      };
+    },
     exitMeansRenewed: false
   }
 };
-var refreshOperatorLogin = (binary, login, expired) => gen(function* () {
+var refreshOperatorLogin = (login, expired, http) => gen(function* () {
   const format = loginFormats[login.format];
   const now = yield* currentTimeMillis;
   const expiringBefore = now + toMillis(login.refresh.within);
-  const credentials = yield* credentialsIn(login.source);
+  const credentials = yield* loginCredentials(login);
   const due = Object.keys(credentials ?? {}).flatMap((provider) => {
     const expires = format.expiry(credentials, provider);
     const waiting = (expired.get(provider)?.retryAt ?? 0) > now;
     return expires === undefined || expires >= expiringBefore || expires <= now && waiting ? [] : [{ provider, expires }];
   });
   for (const { provider, expires } of due) {
-    const ran = yield* runCommand2(binary, login.refresh.args.map((arg) => arg.replace("{provider}", provider)), { env: login.refresh.env, timeout: "30 seconds" }).pipe(as(true), orElseSucceed(() => false), uninterruptible);
-    if (ran && format.exitMeansRenewed || (format.expiry(yield* credentialsIn(login.source), provider) ?? expires) > expires) {
+    const renewal = login.format === "opencode" ? renewOpenCodeLogin(login.binary, login.source, provider, expires).pipe(provide3(http === undefined ? layer4 : succeed5(HttpClient, http)), as(true), orElseSucceed(() => false)) : runCommand2(login.binary, login.refresh.args.map((arg) => arg.replace("{provider}", provider)), {
+      env: login.refresh.env,
+      timeout: "30 seconds"
+    }).pipe(as(true), orElseSucceed(() => false));
+    const ran = yield* renewal.pipe(uninterruptible);
+    if (ran && format.exitMeansRenewed || (format.expiry(yield* loginCredentials(login), provider) ?? expires) > expires) {
       expired.delete(provider);
       continue;
     }
@@ -2346,37 +2768,35 @@ var refreshOperatorLogin = (binary, login, expired) => gen(function* () {
     }
   }
 });
-var referencedClaudeLogin = (held, reference) => {
-  const credential = held[claudeOAuth];
-  return isJsonObject(credential) && isString(credential.accessToken) ? {
-    token: credential.accessToken,
-    held: { ...held, [claudeOAuth]: Object.assign({}, credential, { accessToken: reference }) }
-  } : undefined;
-};
-var stepLogin = (login, reference) => map8(credentialsIn(login.source), (credentials) => {
-  const held = credentials === undefined ? undefined : loginFormats[login.format].withoutRefresh(credentials);
-  if (held === undefined)
+var stepLogin = (login, reference) => map8(loginCredentials(login), (credentials) => {
+  if (credentials === undefined)
     return;
-  const referenced = reference === undefined || login.format !== "claude" ? undefined : referencedClaudeLogin(held, reference);
-  return referenced === undefined ? { content: encodeUnknownJsonStringSync(held) } : { content: encodeUnknownJsonStringSync(referenced.held), token: referenced.token };
+  const format = loginFormats[login.format];
+  if (reference === undefined) {
+    const held = format.withoutRefresh(credentials);
+    return held === undefined ? undefined : { content: encodeUnknownJsonStringSync(held), tokens: {} };
+  }
+  const held = format.byReference(credentials, login, reference);
+  return held === undefined ? undefined : { content: encodeUnknownJsonStringSync(held.held), tokens: held.tokens };
 });
-var renewableStepLogin = (binary, login, referenced) => gen(function* () {
+var renewableStepLogin = (login, referenced, http) => gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
   const directory = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-login-" });
   const file = path.join(directory, path.basename(login.source));
   const expired = new Map;
   let published;
-  let heldToken;
+  let heldTokens;
   const writing = makeUnsafe3(1);
   const refreshing = makeUnsafe3(1);
   const copy = gen(function* () {
     const copied = yield* stepLogin(login, referenced?.reference);
     if (copied === undefined)
       return;
-    if (copied.token !== undefined && copied.token !== heldToken && referenced !== undefined) {
-      yield* referenced.hold(copied.token);
-      heldToken = copied.token;
+    const tokens = encodeUnknownJsonStringSync(copied.tokens);
+    if (referenced !== undefined && tokens !== heldTokens) {
+      yield* referenced.hold(copied.tokens);
+      heldTokens = tokens;
     }
     if (copied.content === published)
       return;
@@ -2384,17 +2804,154 @@ var renewableStepLogin = (binary, login, referenced) => gen(function* () {
     yield* fs.rename(`${file}.next`, file);
     published = copied.content;
   }).pipe((saving) => writing.withPermit(saving));
-  const publish = (refresh) => refresh ? refreshing.withPermit(refreshOperatorLogin(binary, login, expired)).pipe(andThen2(copy)) : copy;
+  const publish = (refresh) => refresh ? refreshing.withPermit(refreshOperatorLogin(login, expired, http)).pipe(andThen2(copy)) : copy;
   return { directory, file, publish, isPublished: () => published !== undefined };
 });
+var loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+var keyDestination = (baseUrl, fallback) => {
+  if (!isString(baseUrl))
+    return { hosts: fallback };
+  const url = getOrUndefined(liftThrowable(() => new URL(baseUrl))());
+  if (url?.protocol === "https:")
+    return { hosts: [url.host] };
+  return { hosts: undefined, local: url?.protocol === "http:" && loopbackHosts.has(url.hostname) };
+};
+var readProviders = (source) => gen(function* () {
+  const fs = yield* FileSystem;
+  const text = yield* fs.readFileString(source).pipe(orElseSucceed(() => {
+    return;
+  }));
+  const config = text === undefined ? undefined : getOrUndefined(decodeJsonStringOption(text));
+  return { text, config: isJsonObject(config) ? config : undefined };
+});
+var objectEntries = (value) => isJsonObject(value) ? Object.entries(value) : [];
+var inheritedDestination = (destinations) => {
+  const hosts = [...new Set(destinations.flatMap(({ hosts }) => hosts ?? []))];
+  return hosts.length > 0 ? { hosts } : { hosts: undefined, local: destinations.some(({ local }) => local === true) };
+};
+var providerDestinations = (config, hosts) => objectEntries(config?.providers).flatMap(([name, provider]) => {
+  if (!isJsonObject(provider))
+    return [];
+  const destination = keyDestination(provider.baseUrl, hosts[name]);
+  const models = (Array.isArray(provider.models) ? provider.models : []).map((model) => isJsonObject(model) && isString(model.baseUrl) ? keyDestination(model.baseUrl, destination.hosts) : destination);
+  return [{ name, provider, destination, models, inherited: inheritedDestination([destination, ...models]) }];
+});
+var loginHostsWithProviders = (operatorFiles) => gen(function* () {
+  const { login, providers } = operatorFiles;
+  if (providers === undefined)
+    return login;
+  const { config } = yield* readProviders(providers.source);
+  const hosts = {
+    ...login.hosts,
+    ...Object.fromEntries(providerDestinations(config, providers.hosts).flatMap(({ name, inherited }) => inherited.hosts !== undefined ? [[name, inherited.hosts]] : inherited.local === true ? [[name, []]] : []))
+  };
+  return { ...login, hosts };
+});
+var carriedLoginHosts = (launch) => launch.renewedLogin?.format === "opencode" ? map8(loginCredentials(launch.renewedLogin), openCodeConsoleHosts) : succeed6([]);
+var carriedProviderHosts = (launch) => gen(function* () {
+  const providers = launch.operatorFiles?.providers;
+  if (providers === undefined)
+    return [];
+  const { config } = yield* readProviders(providers.source);
+  return [
+    ...new Set(providerDestinations(config, providers.hosts).flatMap(({ destination, models }) => [destination, ...models].flatMap(({ hosts }) => hosts ?? [])))
+  ];
+});
+var carriedProviders = (providers, referenced) => gen(function* () {
+  const { text, config } = yield* readProviders(providers.source);
+  if (text === undefined)
+    return [];
+  if (referenced === undefined)
+    return [{ path: providers.path, content: text }];
+  if (config === undefined || !isJsonObject(config.providers))
+    return [{ path: providers.path, content: "{}" }];
+  const tokens = {};
+  const placeholder = (field, value, destination) => {
+    if (!isString(value))
+      return value;
+    if (isPiCommand(value))
+      return;
+    const literal = piResolved(value);
+    if (literal === undefined)
+      return value;
+    if (destination.hosts === undefined && destination.local !== true)
+      return;
+    const reference = referenced.reference(`${providers.referenceName}-${Object.keys(tokens).length}-${field}`.replace(/[^A-Za-z0-9_.-]/g, "-"));
+    if (destination.hosts !== undefined)
+      tokens[reference] = { value: literal, hosts: destination.hosts };
+    return secretPlaceholder(literal, reference);
+  };
+  const heldEntry = (entry, field, destination) => {
+    const { apiKey, headers, ...rest } = entry;
+    const heldHeaders = isJsonObject(headers) ? Object.fromEntries(Object.entries(headers).flatMap(([header, value]) => {
+      const kept = placeholder(`${field}-header-${header}`, value, destination);
+      return kept === undefined ? [] : [[header, kept]];
+    })) : undefined;
+    const key = placeholder(`${field}-key`, apiKey, destination);
+    return {
+      ...rest,
+      ...key === undefined ? undefined : { apiKey: key },
+      ...heldHeaders === undefined ? undefined : { headers: heldHeaders }
+    };
+  };
+  const held = Object.fromEntries(providerDestinations(config, providers.hosts).map(({ name, provider, destination, models, inherited }) => {
+    const entry = heldEntry(provider, name, inherited);
+    const heldModels = Array.isArray(provider.models) ? provider.models.map((model, index) => isJsonObject(model) ? heldEntry(model, `${name}-model-${index}`, models[index] ?? destination) : model) : undefined;
+    const overrides = isJsonObject(provider.modelOverrides) ? Object.fromEntries(Object.entries(provider.modelOverrides).map(([id, override]) => [
+      id,
+      isJsonObject(override) ? heldEntry(override, `${name}-override-${id}`, destination) : override
+    ])) : undefined;
+    return [
+      name,
+      {
+        ...entry,
+        ...heldModels === undefined ? undefined : { models: heldModels },
+        ...overrides === undefined ? undefined : { modelOverrides: overrides }
+      }
+    ];
+  }));
+  yield* referenced.hold(tokens);
+  return [
+    { path: providers.path, content: encodeUnknownJsonStringSync(Object.assign({}, config, { providers: held })) }
+  ];
+});
+var withoutMcpServers = (config) => {
+  const { mcpServers: _servers, projects, ...rest } = config;
+  if (!isJsonObject(projects))
+    return projects === undefined ? rest : { ...rest, projects };
+  return {
+    ...rest,
+    projects: Object.fromEntries(Object.entries(projects).map(([directory, project]) => {
+      if (!isJsonObject(project))
+        return [directory, project];
+      const { mcpServers: _projectServers, ...kept } = project;
+      return [directory, kept];
+    }))
+  };
+};
+var carriedGlobalConfig = (config, referenced) => gen(function* () {
+  const operator = yield* credentialsIn(config.source);
+  if (operator === undefined)
+    return [];
+  const { [config.keyField]: key, ...rest } = withoutMcpServers(operator);
+  if (!isString(key) || referenced === undefined)
+    return [{ path: config.path, content: encodeUnknownJsonStringSync(rest) }];
+  const reference = referenced.reference(config.referenceName);
+  yield* referenced.hold({ [reference]: { value: key, hosts: config.hosts } });
+  return [
+    {
+      path: config.path,
+      content: encodeUnknownJsonStringSync({ ...rest, [config.keyField]: secretPlaceholder(key, reference) })
+    }
+  ];
+});
 var writeHarnessFiles = (input) => gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
   const unwritable = harnessConfigUnwritable();
   const carried = input.carryOperatorFiles ? input.launch.operatorFiles : undefined;
-  const carriesLogin = input.carryOperatorFiles;
-  const renewed = carriesLogin ? carried?.login ?? input.launch.renewedLogin : undefined;
-  const login = renewed === undefined ? undefined : yield* renewableStepLogin(input.launch.binary, renewed, input.loginReference).pipe(orDie);
+  const renewed = !input.carryOperatorFiles ? undefined : carried === undefined ? input.launch.renewedLogin : yield* loginHostsWithProviders(carried);
+  const login = renewed === undefined ? undefined : yield* renewableStepLogin(renewed, input.loginReference, input.loginHttp).pipe(orDie);
   if (login !== undefined)
     yield* login.publish(true).pipe(mapError2(() => unwritable));
   const settings = carried === undefined ? [] : [
@@ -2403,11 +2960,14 @@ var writeHarnessFiles = (input) => gen(function* () {
       content: encodeUnknownJsonStringSync(yield* carriedSettings(carried.settings.source, carried.settings.keys))
     }
   ];
-  const files = [...input.launch.files, ...settings];
-  const loginCopy = carriesLogin ? input.launch.loginCopy : undefined;
-  const copies = [...carried?.copies ?? [], ...loginCopy === undefined ? [] : [loginCopy]];
+  const providers = carried?.providers === undefined ? [] : yield* carriedProviders(carried.providers, input.loginReference).pipe(mapError2(() => unwritable));
+  const globalConfig = input.carryOperatorFiles ? input.launch.globalConfig : undefined;
+  const globalConfigFiles = globalConfig === undefined ? [] : yield* carriedGlobalConfig(globalConfig, input.loginReference).pipe(mapError2(() => unwritable));
+  const files = [...input.launch.files, ...settings, ...providers, ...globalConfigFiles];
+  const copies = carried?.copies ?? [];
   const links = renewed === undefined ? [] : [renewed];
-  if ([...files, ...copies, ...links].some((file) => !isPathWithin2(path, input.configDir, file.path)))
+  const globalConfigLinks = globalConfig?.links ?? [];
+  if ([...files, ...copies, ...links, ...globalConfigLinks].some((file) => !isPathWithin2(path, input.configDir, file.path)))
     return yield* unwritable;
   for (const file of files) {
     const { path } = file;
@@ -2417,14 +2977,17 @@ var writeHarnessFiles = (input) => gen(function* () {
     if (yield* fs.exists(copy.source).pipe(orElseSucceed(() => false)))
       yield* fs.makeDirectory(path.dirname(copy.path), { recursive: true }).pipe(andThen2(fs.copyFile(copy.source, copy.path)), mapError2(() => unwritable));
   }
+  for (const link of globalConfigLinks)
+    yield* fs.makeDirectory(link.target, { recursive: true }).pipe(andThen2(fs.makeDirectory(path.dirname(link.path), { recursive: true })), andThen2(fs.symlink(link.target, link.path)), mapError2(() => unwritable));
   if (input.carryOperatorFiles && input.launch.homeDirectory !== undefined)
     yield* fs.makeDirectory(input.launch.homeDirectory, { recursive: true }).pipe(mapError2(() => unwritable));
   if (renewed === undefined || login === undefined || !login.isPublished())
     return;
-  yield* fs.symlink(renewed.linksDirectory === true ? login.directory : login.file, renewed.path).pipe(mapError2(() => unwritable));
+  yield* fs.makeDirectory(path.dirname(renewed.path), { recursive: true }).pipe(andThen2(fs.symlink(renewed.linksDirectory === true ? login.directory : login.file, renewed.path)), mapError2(() => unwritable));
   const every = (millis, refresh) => forkScoped(forever(sleep(millis).pipe(andThen2(login.publish(refresh)), catch_((error) => logWarning("harness_login_not_renewed", error)))));
   yield* every(loginRenewalMillis, true);
-  yield* every(loginCopyMillis, false);
+  if (renewed.format !== "opencode")
+    yield* every(loginCopyMillis, false);
   const watching = makeUnsafe5();
   yield* forkScoped(fs.watch(path.dirname(renewed.source), { onReady: () => doneUnsafe(watching, void_3) }).pipe(filter((event) => path.basename(event.path) === path.basename(renewed.source)), runForEach(() => login.publish(false)), catch_((error) => logWarning("harness_login_not_watched", error)), ensuring2(succeed4(watching, undefined))));
   yield* _await(watching);
@@ -3067,8 +3630,7 @@ var transcriptSource = (adapter, place) => gen(function* () {
 class SecretRegistryUnwritable extends TaggedError("SecretRegistryUnwritable") {
 }
 var runnerSecretOwner = "runner";
-var claudeLoginReference = secretReference(runnerSecretOwner, "claude-code-login");
-var holdsLoginByReference = (launch) => launch.renewedLogin?.format === "claude";
+var carriesLogin = (launch) => [launch.renewedLogin, launch.operatorFiles?.login, launch.operatorFiles?.providers, launch.globalConfig].some((file) => file !== undefined);
 var stepSecretDirectory = (home, attemptId) => `${home}/.cache/kitman/step-secrets/${attemptId}`;
 var requireSecretHosts = (secrets, destinations) => {
   const unbound = Object.keys(secrets ?? {}).filter((name) => (destinations?.[name]?.hosts.length ?? 0) === 0);
@@ -3317,7 +3879,12 @@ var runAttempt = (request, options) => gen(function* () {
     workspace,
     configDir,
     environment: { ...agent.secrets, ...launch.env, ...mcp.env },
-    hosts: kitMcpHosts(kitSetup)
+    hosts: [
+      ...kitMcpHosts(kitSetup),
+      ...yield* carriedProviderHosts(launch),
+      ...yield* carriedLoginHosts(launch)
+    ],
+    launch
   });
   const harnessArgv = [launch.binary, ...launch.args];
   const sandboxed = gen(function* () {
@@ -3338,7 +3905,7 @@ var runAttempt = (request, options) => gen(function* () {
             { value, hosts: providerKeyHosts.get(name) ?? [] }
           ]))
         };
-        const holdsLogin = holdsLoginByReference(launch);
+        const holdsLogin = carriesLogin(launch);
         const registry = Object.keys(initial).length === 0 && !holdsLogin ? undefined : yield* holdSecrets(initial);
         const withSessions = sessions === undefined ? policy : {
           ...policy,
@@ -3422,15 +3989,17 @@ var runAttempt = (request, options) => gen(function* () {
     launch,
     configDir,
     carryOperatorFiles: request.sandbox.backend !== "docker",
-    ...registry === undefined || !holdsLoginByReference(launch) ? undefined : {
+    ...registry === undefined ? undefined : {
       loginReference: {
-        reference: claudeLoginReference,
-        hold: (token) => registry.hold(claudeLoginReference, { value: token, hosts: adapter.providerHosts })
+        reference: (name) => secretReference(runnerSecretOwner, name),
+        hold: (tokens) => forEach(Object.entries(tokens), ([reference, entry]) => registry.hold(reference, entry), {
+          discard: true
+        })
       }
     }
   }), registry === undefined ? void_3 : watchSecretRegistry(registry, request, options.secretRevocationMs))));
   if (adapter.id === "claude" && request.sandbox.backend !== "docker")
-    yield* trustClaudeWorkspace(options.home, workspace).pipe(catch_((error) => logWarning("claude_trust_failed", error)));
+    yield* trustClaudeWorkspace(launch.globalConfig === undefined ? options.home : (yield* Path).dirname(launch.globalConfig.path), workspace).pipe(catch_((error) => logWarning("claude_trust_failed", error)));
   if (isFailure(command))
     return failed(command.failure.reason, command.failure.summary);
   const call = requester(options.core, yield* scope2);
@@ -3802,7 +4371,7 @@ var catchUpReport = (worktree, input) => gen(function* () {
   const settled = input.automerged === undefined ? [] : (yield* names(input.automerged, input.merged)).filter((path) => !input.conflicted.includes(path));
   const rewritten = [...new Set([...settled, ...yield* names(input.merged, input.head)])].sort();
   const paths = [...new Set([...yield* names(before, input.from), ...yield* names(after, input.head)])].sort();
-  const changed = yield* filter2(paths.slice(0, catchUpPathLimit), (path) => map8(all3([ownDiff(before, input.from, path), ownDiff(after, input.head, path)]), ([was, is]) => was !== is), { concurrency: 8 });
+  const changed = yield* filter3(paths.slice(0, catchUpPathLimit), (path) => map8(all3([ownDiff(before, input.from, path), ownDiff(after, input.head, path)]), ([was, is]) => was !== is), { concurrency: 8 });
   const lists = [input.conflicted, rewritten, paths];
   return {
     from: input.from,
@@ -5419,7 +5988,7 @@ var agentStepSandboxPolicy = (work, apiUrl, runner) => ({
   network: agentNetworkAllowlist({
     apiUrl,
     storageOrigin: work.storageOrigin,
-    providerHosts: harnessAdapter(work.brief.harness)?.providerHosts ?? [],
+    providerHosts: harnessNetworkHosts(harnessAdapter(work.brief.harness)),
     ...work.repoBinding === undefined ? undefined : { repoBindingHost: work.repoBinding.host },
     ...work.network === undefined ? undefined : { agent: work.network },
     ...work.hosts === undefined ? undefined : { allowed: work.hosts }
@@ -6465,7 +7034,7 @@ var regularFiles = (dir) => gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
   const real = yield* fs.realPath(dir);
-  return yield* filter2((yield* fs.readDirectory(dir)).sort(), (name) => gen(function* () {
+  return yield* filter3((yield* fs.readDirectory(dir)).sort(), (name) => gen(function* () {
     const entry = path.join(real, name);
     return (yield* fs.realPath(entry)) === entry && (yield* fs.stat(entry)).type === "File";
   }).pipe(orElseSucceed(() => false)));
@@ -6938,6 +7507,8 @@ export {
   applyAgentEnvironmentMaterialization2 as applyAgentEnvironmentMaterialization,
   applyAgentEnvironmentPlans,
   assertHerdrRunnerCapability2 as assertHerdrRunnerCapability,
+  carriedLoginHosts,
+  carriedProviderHosts,
   checkDockerAlias,
   checkDockerClientConfig,
   checkDockerDaemonArgs,
@@ -6971,6 +7542,7 @@ export {
   halfCloseListener,
   harnessAdapter,
   harnessConfigUnwritable,
+  harnessNetworkHosts,
   harnessesInSrt,
   harnessesUnsupportedInSrt2 as harnessesUnsupportedInSrt,
   herdrAttemptLeased,