@kodax-ai/kodax 0.7.70 → 0.7.71

package/CHANGELOG.md

@@ -6,6 +6,140 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.7.71] - 2026-07-17
+
+### Added
+
+- **Kimi Code K3 support.** The `kimi-code` subscription provider now exposes
+  `k3-256k` (Moderato) and `k3` (1,048,576 context tokens, Allegretto+) as
+  explicit catalog choices, alongside `kimi-for-coding-highspeed` and the
+  stable `kimi-for-coding` default. Both K3 choices send the upstream model id
+  `k3`, so users do not need to override compaction settings for their plan.
+  K3 sends its effort inside `thinking.effort` on both Anthropic- and
+  OpenAI-compatible transports, defaults omitted reasoning to `max`, and
+  preserves both legacy `reasoning=false` and explicit `effort=none` as disabled
+  thinking. Static capability, reasoning, media, cost-tracking, and opt-in
+  real-wire regressions cover the subscription routes and local context-tier
+  mapping.
+- **Standards-based A2A authentication and Agent activation (FEATURE_267/268
+  closure).** Outbound A2A entries can use OAuth 2.0 Client Credentials with an
+  external Authorization Server, while inbound KodaX Agents can validate RFC
+  9068 JWT access tokens against an external issuer/JWKS as an OAuth Resource
+  Server. The fixed environment Bearer profile remains available for
+  compatibility. A hot `agents.<name>.enabled` switch plus `kodax a2a
+  enable|disable` lets operators keep many configured third-party Agents while
+  controlling which ones admit new orchestration; in-flight tasks are not
+  cancelled.
+
+### Changed
+
+- **External Agent SDK migration notes.** `AgentRegistrationService` now
+  requires `setEnabled`; custom implementations must add the same
+  revision/owner-conditional enablement operation. `executorConfig` and
+  executor-reference `metadata` are `AgentJsonObject` values and reject class
+  instances, accessors, circular references, and other non-JSON-safe data at
+  runtime. SDK daemon auto-start without an explicit `homeDir` now follows the
+  resolved `KODAX_HOME`; embedders that intentionally need the OS-home endpoint
+  must pass `homeDir`, while custom endpoints remain attach-only.
+
+### Fixed
+
+- **A2A durable-owner upgrade and admission concurrency.** New inbound tasks
+  persist a non-secret principal-key scheme marker. Pre-realm tasks remain
+  inaccessible during normal serving, but stopped operators can use
+  `kodax a2a migrate-tasks` to dry-run and explicitly apply the configured
+  owner mapping; custom hosts can use the public
+  `migrateA2ALegacyTaskOwners()` SDK with exact mappings. Ambiguous or live-
+  store migration fails closed. Global task capacity now uses a synchronous
+  pending reservation, keeping slow workspace/session/run preparation outside
+  any global lock while preserving exact limits and per-principal ordering.
+- **Bounded External Agent and daemon shutdown/startup.** Executor-plane close
+  now has a 30-second default upper bound (overrideable with `closeTimeoutMs`),
+  obsolete-executor cleanup runs outside the serialized registration mutation
+  lane, and revision tombstones are SHA-256 fingerprints capped at 4,096
+  entries. Current registrations and task snapshots continue to enforce exact
+  revision immutability after older, unreferenced tombstones age out. Daemon
+  auto-start now races health checks against the spawned child's exit, keeps
+  the child referenced until readiness, and terminates it on early exit,
+  timeout, identity mismatch, or when another daemon wins ownership. A startup
+  candidate that exits after losing the owner race now lets its SDK caller wait
+  for and attach to the competing owner instead of failing that caller.
+- **Faster packaged-Electron gates.** Release jobs build once and reuse that
+  output for both the Windows Electron smoke and binary packaging. CI and
+  release jobs cache the version-pinned Electron smoke toolchain, whose local
+  directory is now explicitly ignored. Both paths explicitly materialize the
+  Electron binary after cache restore or dependency installation, preventing a
+  successful npm package install with a missing `electron/dist` from bypassing
+  the real packaged-daemon gate.
+- **A2A authentication and reconciliation hardening.** Card-level and
+  Skill-level security requirements now fail closed unless one complete
+  alternative is satisfiable. Card, RPC, and token origins remain separate;
+  exact credentials used by active RPC/SSE requests remain retained through
+  response parsing and are redacted from errors and successful results;
+  concurrent rejected-token invalidation cannot discard a newer token and each
+  RPC retries at most once. Direct SDK and file configuration now share strict
+  issuer, endpoint, resource, and RFC 6749 scope validation. Task ownership
+  also requires a stable `securityRealm` and hashes the
+  `(realm, subject, tenant)` tuple: built-in Bearer/OAuth derive realms from the
+  token-env name/exact issuer, custom authentication must provide one, authority
+  switches and legacy pre-realm tasks fail closed, and same-realm restart
+  preserves new-format tasks. Authentication/effect changes participate in
+  executor revisions; registration persistence
+  precedes catalog mutation; first-class management ownership plus revision-
+  conditional mutations protects unrelated or concurrently replaced SDK
+  registrations, including same-revision owner takeovers; changed authority is
+  fenced before parallel discovery; live drift is repaired; and a final
+  post-preflight admission check closes disable/removal races without
+  rediscovering unchanged peers. Internal immutable route snapshots preserve
+  admitted task input/cancel/reconcile routing across registration update or
+  removal and Runtime restart without exposing secret material or expanding the
+  public task DTO. Admission now rechecks globally unique task IDs, task writes
+  publish to memory only after durable persistence, and terminal event-write
+  failures cannot strand waiters or route snapshots. Returned registration
+  summaries are detached, executor cache keys are unambiguous tuples, and one
+  ownership conflict or observer failure cannot abort unrelated Agent
+  reconciliation or leave unawaited activation work. Daemon A2A ownership is
+  now bound to the exact resolved config home—`<homeDir>/.kodax` when explicitly
+  selected, otherwise the possibly arbitrary `KODAX_HOME`—recorded in daemon
+  state, and checked across every local profile before mutation. Legacy
+  non-empty version-1 A2A files require an explicit stopped-owner migration,
+  while version-2 migration is a read-only idempotent no-op. Failed initial A2A
+  reconciliation also closes the newly created Runtime before releasing daemon
+  ownership.
+- **A2A post-closure lifecycle and resource correctness.** Executor operations
+  and close now drain without disposal races; configured artifact references
+  and direct `a2a call` use a bounded reference-only/no-fetch policy. CLI task
+  RPC/SSE permits 32 MiB while Card/interface/OAuth/security metadata remains
+  capped at 2 MiB, and unsupported required Card extensions fail discovery.
+  Daemon mutation now requires independently owner-derived
+  `externalAgentAdmin: 1` and `a2aConfigReconciler: 1`; capability overrides
+  cannot forge them. Public `/a2a` config exports are read-only, with raw writers
+  retained inside the fenced CLI owner. Inbound serving now has a global
+  admission reservation, subscribe-first replay, authentication-before-body,
+  exact JSON/SSE media matching, an admitted-handler close barrier, and fixed
+  four-per-task/eight-per-server/24 MiB-per-stream SSE ceilings without
+  terminating the underlying task for one slow subscriber.
+- **Public Kimi Open Platform parity and live coverage.** `kimi` now defaults to
+  `kimi-k2.7-code`, exposes the HighSpeed route and wire-legal K2.5 id, uses the
+  exact 262,144-token limits and current prices, and has gated real-key coverage
+  for credential verification, K2.7 thinking, forced-tool fallback, and K2.6
+  thinking disablement. K2.7 disable requests now fail locally instead of being
+  silently ignored, while K2.6 disable requests emit the required wire toggle.
+
+- **Packaged Electron shared-daemon auto-start.** Runtime SDK embedders running
+  from packaged/asar Electron applications now launch the detached daemon child
+  through a bootstrap-only Node execution boundary without changing the host or
+  long-lived daemon environment, leaking `ELECTRON_RUN_AS_NODE` to user child
+  processes, or opening a second GUI instance. Trusted internal JavaScript
+  children retain a bounded Electron-to-Node launch path. Missing packaged CLI
+  sidecars fail immediately, disabled `RunAsNode` fuses receive an actionable
+  timeout diagnostic, and a real Windows Electron 42.5.0 + asar smoke now gates
+  CI and releases. Public docs also distinguish CLI-style `homeDir` from the
+  lower-level `.kodax` path used by `KODAX_HOME`.
+- **Cross-platform release template checks.** Generated configuration templates
+  now compare normalized line endings, so Windows CRLF checkouts no longer report
+  false drift during binary builds.
+
 ## [0.7.70] - 2026-07-15
 
 ### Added

package/README.md

@@ -347,14 +347,21 @@ temporary environment override. The same rule applies to other paired settings,
 for example `provider` ↔ `KODAX_PROVIDER` and `effort` ↔ `KODAX_EFFORT`.
 JSON names stay camelCase while environment names use `KODAX_UPPER_SNAKE_CASE`.
 
-By default, daemon state, config, and runtime session storage are scoped under
-the OS user home directory, so `kodax --runtime-mode daemon` and SDK clients
-using `createKodaXRuntime({ mode: 'daemon' })` converge on the same local daemon
-profile. The high-level `createKodaXRuntime({ mode: 'daemon' })` API starts or
+By default, daemon state, config, and runtime session storage use the exact
+resolved `KODAX_HOME` (normally `<OS user home>/.kodax`), so CLI and SDK clients
+converge on the same local daemon even when `KODAX_HOME` is an arbitrary custom
+directory. The high-level `createKodaXRuntime({ mode: 'daemon' })` API starts or
 reuses that daemon unless you pass an explicit endpoint/transport or
-`autoStartDaemon: false`. Pass `--home <dir>` or `homeDir` only when you
-intentionally want an isolated daemon namespace for tests, CI, or project-local
-experiments.
+`autoStartDaemon: false`. An explicit `--home <dir>` or `homeDir` selects the
+isolated `<dir>/.kodax` namespace for tests, CI, or project-local experiments.
+
+**v0.7.71 packaged Electron patch:** packaged/asar Electron hosts can use daemon
+auto-start without relaunching the GUI. `ELECTRON_RUN_AS_NODE` is limited to a
+bootstrap-only child exec boundary and removed before daemon or ordinary user
+child code loads. The default-enabled Electron `RunAsNode` fuse is required;
+hosts that disable it must start the daemon through ordinary Node/KodaX CLI and
+connect in attach-only mode. For SDK calls, `homeDir` is the CLI-style base
+directory that owns `.kodax`, not the `.kodax` path itself.
 
 One daemon owns many sessions. Different sessions may run concurrently; starts
 within the same session are queued so that only one run is active for that
@@ -509,18 +516,28 @@ KodaX has two layers that consumers should understand separately:
 
 **Experimental Memory Agent SDK (FEATURE_260, v0.7.68)**: `/experimental-memory` exposes the thin agent-layer `MemoryAgent` and scoped `MemorySession` lifecycle over the existing governed F228 plane. Passive recall is zero-wait; `query()` is read-only and deliberate; durable changes still require the proposal/preview/fingerprint/apply path. The Action LLM remains the final decision maker, recalled content stays low-authority, and safety/scope gates remain deterministic. See the [direct session and boundary guide](docs/SDK_EMBEDDER_GUIDE.md#21-experimental-governed-memory--experimental-memory-feature_260-v0768).
 
-**Bidirectional A2A 1.0 (FEATURE_267, v0.7.69)**: `/a2a` discovers allowed Agent Cards and installs a JSON-RPC/SSE executor through the existing F258 plane. Configured outbound Agents are also registered automatically as `external:<name>` in embedded CLI and user-daemon Runtimes, so the main Agent can orchestrate them without host code. The same module can publish the Runtime default or one validated `~/.kodax/agents/*.md` Agent behind an authenticated Runtime facade. The built-in listener is loopback-only; public deployment uses `handle()` behind host-owned TLS and authorization. A2A 0.3, gRPC, HTTP+JSON, push notifications, and automatic public exposure are not advertised. See the [client/server recipes and security boundaries](docs/SDK_EMBEDDER_GUIDE.md#22-bidirectional-a2a-10--a2a-feature_267-v0769).
-
-**v0.7.70 interoperability hardening** keeps a discovered A2A interface on the
-trusted Agent Card origin and sends a credential only when the Card advertises
-Bearer authentication. `a2a serve` now resolves its provider from CLI, then
-environment, config, and the built-in default; a Markdown Agent can pin its own
-provider. Input continuation resumes the original Runtime run, task history and
-retention are bounded with stable cursor pagination, and authenticated SSE is
-correlated before falling back to polling after an early normal EOF. Only
-direct remote artifacts, broker-staged outputs, and outputs from a successfully
-admitted Skill script can be published; ordinary workspace writes and local
-paths stay private.
+**Bidirectional A2A 1.0 (FEATURE_267, v0.7.69)**: `/a2a` discovers allowed Agent Cards and installs a JSON-RPC/SSE executor through the existing F258 plane. Configured outbound Agents are also registered automatically as `external:<name>` in embedded CLI and user-daemon Runtimes, so the main Agent can orchestrate them without host code. One `a2a.json` may hold many outbound registrations and at most one inbound server, which publishes either the Runtime default or one validated `~/.kodax/agents/*.md` Agent behind an authenticated Runtime facade. The built-in listener is loopback-only; public deployment uses `handle()` behind host-owned TLS and authorization. A2A 0.3, gRPC, HTTP+JSON, push notifications, and automatic public exposure are not advertised. See the [client/server recipes and security boundaries](docs/SDK_EMBEDDER_GUIDE.md#22-bidirectional-a2a-10--a2a-feature_267-v0769).
+
+**A2A interoperability and authentication hardening** keeps a discovered
+interface on the trusted Agent Card origin and sends credentials only when one
+complete Card/Skill security requirement is satisfiable. The no-code client
+supports HTTP Bearer compatibility and OAuth 2.0 Client Credentials; for OAuth,
+an external Authorization Server issues short-lived access tokens and KodaX
+caches them only in memory. Inbound `a2a serve` can validate RFC 9068 JWT access
+tokens from an external issuer/JWKS, but never signs or issues production
+tokens itself. It resolves its provider from CLI, then environment, config, and
+the built-in default; a Markdown Agent can pin its own provider. Input
+continuation resumes the original Runtime run, task history and retention are
+bounded with stable cursor pagination, and authenticated SSE is correlated
+before falling back to polling after an early normal EOF. Only direct remote
+artifacts, broker-staged outputs, and outputs from a successfully admitted
+Skill script can be published; ordinary workspace writes and local paths stay
+private.
+
+This authentication and per-Agent activation hardening is a post-release
+closure of the v0.7.69 F267/F268 design and ships in the v0.7.71 patch; it is
+not a claim that older v0.7.69 binaries contained the
+later OAuth profiles.
 
 **v0.7.70 MCP discovery hardening** uses exact capability IDs and revisioned
 cursors while admitting results against real physical capacity. Compact CJK
@@ -537,8 +554,23 @@ kodax a2a add research https://agent.example/.well-known/agent-card.json --effec
 kodax a2a test research
 kodax a2a call research "Summarize this topic"
 
+# Stage an OAuth-protected Agent, then hot-activate/deactivate it
+export RESEARCH_A2A_CLIENT_SECRET='provisioned-by-your-authorization-server'
+# PowerShell: $env:RESEARCH_A2A_CLIENT_SECRET='provisioned-by-your-authorization-server'
+# PowerShell: run the command on one line or replace each trailing \ with a backtick.
+kodax a2a add reviewer https://reviewer.example/.well-known/agent-card.json \
+  --disabled --effect read --oauth-scheme enterprise-oauth \
+  --oauth-issuer https://identity.example/ \
+  --oauth-token-url https://identity.example/oauth/token \
+  --oauth-client-id kodax-reviewer \
+  --oauth-client-secret-env RESEARCH_A2A_CLIENT_SECRET \
+  --oauth-scope a2a.invoke --oauth-resource https://reviewer.example/
+kodax a2a enable reviewer
+kodax a2a disable reviewer       # blocks new dispatch; does not cancel in-flight tasks
+
 # Expose the Runtime default Agent, or pass a name from ~/.kodax/agents/*.md
 export KODAX_A2A_TOKEN='replace-with-a-long-random-token'
+# PowerShell: $env:KODAX_A2A_TOKEN='replace-with-a-long-random-token'
 kodax a2a expose                 # or: kodax a2a expose document-agent
 kodax a2a serve                  # loopback http://127.0.0.1:8765
 ```
@@ -554,12 +586,30 @@ can stage legacy entries. Remove legacy keys only with
 literal-secret warnings. Running
 CLI/daemon hosts retain the
 last valid revision, atomically replace the complete MCP provider, reconcile
-Extensions per entry, and hot-register outbound A2A Agents. `a2a serve` loads
+Extensions per entry, and hot-register outbound A2A Agents. Each A2A entry has
+a desired `enabled` switch; `kodax a2a list` shows configuration, while the
+owning Runtime is authoritative for live applied registrations. Disabled
+entries are not fetched during automatic reconciliation and, after the owning
+Runtime applies the revision, cannot accept new dispatch. The mutation command
+itself is not cross-process acknowledgement. `a2a add --disabled` still checks
+the Card by default unless `--no-test` is supplied, while `a2a test` performs
+discovery/security planning without requesting an OAuth token. The fixed
+`KODAX_A2A_TOKEN` example is an operator-provisioned compatibility credential;
+KodaX does not generate or issue it. Disabled entries remain available for
+later re-enable. `a2a serve` loads
 its configured MCP/Extension capability surface before listening and pins that
 execution authority; it hot-reloads publication, authentication, and limits.
+
+A2A configuration migration and retained task ownership are separate. If a
+v0.7.70 task store must remain addressable after the realm-aware upgrade, stop
+the A2A server, run `kodax a2a migrate-tasks` to inspect the exact-owner plan,
+then apply it with `--apply --confirm-server-stopped`. OAuth migration also
+requires the known historical `--subject`; normal serving never guesses or
+dual-reads a legacy owner key.
+
 Agent, Skill, Extension-tool authority, workspace, tool-policy, or task-store
 changes require an explicit server restart. Managed
-A2A contexts default to `~/kodax_a2a_server_workspace/<profile>/contexts/`.
+A2A contexts default to `~/kodax_a2a_server_workspace/<runtime-profile>/contexts/`.
 Exact Skill scripts require the opt-in isolated policy and a passing
 `kodax sandbox doctor` (`kodax sandbox setup` performs the explicit Windows
 one-time provisioning).
@@ -1161,8 +1211,8 @@ await runInkInteractiveMode({ provider: 'zhipu-coding', effort: 'auto' });
 |----------|----------------------|-------------------|---------------|
 | anthropic | `ANTHROPIC_API_KEY` | Native | claude-sonnet-4-6 (`claude-opus-4-6` / `claude-haiku-4-5` via `/model`) |
 | openai | `OPENAI_API_KEY` | Native | gpt-5.3-codex (`gpt-5.4` / `gpt-5.3-codex-spark` via `/model`) |
-| kimi | `KIMI_API_KEY` | Native | kimi-k2.6 (`kimi-k2.7-code` 256K / `k2.5` via `/model`) |
-| kimi-code | `KIMI_CODE_API_KEY` | Native | kimi-for-coding |
+| kimi | `KIMI_API_KEY` | Native | kimi-k2.7-code (262,144-token context; `kimi-k2.7-code-highspeed` / `kimi-k2.6` / `kimi-k2.5` via `/model`) |
+| kimi-code | `KIMI_CODE_API_KEY` | Native | kimi-for-coding (`k3-256k` for Moderato / `k3` 1M for Allegretto+ / `kimi-for-coding-highspeed` via `/model`; both K3 choices use upstream `k3`) |
 | qwen | `QWEN_API_KEY` | Native | qwen3.5-plus |
 | zhipu | `ZHIPU_API_KEY` | Native | glm-5 (`glm-5.2` 1M ctx / `glm-5.1` / `glm-5-turbo` via `/model`) |
 | zhipu-coding | `ZHIPU_CODING_API_KEY` | Native | glm-5 (`glm-5.2` 1M ctx / `glm-5.1` / `glm-5-turbo` via `/model`) |

package/README_CN.md

@@ -81,6 +81,13 @@ data/session root 下的 inline Runtime，不参与 Coder owner fence。capabili
 fail closed，不能静默退回 inline Coder。完整接入说明见
 [SDK Embedder Guide §23](docs/SDK_EMBEDDER_GUIDE.md#23-shared-coder-daemon-for-space-and-ide-hosts-feature_269-v0769)。
 
+**v0.7.71 Electron 打包修复**：packaged/asar Electron 宿主可以直接自动启动
+daemon，不会再次打开 GUI。`ELECTRON_RUN_AS_NODE` 只存在于子进程启动边界，
+在 daemon 与普通用户子进程代码加载前即被移除。该路径要求 Electron 默认开启的
+`RunAsNode` fuse；主动关闭该 fuse 的宿主必须通过普通 Node/KodaX CLI 启动 daemon，
+再使用 attach-only 模式连接。SDK 的 `homeDir` 是拥有 `.kodax` 的 CLI 风格基础目录，
+不是 `.kodax` 目录本身。
+
 ## 为什么用 KodaX
 
 <table>
@@ -455,8 +462,8 @@ dist/binary/linux-x64/
 |----------|----------|-----------|-----------|
 | anthropic | `ANTHROPIC_API_KEY` | Native | claude-sonnet-4-6（可 `/model` 切换 `claude-opus-4-6` / `claude-haiku-4-5`） |
 | openai | `OPENAI_API_KEY` | Native | gpt-5.3-codex（可 `/model` 切换 `gpt-5.4` / `gpt-5.3-codex-spark`） |
-| kimi | `KIMI_API_KEY` | Native | kimi-k2.6（可 `/model` 切换 `kimi-k2.7-code` 256K / `k2.5`） |
-| kimi-code | `KIMI_CODE_API_KEY` | Native | kimi-for-coding |
+| kimi | `KIMI_API_KEY` | Native | kimi-k2.7-code（262,144 token；可 `/model` 切换 `kimi-k2.7-code-highspeed` / `kimi-k2.6` / `kimi-k2.5`） |
+| kimi-code | `KIMI_CODE_API_KEY` | Native | kimi-for-coding（可 `/model` 切换 `k3-256k`〔Moderato，256K〕/ `k3`〔Allegretto+，1M〕/ `kimi-for-coding-highspeed`；两个 K3 选项均请求上游 `k3`） |
 | qwen | `QWEN_API_KEY` | Native | qwen3.5-plus |
 | zhipu | `ZHIPU_API_KEY` | Native | glm-5（可 `/model` 切换 `glm-5.2` 1M ctx / `glm-5.1` / `glm-5-turbo`） |
 | zhipu-coding | `ZHIPU_CODING_API_KEY` | Native | glm-5（GLM Coding Plan；可 `/model` 切换 `glm-5.2` 1M ctx / `glm-5.1` / `glm-5-turbo`） |
@@ -590,15 +597,21 @@ KodaX 有两层结构，SDK 用户需要分开理解：
 
 **实验性 Memory Agent SDK（FEATURE_260，v0.7.68）**：`/experimental-memory` 暴露基于既有 F228 治理平面的薄 `MemoryAgent` 与 scoped `MemorySession`。被动 recall 零等待，`query()` 只读且由主 Action LLM 主动选择；持久化仍必须经过 proposal/preview/fingerprint/apply。召回内容保持低权限，安全与 scope 边界仍由确定性代码门禁承担。直接 session 示例与宿主边界见 [SDK Embedder Guide §21](docs/SDK_EMBEDDER_GUIDE.md#21-experimental-governed-memory--experimental-memory-feature_260-v0768)。
 
-**双向 A2A 1.0（FEATURE_267，v0.7.69）**：`/a2a` 可发现 allowlist 内的 Agent Card，并通过既有 F258 plane 安装 JSON-RPC/SSE executor。配置中的出站 Agent 还会作为 `external:<name>` 自动注册到 embedded CLI 与用户 daemon Runtime，因此主 Agent 无需宿主代码即可编排。入站方向可以发布 Runtime 默认 Agent，或发布一个经过验证的 `~/.kodax/agents/*.md` Agent。内置 listener 仅允许 loopback；公网部署必须由宿主用 TLS、鉴权和授权包住 `handle()`。不宣称支持 A2A 0.3、gRPC、HTTP+JSON、push notification，也不会自动把本地 Agent 暴露到网络。详见 [SDK Embedder Guide §22](docs/SDK_EMBEDDER_GUIDE.md#22-bidirectional-a2a-10--a2a-feature_267-v0769)。
+**双向 A2A 1.0（FEATURE_267，v0.7.69）**：`/a2a` 可发现 allowlist 内的 Agent Card，并通过既有 F258 plane 安装 JSON-RPC/SSE executor。配置中的出站 Agent 还会作为 `external:<name>` 自动注册到 embedded CLI 与用户 daemon Runtime，因此主 Agent 无需宿主代码即可编排。一个 `a2a.json` 可保存多个出站注册，但最多只有一个入站 server；入站可发布 Runtime 默认 Agent，或发布一个经过验证的 `~/.kodax/agents/*.md` Agent。内置 listener 仅允许 loopback；公网部署必须由宿主用 TLS、鉴权和授权包住 `handle()`。不宣称支持 A2A 0.3、gRPC、HTTP+JSON、push notification，也不会自动把本地 Agent 暴露到网络。详见 [SDK Embedder Guide §22](docs/SDK_EMBEDDER_GUIDE.md#22-bidirectional-a2a-10--a2a-feature_267-v0769)。
+
+**A2A 互操作与认证加固**：发现得到的 interface 必须与受信 Agent Card 同源，且只有
+完整满足 Card/Skill 的一个 security requirement 时才会携带凭据。无代码 client
+支持 HTTP Bearer 兼容模式与 OAuth 2.0 Client Credentials；OAuth 的短期 access
+token 由外部 Authorization Server 签发，KodaX 只在进程内缓存。入站 `a2a serve`
+可以按外部 issuer/JWKS 校验 RFC 9068 JWT access token，但不会自行签发生产 token。
+服务按 CLI、环境变量、配置、内置默认值的顺序解析 provider，Markdown Agent 也可
+固定自己的 provider。补充输入会继续原 Runtime run；任务历史、保留策略与稳定
+cursor 分页均有边界；带鉴权的 SSE 会先校验关联信息，流在正常终止但未给出终态时
+回退 polling。仅远端直接 artifact、输出 broker 暂存结果，以及成功授权执行的 Skill
+脚本输出可以发布；普通工作区写入与本地路径不会暴露。
 
-**v0.7.70 互操作加固**：发现得到的 A2A interface 必须与受信 Agent Card
-同源，且只有 Card 宣告 Bearer 鉴权时才会携带凭据。`a2a serve` 按 CLI、环境变量、
-配置、内置默认值的顺序解析 provider，Markdown Agent 也可固定自己的 provider。
-补充输入会继续原 Runtime run；任务历史、保留策略与稳定 cursor 分页均有边界；
-带鉴权的 SSE 会先校验关联信息，流在正常终止但未给出终态时回退 polling。
-仅远端直接 artifact、输出 broker 暂存结果，以及成功授权执行的 Skill 脚本输出
-可以发布；普通工作区写入与本地路径不会暴露。
+这里的认证与逐 Agent 激活加固，是对 v0.7.69 F267/F268 设计的发布后补全，
+随 v0.7.71 补丁交付；并不表示早期 v0.7.69 二进制已经包含后续 OAuth profile。
 
 **v0.7.70 MCP 发现加固**：能力使用精确 ID 和带 revision 的 cursor，结果按真实物理
 容量准入。紧凑 CJK 查询会分词；跨语言 lexical 零匹配只会返回容量内的无损分组
@@ -613,8 +626,23 @@ kodax a2a add research https://agent.example/.well-known/agent-card.json --effec
 kodax a2a test research
 kodax a2a call research "总结这个主题"
 
+# 先保存受 OAuth 保护的 Agent，再热启用/停用
+export RESEARCH_A2A_CLIENT_SECRET='由你的授权服务器分配'
+# PowerShell：$env:RESEARCH_A2A_CLIENT_SECRET='由你的授权服务器分配'
+# PowerShell：将命令写成一行，或把每个行尾反斜杠替换为反引号。
+kodax a2a add reviewer https://reviewer.example/.well-known/agent-card.json \
+  --disabled --effect read --oauth-scheme enterprise-oauth \
+  --oauth-issuer https://identity.example/ \
+  --oauth-token-url https://identity.example/oauth/token \
+  --oauth-client-id kodax-reviewer \
+  --oauth-client-secret-env RESEARCH_A2A_CLIENT_SECRET \
+  --oauth-scope a2a.invoke --oauth-resource https://reviewer.example/
+kodax a2a enable reviewer
+kodax a2a disable reviewer       # 只阻止新调度，不取消已运行任务
+
 # 暴露 Runtime 默认 Agent，或指定 ~/.kodax/agents/*.md 中的 Agent 名称
 export KODAX_A2A_TOKEN='请替换为足够长的随机令牌'
+# PowerShell：$env:KODAX_A2A_TOKEN='请替换为足够长的随机令牌'
 kodax a2a expose                 # 或：kodax a2a expose document-agent
 kodax a2a serve                  # 仅监听 http://127.0.0.1:8765
 ```
@@ -628,10 +656,24 @@ MCP、A2A、Extension 分别使用 `~/.kodax/integrations/` 下的一个用户
 和明文 secret 警告后，才应同时使用 `--apply --cleanup-legacy` 清理旧 key。
 运行中的 CLI/daemon 保留最后一个
 有效版本，完整替换 MCP provider、逐条协调 Extension，并热注册出站 A2A Agent。
+每个 A2A 条目都有期望态 `enabled`；`kodax a2a list` 显示配置，实际已应用注册以
+拥有该 Runtime 的进程为准。自动协调不会获取已停用条目的 Card 或 token；拥有者
+观察并应用该 revision 后，停用条目才会阻止新调度，CLI 写入返回本身不是跨进程生效
+确认。`a2a add --disabled` 默认仍会校验 Card，除非显式使用 `--no-test`；`a2a test`
+只做 discovery/security planning，不会申请 OAuth token。示例中的固定
+`KODAX_A2A_TOKEN` 是运维侧预先提供的兼容凭据，并非 KodaX 自行生成或签发。
+停用条目可随时重新启用。
 `a2a serve` 会在监听前装载已配置的 MCP/Extension 能力并固定执行权威，同时热加载
 公开信息、鉴权和限额。Agent、Skill、Extension 工具权威、工作区、tool policy
 或任务存储变更必须显式重启服务。
-托管 A2A 上下文默认位于 `~/kodax_a2a_server_workspace/<profile>/contexts/`。
+
+A2A 配置迁移与历史任务 owner 迁移是两件事。如果升级 realm-aware owner key
+后仍需访问 v0.7.70 的任务库，应先停止 A2A server，执行
+`kodax a2a migrate-tasks` 查看精确 owner 计划，再用
+`--apply --confirm-server-stopped` 应用。OAuth 还必须提供已知历史
+`--subject`；正常服务不会猜测或双读 legacy owner key。
+
+托管 A2A 上下文默认位于 `~/kodax_a2a_server_workspace/<runtime-profile>/contexts/`。
 精确授权的 Skill 脚本必须使用隔离策略，并通过 `kodax sandbox doctor`；
 Windows 的一次性显式初始化由 `kodax sandbox setup` 完成。
 

package/config-templates/integrations/a2a.example.jsonc

@@ -1,23 +1,17 @@
 // Bidirectional A2A configuration: ~/.kodax/integrations/a2a.json.
-// `agents` calls third-party Agents. The optional singleton `server` exposes
-// one KodaX general task Agent; ACP remains the coding/editor protocol.
+// `agents` calls many third-party Agents. The optional singleton `server`
+// exposes exactly one KodaX general task Agent; ACP remains the coding/editor
+// protocol. Uncomment only the entries you need; no token value belongs here.
+// Legacy version 1 files remain readable. Non-empty files require an explicit
+// stopped-daemon migration; new/empty files and every later write use version 2.
 {
-  "version": 1,
-  "agents": {}
+  "version": 2,
 
-  // Outbound example (keep tokens in the named environment variable):
-  // "agents": {
-  //   "reporting": {
-  //     "cardUrl": "https://agents.example.com/.well-known/agent-card.json",
-  //     "credentialEnv": "REPORTING_A2A_TOKEN",
-  //     "effect": "read"
-  //   }
-  // },
-
-  // Create the inbound block with `kodax a2a expose`; do not copy private
-  // Agent instructions, Runtime Skills, model names, or local paths into the
-  // public `published.skills` list. Managed workspaces default below
-  // ~/kodax_a2a_server_workspace/<server>/contexts/<caller-context>/.
+  // Create this inbound block with `kodax a2a expose`; config never starts a
+  // listener by itself. Do not copy private Agent instructions, Runtime Skills,
+  // model names, or local paths into the public `published.skills` list.
+  // Managed workspaces default below
+  // ~/kodax_a2a_server_workspace/<runtime-profile>/contexts/<context-key>/.
   // Native read/grep/glob remains available according to workspace access.
   // Arbitrary shell is never exposed. Skill instructions/assets need no
   // process authority. An exact checked-in scripts/... entry requires
@@ -43,12 +37,62 @@
   //   "published": {
   //     "name": "KodaX Agent",
   //     "description": "Completes approved general tasks.",
-  //     "version": "0.7.70",
+  //     "version": "0.7.71",
   //     "skills": [{ "id": "general", "name": "General", "description": "Complete general tasks.", "tags": [] }],
   //     "inputModes": ["text/plain"],
   //     "outputModes": ["text/plain"]
   //   },
   //   "authentication": { "type": "bearer-env", "tokenEnv": "KODAX_A2A_TOKEN", "principalId": "configured-client" },
   //   "dataDir": "~/.kodax/a2a/tasks"
+  // },
+
+  // Production OAuth2 resource-server alternative for the server above. The
+  // external Authorization Server issues access tokens and, for JWT tokens,
+  // signs them. KodaX holds no issuer signing key; it validates RFC 9068 tokens
+  // against the issuer's rotating JWKS, audience, expiry, subject, and scopes.
+  // Replace the server.authentication value above with:
+  // {
+  //   "type": "oauth2-jwt",
+  //   "scheme": "enterprise-oauth",
+  //   "issuer": "https://identity.example.com",
+  //   "audience": "https://agent.example.com/a2a",
+  //   "jwksUrl": "https://identity.example.com/.well-known/jwks.json",
+  //   "tokenUrl": "https://identity.example.com/oauth/token",
+  //   "metadataUrl": "https://identity.example.com/.well-known/oauth-authorization-server",
+  //   "requiredScopes": ["a2a.invoke"]
   // }
+
+  "agents": {
+    // Fixed Bearer compatibility example. `enabled` is hot desired state:
+    // disabled Agents remain configured but are not candidates for new
+    // orchestration, while already admitted remote tasks may finish.
+    // "reporting": {
+    //   "cardUrl": "https://agents.example.com/.well-known/agent-card.json",
+    //   "enabled": true,
+    //   "credentialEnv": "REPORTING_A2A_TOKEN",
+    //   "effect": "read"
+    // },
+
+    // Standards-based machine-to-machine OAuth2 example. The external
+    // Authorization Server issues access tokens; KodaX obtains and caches them
+    // only in process memory. `tokenUrl` must exactly match the selected Card
+    // OAuth2 clientCredentials flow. Use `kodax a2a enable|disable <name>` to
+    // mutate `enabled` atomically; the owning Runtime applies it asynchronously.
+    // "reviewer": {
+    //   "cardUrl": "https://reviewer.example.com/.well-known/agent-card.json",
+    //   "enabled": false,
+    //   "effect": "read",
+    //   "authentication": {
+    //     "type": "oauth2-client-credentials",
+    //     "scheme": "enterprise-oauth",
+    //     "issuer": "https://identity.example.com",
+    //     "tokenUrl": "https://identity.example.com/oauth/token",
+    //     "clientId": "kodax-reviewer",
+    //     "clientSecretEnv": "REVIEWER_CLIENT_SECRET",
+    //     "scopes": ["a2a.invoke"],
+    //     "resource": "https://reviewer.example.com/",
+    //     "clientAuthentication": "client-secret-basic"
+    //   }
+    // }
+  }
 }

package/dist/chunks/{agent-T72XYPW4.js → agent-X2EWQADL.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Ga as i,K as c,L as d,M as e,Ma as j,N as f,ma as g,na as h}from"./chunk-RY5OLVQV.js";import"./chunk-I4TPQEJN.js";import"./chunk-Y4WOTWUC.js";import"./chunk-AQGNRBEJ.js";import"./chunk-UJEMSPM5.js";import{sb as a,tb as b}from"./chunk-7PV577LP.js";import"./chunk-AWMTNUDS.js";import"./chunk-F7C7J6IM.js";import"./chunk-NGHQIGVW.js";import"./chunk-ONUPGMER.js";export{d as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,e as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,f as emitResilienceDebug,c as estimateProviderPayloadBytes,j as runKodaX,i as saveSessionSnapshot,a as validateAndFixToolHistory};
+import{Ga as i,K as c,L as d,M as e,Ma as j,N as f,ma as g,na as h}from"./chunk-T7LYK53M.js";import"./chunk-64NQBOSN.js";import"./chunk-44QXPEEE.js";import"./chunk-PVUXONQB.js";import"./chunk-ZJIMT5I3.js";import{vb as a,wb as b}from"./chunk-Y5XKAN7C.js";import"./chunk-52JSZ77P.js";import"./chunk-VRSVNU2Y.js";import"./chunk-23X6REO4.js";import"./chunk-ONUPGMER.js";export{d as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,e as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,f as emitResilienceDebug,c as estimateProviderPayloadBytes,j as runKodaX,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-BLNXDO2F.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Ba as a,Ca as b}from"./chunk-F7KGYHJ3.js";import"./chunk-GVTM4Z6O.js";import"./chunk-SX2WFHIS.js";import"./chunk-A574DBTV.js";import"./chunk-A2TFSV5M.js";import"./chunk-PHH4TRGF.js";import"./chunk-T7LYK53M.js";import"./chunk-64NQBOSN.js";import"./chunk-44QXPEEE.js";import"./chunk-PVUXONQB.js";import"./chunk-ZJIMT5I3.js";import"./chunk-Y5XKAN7C.js";import"./chunk-52JSZ77P.js";import"./chunk-VRSVNU2Y.js";import"./chunk-23X6REO4.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};

package/dist/chunks/chunk-23X6REO4.js

@@ -0,0 +1,46 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{a as o}from"./chunk-ONUPGMER.js";import{AsyncLocalStorage as Be}from"node:async_hooks";var Ne=new Be;function Le(e){let t=Ne.getStore()?.credential;return t?M(e,t,new WeakMap):e}o(Le,"redactScopedProviderCredential");function M(e,t,n){if(typeof e=="string")return e.split(t).join("[REDACTED_CREDENTIAL]");if(e===null||typeof e!="object")return e;let r=n.get(e);if(r!==void 0)return r;if(e instanceof Error){let s=new Error(M(e.message,t,n));return n.set(e,s),s.name=e.name,e.stack!==void 0&&(s.stack=M(e.stack,t,n)),s}if(Array.isArray(e)){let s=[];n.set(e,s);for(let l of e)s.push(M(l,t,n));return s}let i={};n.set(e,i);for(let[s,l]of Object.entries(Object.getOwnPropertyDescriptors(e))){if(!l.enumerable||!("value"in l))continue;let u=s.split(t).join("[REDACTED_CREDENTIAL]");i[u]=M(l.value,t,n)}return i}o(M,"redactCredentialValue");function A(e,t){return`${e}/${t??""}`}o(A,"capabilityCacheKey");function je(e,t,n){return e[A(t,n)]?.rejected??[]}o(je,"getRejectedEfforts");function $e(e,t,n,r,i,s){let l=A(t,n),u=e[l],g=u?.rejected.includes(r)?u.rejected:[...u?.rejected??[],r];return{...e,[l]:{rejected:g,source:i,updatedAt:s}}}o($e,"addRejectedEffort");function Fe(e,t,n){if(!t)return{};let r={...e};return delete r[A(t,n)],r}o(Fe,"removeCacheEntry");function Ue(e){if(!e||typeof e!="object")return{};let t={};for(let[n,r]of Object.entries(e)){if(!r||typeof r!="object")continue;let i=r,s=Array.isArray(i.rejected)?i.rejected.filter(g=>typeof g=="string"):[],l=i.source==="probed"?"probed":"observed",u=typeof i.updatedAt=="string"?i.updatedAt:"";t[n]={rejected:s,source:l,updatedAt:u}}return t}o(Ue,"sanitizeCapabilityCache");import{AsyncLocalStorage as We}from"node:async_hooks";var Ve=new We,J=8,Y=32;function ze(e){if(e===void 0)return;let t=Number.parseInt(e,10);return Number.isInteger(t)&&t>0?t:void 0}o(ze,"parsePositiveInt");function qe(){let e=I()?.workflow?.maxConcurrency,t=typeof e=="number"&&Number.isInteger(e)&&e>0?e:ze(process.env.KODAX_WORKFLOW_MAX_CONCURRENCY)??J;return Math.max(1,Math.min(Y,t))}o(qe,"resolveWorkflowMaxConcurrency");function I(){return Ve.getStore()}o(I,"getRunScopedConfig");var K={transport:"native-api",conversationSemantics:"full-history",mcpSupport:"none",contextFidelity:"full",toolCallingFidelity:"full",sessionSupport:"full",longRunningSupport:"full",multimodalSupport:"none",evidenceSupport:"full"},Q={...K,multimodalSupport:"image-input"},O={transport:"cli-bridge",conversationSemantics:"last-user-message",mcpSupport:"none",contextFidelity:"lossy",toolCallingFidelity:"limited",sessionSupport:"stateless",longRunningSupport:"limited",multimodalSupport:"none",evidenceSupport:"limited"},Z={...O,multimodalSupport:"image-input"};function j(e){return{transport:e.transport,conversationSemantics:e.conversationSemantics,mcpSupport:e.mcpSupport,contextFidelity:e.contextFidelity??"full",toolCallingFidelity:e.toolCallingFidelity??"full",sessionSupport:e.sessionSupport??"full",longRunningSupport:e.longRunningSupport??"full",multimodalSupport:e.multimodalSupport??"none",evidenceSupport:e.evidenceSupport??"full"}}o(j,"normalizeCapabilityProfile");import tn from"@anthropic-ai/sdk";import{parse as $o}from"partial-json";import hn from"openai";import{ClientSideConnection as _n,PROTOCOL_VERSION as Xn,ndJsonStream as An}from"@agentclientprotocol/sdk";var Sn=String.raw`
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+public static class KodaXNativeProcessSnapshot {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
+  private struct ProcessEntry32 {
+    public uint dwSize;
+    public uint cntUsage;
+    public uint th32ProcessID;
+    public IntPtr th32DefaultHeapID;
+    public uint th32ModuleID;
+    public uint cntThreads;
+    public uint th32ParentProcessID;
+    public int pcPriClassBase;
+    public uint dwFlags;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
+    public string szExeFile;
+  }
+  [DllImport("kernel32.dll", SetLastError = true)]
+  private static extern IntPtr CreateToolhelp32Snapshot(uint flags, uint processId);
+  [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
+  private static extern bool Process32First(IntPtr snapshot, ref ProcessEntry32 entry);
+  [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
+  private static extern bool Process32Next(IntPtr snapshot, ref ProcessEntry32 entry);
+  [DllImport("kernel32.dll")]
+  private static extern bool CloseHandle(IntPtr handle);
+  public static string ReadRows() {
+    var snapshot = CreateToolhelp32Snapshot(2, 0);
+    if (snapshot == new IntPtr(-1)) return string.Empty;
+    var rows = new StringBuilder();
+    var entry = new ProcessEntry32();
+    entry.dwSize = (uint)Marshal.SizeOf(entry);
+    try {
+      if (!Process32First(snapshot, ref entry)) return string.Empty;
+      do {
+        rows.Append(entry.th32ProcessID).Append(',').Append(entry.th32ParentProcessID).Append('\n');
+        entry.dwSize = (uint)Marshal.SizeOf(entry);
+      } while (Process32Next(snapshot, ref entry));
+      return rows.ToString();
+    } finally {
+      CloseHandle(snapshot);
+    }
+  }
+}`;import ie from"node:fs";import se from"node:os";import ae from"node:path";var pt="gpt-5.4",gt="auto-gemini-3",mt=["gpt-5.4","gpt-5.3-codex","gpt-5.3-codex-spark"],ht=["auto-gemini-3","gemini-3.1-pro-preview","gemini-3-flash-preview","gemini-2.5-pro","gemini-2.5-flash"];function de(e){let t=new Set,n=[];for(let r of e){let i=r.trim();if(!i)continue;let s=i.toLowerCase();t.has(s)||(t.add(s),n.push(i))}return n}o(de,"dedupePreserveOrder");function yt(){let e=ae.join(se.homedir(),".codex","config.toml");try{return ie.readFileSync(e,"utf8").match(/^\s*model\s*=\s*"([^"]+)"/m)?.[1]?.trim()||null}catch{return null}}o(yt,"readCodexConfiguredModel");function bt(){let e=ae.join(se.homedir(),".gemini","settings.json");try{let t=JSON.parse(ie.readFileSync(e,"utf8")),n=typeof t.model=="string"?t.model.trim():"";return n||(typeof t.general?.model=="string"?t.general.model.trim():"")||null}catch{return null}}o(bt,"readGeminiConfiguredModel");function E(){return yt()||pt}o(E,"getCodexCliDefaultModel");function T(){return bt()||gt}o(T,"getGeminiCliDefaultModel");function w(){return de([E(),...mt])}o(w,"getCodexCliKnownModels");function _(){return de([T(),...ht])}o(_,"getGeminiCliKnownModels");var pr=T(),gr=_();var xr=E(),Sr=w();import{existsSync as wt,readFileSync as _t}from"node:fs";import S from"node:path";import{fileURLToPath as Xt}from"node:url";var le=["none","prompt-only","native-effort","native-budget","native-toggle","native-adaptive","unknown"],ue=["openai-responses-effort","openai-chat-effort","codex-cli-config","anthropic-output-effort","provider-budget","provider-toggle","prompt-only","none"],ce=["anthropic-adaptive","anthropic-budget","provider-budget","provider-toggle","none"],fe=["zai-glm-5.2","zai-glm-toggle","deepseek-v4-openai","deepseek-v4-anthropic","deepseek-toggle","kimi-k3","kimi-k2.7-code","kimi-hybrid-toggle","minimax-m3","minimax-m2-always","mimo-v2.5-toggle","qwen-hybrid-thinking","openai-chat-reasoning","openai-responses-reasoning","codex-cli-effort","claude-adaptive-xhigh","claude-adaptive-max","anthropic-budget","generic-thinking-toggle","none"],pe=["native","image-input-native","cli-bridge","image-input-cli-bridge"],ge=["count-tokens","models-list","minimal-message","unsupported"];function h(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}o(h,"isPlainObject");function R(e,t){if(typeof e!="string"||e.length===0)throw new Error(`provider-capabilities.json: ${t} must be a non-empty string`);return e}o(R,"requireString");function x(e,t){if(e!==void 0)return R(e,t)}o(x,"optionalString");function P(e,t){if(e!==void 0){if(typeof e!="number"||!Number.isFinite(e)||e<0)throw new Error(`provider-capabilities.json: ${t} must be a non-negative finite number`);return e}}o(P,"optionalNumber");function f(e,t){if(e!==void 0){if(typeof e!="boolean")throw new Error(`provider-capabilities.json: ${t} must be a boolean`);return e}}o(f,"optionalBoolean");function me(e,t){if(e!==void 0){if(!Array.isArray(e))throw new Error(`provider-capabilities.json: ${t} must be an array`);return e.map((n,r)=>R(n,`${t}[${r}]`))}}o(me,"optionalStringArray");function Ct(e,t){if(e===void 0)return;if(!h(e))throw new Error(`provider-capabilities.json: ${t} must be an object`);let n={};for(let[r,i]of Object.entries(e))n[r]=R(i,`${t}.${r}`);return n}o(Ct,"optionalStringMap");function Pt(e,t){if(e!==void 0){if(typeof e!="string"||!fe.includes(e))throw new Error(`provider-capabilities.json: ${t} must be one of ${fe.join(", ")}, got ${JSON.stringify(e)}`);return e}}o(Pt,"optionalReasoningPreset");function F(e,t){if(typeof e!="string"||!le.includes(e))throw new Error(`provider-capabilities.json: ${t} must be one of ${le.join(", ")}, got ${JSON.stringify(e)}`);return e}o(F,"requireReasoningCapability");function Rt(e,t){if(typeof e!="string"||!ue.includes(e))throw new Error(`provider-capabilities.json: ${t} must be one of ${ue.join(", ")}, got ${JSON.stringify(e)}`);return e}o(Rt,"requireEffortStrategy");function Et(e,t){if(e!==void 0){if(typeof e!="string"||!ce.includes(e))throw new Error(`provider-capabilities.json: ${t} must be one of ${ce.join(", ")}, got ${JSON.stringify(e)}`);return e}}o(Et,"optionalThinkingStrategy");function he(e,t){if(e===void 0)return;if(!h(e))throw new Error(`provider-capabilities.json: ${t} must be an object`);let n=Rt(e.effortStrategy,`${t}.effortStrategy`),r=Pt(e.reasoningPreset,`${t}.reasoningPreset`),i=Et(e.thinkingStrategy,`${t}.thinkingStrategy`),s=x(e.defaultEffort,`${t}.defaultEffort`),l=Ct(e.effortAliases,`${t}.effortAliases`),u=me(e.disabledEfforts,`${t}.disabledEfforts`),g=me(e.localRejectEfforts,`${t}.localRejectEfforts`),y=f(e.allowCustomEffort,`${t}.allowCustomEffort`),b=f(e.supportsReasoningEffort,`${t}.supportsReasoningEffort`),v=f(e.supportsReasoningSummary,`${t}.supportsReasoningSummary`),k=f(e.supportsEncryptedReasoningReplay,`${t}.supportsEncryptedReasoningReplay`),d=f(e.supportsAdaptiveThinking,`${t}.supportsAdaptiveThinking`),C=f(e.supportsManualThinkingBudget,`${t}.supportsManualThinkingBudget`),p=f(e.supportsDisabledThinking,`${t}.supportsDisabledThinking`),X=f(e.requiresEffortBetaHeader,`${t}.requiresEffortBetaHeader`),a={effortStrategy:n};if(r!==void 0&&(a.reasoningPreset=r),i!==void 0&&(a.thinkingStrategy=i),s!==void 0&&(a.defaultEffort=s),l!==void 0&&(a.effortAliases=l),u!==void 0&&(a.disabledEfforts=u),g!==void 0&&(a.localRejectEfforts=g),e.supportedEfforts!==void 0){if(!Array.isArray(e.supportedEfforts))throw new Error(`provider-capabilities.json: ${t}.supportedEfforts must be an array`);a.supportedEfforts=e.supportedEfforts.map((c,m)=>{if(!h(c))throw new Error(`provider-capabilities.json: ${t}.supportedEfforts[${m}] must be an object`);return{value:R(c.value,`${t}.supportedEfforts[${m}].value`),...x(c.description,`${t}.supportedEfforts[${m}].description`)!==void 0?{description:x(c.description,`${t}.supportedEfforts[${m}].description`)}:{},...f(c.isDefault,`${t}.supportedEfforts[${m}].isDefault`)!==void 0?{isDefault:f(c.isDefault,`${t}.supportedEfforts[${m}].isDefault`)}:{},...f(c.isUserVisible,`${t}.supportedEfforts[${m}].isUserVisible`)!==void 0?{isUserVisible:f(c.isUserVisible,`${t}.supportedEfforts[${m}].isUserVisible`)}:{}}})}if(e.budgetByEffort!==void 0){if(!h(e.budgetByEffort))throw new Error(`provider-capabilities.json: ${t}.budgetByEffort must be an object`);let c={};for(let[m,G]of Object.entries(e.budgetByEffort))c[m]=P(G,`${t}.budgetByEffort.${m}`)??0;a.budgetByEffort=c}return y!==void 0&&(a.allowCustomEffort=y),b!==void 0&&(a.supportsReasoningEffort=b),v!==void 0&&(a.supportsReasoningSummary=v),k!==void 0&&(a.supportsEncryptedReasoningReplay=k),d!==void 0&&(a.supportsAdaptiveThinking=d),C!==void 0&&(a.supportsManualThinkingBudget=C),p!==void 0&&(a.supportsDisabledThinking=p),X!==void 0&&(a.requiresEffortBetaHeader=X),a}o(he,"validateReasoningProfile");function ye(e,t){let n=e.reasoningProfile,r=e.reasoningCapabilityV2;if(n!==void 0&&r!==void 0)throw new Error(`provider-capabilities.json: ${t} must not define both reasoningProfile and deprecated reasoningCapabilityV2`);return n!==void 0?he(n,`${t}.reasoningProfile`):he(r,`${t}.reasoningCapabilityV2`)}o(ye,"validateReasoningProfileField");function Tt(e,t){if(typeof e!="string"||!pe.includes(e))throw new Error(`provider-capabilities.json: ${t} must be one of ${pe.join(", ")}, got ${JSON.stringify(e)}`);return e}o(Tt,"requireProfileName");function xt(e,t){if(typeof e!="string"||!ge.includes(e))throw new Error(`provider-capabilities.json: ${t} must be one of ${ge.join(", ")}, got ${JSON.stringify(e)}`);return e}o(xt,"requireVerifyStrategy");function St(e,t){if(!h(e))throw new Error(`provider-capabilities.json: ${t} must be an object`);let n=R(e.id,`${t}.id`),r=x(e.wireModel,`${t}.wireModel`),i=x(e.displayName,`${t}.displayName`),s=P(e.contextWindow,`${t}.contextWindow`),l=P(e.maxOutputTokens,`${t}.maxOutputTokens`),u=P(e.thinkingBudgetCap,`${t}.thinkingBudgetCap`),g=f(e.replayReasoningContent,`${t}.replayReasoningContent`),y=f(e.strictThinkingSignature,`${t}.strictThinkingSignature`),b=P(e.streamMaxDurationMs,`${t}.streamMaxDurationMs`),v=e.reasoningCapability===void 0?void 0:F(e.reasoningCapability,`${t}.reasoningCapability`),k=ye(e,t),d={id:n};return r!==void 0&&(d.wireModel=r),i!==void 0&&(d.displayName=i),s!==void 0&&(d.contextWindow=s),l!==void 0&&(d.maxOutputTokens=l),u!==void 0&&(d.thinkingBudgetCap=u),v!==void 0&&(d.reasoningCapability=v),k!==void 0&&(d.reasoningProfile=k),g!==void 0&&(d.replayReasoningContent=g),y!==void 0&&(d.strictThinkingSignature=y),b!==void 0&&(d.streamMaxDurationMs=b),d}o(St,"validateModelDescriptor");function Mt(e,t){if(e===void 0)return;if(!h(e))throw new Error(`provider-capabilities.json: ${t} must be an object`);let n={};for(let[r,i]of Object.entries(e))n[r]=F(i,`${t}.${r}`);return n}o(Mt,"validateModelReasoningCapabilities");function Kt(e,t){if(!h(e))throw new Error(`provider-capabilities.json: providers.${t} must be an object`);let n=f(e.cliBridge,`providers.${t}.cliBridge`),r=R(e.apiKeyEnv,`providers.${t}.apiKeyEnv`),i=F(e.reasoningCapability,`providers.${t}.reasoningCapability`),s=ye(e,`providers.${t}`),l=Tt(e.capabilityProfile,`providers.${t}.capabilityProfile`),u=xt(e.verifyStrategy,`providers.${t}.verifyStrategy`);if(n&&u!=="unsupported")throw new Error(`provider-capabilities.json: providers.${t} is a cliBridge entry but verifyStrategy="${u}" \u2014 must be "unsupported" (CLI binary owns credentials)`);let g=P(e.contextWindow,`providers.${t}.contextWindow`),y=P(e.maxOutputTokens,`providers.${t}.maxOutputTokens`),b=P(e.thinkingBudgetCap,`providers.${t}.thinkingBudgetCap`),v=f(e.supportsThinking,`providers.${t}.supportsThinking`),k=Mt(e.modelReasoningCapabilities,`providers.${t}.modelReasoningCapabilities`),d=x(e.model,`providers.${t}.model`);if(n&&(d!==void 0||e.models!==void 0))throw new Error(`provider-capabilities.json: providers.${t} is a cliBridge entry but defines model/models \u2014 must be omitted (filled at load time)`);if(!n&&d===void 0)throw new Error(`provider-capabilities.json: providers.${t}.model is required (only cliBridge entries may omit)`);let C;if(e.models!==void 0){if(!Array.isArray(e.models))throw new Error(`provider-capabilities.json: providers.${t}.models must be an array`);C=e.models.map((a,c)=>St(a,`providers.${t}.models[${c}]`));let X=new Set([...d===void 0?[]:[d],...C.map(a=>a.id)]);for(let[a,c]of C.entries())if(c.wireModel!==void 0&&!X.has(c.wireModel))throw new Error(`provider-capabilities.json: providers.${t}.models[${a}].wireModel must reference a declared model, got ${JSON.stringify(c.wireModel)}`)}let p={apiKeyEnv:r,reasoningCapability:i,capabilityProfile:l,verifyStrategy:u};return s!==void 0&&(p.reasoningProfile=s),d!==void 0&&(p.model=d),C!==void 0&&(p.models=C),g!==void 0&&(p.contextWindow=g),y!==void 0&&(p.maxOutputTokens=y),b!==void 0&&(p.thinkingBudgetCap=b),v!==void 0&&(p.supportsThinking=v),k!==void 0&&(p.modelReasoningCapabilities=k),n&&(p.cliBridge=!0),p}o(Kt,"validateProviderEntry");function be(e){if(!h(e))throw new Error("provider-capabilities.json: root must be an object");if(e.version!==1)throw new Error(`provider-capabilities.json: version must be 1, got ${JSON.stringify(e.version)}`);let t=R(e.updatedAt,"updatedAt");if(!h(e.providers))throw new Error("provider-capabilities.json: providers must be an object");let n={};for(let[r,i]of Object.entries(e.providers))n[r]=Kt(i,r);return{version:1,updatedAt:t,providers:n}}o(be,"validateProviderCapabilitiesJson");var At=Object.freeze({native:K,"image-input-native":Q,"cli-bridge":O,"image-input-cli-bridge":Z}),L=null;function It(){if(process.env.KODAX_BUNDLED==="true")return S.join(S.dirname(process.execPath),"provider-capabilities.json");let e=S.dirname(Xt(import.meta.url)),t=[S.join(e,"provider-capabilities.json"),S.join(S.dirname(e),"provider-capabilities.json")];for(let n of t)if(wt(n))return n;return t[0]}o(It,"resolveJsonPath");function Ot(e){if(e.models){for(let t of e.models)t.reasoningProfile&&ve(t.reasoningProfile);for(let t of e.models)Object.freeze(t);Object.freeze(e.models)}return e.reasoningProfile&&ve(e.reasoningProfile),e.modelReasoningCapabilities&&Object.freeze(e.modelReasoningCapabilities),Object.freeze(e)}o(Ot,"deepFreezeSnapshot");function ve(e){if(e.supportedEfforts){for(let t of e.supportedEfforts)Object.freeze(t);Object.freeze(e.supportedEfforts)}e.budgetByEffort&&Object.freeze(e.budgetByEffort),e.effortAliases&&Object.freeze(e.effortAliases),e.disabledEfforts&&Object.freeze(e.disabledEfforts),e.localRejectEfforts&&Object.freeze(e.localRejectEfforts),Object.freeze(e)}o(ve,"freezeReasoningProfile");function Dt(e){if(e==="gemini-cli"){let t=T();return{model:t,models:_().filter(n=>n!==t).map(n=>({id:n}))}}if(e==="codex-cli"){let t=E();return{model:t,models:w().filter(n=>n!==t).map(n=>({id:n}))}}throw new Error(`provider-capabilities loader: unknown cliBridge provider '${e}'`)}o(Dt,"resolveCliBridgeModels");function Bt(e,t){let n=At[t.capabilityProfile];if(!n)throw new Error(`provider-capabilities loader: unknown capabilityProfile '${t.capabilityProfile}' for provider '${e}'`);if(t.cliBridge){let i=Dt(e),s={model:i.model,models:i.models,apiKeyEnv:t.apiKeyEnv,reasoningCapability:t.reasoningCapability,capabilityProfile:n,verifyStrategy:t.verifyStrategy};return t.reasoningProfile!==void 0&&(s.reasoningProfile=t.reasoningProfile),t.supportsThinking!==void 0&&(s.supportsThinking=t.supportsThinking),s}let r={model:t.model,apiKeyEnv:t.apiKeyEnv,reasoningCapability:t.reasoningCapability,capabilityProfile:n,verifyStrategy:t.verifyStrategy};return t.reasoningProfile!==void 0&&(r.reasoningProfile=t.reasoningProfile),t.models!==void 0&&(r.models=t.models),t.modelReasoningCapabilities!==void 0&&(r.modelReasoningCapabilities=t.modelReasoningCapabilities),t.contextWindow!==void 0&&(r.contextWindow=t.contextWindow),t.maxOutputTokens!==void 0&&(r.maxOutputTokens=t.maxOutputTokens),t.thinkingBudgetCap!==void 0&&(r.thinkingBudgetCap=t.thinkingBudgetCap),t.supportsThinking!==void 0&&(r.supportsThinking=t.supportsThinking),r}o(Bt,"buildSnapshot");function ke(){if(L)return L;let e=It(),t;try{let i=_t(e,"utf8");t=JSON.parse(i)}catch(i){let s=i instanceof Error?i.message:String(i);throw new Error(`provider-capabilities loader: failed to read ${e}: ${s}`)}let n=be(t),r={};for(let[i,s]of Object.entries(n.providers))r[i]=Ot(Bt(i,s));return L=Object.freeze(r),L}o(ke,"getProviderSnapshots");import Yr from"@anthropic-ai/sdk";var V=ke();var Ce=process.env.KODAX_PROVIDER??"zhipu-coding";export{Le as a,je as b,$e as c,Fe as d,Ue as e,qe as f,j as g,V as h};

package/dist/chunks/{chunk-Y4WOTWUC.js → chunk-44QXPEEE.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{o}from"./chunk-UJEMSPM5.js";import{a as i}from"./chunk-ONUPGMER.js";function r(u){let e=o(u?.llm);if(!e)return;let t={};return e.requestTimeoutMs!==void 0&&(t.requestTimeoutMs=e.requestTimeoutMs),e.streamIdleTimeoutMs!==void 0&&(t.streamIdleTimeoutMs=e.streamIdleTimeoutMs),e.chunkTimeoutMs!==void 0&&(t.chunkTimeoutMs=e.chunkTimeoutMs),e.maxRetryDelayMs!==void 0&&(t.maxRetryDelayMs=e.maxRetryDelayMs),Object.keys(t).length>0?t:void 0}i(r,"providerResilienceConfigFromTimeouts");export{r as a};
+import{o}from"./chunk-ZJIMT5I3.js";import{a as i}from"./chunk-ONUPGMER.js";function r(u){let e=o(u?.llm);if(!e)return;let t={};return e.requestTimeoutMs!==void 0&&(t.requestTimeoutMs=e.requestTimeoutMs),e.streamIdleTimeoutMs!==void 0&&(t.streamIdleTimeoutMs=e.streamIdleTimeoutMs),e.chunkTimeoutMs!==void 0&&(t.chunkTimeoutMs=e.chunkTimeoutMs),e.maxRetryDelayMs!==void 0&&(t.maxRetryDelayMs=e.maxRetryDelayMs),Object.keys(t).length>0?t:void 0}i(r,"providerResilienceConfigFromTimeouts");export{r as a};