@namzu/cli 20.0.0 → 22.0.0

package/dist/integrations/providers/discover.d.ts

@@ -1,66 +1,30 @@
 /**
- * Credential discoverer for LLM provider clients.
+ * Discover usable credential sources, reachable local servers, and public Zen.
  *
- * For each entry in `PROVIDER_REGISTRY`, ask four questions:
- *   1. Is there a usable session owned by an installed Claude or Codex harness?
- *   2. Is there a subscription credential in namzu's own store?
- *   3. Is one of its optional API-key env vars set in `process.env`?
- *   4. Is the probe URL (if any) reachable right now?
+ * Claude/Codex device sessions precede Namzu-owned sign-ins and their optional
+ * API environment alternatives. Gemini prefers explicit API keys, then reuses its
+ * installed CLI Google session. Zen/Go use direct API environment variables,
+ * then exact API entries in OpenCode's owner store. Anonymous Zen is available
+ * without a credential or local installation and is ordered last.
  *
- * The header used to say "three" and list two, and the one it omitted was the
- * Keychain — the question that reads a secret off the machine, so the one a
- * reader most needs to see. A count that disagrees with its own list is the
- * tell that the list stopped being maintained; in a file about credentials that
- * is worth more than a typo.
- *
- * **The Keychain path is macOS-only, and question 2 is why that is no longer a
- * hole.** `readAgentKeychainCredential` returns `null` on any other platform
- * before it looks at anything; it reads a credential belonging to a
- * co-installed tool, so it can only ever help someone who has that tool, on
- * that operating system. namzu's own store works everywhere, which is what
- * makes signing in from inside namzu useful on a machine that has neither.
- *
- * Order matters when both answer. A current device-harness session wins; a
- * Namzu-owned sign-in is the fallback for a machine that has no usable harness
- * session. API-key/env sources remain optional alternatives after both.
- *
- * The first positive answer per provider wins; subsequent sources are
- * recorded as "also available from" so the picker can show alternatives
- * (e.g. anthropic via env, also reachable as a local server).
- *
- * ## Membership means "usable right now", and two consumers depend on that
- *
- * A provider appears in the returned list only when a source actually answered.
- * That is not merely a description of the loop — it is the contract the readers
- * are built on, and it is why this function does NOT return a local provider
- * whose server is down:
- *
- *  - the `providers.chain` doctor check reads presence itself as the verdict
- *    for a provider that needs no key (`requiresApiKey ? apiKey : Boolean(det)`),
- *    so an unreachable entry would make it print `reachable` for a dead server;
- *  - the session's chain builder applies no credential test to a local
- *    provider, so an unreachable entry would be built into the chain and fail
- *    on the day it was supposed to rescue a run.
- *
- * `DetectionSource` has no way to say "found, not usable" either — every
- * variant asserts a working source.
- *
- * A dead branch here used to propose the opposite: list a local provider whose
- * probe failed, so the picker could show `(not running)` and the operator would
- * know they could start the server. It was removed rather than built, because
- * the operator-facing half of that idea already exists somewhere better — the
- * picker's empty state names both local servers and their ports and says to
- * start one — while the machine-facing half would have made the two readers
- * above lie. See cogitave/namzu#258.
- *
- * Discovery is non-throwing. Network probes have short timeouts. The
- * picker can render immediately and refine if discovery completes later.
+ * A public source promises only access to the documented free model catalogue;
+ * it does not assert network reachability. Local servers still require a
+ * successful bounded probe. Discovery never writes borrowed credentials.
  */
 import type { CredentialOrigin } from './oauth.js';
 import { type ProviderId, type ProviderRegistryEntry } from './registry.js';
 export type DetectionSource = {
     readonly kind: 'env';
     readonly envName: string;
+}
+/** Public free-model access; does not assert connectivity or an account credential. */
+ | {
+    readonly kind: 'public';
+}
+/** A read-only API key owned by OpenCode, kept on its original billing route. */
+ | {
+    readonly kind: 'opencode-file';
+    readonly path: string;
 } | {
     readonly kind: 'probe';
     readonly url: string;
@@ -78,6 +42,11 @@ export type DetectionSource = {
     readonly kind: 'codex-file';
     readonly path: string;
 }
+/** A Google account session owned by Gemini CLI. */
+ | {
+    readonly kind: 'gemini-file';
+    readonly path: string;
+}
 /**
  * namzu's own credential store — a subscription the operator signed in to
  * from inside namzu. Carries the path because "where did this come from"
@@ -129,6 +98,11 @@ export interface DetectedProvider {
         readonly expiresAt?: number;
         readonly origin: 'codex-file' | 'stored';
     };
+    /** Exact owner file and optional Google Cloud billing project, never a Namzu project ID. */
+    readonly gemini?: {
+        readonly sourcePath: string;
+        readonly projectId?: string;
+    };
     /** Other sources that also satisfy this provider — informational. */
     readonly alternatives: readonly DetectionSource[];
 }

package/dist/integrations/providers/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAeH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAE9F,MAAM,MAAM,eAAe,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACzD,sEAAsE;GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACzD,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACxD;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAE/B,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;QAClC,qDAAqD;QACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,QAAQ,CAAA;KACxC,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,eAAe;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAChC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC5C,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACnC,SAAS,gBAAgB,EAAE,CAY7B;AAID,wBAAsB,iBAAiB,CACtC,IAAI,GAAE,eAAoB,GACxB,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAiMtC;AAsBD,yEAAyE;AACzE,wBAAgB,YAAY,CAC3B,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,EAAE,EAAE,UAAU,GACZ,gBAAgB,GAAG,IAAI,CAEzB"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAkBH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAE9F,MAAM,MAAM,eAAe,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACpD,uFAAuF;GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,iFAAiF;GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACzD,sEAAsE;GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACzD,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACxD,oDAAoD;GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACzD;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAE/B,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;QAClC,qDAAqD;QACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,QAAQ,CAAA;KACxC,CAAA;IACD,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9E,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,eAAe;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAChC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC5C,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACnC,SAAS,gBAAgB,EAAE,CAa7B;AAID,wBAAsB,iBAAiB,CACtC,IAAI,GAAE,eAAoB,GACxB,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAyOtC;AAsBD,yEAAyE;AACzE,wBAAgB,YAAY,CAC3B,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,EAAE,EAAE,UAAU,GACZ,gBAAgB,GAAG,IAAI,CAEzB"}

package/dist/integrations/providers/discover.js

@@ -1,64 +1,21 @@
 /**
- * Credential discoverer for LLM provider clients.
+ * Discover usable credential sources, reachable local servers, and public Zen.
  *
- * For each entry in `PROVIDER_REGISTRY`, ask four questions:
- *   1. Is there a usable session owned by an installed Claude or Codex harness?
- *   2. Is there a subscription credential in namzu's own store?
- *   3. Is one of its optional API-key env vars set in `process.env`?
- *   4. Is the probe URL (if any) reachable right now?
+ * Claude/Codex device sessions precede Namzu-owned sign-ins and their optional
+ * API environment alternatives. Gemini prefers explicit API keys, then reuses its
+ * installed CLI Google session. Zen/Go use direct API environment variables,
+ * then exact API entries in OpenCode's owner store. Anonymous Zen is available
+ * without a credential or local installation and is ordered last.
  *
- * The header used to say "three" and list two, and the one it omitted was the
- * Keychain — the question that reads a secret off the machine, so the one a
- * reader most needs to see. A count that disagrees with its own list is the
- * tell that the list stopped being maintained; in a file about credentials that
- * is worth more than a typo.
- *
- * **The Keychain path is macOS-only, and question 2 is why that is no longer a
- * hole.** `readAgentKeychainCredential` returns `null` on any other platform
- * before it looks at anything; it reads a credential belonging to a
- * co-installed tool, so it can only ever help someone who has that tool, on
- * that operating system. namzu's own store works everywhere, which is what
- * makes signing in from inside namzu useful on a machine that has neither.
- *
- * Order matters when both answer. A current device-harness session wins; a
- * Namzu-owned sign-in is the fallback for a machine that has no usable harness
- * session. API-key/env sources remain optional alternatives after both.
- *
- * The first positive answer per provider wins; subsequent sources are
- * recorded as "also available from" so the picker can show alternatives
- * (e.g. anthropic via env, also reachable as a local server).
- *
- * ## Membership means "usable right now", and two consumers depend on that
- *
- * A provider appears in the returned list only when a source actually answered.
- * That is not merely a description of the loop — it is the contract the readers
- * are built on, and it is why this function does NOT return a local provider
- * whose server is down:
- *
- *  - the `providers.chain` doctor check reads presence itself as the verdict
- *    for a provider that needs no key (`requiresApiKey ? apiKey : Boolean(det)`),
- *    so an unreachable entry would make it print `reachable` for a dead server;
- *  - the session's chain builder applies no credential test to a local
- *    provider, so an unreachable entry would be built into the chain and fail
- *    on the day it was supposed to rescue a run.
- *
- * `DetectionSource` has no way to say "found, not usable" either — every
- * variant asserts a working source.
- *
- * A dead branch here used to propose the opposite: list a local provider whose
- * probe failed, so the picker could show `(not running)` and the operator would
- * know they could start the server. It was removed rather than built, because
- * the operator-facing half of that idea already exists somewhere better — the
- * picker's empty state names both local servers and their ports and says to
- * start one — while the machine-facing half would have made the two readers
- * above lie. See cogitave/namzu#258.
- *
- * Discovery is non-throwing. Network probes have short timeouts. The
- * picker can render immediately and refine if discovery completes later.
+ * A public source promises only access to the documented free model catalogue;
+ * it does not assert network reachability. Local servers still require a
+ * successful bounded probe. Discovery never writes borrowed credentials.
  */
 import { EnvCredentialProvider } from '@namzu/sdk';
+import { hasApiCredential } from './access.js';
 import { credentialsPath, readStoredCodexCredential, readStoredSubscriptionCredential, } from './credential-store.js';
-import { preferFresherCredential, readClaudeFileCredentialCandidates, readCodexFileCredentialCandidates, } from './harness-credentials.js';
+import { readGeminiFileCredentialCandidates } from './gemini-credentials.js';
+import { preferFresherCredential, readClaudeFileCredentialCandidates, readCodexFileCredentialCandidates, readOpenCodeApiCredentialCandidates, } from './harness-credentials.js';
 import { KEYCHAIN_SERVICE, readAgentKeychainCredential } from './keychain.js';
 import { PROVIDER_REGISTRY } from './registry.js';
 /**
@@ -76,6 +33,8 @@ import { PROVIDER_REGISTRY } from './registry.js';
  */
 export function signedInSubscriptionProviders(detected) {
     return detected.filter((provider) => {
+        if (provider.entry.id === 'google')
+            return provider.source.kind === 'gemini-file';
         if (provider.entry.subscriptionLogin === undefined)
             return false;
         return [provider.source, ...provider.alternatives].some((source) => source.kind === 'claude-file' ||
@@ -95,6 +54,7 @@ export async function discoverProviders(opts = {}) {
     // The vocabulary agreement is asserted instead, where it can fail loudly.
     const credentials = new EnvCredentialProvider({ env, anyKey: true });
     const detected = [];
+    const geminiCredentials = readGeminiFileCredentialCandidates(opts.home, env, opts.windowsHome);
     // Read both credential sources once, up front, so the loop body stays
     // uniform. Only anthropic consumes either.
     //
@@ -131,6 +91,7 @@ export async function discoverProviders(opts = {}) {
     // Keychain.
     const keychainCredential = opts.skipKeychain ? null : readAgentKeychainCredential();
     const claudeFileCredentials = readClaudeFileCredentialCandidates(opts.home, env, opts.windowsHome);
+    const openCodeCredentials = readOpenCodeApiCredentialCandidates(opts.home, env, opts.windowsHome);
     const codexFileCredentials = readCodexFileCredentialCandidates(opts.home, env, opts.windowsHome).filter((candidate) => candidate.credential.expiresAt === undefined ||
         candidate.credential.expiresAt - Date.now() > 60_000);
     const usableCodexFileCredential = codexFileCredentials.reduce((current, candidate) => {
@@ -145,8 +106,10 @@ export async function discoverProviders(opts = {}) {
         const entry = PROVIDER_REGISTRY[id];
         const sources = [];
         let apiKey;
+        let anonymousSelected = false;
         let oauth;
         let codex;
+        let gemini;
         if (id === 'anthropic') {
             const borrowedCandidates = [
                 ...claudeFileCredentials.map(({ credential, path }) => ({
@@ -157,7 +120,10 @@ export async function discoverProviders(opts = {}) {
                     ? [
                         {
                             credential: keychainCredential,
-                            source: { kind: 'keychain', service: KEYCHAIN_SERVICE },
+                            source: {
+                                kind: 'keychain',
+                                service: KEYCHAIN_SERVICE,
+                            },
                         },
                     ]
                     : []),
@@ -239,12 +205,45 @@ export async function discoverProviders(opts = {}) {
             // provider, and that the "is this a credential" vocabulary is the
             // one the host-bash scrub uses rather than a third table beside it.
             const resolved = await credentials.resolve(envName);
-            if (resolved) {
+            if (anonymousSelected)
+                continue;
+            if ((id === 'zen' || id === 'zen-go') && resolved?.value.trim() === 'public') {
+                if (sources.length === 0) {
+                    anonymousSelected = true;
+                    sources.push({ kind: 'env', envName });
+                }
+                continue;
+            }
+            if (resolved && hasApiCredential(entry, resolved.value)) {
                 if (apiKey === undefined)
                     apiKey = resolved.value;
                 sources.push({ kind: 'env', envName });
             }
         }
+        if (id === 'google') {
+            const borrowed = geminiCredentials[0];
+            if (borrowed && apiKey === undefined) {
+                apiKey = borrowed.credential.accessToken;
+                sources.push({ kind: 'gemini-file', path: borrowed.path });
+                const projectId = env.GOOGLE_CLOUD_PROJECT?.trim() || env.GOOGLE_CLOUD_PROJECT_ID?.trim();
+                gemini = { sourcePath: borrowed.path, ...(projectId ? { projectId } : {}) };
+            }
+        }
+        if (id === 'zen' || id === 'zen-go') {
+            for (const candidate of openCodeCredentials) {
+                if (anonymousSelected)
+                    break;
+                if (candidate.provider !== id)
+                    continue;
+                if (apiKey === undefined)
+                    apiKey = candidate.apiKey;
+                sources.push(candidate.source);
+            }
+            if (id === 'zen' && sources.length === 0)
+                sources.push({ kind: 'public' });
+        }
+        if (id === 'zen-go' && anonymousSelected)
+            continue;
         if (sources.length === 0 && entry.probeUrl && !opts.skipProbes) {
             const reachable = await probe(entry.probeUrl, opts);
             if (reachable) {
@@ -259,11 +258,16 @@ export async function discoverProviders(opts = {}) {
                 baseUrl: entry.defaultBaseUrl,
                 ...(oauth ? { oauth } : {}),
                 ...(codex ? { codex } : {}),
+                ...(gemini ? { gemini } : {}),
                 alternatives: sources.slice(1),
             });
         }
     }
-    return detected;
+    // A public fallback should not displace an existing account or local server
+    // when a headless caller has no saved provider preference. An explicit
+    // public environment marker retains env provenance but is still anonymous.
+    const anonymous = (provider) => provider.entry.id === 'zen' && !hasApiCredential(provider.entry, provider.apiKey);
+    return detected.sort((left, right) => Number(anonymous(left)) - Number(anonymous(right)));
 }
 async function probe(url, opts) {
     const fetchFn = opts.fetch ?? globalThis.fetch;

package/dist/integrations/providers/discover.js.map

@@ -1 +1 @@
-{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElD,OAAO,EACN,eAAe,EACf,yBAAyB,EACzB,gCAAgC,GAChC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,uBAAuB,EACvB,kCAAkC,EAClC,iCAAiC,GACjC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAE7E,OAAO,EAAE,iBAAiB,EAA+C,MAAM,eAAe,CAAA;AAgF9F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC5C,QAAqC;IAErC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnC,IAAI,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CACtD,CAAC,MAAM,EAAE,EAAE,CACV,MAAM,CAAC,IAAI,KAAK,aAAa;YAC7B,MAAM,CAAC,IAAI,KAAK,YAAY;YAC5B,MAAM,CAAC,IAAI,KAAK,UAAU;YAC1B,MAAM,CAAC,IAAI,KAAK,QAAQ;YACxB,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,yBAAyB,CAAC,CACxE,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACnC,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE;IACF,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mCAAmC;IACnC,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,oDAAoD;IACpD,4EAA4E;IAC5E,uEAAuE;IACvE,sDAAsD;IACtD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpF,MAAM,qBAAqB,GAAG,IAAI,CAAC,UAAU;QAC5C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7E,0EAA0E;IAC1E,YAAY;IACZ,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAA;IACnF,MAAM,qBAAqB,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IAClG,MAAM,oBAAoB,GAAG,iCAAiC,CAC7D,IAAI,CAAC,IAAI,EACT,GAAG,EACH,IAAI,CAAC,WAAW,CAChB,CAAC,MAAM,CACP,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;QAC5C,SAAS,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CACrD,CAAA;IACD,MAAM,yBAAyB,GAAG,oBAAoB,CAAC,MAAM,CAE3D,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE;QACxB,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,OAAO,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;YACvE,SAAS,CAAC,UAAU;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAA;IACX,CAAC,EAAE,IAAI,CAAC,CAAA;IAER,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAA0B,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,OAAO,GAAsB,EAAE,CAAA;QACrC,IAAI,MAA0B,CAAA;QAC9B,IAAI,KAAgC,CAAA;QACpC,IAAI,KAAgC,CAAA;QAEpC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,kBAAkB,GAAG;gBAC1B,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBACvD,UAAU;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAW;iBAC9C,CAAC,CAAC;gBACH,GAAG,CAAC,kBAAkB;oBACrB,CAAC,CAAC;wBACA;4BACC,UAAU,EAAE,kBAAkB;4BAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAW;yBAChE;qBACD;oBACF,CAAC,CAAC,EAAE,CAAC;aACN,CAAC,MAAM,CACP,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;gBAC5C,SAAS,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBACpD,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;oBACvC,SAAS,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAClD,CAAA;YACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CACzC,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE;gBACtB,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAA;gBAC9B,OAAO,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;oBACvE,SAAS,CAAC,UAAU;oBACpB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,OAAO,CAAA;YACX,CAAC,EACD,IAAI,CACJ,CAAA;YACD,IAAI,QAAQ,EAAE,CAAC;gBACd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAA;oBACxC,KAAK,GAAG;wBACP,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,YAAY;wBAC9C,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS;wBACxC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;wBAC3E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACvF,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;gBAC5C,IAAI,SAAS,KAAK,QAAQ;oBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC3D,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAA;oBACrC,KAAK,GAAG;wBACP,YAAY,EAAE,gBAAgB,CAAC,YAAY;wBAC3C,SAAS,EAAE,gBAAgB,CAAC,SAAS;wBACrC,MAAM,EAAE,QAAQ;qBAChB,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtE,CAAC,CAAA;YACH,CAAC;QACF,CAAC;QAED,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,qBAAqB,IAAI,yBAAyB,CAAC,EAAE,CAAC;YAC5E,MAAM,UAAU,GAAG,yBAAyB,EAAE,UAAU,IAAI,qBAAqB,CAAA;YACjF,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;YAC/C,MAAM,GAAG,UAAU,CAAC,WAAW,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;gBACzD,IAAI,EAAE,yBAAyB;oBAC9B,CAAC,CAAC,yBAAyB,CAAC,IAAI;oBAChC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aACnE,CAAC,CAAA;YACF,KAAK,GAAG;gBACP,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;aAC3D,CAAA;YACD,IAAI,qBAAqB,IAAI,yBAAyB,EAAE,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtE,CAAC,CAAA;YACH,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;gBAC9C,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;oBAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC3D,CAAC;YACF,CAAC;QACF,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACd,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAA;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACvC,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YACrD,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACb,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,CAAC,CAAoB;gBACrC,MAAM;gBACN,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;aAC9B,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,IAAqB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAC/C,CAAA;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAC3B,IAAiC,EACjC,EAAc;IAEd,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;AACnD,CAAC"}
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EACN,eAAe,EACf,yBAAyB,EACzB,gCAAgC,GAChC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EACN,uBAAuB,EACvB,kCAAkC,EAClC,iCAAiC,EACjC,mCAAmC,GACnC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAE7E,OAAO,EAAE,iBAAiB,EAA+C,MAAM,eAAe,CAAA;AAwF9F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC5C,QAAqC;IAErC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAA;QACjF,IAAI,QAAQ,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CACtD,CAAC,MAAM,EAAE,EAAE,CACV,MAAM,CAAC,IAAI,KAAK,aAAa;YAC7B,MAAM,CAAC,IAAI,KAAK,YAAY;YAC5B,MAAM,CAAC,IAAI,KAAK,UAAU;YAC1B,MAAM,CAAC,IAAI,KAAK,QAAQ;YACxB,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,yBAAyB,CAAC,CACxE,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACnC,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,MAAM,iBAAiB,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IAE9F,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE;IACF,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mCAAmC;IACnC,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,oDAAoD;IACpD,4EAA4E;IAC5E,uEAAuE;IACvE,sDAAsD;IACtD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpF,MAAM,qBAAqB,GAAG,IAAI,CAAC,UAAU;QAC5C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7E,0EAA0E;IAC1E,YAAY;IACZ,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAA;IACnF,MAAM,qBAAqB,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IAClG,MAAM,mBAAmB,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IACjG,MAAM,oBAAoB,GAAG,iCAAiC,CAC7D,IAAI,CAAC,IAAI,EACT,GAAG,EACH,IAAI,CAAC,WAAW,CAChB,CAAC,MAAM,CACP,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;QAC5C,SAAS,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CACrD,CAAA;IACD,MAAM,yBAAyB,GAAG,oBAAoB,CAAC,MAAM,CAE3D,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE;QACxB,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,OAAO,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;YACvE,SAAS,CAAC,UAAU;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAA;IACX,CAAC,EAAE,IAAI,CAAC,CAAA;IAER,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAA0B,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,OAAO,GAAsB,EAAE,CAAA;QACrC,IAAI,MAA0B,CAAA;QAC9B,IAAI,iBAAiB,GAAG,KAAK,CAAA;QAC7B,IAAI,KAAgC,CAAA;QACpC,IAAI,KAAgC,CAAA;QACpC,IAAI,MAAkC,CAAA;QAEtC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,kBAAkB,GAAG;gBAC1B,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBACvD,UAAU;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAW;iBAC9C,CAAC,CAAC;gBACH,GAAG,CAAC,kBAAkB;oBACrB,CAAC,CAAC;wBACA;4BACC,UAAU,EAAE,kBAAkB;4BAC9B,MAAM,EAAE;gCACP,IAAI,EAAE,UAAU;gCAChB,OAAO,EAAE,gBAAgB;6BAChB;yBACV;qBACD;oBACF,CAAC,CAAC,EAAE,CAAC;aACN,CAAC,MAAM,CACP,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;gBAC5C,SAAS,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBACpD,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;oBACvC,SAAS,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAClD,CAAA;YACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CACzC,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE;gBACtB,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAA;gBAC9B,OAAO,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;oBACvE,SAAS,CAAC,UAAU;oBACpB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,OAAO,CAAA;YACX,CAAC,EACD,IAAI,CACJ,CAAA;YACD,IAAI,QAAQ,EAAE,CAAC;gBACd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAA;oBACxC,KAAK,GAAG;wBACP,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,YAAY;wBAC9C,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS;wBACxC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;wBAC3E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACvF,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;gBAC5C,IAAI,SAAS,KAAK,QAAQ;oBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC3D,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAA;oBACrC,KAAK,GAAG;wBACP,YAAY,EAAE,gBAAgB,CAAC,YAAY;wBAC3C,SAAS,EAAE,gBAAgB,CAAC,SAAS;wBACrC,MAAM,EAAE,QAAQ;qBAChB,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtE,CAAC,CAAA;YACH,CAAC;QACF,CAAC;QAED,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,qBAAqB,IAAI,yBAAyB,CAAC,EAAE,CAAC;YAC5E,MAAM,UAAU,GAAG,yBAAyB,EAAE,UAAU,IAAI,qBAAqB,CAAA;YACjF,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;YAC/C,MAAM,GAAG,UAAU,CAAC,WAAW,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;gBACzD,IAAI,EAAE,yBAAyB;oBAC9B,CAAC,CAAC,yBAAyB,CAAC,IAAI;oBAChC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aACnE,CAAC,CAAA;YACF,KAAK,GAAG;gBACP,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;aAC3D,CAAA;YACD,IAAI,qBAAqB,IAAI,yBAAyB,EAAE,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtE,CAAC,CAAA;YACH,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;gBAC9C,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;oBAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC3D,CAAC;YACF,CAAC;QACF,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,iBAAiB;gBAAE,SAAQ;YAC/B,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,iBAAiB,GAAG,IAAI,CAAA;oBACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;gBACvC,CAAC;gBACD,SAAQ;YACT,CAAC;YACD,IAAI,QAAQ,IAAI,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzD,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAA;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACvC,CAAC;QACF,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACrC,IAAI,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAA;gBACxC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAA;gBACzF,MAAM,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;YAC5E,CAAC;QACF,CAAC;QACD,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACrC,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;gBAC7C,IAAI,iBAAiB;oBAAE,MAAK;gBAC5B,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE;oBAAE,SAAQ;gBACvC,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,GAAG,SAAS,CAAC,MAAM,CAAA;gBACnD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC/B,CAAC;YACD,IAAI,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,IAAI,iBAAiB;YAAE,SAAQ;QAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YACrD,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACb,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,CAAC,CAAoB;gBACrC,MAAM;gBACN,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;aAC9B,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,SAAS,GAAG,CAAC,QAA0B,EAAE,EAAE,CAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1F,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,IAAqB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAC/C,CAAA;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAC3B,IAAiC,EACjC,EAAc;IAEd,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;AACnD,CAAC"}

package/dist/integrations/providers/gemini-credentials.d.ts

@@ -0,0 +1,13 @@
+export interface GeminiCredential {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly expiresAt?: number;
+}
+export declare function readGeminiCredentialFile(path: string): GeminiCredential | null;
+export declare function readGeminiFileCredentialCandidates(home: string | undefined, env?: NodeJS.ProcessEnv, windowsHome?: string | null | undefined): readonly {
+    readonly path: string;
+    readonly credential: GeminiCredential;
+}[];
+/** Refresh in memory only. Re-read the owner's file before every request so logout is respected. */
+export declare function createGeminiAccessTokenResolver(path: string, fetchFn?: typeof fetch, env?: NodeJS.ProcessEnv): (signal?: AbortSignal) => Promise<string>;
+//# sourceMappingURL=gemini-credentials.d.ts.map

package/dist/integrations/providers/gemini-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-credentials.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/gemini-credentials.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAqC9E;AAED,wBAAgB,kCAAkC,CACjD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,WAAW,GAAE,MAAM,GAAG,IAAI,GAAG,SAA2D,GACtF,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,EAAE,CAkB7E;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,KAAwB,EACxC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CA+E3C"}

package/dist/integrations/providers/gemini-credentials.js

@@ -0,0 +1,148 @@
+/** Read-only reuse of the Google account session owned by Gemini CLI. */
+import { constants, closeSync, fstatSync, openSync, readSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { wslWindowsHome } from './harness-credentials.js';
+const REFRESH_URL = 'https://oauth2.googleapis.com/token';
+const MAX_BYTES = 1024 * 1024;
+export function readGeminiCredentialFile(path) {
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_BYTES)
+            return null;
+        const buffer = Buffer.alloc(MAX_BYTES + 1);
+        let size = 0;
+        while (size < buffer.length) {
+            const count = readSync(fd, buffer, size, buffer.length - size, null);
+            if (count === 0)
+                break;
+            size += count;
+        }
+        if (size > MAX_BYTES)
+            return null;
+        const value = JSON.parse(buffer.subarray(0, size).toString('utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return null;
+        const record = value;
+        if (typeof record.access_token !== 'string' || !record.access_token.trim())
+            return null;
+        if (record.expiry_date !== undefined &&
+            (typeof record.expiry_date !== 'number' ||
+                !Number.isFinite(record.expiry_date) ||
+                record.expiry_date <= 0))
+            return null;
+        return {
+            accessToken: record.access_token,
+            ...(typeof record.refresh_token === 'string' && record.refresh_token.trim()
+                ? { refreshToken: record.refresh_token }
+                : {}),
+            ...(typeof record.expiry_date === 'number' ? { expiresAt: record.expiry_date } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+export function readGeminiFileCredentialCandidates(home, env = process.env, windowsHome = home === undefined ? wslWindowsHome(env) : null) {
+    // Gemini CLI's Storage appends .gemini to its overridden home. An explicit
+    // owner location must not fall through to a different signed-in account.
+    const paths = env.GEMINI_CLI_HOME
+        ? [join(env.GEMINI_CLI_HOME, '.gemini', 'oauth_creds.json')]
+        : [
+            join(home ?? homedir(), '.gemini', 'oauth_creds.json'),
+            ...(windowsHome ? [join(windowsHome, '.gemini', 'oauth_creds.json')] : []),
+        ];
+    return [...new Set(paths)].flatMap((path) => {
+        const credential = readGeminiCredentialFile(path);
+        return credential &&
+            (credential.expiresAt === undefined ||
+                credential.expiresAt > Date.now() + 60_000 ||
+                credential.refreshToken)
+            ? [{ path, credential }]
+            : [];
+    });
+}
+/** Refresh in memory only. Re-read the owner's file before every request so logout is respected. */
+export function createGeminiAccessTokenResolver(path, fetchFn = globalThis.fetch, env = process.env) {
+    let source;
+    let cached;
+    let pending;
+    return async (signal) => {
+        signal?.throwIfAborted();
+        const owner = readGeminiCredentialFile(path);
+        if (!owner)
+            throw new Error('Gemini CLI sign-in is no longer available. Sign in with Gemini CLI again.');
+        const fingerprint = JSON.stringify(owner);
+        if (source !== fingerprint) {
+            source = fingerprint;
+            cached = owner;
+            pending = undefined;
+        }
+        const current = cached ?? owner;
+        if (current.expiresAt === undefined || current.expiresAt > Date.now() + 60_000)
+            return current.accessToken;
+        if (!current.refreshToken)
+            throw new Error('Gemini CLI sign-in has expired. Sign in with Gemini CLI again.');
+        const clientId = env.GOOGLE_OAUTH_CLIENT_ID?.trim();
+        const clientSecret = env.GOOGLE_OAUTH_CLIENT_SECRET?.trim();
+        if (!clientId || !clientSecret)
+            throw new Error('Gemini CLI sign-in has expired. Refresh it in Gemini CLI, or configure the matching GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET.');
+        if (!pending) {
+            const refresh = current.refreshToken;
+            const operation = (async () => {
+                const response = await fetchFn(REFRESH_URL, {
+                    method: 'POST',
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(15_000),
+                    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                    body: new URLSearchParams({
+                        client_id: clientId,
+                        client_secret: clientSecret,
+                        refresh_token: refresh,
+                        grant_type: 'refresh_token',
+                    }),
+                });
+                if (!response.ok)
+                    throw new Error(`Gemini CLI sign-in could not be refreshed (HTTP ${response.status}). Sign in with Gemini CLI again.`);
+                const value = (await response.json());
+                if (typeof value.access_token !== 'string' ||
+                    !value.access_token ||
+                    typeof value.expires_in !== 'number' ||
+                    !Number.isFinite(value.expires_in) ||
+                    value.expires_in <= 0)
+                    throw new Error('Google returned an invalid sign-in refresh response.');
+                // Do not let a late refresh replace a newer owner session.
+                if (source === fingerprint)
+                    cached = {
+                        accessToken: value.access_token,
+                        refreshToken: typeof value.refresh_token === 'string' ? value.refresh_token : refresh,
+                        expiresAt: Date.now() + value.expires_in * 1000,
+                    };
+                return value.access_token;
+            })();
+            pending = operation;
+            void operation
+                .finally(() => {
+                if (pending === operation)
+                    pending = undefined;
+            })
+                .catch(() => { });
+        }
+        if (!signal)
+            return pending;
+        signal.throwIfAborted();
+        // A cancelled waiter must not cancel a refresh needed by sibling requests.
+        return new Promise((resolve, reject) => {
+            const abort = () => reject(signal.reason);
+            signal.addEventListener('abort', abort, { once: true });
+            pending?.then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+        });
+    };
+}
+//# sourceMappingURL=gemini-credentials.js.map

package/dist/integrations/providers/gemini-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini-credentials.js","sourceRoot":"","sources":["../../../src/integrations/providers/gemini-credentials.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD,MAAM,WAAW,GAAG,qCAAqC,CAAA;AACzD,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAA;AAQ7B,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACpD,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;YAAE,OAAO,IAAI,CAAA;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QAC1C,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,OAAO,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAA;YACpE,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAK;YACtB,IAAI,IAAI,KAAK,CAAA;QACd,CAAC;QACD,IAAI,IAAI,GAAG,SAAS;YAAE,OAAO,IAAI,CAAA;QACjC,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5E,MAAM,MAAM,GAAG,KAAgC,CAAA;QAC/C,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA;QACvF,IACC,MAAM,CAAC,WAAW,KAAK,SAAS;YAChC,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;gBACpC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAEzB,OAAO,IAAI,CAAA;QACZ,OAAO;YACN,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;gBAC1E,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;IACpC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kCAAkC,CACjD,IAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,cAAyC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;IAExF,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe;QAChC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAC5D,CAAC,CAAC;YACA,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC;YACtD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAA;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QACjD,OAAO,UAAU;YAChB,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;gBAClC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBAC1C,UAAU,CAAC,YAAY,CAAC;YACzB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YACxB,CAAC,CAAC,EAAE,CAAA;IACN,CAAC,CAAC,CAAA;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,+BAA+B,CAC9C,IAAY,EACZ,UAAwB,UAAU,CAAC,KAAK,EACxC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAA0B,CAAA;IAC9B,IAAI,MAAoC,CAAA;IACxC,IAAI,OAAoC,CAAA;IACxC,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACvB,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,KAAK;YACT,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;QAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC5B,MAAM,GAAG,WAAW,CAAA;YACpB,MAAM,GAAG,KAAK,CAAA;YACd,OAAO,GAAG,SAAS,CAAA;QACpB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,KAAK,CAAA;QAC/B,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC7E,OAAO,OAAO,CAAC,WAAW,CAAA;QAC3B,IAAI,CAAC,OAAO,CAAC,YAAY;YACxB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QAClF,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAA;QACnD,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;YAC7B,MAAM,IAAI,KAAK,CACd,4IAA4I,CAC5I,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAA;YACpC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE;oBAC3C,MAAM,EAAE,MAAM;oBACd,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;oBACnC,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;wBACzB,SAAS,EAAE,QAAQ;wBACnB,aAAa,EAAE,YAAY;wBAC3B,aAAa,EAAE,OAAO;wBACtB,UAAU,EAAE,eAAe;qBAC3B,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,QAAQ,CAAC,EAAE;oBACf,MAAM,IAAI,KAAK,CACd,mDAAmD,QAAQ,CAAC,MAAM,mCAAmC,CACrG,CAAA;gBACF,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;gBAChE,IACC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;oBACtC,CAAC,KAAK,CAAC,YAAY;oBACnB,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;oBACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;oBAClC,KAAK,CAAC,UAAU,IAAI,CAAC;oBAErB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;gBACxE,2DAA2D;gBAC3D,IAAI,MAAM,KAAK,WAAW;oBACzB,MAAM,GAAG;wBACR,WAAW,EAAE,KAAK,CAAC,YAAY;wBAC/B,YAAY,EAAE,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO;wBACrF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI;qBAC/C,CAAA;gBACF,OAAO,KAAK,CAAC,YAAY,CAAA;YAC1B,CAAC,CAAC,EAAE,CAAA;YACJ,OAAO,GAAG,SAAS,CAAA;YACnB,KAAK,SAAS;iBACZ,OAAO,CAAC,GAAG,EAAE;gBACb,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,GAAG,SAAS,CAAA;YAC/C,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAClB,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAA;QAC3B,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,2EAA2E;QAC3E,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QACzF,CAAC,CAAC,CAAA;IACH,CAAC,CAAA;AACF,CAAC"}

package/dist/integrations/providers/harness-credentials.d.ts

@@ -34,6 +34,20 @@ export declare function wslWindowsHome(env?: NodeJS.ProcessEnv, run?: typeof exe
  */
 export declare function readClaudeFileCredentialCandidates(home: string | undefined, env?: NodeJS.ProcessEnv, windowsHome?: string | null | undefined): readonly HarnessCredentialCandidate<AgentOAuthCredential>[];
 export declare function codexCredentialsPath(home?: string, env?: NodeJS.ProcessEnv): string;
+export interface OpenCodeApiCredentialCandidate {
+    readonly provider: 'zen' | 'zen-go';
+    readonly apiKey: string;
+    readonly source: {
+        readonly kind: 'opencode-file';
+        readonly path: string;
+    } | {
+        readonly kind: 'env';
+        readonly envName: 'OPENCODE_AUTH_CONTENT';
+    };
+}
+export declare function opencodeCredentialsPath(home?: string, env?: NodeJS.ProcessEnv): string;
+/** Read only OpenCode-owned API entries; OAuth and provider aliases are not credentials here. */
+export declare function readOpenCodeApiCredentialCandidates(home: string | undefined, env?: NodeJS.ProcessEnv, windowsHome?: string | null | undefined): readonly OpenCodeApiCredentialCandidate[];
 export declare function readClaudeFileCredential(home?: string): AgentOAuthCredential | null;
 /** Read a Claude-owned credential from the exact path discovery admitted. */
 export declare function readClaudeCredentialFile(path: string): AgentOAuthCredential | null;

package/dist/integrations/providers/harness-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness-credentials.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAejD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAIzD,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC,SAAS,oBAAoB;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAA;CAC7C;AAED,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEtE;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,OAAO,YAA2B,EACvC,OAAO,SAAoC,GACzC,MAAM,GAAG,IAAI,CAqBf;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CACjD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,WAAW,GAAE,MAAM,GAAG,IAAI,GAAG,SAA2D,GACtF,SAAS,0BAA0B,CAAC,oBAAoB,CAAC,EAAE,CAU7D;AAED,wBAAgB,oBAAoB,CACnC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAQR;AA6BD,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,MAAkB,GAAG,oBAAoB,GAAG,IAAI,CAE9F;AAED,6EAA6E;AAC7E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAWlF;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,oBAAoB,GAC/B,6BAA6B,CAiD/B;AAOD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,oBAAoB,GAAG,IAAI,CAW9B;AAoBD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,oBAAoB,GAAG,IAAI,CAE7B;AAED,oFAAoF;AACpF,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,WAAW,GAAE,MAAM,GAAG,IAAI,GAAG,SAA2D,GACtF,SAAS,0BAA0B,CAAC,oBAAoB,CAAC,EAAE,CAa7D;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAkBjF;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,oBAAoB,EACrE,IAAI,EAAE,CAAC,GAAG,IAAI,EACd,KAAK,EAAE,CAAC,GAAG,IAAI,EACf,GAAG,SAAa,GACd,CAAC,GAAG,IAAI,CASV"}
+{"version":3,"file":"harness-credentials.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAejD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAIzD,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC,SAAS,oBAAoB;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAA;CAC7C;AAED,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEtE;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,OAAO,YAA2B,EACvC,OAAO,SAAoC,GACzC,MAAM,GAAG,IAAI,CAqBf;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CACjD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,WAAW,GAAE,MAAM,GAAG,IAAI,GAAG,SAA2D,GACtF,SAAS,0BAA0B,CAAC,oBAAoB,CAAC,EAAE,CAU7D;AAED,wBAAgB,oBAAoB,CACnC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAQR;AAED,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EACZ;QAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACzD;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;KAAE,CAAA;CACtE;AAED,wBAAgB,uBAAuB,CACtC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAIR;AAED,iGAAiG;AACjG,wBAAgB,mCAAmC,CAClD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,WAAW,GAAE,MAAM,GAAG,IAAI,GAAG,SAA2D,GACtF,SAAS,8BAA8B,EAAE,CA4C3C;AA6BD,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,MAAkB,GAAG,oBAAoB,GAAG,IAAI,CAE9F;AAED,6EAA6E;AAC7E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAWlF;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,oBAAoB,GAC/B,6BAA6B,CAiD/B;AAOD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,oBAAoB,GAAG,IAAI,CAW9B;AAoBD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,oBAAoB,GAAG,IAAI,CAE7B;AAED,oFAAoF;AACpF,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,WAAW,GAAE,MAAM,GAAG,IAAI,GAAG,SAA2D,GACtF,SAAS,0BAA0B,CAAC,oBAAoB,CAAC,EAAE,CAa7D;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAkBjF;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,oBAAoB,EACrE,IAAI,EAAE,CAAC,GAAG,IAAI,EACd,KAAK,EAAE,CAAC,GAAG,IAAI,EACf,GAAG,SAAa,GACd,CAAC,GAAG,IAAI,CASV"}

package/dist/integrations/providers/harness-credentials.js

@@ -77,6 +77,52 @@ export function codexCredentialsPath(home = homedir(), env = process.env) {
         : join(home, '.codex');
     return join(root, 'auth.json');
 }
+export function opencodeCredentialsPath(home = homedir(), env = process.env) {
+    const configured = env.XDG_DATA_HOME?.trim();
+    const root = configured && isAbsolute(configured) ? configured : join(home, '.local', 'share');
+    return join(root, 'opencode', 'auth.json');
+}
+/** Read only OpenCode-owned API entries; OAuth and provider aliases are not credentials here. */
+export function readOpenCodeApiCredentialCandidates(home, env = process.env, windowsHome = home === undefined ? wslWindowsHome(env) : null) {
+    const parse = (value, source) => {
+        const root = record(value);
+        return ['opencode', 'opencode-go'].flatMap((id) => {
+            const entry = record(root?.[id]);
+            const apiKey = typeof entry?.key === 'string' ? entry.key.trim() : undefined;
+            return entry?.type === 'api' && apiKey && apiKey !== 'public'
+                ? [
+                    {
+                        provider: id === 'opencode' ? 'zen' : 'zen-go',
+                        apiKey,
+                        source,
+                    },
+                ]
+                : [];
+        });
+    };
+    // OpenCode treats this as the complete store. Even an invalid override must
+    // not silently revive an older account from disk.
+    if (env.OPENCODE_AUTH_CONTENT !== undefined) {
+        try {
+            if (Buffer.byteLength(env.OPENCODE_AUTH_CONTENT, 'utf8') > MAX_CREDENTIAL_FILE_BYTES)
+                return [];
+            return parse(JSON.parse(env.OPENCODE_AUTH_CONTENT), {
+                kind: 'env',
+                envName: 'OPENCODE_AUTH_CONTENT',
+            });
+        }
+        catch {
+            return [];
+        }
+    }
+    const paths = env.XDG_DATA_HOME?.trim() && isAbsolute(env.XDG_DATA_HOME.trim())
+        ? [opencodeCredentialsPath(home, env)]
+        : [
+            opencodeCredentialsPath(home, env),
+            ...(windowsHome ? [opencodeCredentialsPath(windowsHome, {})] : []),
+        ];
+    return [...new Set(paths)].flatMap((path) => parse(readCredentialJson(path), { kind: 'opencode-file', path }));
+}
 function readCredentialJson(path) {
     try {
         const stat = statSync(path);