@namzu/cli 35.0.0 → 36.1.0

package/dist/chunks/chunk-2A37JQKY.js

@@ -0,0 +1,1355 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  PROVIDER_REGISTRY,
+  unsupportedProviderMessage
+} from "./chunk-6LLJQ3KY.js";
+import {
+  findActiveZenModel
+} from "./chunk-AHIDYIRB.js";
+import {
+  isExperimentalFreeZenModel
+} from "./chunk-GIXSS6KW.js";
+import {
+  apiKeysPath,
+  credentialsPath,
+  googleApiKeyPath,
+  readStoredApiKey,
+  readStoredCodexCredential,
+  readStoredGeminiApiKey,
+  readStoredSubscriptionCredential
+} from "./chunk-Q24K7536.js";
+import {
+  namzuHomePath
+} from "./chunk-NQY5P2EB.js";
+import {
+  EnvCredentialProvider,
+  ProviderRegistry,
+  resolveProviderCapabilities
+} from "./chunk-EWKJGHRO.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/integrations/providers/access.ts
+function hasApiCredential(entry, apiKey) {
+  if (entry.id === "zen" || entry.id === "zen-go") {
+    return Boolean(apiKey?.trim() && apiKey.trim() !== "public");
+  }
+  return Boolean(apiKey);
+}
+__name(hasApiCredential, "hasApiCredential");
+function requiresCredentialForModel(entry, model) {
+  return entry.requiresApiKey || entry.id === "zen" && !isExperimentalFreeZenModel("zen", findActiveZenModel("zen", model));
+}
+__name(requiresCredentialForModel, "requiresCredentialForModel");
+function canSelectModel(entry, apiKey, model) {
+  return hasApiCredential(entry, apiKey) || !requiresCredentialForModel(entry, model);
+}
+__name(canSelectModel, "canSelectModel");
+
+// src/context/environment.ts
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { promisify } from "node:util";
+var run = promisify(execFile);
+var GIT_TIMEOUT_MS = 2e3;
+function detectWsl(env = process.env, probe2 = {}) {
+  const distro = env.WSL_DISTRO_NAME?.trim() || null;
+  const socket = env.WSL_INTEROP?.trim() || null;
+  if (!distro && !socket) return void 0;
+  const exists = probe2.exists ?? existsSync;
+  const list = probe2.list ?? ((path) => {
+    try {
+      return readdirSync(path);
+    } catch {
+      return [];
+    }
+  });
+  const interop = socket !== null || exists("/proc/sys/fs/binfmt_misc/WSLInterop");
+  const mountRoot = probe2.mountRoot ?? readWslMountRoot();
+  const drives = list(mountRoot === "/" ? "/" : mountRoot.slice(0, -1)).filter((name) => /^[a-z]$/i.test(name)).sort().map((name) => `${mountRoot}${name}`);
+  return { distro, interop, drives, mountRoot };
+}
+__name(detectWsl, "detectWsl");
+var DEFAULT_WSL_MOUNT_ROOT = "/mnt/";
+function parseWslMountRoot(wslConf) {
+  if (!wslConf) return DEFAULT_WSL_MOUNT_ROOT;
+  let inAutomount = false;
+  let root;
+  for (const raw of wslConf.replace(/^\uFEFF/, "").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#") || line.startsWith(";")) continue;
+    const section = /^\[([^\]]+)\]$/.exec(line);
+    if (section) {
+      inAutomount = (section[1] ?? "").trim().toLowerCase() === "automount";
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (!inAutomount || eq <= 0 || line.slice(0, eq).trim().toLowerCase() !== "root") continue;
+    let value = line.slice(eq + 1).replace(/\s[#;].*$/, "").trim();
+    if (/^(["']).*\1$/.test(value)) value = value.slice(1, -1);
+    root = value;
+  }
+  if (!root || !root.startsWith("/")) return DEFAULT_WSL_MOUNT_ROOT;
+  return root.endsWith("/") ? root : `${root}/`;
+}
+__name(parseWslMountRoot, "parseWslMountRoot");
+function readWslMountRoot(readFile = (path) => {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}) {
+  return parseWslMountRoot(readFile("/etc/wsl.conf"));
+}
+__name(readWslMountRoot, "readWslMountRoot");
+function wslSystem32(mountRoot = DEFAULT_WSL_MOUNT_ROOT) {
+  return `${mountRoot}c/Windows/System32`;
+}
+__name(wslSystem32, "wslSystem32");
+function localIsoDate(now) {
+  const pad = /* @__PURE__ */ __name((n) => String(n).padStart(2, "0"), "pad");
+  return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
+}
+__name(localIsoDate, "localIsoDate");
+async function git(cwd, args) {
+  try {
+    const { stdout } = await run("git", [...args], { cwd, timeout: GIT_TIMEOUT_MS });
+    const out = stdout.trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+__name(git, "git");
+async function readEnvironmentFacts(cwd, now = /* @__PURE__ */ new Date()) {
+  const [insideWorkTree, branch] = await Promise.all([
+    git(cwd, ["rev-parse", "--is-inside-work-tree"]),
+    git(cwd, ["symbolic-ref", "--short", "HEAD"])
+  ]);
+  const isRepository = insideWorkTree === "true";
+  return {
+    today: localIsoDate(now),
+    // A repository with no symbolic HEAD is on a detached one. Distinguishing
+    // that from "not a repository" matters: on a detached HEAD a commit goes
+    // nowhere reachable, and an agent about to commit should know.
+    branch: isRepository ? branch ?? "detached" : null,
+    isRepository
+  };
+}
+__name(readEnvironmentFacts, "readEnvironmentFacts");
+function composeEnvironmentPrompt(facts) {
+  const lines = [`Today's date is ${facts.today}.`];
+  if (!facts.isRepository) {
+    lines.push("The working directory is not a git repository.");
+  } else if (facts.branch === "detached") {
+    lines.push(
+      "The working directory is a git repository with a detached HEAD \u2014 no branch is checked out, so a commit made here is not reachable from any branch."
+    );
+  } else {
+    lines.push(`The working directory is a git repository on branch \`${facts.branch}\`.`);
+  }
+  if (facts.additionalDirectories && facts.additionalDirectories.length > 0) {
+    lines.push(
+      `Besides the working directory, the file tools may reach these directories, by absolute path: ${facts.additionalDirectories.map((d) => `\`${d}\``).join(", ")}. Relative paths still resolve against the working directory.`
+    );
+  }
+  if (facts.boundary) lines.push(...boundaryLines(facts.boundary));
+  if (facts.wsl) lines.push(...wslLines(facts.wsl, facts.boundary));
+  lines.push(
+    "These are facts about right now. Prefer them over any date or branch you would otherwise assume."
+  );
+  return `## Environment
+
+${lines.join("\n")}`;
+}
+__name(composeEnvironmentPrompt, "composeEnvironmentPrompt");
+function boundaryLines(boundary) {
+  if (!boundary.sandbox) {
+    const outside = boundary.interactive ? "A path anywhere else is not refused outright: the user is asked to approve that call first, every time \u2014 in plan mode too, for a read; the strict permission mode refuses it. When you need a directory repeatedly, suggest the user add it with `/add-dir <path>`." : "A path anywhere else is refused in this session, because it needs a person to approve it and nobody is at the terminal. If you need one, say which directory and why, so the user can add it (`--add-dir <path>`) and run again.";
+    return [
+      "Tools run on this machine, not in a sandbox: shell commands and file changes go through the permission settings, which may ask the user before they run.",
+      `The file tools reach the working directory and any added directories directly. ${outside} A refusal that remains is a decision, not a missing file; say so rather than retrying another spelling.`
+    ];
+  }
+  const { environment, enforced } = boundary.sandbox;
+  const network = enforced.includes("network") ? " The network is cut inside it." : " It does not cut the network on this machine.";
+  const escapeRoute = boundary.escape === "ask" ? "When one command genuinely cannot work inside it (it needs the network, a path it does not mount, or a host tool), set `dangerously_disable_sandbox: true` on that one `bash` call: the user is asked to approve it every time, whatever else is approved; the plan and strict permission modes refuse it. Never use it to get around a permission refusal." : boundary.escape === "unattended" ? "When one command genuinely cannot work inside it, `dangerously_disable_sandbox: true` on that `bash` call runs it on the host: this session is configured to allow that without asking, and every use is recorded. Use it only when the sandbox is the obstacle." : "Commands cannot leave the sandbox in this session. When one needs something the sandbox withholds, say what and why, and let the user decide.";
+  const files = enforced.includes("filesystem") ? " Inside it, commands can read and write the working directory and the added directories; the system directories programs need are readable, /tmp is private to the command, and the rest of this machine (the home directory, other projects, other mounts) cannot be reached from it, so no spelling of such a path will be found." : " It does not confine the file system here, so commands can still see files outside the working directory.";
+  return [
+    `Shell commands run in a sandbox (${environment}${enforced.length > 0 ? `, enforcing ${enforced.join(", ")}` : ", enforcing nothing on this platform"}).${files}${network} The file tools reach only the working directory and the added directories.`,
+    `To reach another directory, ask the user to add it with \`/add-dir <path>\` (the next turn binds it). ${escapeRoute}`
+  ];
+}
+__name(boundaryLines, "boundaryLines");
+function wslLines(wsl, boundary) {
+  const sandboxed = boundary?.sandbox?.enforced.includes("filesystem") === true;
+  const fileTools = boundary?.sandbox !== void 0 ? "the file tools reach them only once added with `/add-dir`" : boundary?.interactive === false ? "a file tool reaching them is refused in this session, since nobody is here to approve it" : "a file tool reaching them asks for approval first, like any other outside path";
+  const root = wsl.mountRoot ?? DEFAULT_WSL_MOUNT_ROOT;
+  const drives = wsl.drives.length > 0 ? `Windows drives are mounted under ${wsl.drives.map((d) => `\`${d}\``).join(", ")} (\`C:\\Users\` is \`${root}c/Users\`; \`wslpath -w\` and \`wslpath -u\` convert).` : `No Windows drive is mounted under \`${root === "/" ? "/" : root.slice(0, -1)}\` right now.`;
+  const reach = sandboxed ? "They are outside the sandbox, so a command there needs `/add-dir` or the sandbox escape." : `They are outside the working directory, so ${fileTools}.`;
+  const interop = wsl.interop ? `Windows programs start from the shell through WSL interop, by their \`.exe\` name: \`powershell.exe -NoProfile -Command ...\`, \`cmd.exe /c ...\`, \`explorer.exe .\` (it exits 1 even when it succeeds). \`cmd.exe\` started from a Linux directory warns that UNC paths are unsupported and falls back to C:\\Windows, so \`cd\` under \`${root}c\` first or use \`powershell.exe\`. If a name is not found, the Windows side of \`PATH\` was not appended; \`cmd.exe\` is under \`${wslSystem32(root)}\` and \`powershell.exe\` under its \`WindowsPowerShell/v1.0\`.${sandboxed ? " The sandbox does not mount the Windows drives those programs live on, so running one needs the sandbox escape." : ""}` : "WSL interop is off here, so Windows `.exe` programs cannot be started from the shell.";
+  return [
+    `This machine is Windows Subsystem for Linux${wsl.distro ? ` (distro \`${wsl.distro}\`)` : ""}. ${drives} ${reach}`,
+    interop
+  ];
+}
+__name(wslLines, "wslLines");
+
+// src/integrations/providers/harness-credentials.ts
+import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import {
+  closeSync,
+  fsyncSync,
+  openSync,
+  readFileSync as readFileSync2,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+var MAX_CREDENTIAL_FILE_BYTES = 1024 * 1024;
+function claudeCredentialsPath(home = homedir(), env = process.env) {
+  const configured = env.CLAUDE_CONFIG_DIR;
+  return join(configured ? resolve(configured) : join(home, ".claude"), ".credentials.json");
+}
+__name(claudeCredentialsPath, "claudeCredentialsPath");
+function windowsPathToWsl(path, mountRoot = DEFAULT_WSL_MOUNT_ROOT) {
+  const normalized = path.trim().replaceAll("\\", "/");
+  const match = /^([A-Za-z]):\/(.+)$/u.exec(normalized);
+  if (!match?.[1] || !match[2] || match[2].split("/").includes("..")) return null;
+  return `${mountRoot}${match[1].toLowerCase()}/${match[2]}`;
+}
+__name(windowsPathToWsl, "windowsPathToWsl");
+function wslWindowsHome(env = process.env, run2 = execFileSync, command, mountRoot) {
+  if (!env.WSL_DISTRO_NAME && !env.WSL_INTEROP) return null;
+  const root = mountRoot ?? readWslMountRoot();
+  const cmd = command ?? `${wslSystem32(root)}/cmd.exe`;
+  try {
+    if (!statSync(cmd).isFile()) return null;
+    const output = run2(cmd, ["/d", "/s", "/c", "echo", "%USERPROFILE%"], {
+      encoding: "utf8",
+      timeout: 1e3,
+      // The interop shim that fronts a Windows process does not honour
+      // SIGTERM the way a Linux process does; a probe that overran its
+      // second was left alive, and the synchronous call waited on it for
+      // as long as Windows took to answer. SIGKILL is what actually ends
+      // it, and the answer is "no paired home", which is the correct one
+      // for a probe that could not be made in time.
+      killSignal: "SIGKILL",
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return windowsPathToWsl(String(output), root);
+  } catch {
+    return null;
+  }
+}
+__name(wslWindowsHome, "wslWindowsHome");
+function readClaudeFileCredentialCandidates(home, env = process.env, windowsHome = home === void 0 ? wslWindowsHome(env) : null) {
+  return claudeCredentialSearchPaths(home, env, windowsHome).flatMap((path) => {
+    const credential = readClaudeCredentialFile(path);
+    return credential ? [{ path, credential }] : [];
+  });
+}
+__name(readClaudeFileCredentialCandidates, "readClaudeFileCredentialCandidates");
+function claudeCredentialSearchPaths(home, env = process.env, windowsHome = home === void 0 ? wslWindowsHome(env) : null) {
+  const paths = env.CLAUDE_CONFIG_DIR ? [claudeCredentialsPath(home, env)] : [
+    claudeCredentialsPath(home, env),
+    ...windowsHome ? [claudeCredentialsPath(windowsHome, {})] : []
+  ];
+  return [...new Set(paths)];
+}
+__name(claudeCredentialSearchPaths, "claudeCredentialSearchPaths");
+function codexCredentialsPath(home = homedir(), env = process.env) {
+  const configured = env.CODEX_HOME?.trim();
+  const root = configured ? isAbsolute(configured) ? configured : resolve(configured) : join(home, ".codex");
+  return join(root, "auth.json");
+}
+__name(codexCredentialsPath, "codexCredentialsPath");
+function opencodeCredentialsPath(home = homedir(), env = process.env) {
+  const configured = env.XDG_DATA_HOME?.trim();
+  const root = configured && isAbsolute(configured) ? configured : join(home, ".local", "share");
+  return join(root, "opencode", "auth.json");
+}
+__name(opencodeCredentialsPath, "opencodeCredentialsPath");
+function readOpenCodeApiCredentialCandidates(home, env = process.env, windowsHome = home === void 0 ? wslWindowsHome(env) : null) {
+  const parse = /* @__PURE__ */ __name((value, source) => {
+    const root = record(value);
+    return ["opencode", "opencode-go"].flatMap((id) => {
+      const entry = record(root?.[id]);
+      const apiKey = typeof entry?.key === "string" ? entry.key.trim() : void 0;
+      return entry?.type === "api" && apiKey && apiKey !== "public" ? [
+        {
+          provider: id === "opencode" ? "zen" : "zen-go",
+          apiKey,
+          source
+        }
+      ] : [];
+    });
+  }, "parse");
+  if (env.OPENCODE_AUTH_CONTENT !== void 0) {
+    try {
+      if (Buffer.byteLength(env.OPENCODE_AUTH_CONTENT, "utf8") > MAX_CREDENTIAL_FILE_BYTES)
+        return [];
+      return parse(JSON.parse(env.OPENCODE_AUTH_CONTENT), {
+        kind: "env",
+        envName: "OPENCODE_AUTH_CONTENT"
+      });
+    } catch {
+      return [];
+    }
+  }
+  const paths = env.XDG_DATA_HOME?.trim() && isAbsolute(env.XDG_DATA_HOME.trim()) ? [opencodeCredentialsPath(home, env)] : [
+    opencodeCredentialsPath(home, env),
+    ...windowsHome ? [opencodeCredentialsPath(windowsHome, {})] : []
+  ];
+  return [...new Set(paths)].flatMap(
+    (path) => parse(readCredentialJson(path), { kind: "opencode-file", path })
+  );
+}
+__name(readOpenCodeApiCredentialCandidates, "readOpenCodeApiCredentialCandidates");
+function readCredentialJson(path) {
+  try {
+    const stat = statSync(path);
+    if (!stat.isFile() || stat.size <= 0 || stat.size > MAX_CREDENTIAL_FILE_BYTES) return null;
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+__name(readCredentialJson, "readCredentialJson");
+function record(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
+__name(record, "record");
+function optionalString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+__name(optionalString, "optionalString");
+function optionalFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+__name(optionalFiniteNumber, "optionalFiniteNumber");
+function optionalStringArray(value) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) return void 0;
+  return value;
+}
+__name(optionalStringArray, "optionalStringArray");
+function readClaudeFileCredential(home = homedir(), env = process.env) {
+  return readClaudeCredentialFile(claudeCredentialsPath(home, env));
+}
+__name(readClaudeFileCredential, "readClaudeFileCredential");
+function readClaudeCredentialFile(path) {
+  const root = record(readCredentialJson(path));
+  const oauth = record(root?.claudeAiOauth);
+  const accessToken = optionalString(oauth?.accessToken);
+  if (!accessToken) return null;
+  return {
+    accessToken,
+    refreshToken: optionalString(oauth?.refreshToken),
+    expiresAt: optionalFiniteNumber(oauth?.expiresAt),
+    scopes: optionalStringArray(oauth?.scopes)
+  };
+}
+__name(readClaudeCredentialFile, "readClaudeCredentialFile");
+function sameClaudeCredential(left, right) {
+  return left.accessToken === right.accessToken && left.refreshToken === right.refreshToken && left.expiresAt === right.expiresAt && JSON.stringify(left.scopes ?? []) === JSON.stringify(right.scopes ?? []);
+}
+__name(sameClaudeCredential, "sameClaudeCredential");
+function replaceClaudeCredentialFile(path, expected, replacement) {
+  const root = record(readCredentialJson(path));
+  const oauth = record(root?.claudeAiOauth);
+  const current = readClaudeCredentialFile(path);
+  if (!root || !oauth || !current) return { replaced: false, current };
+  if (!sameClaudeCredential(current, expected)) return { replaced: false, current };
+  const updated = {
+    ...root,
+    claudeAiOauth: {
+      ...oauth,
+      accessToken: replacement.accessToken,
+      ...replacement.refreshToken === void 0 ? {} : { refreshToken: replacement.refreshToken },
+      ...replacement.expiresAt === void 0 ? {} : { expiresAt: replacement.expiresAt },
+      ...replacement.scopes === void 0 ? {} : { scopes: replacement.scopes }
+    }
+  };
+  const tempPath = join(
+    dirname(path),
+    `.${basename(path)}.namzu-${process.pid}-${randomBytes(8).toString("hex")}.tmp`
+  );
+  let descriptor;
+  try {
+    descriptor = openSync(tempPath, "wx", 384);
+    writeFileSync(descriptor, `${JSON.stringify(updated, null, 2)}
+`, "utf8");
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    descriptor = void 0;
+    const beforeCommit = readClaudeCredentialFile(path);
+    if (!beforeCommit || !sameClaudeCredential(beforeCommit, expected)) {
+      return { replaced: false, current: beforeCommit };
+    }
+    renameSync(tempPath, path);
+    return { replaced: true, current: replacement };
+  } finally {
+    if (descriptor !== void 0) {
+      try {
+        closeSync(descriptor);
+      } catch {
+      }
+    }
+    try {
+      unlinkSync(tempPath);
+    } catch {
+    }
+  }
+}
+__name(replaceClaudeCredentialFile, "replaceClaudeCredentialFile");
+function codexCredentialFromTokens(tokens) {
+  if (tokens.accessToken.length === 0) return null;
+  const claims = jwtClaims(tokens.accessToken);
+  const accountId = tokens.accountId ?? claims.accountId;
+  if (!accountId) return null;
+  return {
+    accessToken: tokens.accessToken,
+    ...tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {},
+    accountId,
+    ...claims.expiresAt === void 0 ? {} : { expiresAt: claims.expiresAt }
+  };
+}
+__name(codexCredentialFromTokens, "codexCredentialFromTokens");
+function jwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1]) return {};
+  try {
+    const payload = record(JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")));
+    const auth = record(payload?.["https://api.openai.com/auth"]);
+    const exp = optionalFiniteNumber(payload?.exp);
+    return {
+      ...exp === void 0 ? {} : { expiresAt: exp * 1e3 },
+      ...optionalString(auth?.chatgpt_account_id) ? { accountId: optionalString(auth?.chatgpt_account_id) } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+__name(jwtClaims, "jwtClaims");
+function readCodexFileCredential(home = homedir(), env = process.env) {
+  return readCodexCredentialFile(codexCredentialsPath(home, env));
+}
+__name(readCodexFileCredential, "readCodexFileCredential");
+function readCodexFileCredentialCandidates(home, env = process.env, windowsHome = home === void 0 ? wslWindowsHome(env) : null) {
+  const paths = env.CODEX_HOME?.trim() ? [codexCredentialsPath(home, env)] : [
+    codexCredentialsPath(home, env),
+    ...windowsHome ? [codexCredentialsPath(windowsHome, {})] : []
+  ];
+  return [...new Set(paths)].flatMap((path) => {
+    const credential = readCodexCredentialFile(path);
+    return credential ? [{ path, credential }] : [];
+  });
+}
+__name(readCodexFileCredentialCandidates, "readCodexFileCredentialCandidates");
+function readCodexCredentialFile(path) {
+  const root = record(readCredentialJson(path));
+  const tokens = record(root?.tokens);
+  const accessToken = optionalString(tokens?.access_token);
+  if (!accessToken) return null;
+  const accessClaims = jwtClaims(accessToken);
+  const idToken = optionalString(tokens?.id_token);
+  const idClaims = idToken ? jwtClaims(idToken) : {};
+  const accountId = optionalString(tokens?.account_id) ?? accessClaims.accountId ?? idClaims.accountId;
+  if (!accountId) return null;
+  return codexCredentialFromTokens({
+    accessToken,
+    ...optionalString(tokens?.refresh_token) ? { refreshToken: optionalString(tokens?.refresh_token) } : {},
+    accountId
+  });
+}
+__name(readCodexCredentialFile, "readCodexCredentialFile");
+function preferFresherCredential(left, right, now = Date.now()) {
+  if (!left) return right;
+  if (!right) return left;
+  const leftExpiry = left.expiresAt ?? Number.POSITIVE_INFINITY;
+  const rightExpiry = right.expiresAt ?? Number.POSITIVE_INFINITY;
+  const leftFresh = leftExpiry > now + 6e4;
+  const rightFresh = rightExpiry > now + 6e4;
+  if (leftFresh !== rightFresh) return leftFresh ? left : right;
+  return leftExpiry >= rightExpiry ? left : right;
+}
+__name(preferFresherCredential, "preferFresherCredential");
+
+// src/integrations/providers/gemini-credentials.ts
+import { constants, closeSync as closeSync2, fstatSync, openSync as openSync2, readSync } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+var REFRESH_URL = "https://oauth2.googleapis.com/token";
+var MAX_BYTES = 1024 * 1024;
+function readGeminiCredentialFile(path) {
+  let fd;
+  try {
+    fd = openSync2(path, constants.O_RDONLY | constants.O_NONBLOCK);
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > MAX_BYTES) return null;
+    const buffer = Buffer.alloc(MAX_BYTES + 1);
+    let size = 0;
+    while (size < buffer.length) {
+      const count = readSync(fd, buffer, size, buffer.length - size, null);
+      if (count === 0) break;
+      size += count;
+    }
+    if (size > MAX_BYTES) return null;
+    const value = JSON.parse(buffer.subarray(0, size).toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const record2 = value;
+    if (typeof record2.access_token !== "string" || !record2.access_token.trim()) return null;
+    if (record2.expiry_date !== void 0 && (typeof record2.expiry_date !== "number" || !Number.isFinite(record2.expiry_date) || record2.expiry_date <= 0))
+      return null;
+    return {
+      accessToken: record2.access_token,
+      ...typeof record2.refresh_token === "string" && record2.refresh_token.trim() ? { refreshToken: record2.refresh_token } : {},
+      ...typeof record2.expiry_date === "number" ? { expiresAt: record2.expiry_date } : {}
+    };
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+  }
+}
+__name(readGeminiCredentialFile, "readGeminiCredentialFile");
+function readGeminiFileCredentialCandidates(home, env = process.env, windowsHome = home === void 0 ? wslWindowsHome(env) : null) {
+  const paths = env.GEMINI_CLI_HOME ? [join2(env.GEMINI_CLI_HOME, ".gemini", "oauth_creds.json")] : [
+    join2(home ?? homedir2(), ".gemini", "oauth_creds.json"),
+    ...windowsHome ? [join2(windowsHome, ".gemini", "oauth_creds.json")] : []
+  ];
+  return [...new Set(paths)].flatMap((path) => {
+    const credential = readGeminiCredentialFile(path);
+    return credential && (credential.expiresAt === void 0 || credential.expiresAt > Date.now() + 6e4 || credential.refreshToken) ? [{ path, credential }] : [];
+  });
+}
+__name(readGeminiFileCredentialCandidates, "readGeminiFileCredentialCandidates");
+function createGeminiAccessTokenResolver(path, fetchFn = globalThis.fetch, env = process.env) {
+  let source;
+  let cached;
+  let pending;
+  return async (signal) => {
+    signal?.throwIfAborted();
+    const owner = readGeminiCredentialFile(path);
+    if (!owner)
+      throw new Error("Gemini CLI sign-in is no longer available. Sign in with Gemini CLI again.");
+    const fingerprint = JSON.stringify(owner);
+    if (source !== fingerprint) {
+      source = fingerprint;
+      cached = owner;
+      pending = void 0;
+    }
+    const current = cached ?? owner;
+    if (current.expiresAt === void 0 || current.expiresAt > Date.now() + 6e4)
+      return current.accessToken;
+    if (!current.refreshToken)
+      throw new Error("Gemini CLI sign-in has expired. Sign in with Gemini CLI again.");
+    const clientId = env.GOOGLE_OAUTH_CLIENT_ID?.trim();
+    const clientSecret = env.GOOGLE_OAUTH_CLIENT_SECRET?.trim();
+    if (!clientId || !clientSecret)
+      throw new Error(
+        "Gemini CLI sign-in has expired. Refresh it in Gemini CLI, or configure the matching GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET."
+      );
+    if (!pending) {
+      const refresh = current.refreshToken;
+      const operation = (async () => {
+        const response = await fetchFn(REFRESH_URL, {
+          method: "POST",
+          redirect: "error",
+          signal: AbortSignal.timeout(15e3),
+          headers: { "content-type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            client_id: clientId,
+            client_secret: clientSecret,
+            refresh_token: refresh,
+            grant_type: "refresh_token"
+          })
+        });
+        if (!response.ok)
+          throw new Error(
+            `Gemini CLI sign-in could not be refreshed (HTTP ${response.status}). Sign in with Gemini CLI again.`
+          );
+        const value = await response.json();
+        if (typeof value.access_token !== "string" || !value.access_token || typeof value.expires_in !== "number" || !Number.isFinite(value.expires_in) || value.expires_in <= 0)
+          throw new Error("Google returned an invalid sign-in refresh response.");
+        if (source === fingerprint)
+          cached = {
+            accessToken: value.access_token,
+            refreshToken: typeof value.refresh_token === "string" ? value.refresh_token : refresh,
+            expiresAt: Date.now() + value.expires_in * 1e3
+          };
+        return value.access_token;
+      })();
+      pending = operation;
+      void operation.finally(() => {
+        if (pending === operation) pending = void 0;
+      }).catch(() => {
+      });
+    }
+    if (!signal) return pending;
+    signal.throwIfAborted();
+    return new Promise((resolve2, reject) => {
+      const abort = /* @__PURE__ */ __name(() => reject(signal.reason), "abort");
+      signal.addEventListener("abort", abort, { once: true });
+      pending?.then(resolve2, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+  };
+}
+__name(createGeminiAccessTokenResolver, "createGeminiAccessTokenResolver");
+
+// src/integrations/providers/keychain.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { platform } from "node:os";
+var KEYCHAIN_SERVICE = "Claude Code-credentials";
+function readAgentKeychainCredential() {
+  if (platform() !== "darwin") return null;
+  let raw;
+  try {
+    raw = execFileSync2("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"], {
+      encoding: "utf8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+  if (raw.length === 0) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const env = parsed.claudeAiOauth;
+  if (typeof env !== "object" || env === null) return null;
+  const oauth = env;
+  const accessToken = oauth.accessToken;
+  if (typeof accessToken !== "string" || accessToken.length === 0) return null;
+  return {
+    accessToken,
+    refreshToken: typeof oauth.refreshToken === "string" ? oauth.refreshToken : void 0,
+    expiresAt: typeof oauth.expiresAt === "number" ? oauth.expiresAt : void 0,
+    scopes: Array.isArray(oauth.scopes) ? oauth.scopes.filter((s) => typeof s === "string") : void 0
+  };
+}
+__name(readAgentKeychainCredential, "readAgentKeychainCredential");
+function isAnthropicOAuthToken(value) {
+  if (value.startsWith("sk-ant-api")) return false;
+  if (value.startsWith("sk-ant-oat")) return true;
+  if (value.startsWith("eyJ")) return true;
+  if (value.startsWith("cc-")) return true;
+  return false;
+}
+__name(isAnthropicOAuthToken, "isAnthropicOAuthToken");
+
+// src/integrations/providers/discover.ts
+function signedInSubscriptionProviders(detected) {
+  return detected.filter((provider) => {
+    if (provider.entry.id === "google") return provider.source.kind === "gemini-file";
+    if (provider.entry.subscriptionLogin === void 0) return false;
+    return [provider.source, ...provider.alternatives].some(
+      (source) => source.kind === "claude-file" || source.kind === "codex-file" || source.kind === "keychain" || source.kind === "stored" || source.kind === "env" && source.envName === "CLAUDE_CODE_OAUTH_TOKEN"
+    );
+  });
+}
+__name(signedInSubscriptionProviders, "signedInSubscriptionProviders");
+var DEFAULT_PROBE_TIMEOUT_MS = 300;
+async function discoverProviders(opts = {}) {
+  const env = opts.env ?? process.env;
+  const credentials = new EnvCredentialProvider({ env, anyKey: true });
+  const detected = [];
+  const geminiCredentials = readGeminiFileCredentialCandidates(opts.home, env, opts.windowsHome);
+  const storedCredential = opts.skipStored ? null : readStoredSubscriptionCredential(...opts.home === void 0 ? [] : [opts.home]);
+  const storedCodexCredential = opts.skipStored ? null : readStoredCodexCredential(...opts.home === void 0 ? [] : [opts.home]);
+  const storedGeminiApiKey = opts.skipStored ? null : readStoredGeminiApiKey(...opts.home === void 0 ? [] : [opts.home]);
+  const keychainCredential = opts.skipKeychain || env.CLAUDE_CONFIG_DIR ? null : readAgentKeychainCredential();
+  const claudeFileCredentials = readClaudeFileCredentialCandidates(opts.home, env, opts.windowsHome);
+  const openCodeCredentials = readOpenCodeApiCredentialCandidates(opts.home, env, opts.windowsHome);
+  const codexFileCredentials = readCodexFileCredentialCandidates(
+    opts.home,
+    env,
+    opts.windowsHome
+  ).filter(
+    (candidate) => candidate.credential.expiresAt === void 0 || candidate.credential.expiresAt - Date.now() > 6e4
+  );
+  const usableCodexFileCredential = codexFileCredentials.reduce((current, candidate) => {
+    if (!current) return candidate;
+    return preferFresherCredential(current.credential, candidate.credential) === candidate.credential ? candidate : current;
+  }, null);
+  const probes = /* @__PURE__ */ new Map();
+  if (!opts.skipProbes) {
+    for (const probed of Object.values(PROVIDER_REGISTRY)) {
+      if (probed.probeUrl) probes.set(probed.id, probe(probed.probeUrl, opts));
+    }
+  }
+  for (const id of Object.keys(PROVIDER_REGISTRY)) {
+    const entry = PROVIDER_REGISTRY[id];
+    const sources = [];
+    let apiKey;
+    let anonymousSelected = false;
+    let oauth;
+    let codex;
+    let gemini;
+    if (id === "anthropic") {
+      const borrowedCandidates = [
+        ...claudeFileCredentials.map(({ credential, path }) => ({
+          credential,
+          source: { kind: "claude-file", path }
+        })),
+        ...keychainCredential ? [
+          {
+            credential: keychainCredential,
+            source: {
+              kind: "keychain",
+              service: KEYCHAIN_SERVICE
+            }
+          }
+        ] : []
+      ].filter(
+        (candidate) => candidate.credential.expiresAt === void 0 || candidate.credential.expiresAt - Date.now() > 6e4 || candidate.source.kind === "claude-file" && candidate.credential.refreshToken !== void 0
+      );
+      const borrowed = borrowedCandidates.reduce(
+        (current, candidate) => {
+          if (!current) return candidate;
+          return preferFresherCredential(current.credential, candidate.credential) === candidate.credential ? candidate : current;
+        },
+        null
+      );
+      if (borrowed) {
+        if (apiKey === void 0) {
+          apiKey = borrowed.credential.accessToken;
+          oauth = {
+            refreshToken: borrowed.credential.refreshToken,
+            expiresAt: borrowed.credential.expiresAt,
+            origin: borrowed.source.kind === "claude-file" ? "claude-file" : "keychain",
+            ...borrowed.source.kind === "claude-file" ? { sourcePath: borrowed.source.path } : {}
+          };
+        }
+        sources.push(borrowed.source);
+      }
+      for (const candidate of borrowedCandidates) {
+        if (candidate !== borrowed) sources.push(candidate.source);
+      }
+      if (storedCredential) {
+        if (apiKey === void 0) {
+          apiKey = storedCredential.accessToken;
+          oauth = {
+            refreshToken: storedCredential.refreshToken,
+            expiresAt: storedCredential.expiresAt,
+            origin: "stored"
+          };
+        }
+        sources.push({
+          kind: "stored",
+          path: credentialsPath(...opts.home === void 0 ? [] : [opts.home])
+        });
+      }
+    }
+    if (id === "codex" && (storedCodexCredential || usableCodexFileCredential)) {
+      const credential = usableCodexFileCredential?.credential ?? storedCodexCredential;
+      if (!credential) throw new Error("unreachable");
+      apiKey = credential.accessToken;
+      sources.push({
+        kind: usableCodexFileCredential ? "codex-file" : "stored",
+        path: usableCodexFileCredential ? usableCodexFileCredential.path : credentialsPath(...opts.home === void 0 ? [] : [opts.home])
+      });
+      codex = {
+        accountId: credential.accountId,
+        expiresAt: credential.expiresAt,
+        origin: usableCodexFileCredential ? "codex-file" : "stored"
+      };
+      if (storedCodexCredential && usableCodexFileCredential) {
+        sources.push({
+          kind: "stored",
+          path: credentialsPath(...opts.home === void 0 ? [] : [opts.home])
+        });
+      }
+      for (const candidate of codexFileCredentials) {
+        if (candidate !== usableCodexFileCredential) {
+          sources.push({ kind: "codex-file", path: candidate.path });
+        }
+      }
+    }
+    for (const envName of entry.envVars) {
+      const resolved = await credentials.resolve(envName);
+      if (anonymousSelected) continue;
+      if ((id === "zen" || id === "zen-go") && resolved?.value.trim() === "public") {
+        if (sources.length === 0) {
+          anonymousSelected = true;
+          sources.push({ kind: "env", envName });
+        }
+        continue;
+      }
+      if (resolved && hasApiCredential(entry, resolved.value)) {
+        if (apiKey === void 0) apiKey = resolved.value;
+        sources.push({ kind: "env", envName });
+      }
+    }
+    if (!opts.skipStored && id !== "google" && entry.acceptsTypedCredential) {
+      const saved = readStoredApiKey(id, opts.home);
+      if (saved && hasApiCredential(entry, saved)) {
+        if (apiKey === void 0) apiKey = saved;
+        sources.push({ kind: "stored-api-key", path: apiKeysPath(opts.home) });
+      }
+    }
+    if (id === "google") {
+      if (storedGeminiApiKey && hasApiCredential(entry, storedGeminiApiKey)) {
+        if (apiKey === void 0) apiKey = storedGeminiApiKey;
+        sources.push({
+          kind: "stored-gemini-key",
+          path: googleApiKeyPath(...opts.home === void 0 ? [] : [opts.home])
+        });
+      }
+      const borrowed = geminiCredentials[0];
+      if (borrowed) {
+        if (apiKey === void 0) {
+          apiKey = borrowed.credential.accessToken;
+          const projectId = env.GOOGLE_CLOUD_PROJECT?.trim() || env.GOOGLE_CLOUD_PROJECT_ID?.trim();
+          gemini = {
+            sourcePath: borrowed.path,
+            ...projectId ? { projectId } : {}
+          };
+        }
+        sources.push({ kind: "gemini-file", path: borrowed.path });
+      }
+    }
+    if (id === "zen" || id === "zen-go") {
+      for (const candidate of openCodeCredentials) {
+        if (anonymousSelected) break;
+        if (candidate.provider !== id) continue;
+        if (apiKey === void 0) apiKey = candidate.apiKey;
+        sources.push(candidate.source);
+      }
+      if (id === "zen" && sources.length === 0) sources.push({ kind: "public" });
+    }
+    if (id === "zen-go" && anonymousSelected) continue;
+    if (sources.length === 0 && entry.probeUrl && probes.has(id)) {
+      const reachable = await probes.get(id);
+      if (reachable) {
+        sources.push({ kind: "probe", url: entry.probeUrl });
+      }
+    }
+    if (sources.length > 0) {
+      detected.push({
+        entry,
+        source: sources[0],
+        apiKey,
+        baseUrl: entry.defaultBaseUrl,
+        ...oauth ? { oauth } : {},
+        ...codex ? { codex } : {},
+        ...gemini ? { gemini } : {},
+        alternatives: sources.slice(1)
+      });
+    }
+  }
+  return detected.sort((left, right) => automaticRank(left) - automaticRank(right));
+}
+__name(discoverProviders, "discoverProviders");
+function isAnonymousZen(provider) {
+  return provider.entry.id === "zen" && !hasApiCredential(provider.entry, provider.apiKey);
+}
+__name(isAnonymousZen, "isAnonymousZen");
+var AUTOMATIC_ORDER = ["sign-in", "key", "local", "free"];
+function automaticKind(provider) {
+  if (isAnonymousZen(provider)) return "free";
+  if (signedInSubscriptionProviders([provider]).length > 0) return "sign-in";
+  if (provider.source?.kind === "probe") return "local";
+  return "key";
+}
+__name(automaticKind, "automaticKind");
+function automaticRank(provider) {
+  return AUTOMATIC_ORDER.indexOf(automaticKind(provider));
+}
+__name(automaticRank, "automaticRank");
+function automaticChoice(detected) {
+  const ranked = [...detected].sort((left, right) => automaticRank(left) - automaticRank(right));
+  const provider = ranked[0];
+  return provider ? { provider, kind: automaticKind(provider) } : null;
+}
+__name(automaticChoice, "automaticChoice");
+function describeAutomaticChoice(choice) {
+  const { provider, kind } = choice;
+  const product = provider.entry.label.replace(/\s*\(.*\)\s*$/, "").trim() || provider.entry.label;
+  switch (kind) {
+    case "sign-in": {
+      const account = provider.entry.id === "anthropic" ? "Claude" : provider.entry.id === "codex" ? "ChatGPT or Codex" : product;
+      return `Using your ${account} sign-in, found on this computer.`;
+    }
+    case "key":
+      return `Using your ${product} key, found on this computer.`;
+    case "local":
+      return `Using ${product} running on this computer.`;
+    case "free":
+      return "Using Zen's free models (experimental).";
+  }
+}
+__name(describeAutomaticChoice, "describeAutomaticChoice");
+async function probe(url, opts) {
+  const fetchFn = opts.fetch ?? globalThis.fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(
+    () => controller.abort(),
+    opts.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS
+  );
+  try {
+    const res = await fetchFn(url, {
+      method: "GET",
+      signal: controller.signal
+    });
+    return res.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+__name(probe, "probe");
+function findDetected(list, id) {
+  return list.find((d) => d.entry.id === id) ?? null;
+}
+__name(findDetected, "findDetected");
+
+// src/integrations/providers/preferences.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var PREFERENCES_FILE_VERSION = 3;
+function chainPositionName(index) {
+  return index === 0 ? "primary provider" : `fallback #${index}`;
+}
+__name(chainPositionName, "chainPositionName");
+var PreferencesError = class extends Error {
+  static {
+    __name(this, "PreferencesError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "PreferencesError";
+  }
+};
+function primaryProvider(prefs) {
+  const first = prefs.providers?.[0];
+  if (!first) {
+    throw new PreferencesError("preferences.providers is empty \u2014 no provider to run");
+  }
+  return first;
+}
+__name(primaryProvider, "primaryProvider");
+function preferencesPath(home) {
+  return join3(namzuHomePath(home), "preferences.json");
+}
+__name(preferencesPath, "preferencesPath");
+function readPreferences(home) {
+  const path = preferencesPath(home);
+  let raw;
+  try {
+    raw = readFileSync3(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return { status: "missing" };
+    throw new PreferencesError(
+      `could not read ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new PreferencesError(
+      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new PreferencesError(`${path} top-level must be an object`);
+  }
+  const v = parsed;
+  if (v.version === 1) {
+    return {
+      status: "needs-repick",
+      reason: "preferences file uses an older schema (v1) \u2014 namzu now picks an LLM provider client directly. Please re-pick."
+    };
+  }
+  if (v.version === 2) {
+    const migrated = migrateV2(parsed);
+    if (!migrated) {
+      throw new PreferencesError(`${path} has an unexpected shape for a v2 file`);
+    }
+    const invalid2 = describeInvalidChain(migrated.providers);
+    if (invalid2) return { status: "needs-repick", reason: `${invalid2} \u2014 please re-pick.` };
+    return { status: "ok", prefs: migrated };
+  }
+  if (v.version !== PREFERENCES_FILE_VERSION) {
+    return {
+      status: "needs-repick",
+      reason: `preferences file at unsupported version ${String(v.version)} \u2014 please re-pick.`
+    };
+  }
+  if (!isPreferences(parsed)) {
+    throw new PreferencesError(`${path} has an unexpected shape`);
+  }
+  const invalid = describeInvalidChain(parsed.providers);
+  if (invalid) return { status: "needs-repick", reason: `${invalid} \u2014 please re-pick.` };
+  return { status: "ok", prefs: parsed };
+}
+__name(readPreferences, "readPreferences");
+function writePreferences(prefs, home) {
+  if (prefs.version !== PREFERENCES_FILE_VERSION) {
+    throw new PreferencesError(
+      `unsupported preferences version: ${String(prefs.version)} (expected ${PREFERENCES_FILE_VERSION})`
+    );
+  }
+  if (!Array.isArray(prefs.providers) || prefs.providers.length === 0) {
+    throw new PreferencesError("preferences.providers must list at least one provider");
+  }
+  const invalid = describeInvalidChain(prefs.providers);
+  if (invalid) throw new PreferencesError(invalid);
+  const path = preferencesPath(home);
+  mkdirSync(dirname2(path), { recursive: true, mode: DIR_MODE });
+  const body = `${JSON.stringify(prefs, null, 2)}
+`;
+  const tmp = `${path}.tmp.${process.pid}.${randomBytes2(4).toString("hex")}`;
+  writeFileSync2(tmp, body, { mode: FILE_MODE });
+  chmodSync(tmp, FILE_MODE);
+  renameSync2(tmp, path);
+}
+__name(writePreferences, "writePreferences");
+function migrateV2(value) {
+  const v = value;
+  if (typeof v.provider !== "string" || v.provider.length === 0) return null;
+  if (v.model !== void 0 && typeof v.model !== "string") return null;
+  if (!isSubagents(v.subagents)) return null;
+  const member = {
+    id: v.provider,
+    ...typeof v.model === "string" ? { model: v.model } : {}
+  };
+  return {
+    version: PREFERENCES_FILE_VERSION,
+    providers: [member],
+    ...v.subagents !== void 0 ? { subagents: v.subagents } : {}
+  };
+}
+__name(migrateV2, "migrateV2");
+function describeInvalidChain(members) {
+  if (members.length === 0) {
+    return "preferences lists no providers";
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, member] of members.entries()) {
+    const position = chainPositionName(index);
+    if (!(member.id in PROVIDER_REGISTRY)) {
+      return `${position} "${member.id}" is not a provider namzu knows (known: ${Object.keys(PROVIDER_REGISTRY).join(", ")})`;
+    }
+    if (index === 0 && !PROVIDER_REGISTRY[member.id].constructible) {
+      return unsupportedProviderMessage(member.id);
+    }
+    const key = JSON.stringify([member.id, member.model ?? null]);
+    if (seen.has(key)) {
+      const shown = member.model ? `${member.id} (${member.model})` : member.id;
+      return `${position} repeats "${shown}", which is already earlier in the chain \u2014 a provider cannot be its own fallback`;
+    }
+    seen.add(key);
+  }
+  return null;
+}
+__name(describeInvalidChain, "describeInvalidChain");
+function isSubagents(value) {
+  if (value === void 0) return true;
+  if (typeof value !== "object" || value === null) return false;
+  const sa = value;
+  if (!Array.isArray(sa.active)) return false;
+  for (const item of sa.active) {
+    if (typeof item !== "string") return false;
+  }
+  return true;
+}
+__name(isSubagents, "isSubagents");
+function isProviderChoice(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (typeof v.id !== "string" || v.id.length === 0) return false;
+  if (v.model !== void 0 && typeof v.model !== "string") return false;
+  return true;
+}
+__name(isProviderChoice, "isProviderChoice");
+function isPreferences(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  if (v.version !== PREFERENCES_FILE_VERSION) return false;
+  if (!Array.isArray(v.providers)) return false;
+  for (const member of v.providers) {
+    if (!isProviderChoice(member)) return false;
+  }
+  if (v.allowCapabilityMismatch !== void 0 && typeof v.allowCapabilityMismatch !== "boolean") {
+    return false;
+  }
+  if (!isSubagents(v.subagents)) return false;
+  return true;
+}
+__name(isPreferences, "isPreferences");
+
+// src/integrations/providers/chain-capabilities.ts
+var BOOLEAN_CAPABILITIES = [
+  {
+    key: "supportsTools",
+    has: "it can call tools",
+    lacks: "it cannot call tools",
+    consequence: "tools become unavailable"
+  },
+  {
+    key: "supportsFunctionCalling",
+    has: "it supports function calling",
+    lacks: "it does not support function calling",
+    consequence: "function calling becomes unavailable"
+  },
+  {
+    key: "supportsStreaming",
+    has: "it can stream replies",
+    lacks: "it cannot stream replies",
+    consequence: "replies stop streaming"
+  },
+  {
+    key: "supportsVision",
+    has: "it can read image attachments",
+    lacks: "it cannot read image attachments",
+    consequence: "image attachments stop being sent"
+  },
+  {
+    key: "supportsDocuments",
+    has: "it can read document attachments",
+    lacks: "it cannot read document attachments",
+    consequence: "document attachments stop being sent"
+  }
+];
+function describe(index, member) {
+  const entry = PROVIDER_REGISTRY[member.id];
+  return `${chainPositionName(index)} (${entry ? entry.label : member.id})`;
+}
+__name(describe, "describe");
+function chainCapabilityDisagreements(members, resolved) {
+  const out = [];
+  for (const capability of BOOLEAN_CAPABILITIES) {
+    const firstWithIt = resolved.findIndex(
+      (entry) => entry.kind === "known" && entry.capabilities[capability.key] === true
+    );
+    if (firstWithIt === -1) continue;
+    const has = members[firstWithIt];
+    if (!has) continue;
+    for (const [index, entry] of resolved.entries()) {
+      if (entry.kind !== "known" || index === firstWithIt) continue;
+      if (entry.capabilities[capability.key] === true) continue;
+      const lacks = members[index];
+      if (!lacks) continue;
+      out.push({
+        declaredBy: firstWithIt,
+        missingFrom: index,
+        sentence: `${describe(index, lacks)} declares ${capability.lacks}, while ${describe(firstWithIt, has)} declares ${capability.has} \u2014 if the chain falls over to it, ${capability.consequence}.`
+      });
+    }
+  }
+  out.push(...ceilingDisagreements(members, resolved));
+  return out;
+}
+__name(chainCapabilityDisagreements, "chainCapabilityDisagreements");
+function ceilingDisagreements(members, resolved) {
+  const ceilings = [];
+  for (const [index, entry] of resolved.entries()) {
+    if (entry.kind !== "known") continue;
+    const value = entry.capabilities.maxOutputTokens;
+    if (typeof value === "number") ceilings.push({ index, value });
+  }
+  let largest;
+  for (const ceiling of ceilings) {
+    if (!largest || ceiling.value > largest.value) largest = ceiling;
+  }
+  if (!largest) return [];
+  const out = [];
+  for (const ceiling of ceilings) {
+    if (ceiling.value >= largest.value) continue;
+    const has = members[largest.index];
+    const lacks = members[ceiling.index];
+    if (!has || !lacks) continue;
+    out.push({
+      declaredBy: largest.index,
+      missingFrom: ceiling.index,
+      sentence: `${describe(ceiling.index, lacks)} declares a maximum output of ${ceiling.value} tokens, below ${describe(largest.index, has)} at ${largest.value} \u2014 if the chain falls over to it, replies are capped at ${ceiling.value}.`
+    });
+  }
+  return out;
+}
+__name(ceilingDisagreements, "ceilingDisagreements");
+function unresolvedMembers(members, resolved) {
+  const out = [];
+  for (const [index, entry] of resolved.entries()) {
+    const member = members[index];
+    if (entry.kind !== "unresolved" || !member) continue;
+    out.push(`${describe(index, member)}: ${entry.reason}`);
+  }
+  return out;
+}
+__name(unresolvedMembers, "unresolvedMembers");
+function describeCapabilityRefusal(disagreements) {
+  if (disagreements.length === 0) return null;
+  return [
+    "The providers in your chain declare different capabilities, so namzu cannot honour the chain as written:",
+    ...disagreements.map((d) => `  - ${d.sentence}`),
+    "",
+    "Taking the strongest answer would advertise abilities a fallback does not have. Taking the weakest would cost your primary a capability on every turn, to guard against a failure that happens rarely. Neither is chosen for you.",
+    'Either drop the member that disagrees, or set "allowCapabilityMismatch": true in ~/.namzu/preferences.json to accept the limitation \u2014 it is printed on every launch.'
+  ].join("\n");
+}
+__name(describeCapabilityRefusal, "describeCapabilityRefusal");
+function describeAcceptedMismatch(disagreements) {
+  if (disagreements.length === 0) return null;
+  return [
+    "Provider chain: the members declare different capabilities, and you have accepted that.",
+    ...disagreements.map((d) => `  - ${d.sentence}`)
+  ].join("\n");
+}
+__name(describeAcceptedMismatch, "describeAcceptedMismatch");
+
+// src/integrations/providers/register.ts
+var registered = /* @__PURE__ */ new Set();
+async function ensureRegistered(id) {
+  if (registered.has(id)) return;
+  switch (id) {
+    case "anthropic": {
+      const mod = await import("./dist-ERN5DRKK.js");
+      mod.registerAnthropic();
+      break;
+    }
+    case "google": {
+      const mod = await import("./dist-BFC7XUCT.js");
+      mod.registerGoogle();
+      break;
+    }
+    case "openai": {
+      const mod = await import("./dist-SKRHHPUR.js");
+      mod.registerOpenAI();
+      break;
+    }
+    case "codex": {
+      const mod = await import("./dist-SKRHHPUR.js");
+      mod.registerCodex();
+      break;
+    }
+    case "deepseek": {
+      const mod = await import("./dist-G42HPNIE.js");
+      mod.registerDeepSeek();
+      break;
+    }
+    case "openrouter": {
+      const mod = await import("./dist-3GJFRS2X.js");
+      mod.registerOpenRouter();
+      break;
+    }
+    case "zen": {
+      const mod = await import("./dist-Z47L7ZAJ.js");
+      mod.registerZen();
+      break;
+    }
+    case "zen-go": {
+      const mod = await import("./dist-Z47L7ZAJ.js");
+      mod.registerZenGo();
+      break;
+    }
+    case "ollama": {
+      const mod = await import("./dist-EY3OJBQH.js");
+      mod.registerOllama();
+      break;
+    }
+    default:
+      throw new Error(unsupportedProviderMessage(id));
+  }
+  registered.add(id);
+}
+__name(ensureRegistered, "ensureRegistered");
+function isRegistered(id) {
+  return registered.has(id);
+}
+__name(isRegistered, "isRegistered");
+async function resolveChainCapabilities(members) {
+  const out = [];
+  for (const member of members) {
+    if (!(member.id in PROVIDER_REGISTRY)) {
+      out.push({
+        kind: "unresolved",
+        reason: `"${member.id}" is not a provider namzu knows`
+      });
+      continue;
+    }
+    try {
+      await ensureRegistered(member.id);
+      out.push({
+        kind: "known",
+        capabilities: resolveProviderCapabilities({
+          capabilities: ProviderRegistry.getCapabilities(member.id)
+        })
+      });
+    } catch (err) {
+      out.push({
+        kind: "unresolved",
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return out;
+}
+__name(resolveChainCapabilities, "resolveChainCapabilities");
+
+export {
+  hasApiCredential,
+  requiresCredentialForModel,
+  canSelectModel,
+  detectWsl,
+  DEFAULT_WSL_MOUNT_ROOT,
+  readWslMountRoot,
+  wslSystem32,
+  readEnvironmentFacts,
+  composeEnvironmentPrompt,
+  claudeCredentialsPath,
+  wslWindowsHome,
+  claudeCredentialSearchPaths,
+  codexCredentialsPath,
+  readClaudeFileCredential,
+  readClaudeCredentialFile,
+  replaceClaudeCredentialFile,
+  codexCredentialFromTokens,
+  readCodexFileCredential,
+  readCodexCredentialFile,
+  createGeminiAccessTokenResolver,
+  KEYCHAIN_SERVICE,
+  readAgentKeychainCredential,
+  isAnthropicOAuthToken,
+  signedInSubscriptionProviders,
+  discoverProviders,
+  isAnonymousZen,
+  automaticKind,
+  automaticChoice,
+  describeAutomaticChoice,
+  findDetected,
+  PREFERENCES_FILE_VERSION,
+  chainPositionName,
+  PreferencesError,
+  primaryProvider,
+  preferencesPath,
+  readPreferences,
+  writePreferences,
+  chainCapabilityDisagreements,
+  unresolvedMembers,
+  describeCapabilityRefusal,
+  describeAcceptedMismatch,
+  ensureRegistered,
+  isRegistered,
+  resolveChainCapabilities
+};
+//# sourceMappingURL=chunk-2A37JQKY.js.map