@noxsoft/anima 2.0.0

package/dist/auth-profiles-_5BsNObq.js

@@ -0,0 +1,1565 @@
+import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
+import { o as resolveOAuthPath, s as resolveStateDir } from "./paths-CCxa0o9c.js";
+import { _ as DEFAULT_AGENT_ID } from "./workspace-Dcfoy5JJ.js";
+import { l as createSubsystemLogger, z as resolveUserPath } from "./exec-BenD3A5l.js";
+import { a as resolveAgentModelPrimary } from "./agent-scope-BVf4aSwY.js";
+import { t as formatCliCommand } from "./command-format-SkzzRqR1.js";
+import { t as parseBooleanValue } from "./boolean-Ce2-qkSB.js";
+import fs from "node:fs/promises";
+import path from "node:path";
+import fs$1 from "node:fs";
+import { execFileSync, execSync } from "node:child_process";
+import { randomBytes, randomUUID } from "node:crypto";
+import "@aws-sdk/client-bedrock";
+import { getEnvApiKey, getOAuthApiKey, getOAuthProviders } from "@mariozechner/pi-ai";
+
+//#region src/agents/auth-profiles/constants.ts
+const AUTH_STORE_VERSION = 1;
+const AUTH_PROFILE_FILENAME = "auth-profiles.json";
+const LEGACY_AUTH_FILENAME = "auth.json";
+const QWEN_CLI_PROFILE_ID = "qwen-portal:qwen-cli";
+const MINIMAX_CLI_PROFILE_ID = "minimax-portal:minimax-cli";
+const AUTH_STORE_LOCK_OPTIONS = {
+	retries: {
+		retries: 10,
+		factor: 2,
+		minTimeout: 100,
+		maxTimeout: 1e4,
+		randomize: true
+	},
+	stale: 3e4
+};
+const EXTERNAL_CLI_SYNC_TTL_MS = 900 * 1e3;
+const EXTERNAL_CLI_NEAR_EXPIRY_MS = 600 * 1e3;
+const log$2 = createSubsystemLogger("agents/auth-profiles");
+
+//#endregion
+//#region src/agents/auth-profiles/display.ts
+function resolveAuthProfileDisplayLabel(params) {
+	const { cfg, store, profileId } = params;
+	const profile = store.profiles[profileId];
+	const email = cfg?.auth?.profiles?.[profileId]?.email?.trim() || (profile && "email" in profile ? profile.email?.trim() : void 0);
+	if (email) return `${profileId} (${email})`;
+	return profileId;
+}
+
+//#endregion
+//#region src/agents/defaults.ts
+const DEFAULT_PROVIDER = "anthropic";
+const DEFAULT_MODEL = "claude-opus-4-6";
+const DEFAULT_CONTEXT_TOKENS = 2e5;
+
+//#endregion
+//#region src/agents/cloudflare-ai-gateway.ts
+const CLOUDFLARE_AI_GATEWAY_PROVIDER_ID = "cloudflare-ai-gateway";
+const CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_ID = "claude-sonnet-4-5";
+const CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_REF = `${CLOUDFLARE_AI_GATEWAY_PROVIDER_ID}/${CLOUDFLARE_AI_GATEWAY_DEFAULT_MODEL_ID}`;
+
+//#endregion
+//#region src/infra/env.ts
+const log$1 = createSubsystemLogger("env");
+function isTruthyEnvValue(value) {
+	return parseBooleanValue(value) === true;
+}
+
+//#endregion
+//#region src/infra/shell-env.ts
+const DEFAULT_TIMEOUT_MS = 15e3;
+const DEFAULT_MAX_BUFFER_BYTES = 2 * 1024 * 1024;
+let lastAppliedKeys = [];
+let cachedShellPath;
+function resolveShell(env) {
+	const shell = env.SHELL?.trim();
+	return shell && shell.length > 0 ? shell : "/bin/sh";
+}
+function parseShellEnv(stdout) {
+	const shellEnv = /* @__PURE__ */ new Map();
+	const parts = stdout.toString("utf8").split("\0");
+	for (const part of parts) {
+		if (!part) continue;
+		const eq = part.indexOf("=");
+		if (eq <= 0) continue;
+		const key = part.slice(0, eq);
+		const value = part.slice(eq + 1);
+		if (!key) continue;
+		shellEnv.set(key, value);
+	}
+	return shellEnv;
+}
+function loadShellEnvFallback(opts) {
+	const logger = opts.logger ?? console;
+	const exec = opts.exec ?? execFileSync;
+	if (!opts.enabled) {
+		lastAppliedKeys = [];
+		return {
+			ok: true,
+			applied: [],
+			skippedReason: "disabled"
+		};
+	}
+	if (opts.expectedKeys.some((key) => Boolean(opts.env[key]?.trim()))) {
+		lastAppliedKeys = [];
+		return {
+			ok: true,
+			applied: [],
+			skippedReason: "already-has-keys"
+		};
+	}
+	const timeoutMs = typeof opts.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) ? Math.max(0, opts.timeoutMs) : DEFAULT_TIMEOUT_MS;
+	const shell = resolveShell(opts.env);
+	let stdout;
+	try {
+		stdout = exec(shell, [
+			"-l",
+			"-c",
+			"env -0"
+		], {
+			encoding: "buffer",
+			timeout: timeoutMs,
+			maxBuffer: DEFAULT_MAX_BUFFER_BYTES,
+			env: opts.env,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		logger.warn(`[anima] shell env fallback failed: ${msg}`);
+		lastAppliedKeys = [];
+		return {
+			ok: false,
+			error: msg,
+			applied: []
+		};
+	}
+	const shellEnv = parseShellEnv(stdout);
+	const applied = [];
+	for (const key of opts.expectedKeys) {
+		if (opts.env[key]?.trim()) continue;
+		const value = shellEnv.get(key);
+		if (!value?.trim()) continue;
+		opts.env[key] = value;
+		applied.push(key);
+	}
+	lastAppliedKeys = applied;
+	return {
+		ok: true,
+		applied
+	};
+}
+function shouldEnableShellEnvFallback(env) {
+	return isTruthyEnvValue(env.ANIMA_LOAD_SHELL_ENV);
+}
+function shouldDeferShellEnvFallback(env) {
+	return isTruthyEnvValue(env.ANIMA_DEFER_SHELL_ENV_FALLBACK);
+}
+function resolveShellEnvFallbackTimeoutMs(env) {
+	const raw = env.ANIMA_SHELL_ENV_TIMEOUT_MS?.trim();
+	if (!raw) return DEFAULT_TIMEOUT_MS;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed)) return DEFAULT_TIMEOUT_MS;
+	return Math.max(0, parsed);
+}
+function getShellPathFromLoginShell(opts) {
+	if (cachedShellPath !== void 0) return cachedShellPath;
+	if (process.platform === "win32") {
+		cachedShellPath = null;
+		return cachedShellPath;
+	}
+	const exec = opts.exec ?? execFileSync;
+	const timeoutMs = typeof opts.timeoutMs === "number" && Number.isFinite(opts.timeoutMs) ? Math.max(0, opts.timeoutMs) : DEFAULT_TIMEOUT_MS;
+	const shell = resolveShell(opts.env);
+	let stdout;
+	try {
+		stdout = exec(shell, [
+			"-l",
+			"-c",
+			"env -0"
+		], {
+			encoding: "buffer",
+			timeout: timeoutMs,
+			maxBuffer: DEFAULT_MAX_BUFFER_BYTES,
+			env: opts.env,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch {
+		cachedShellPath = null;
+		return cachedShellPath;
+	}
+	const shellPath = parseShellEnv(stdout).get("PATH")?.trim();
+	cachedShellPath = shellPath && shellPath.length > 0 ? shellPath : null;
+	return cachedShellPath;
+}
+function getShellEnvAppliedKeys() {
+	return [...lastAppliedKeys];
+}
+
+//#endregion
+//#region src/utils/normalize-secret-input.ts
+/**
+* Secret normalization for copy/pasted credentials.
+*
+* Common footgun: line breaks (especially `\r`) embedded in API keys/tokens.
+* We strip line breaks anywhere, then trim whitespace at the ends.
+*
+* Intentionally does NOT remove ordinary spaces inside the string to avoid
+* silently altering "Bearer <token>" style values.
+*/
+function normalizeSecretInput(value) {
+	if (typeof value !== "string") return "";
+	return value.replace(/[\r\n\u2028\u2029]+/g, "").trim();
+}
+function normalizeOptionalSecretInput(value) {
+	const normalized = normalizeSecretInput(value);
+	return normalized ? normalized : void 0;
+}
+
+//#endregion
+//#region src/agents/model-auth.ts
+const AWS_BEARER_ENV = "AWS_BEARER_TOKEN_BEDROCK";
+const AWS_ACCESS_KEY_ENV = "AWS_ACCESS_KEY_ID";
+const AWS_SECRET_KEY_ENV = "AWS_SECRET_ACCESS_KEY";
+const AWS_PROFILE_ENV = "AWS_PROFILE";
+function resolveProviderConfig(cfg, provider) {
+	const providers = cfg?.models?.providers ?? {};
+	const direct = providers[provider];
+	if (direct) return direct;
+	const normalized = normalizeProviderId(provider);
+	if (normalized === provider) return Object.entries(providers).find(([key]) => normalizeProviderId(key) === normalized)?.[1];
+	return providers[normalized] ?? Object.entries(providers).find(([key]) => normalizeProviderId(key) === normalized)?.[1];
+}
+function getCustomProviderApiKey(cfg, provider) {
+	return normalizeOptionalSecretInput(resolveProviderConfig(cfg, provider)?.apiKey);
+}
+function resolveProviderAuthOverride(cfg, provider) {
+	const auth = resolveProviderConfig(cfg, provider)?.auth;
+	if (auth === "api-key" || auth === "aws-sdk" || auth === "oauth" || auth === "token") return auth;
+}
+function resolveEnvSourceLabel(params) {
+	return `${params.envVars.some((envVar) => params.applied.has(envVar)) ? "shell env: " : "env: "}${params.label}`;
+}
+function resolveAwsSdkAuthInfo() {
+	const applied = new Set(getShellEnvAppliedKeys());
+	if (process.env[AWS_BEARER_ENV]?.trim()) return {
+		mode: "aws-sdk",
+		source: resolveEnvSourceLabel({
+			applied,
+			envVars: [AWS_BEARER_ENV],
+			label: AWS_BEARER_ENV
+		})
+	};
+	if (process.env[AWS_ACCESS_KEY_ENV]?.trim() && process.env[AWS_SECRET_KEY_ENV]?.trim()) return {
+		mode: "aws-sdk",
+		source: resolveEnvSourceLabel({
+			applied,
+			envVars: [AWS_ACCESS_KEY_ENV, AWS_SECRET_KEY_ENV],
+			label: `${AWS_ACCESS_KEY_ENV} + ${AWS_SECRET_KEY_ENV}`
+		})
+	};
+	if (process.env[AWS_PROFILE_ENV]?.trim()) return {
+		mode: "aws-sdk",
+		source: resolveEnvSourceLabel({
+			applied,
+			envVars: [AWS_PROFILE_ENV],
+			label: AWS_PROFILE_ENV
+		})
+	};
+	return {
+		mode: "aws-sdk",
+		source: "aws-sdk default chain"
+	};
+}
+async function resolveApiKeyForProvider(params) {
+	const { provider, cfg, profileId, preferredProfile } = params;
+	const store = params.store ?? ensureAuthProfileStore(params.agentDir);
+	if (profileId) {
+		const resolved = await resolveApiKeyForProfile({
+			cfg,
+			store,
+			profileId,
+			agentDir: params.agentDir
+		});
+		if (!resolved) throw new Error(`No credentials found for profile "${profileId}".`);
+		const mode = store.profiles[profileId]?.type;
+		return {
+			apiKey: resolved.apiKey,
+			profileId,
+			source: `profile:${profileId}`,
+			mode: mode === "oauth" ? "oauth" : mode === "token" ? "token" : "api-key"
+		};
+	}
+	const authOverride = resolveProviderAuthOverride(cfg, provider);
+	if (authOverride === "aws-sdk") return resolveAwsSdkAuthInfo();
+	const order = resolveAuthProfileOrder({
+		cfg,
+		store,
+		provider,
+		preferredProfile
+	});
+	for (const candidate of order) try {
+		const resolved = await resolveApiKeyForProfile({
+			cfg,
+			store,
+			profileId: candidate,
+			agentDir: params.agentDir
+		});
+		if (resolved) {
+			const mode = store.profiles[candidate]?.type;
+			return {
+				apiKey: resolved.apiKey,
+				profileId: candidate,
+				source: `profile:${candidate}`,
+				mode: mode === "oauth" ? "oauth" : mode === "token" ? "token" : "api-key"
+			};
+		}
+	} catch {}
+	const envResolved = resolveEnvApiKey(provider);
+	if (envResolved) return {
+		apiKey: envResolved.apiKey,
+		source: envResolved.source,
+		mode: envResolved.source.includes("OAUTH_TOKEN") ? "oauth" : "api-key"
+	};
+	const customKey = getCustomProviderApiKey(cfg, provider);
+	if (customKey) return {
+		apiKey: customKey,
+		source: "models.json",
+		mode: "api-key"
+	};
+	const normalized = normalizeProviderId(provider);
+	if (authOverride === void 0 && normalized === "amazon-bedrock") return resolveAwsSdkAuthInfo();
+	if (provider === "openai") {
+		if (listProfilesForProvider(store, "openai-codex").length > 0) throw new Error("No API key found for provider \"openai\". You are authenticated with OpenAI Codex OAuth. Use openai-codex/gpt-5.3-codex (OAuth) or set OPENAI_API_KEY to use openai/gpt-5.1-codex.");
+	}
+	const authStorePath = resolveAuthStorePathForDisplay(params.agentDir);
+	const resolvedAgentDir = path.dirname(authStorePath);
+	throw new Error([
+		`No API key found for provider "${provider}".`,
+		`Auth store: ${authStorePath} (agentDir: ${resolvedAgentDir}).`,
+		`Configure auth for this agent (${formatCliCommand("anima agents add <id>")}) or copy auth-profiles.json from the main agentDir.`
+	].join(" "));
+}
+function resolveEnvApiKey(provider) {
+	const normalized = normalizeProviderId(provider);
+	const applied = new Set(getShellEnvAppliedKeys());
+	const pick = (envVar) => {
+		const value = normalizeOptionalSecretInput(process.env[envVar]);
+		if (!value) return null;
+		return {
+			apiKey: value,
+			source: applied.has(envVar) ? `shell env: ${envVar}` : `env: ${envVar}`
+		};
+	};
+	if (normalized === "github-copilot") return pick("COPILOT_GITHUB_TOKEN") ?? pick("GH_TOKEN") ?? pick("GITHUB_TOKEN");
+	if (normalized === "anthropic") return pick("ANTHROPIC_OAUTH_TOKEN") ?? pick("ANTHROPIC_API_KEY");
+	if (normalized === "chutes") return pick("CHUTES_OAUTH_TOKEN") ?? pick("CHUTES_API_KEY");
+	if (normalized === "zai") return pick("ZAI_API_KEY") ?? pick("Z_AI_API_KEY");
+	if (normalized === "google-vertex") {
+		const envKey = getEnvApiKey(normalized);
+		if (!envKey) return null;
+		return {
+			apiKey: envKey,
+			source: "gcloud adc"
+		};
+	}
+	if (normalized === "opencode") return pick("OPENCODE_API_KEY") ?? pick("OPENCODE_ZEN_API_KEY");
+	if (normalized === "qwen-portal") return pick("QWEN_OAUTH_TOKEN") ?? pick("QWEN_PORTAL_API_KEY");
+	if (normalized === "minimax-portal") return pick("MINIMAX_OAUTH_TOKEN") ?? pick("MINIMAX_API_KEY");
+	if (normalized === "kimi-coding") return pick("KIMI_API_KEY") ?? pick("KIMICODE_API_KEY");
+	if (normalized === "huggingface") return pick("HUGGINGFACE_HUB_TOKEN") ?? pick("HF_TOKEN");
+	const envVar = {
+		openai: "OPENAI_API_KEY",
+		google: "GEMINI_API_KEY",
+		voyage: "VOYAGE_API_KEY",
+		groq: "GROQ_API_KEY",
+		deepgram: "DEEPGRAM_API_KEY",
+		cerebras: "CEREBRAS_API_KEY",
+		xai: "XAI_API_KEY",
+		openrouter: "OPENROUTER_API_KEY",
+		litellm: "LITELLM_API_KEY",
+		"vercel-ai-gateway": "AI_GATEWAY_API_KEY",
+		"cloudflare-ai-gateway": "CLOUDFLARE_AI_GATEWAY_API_KEY",
+		moonshot: "MOONSHOT_API_KEY",
+		minimax: "MINIMAX_API_KEY",
+		nvidia: "NVIDIA_API_KEY",
+		xiaomi: "XIAOMI_API_KEY",
+		synthetic: "SYNTHETIC_API_KEY",
+		venice: "VENICE_API_KEY",
+		mistral: "MISTRAL_API_KEY",
+		opencode: "OPENCODE_API_KEY",
+		together: "TOGETHER_API_KEY",
+		qianfan: "QIANFAN_API_KEY",
+		ollama: "OLLAMA_API_KEY",
+		vllm: "VLLM_API_KEY"
+	}[normalized];
+	if (!envVar) return null;
+	return pick(envVar);
+}
+function resolveModelAuthMode(provider, cfg, store) {
+	const resolved = provider?.trim();
+	if (!resolved) return;
+	const authOverride = resolveProviderAuthOverride(cfg, resolved);
+	if (authOverride === "aws-sdk") return "aws-sdk";
+	const authStore = store ?? ensureAuthProfileStore();
+	const profiles = listProfilesForProvider(authStore, resolved);
+	if (profiles.length > 0) {
+		const modes = new Set(profiles.map((id) => authStore.profiles[id]?.type).filter((mode) => Boolean(mode)));
+		if ([
+			"oauth",
+			"token",
+			"api_key"
+		].filter((k) => modes.has(k)).length >= 2) return "mixed";
+		if (modes.has("oauth")) return "oauth";
+		if (modes.has("token")) return "token";
+		if (modes.has("api_key")) return "api-key";
+	}
+	if (authOverride === void 0 && normalizeProviderId(resolved) === "amazon-bedrock") return "aws-sdk";
+	const envKey = resolveEnvApiKey(resolved);
+	if (envKey?.apiKey) return envKey.source.includes("OAUTH_TOKEN") ? "oauth" : "api-key";
+	if (getCustomProviderApiKey(cfg, resolved)) return "api-key";
+	return "unknown";
+}
+async function getApiKeyForModel(params) {
+	return resolveApiKeyForProvider({
+		provider: params.model.provider,
+		cfg: params.cfg,
+		profileId: params.profileId,
+		preferredProfile: params.preferredProfile,
+		store: params.store,
+		agentDir: params.agentDir
+	});
+}
+function requireApiKey(auth, provider) {
+	const key = normalizeSecretInput(auth.apiKey);
+	if (key) return key;
+	throw new Error(`No API key resolved for provider "${provider}" (auth mode: ${auth.mode}).`);
+}
+
+//#endregion
+//#region src/agents/synthetic-models.ts
+const SYNTHETIC_DEFAULT_MODEL_ID = "hf:MiniMaxAI/MiniMax-M2.1";
+const SYNTHETIC_DEFAULT_MODEL_REF = `synthetic/${SYNTHETIC_DEFAULT_MODEL_ID}`;
+
+//#endregion
+//#region src/agents/venice-models.ts
+const VENICE_DEFAULT_MODEL_ID = "llama-3.3-70b";
+const VENICE_DEFAULT_MODEL_REF = `venice/${VENICE_DEFAULT_MODEL_ID}`;
+
+//#endregion
+//#region src/agents/models-config.providers.ts
+function normalizeGoogleModelId(id) {
+	if (id === "gemini-3-pro") return "gemini-3-pro-preview";
+	if (id === "gemini-3-flash") return "gemini-3-flash-preview";
+	return id;
+}
+
+//#endregion
+//#region src/agents/model-selection.ts
+const ANTHROPIC_MODEL_ALIASES = {
+	"opus-4.6": "claude-opus-4-6",
+	"opus-4.5": "claude-opus-4-5",
+	"sonnet-4.5": "claude-sonnet-4-5"
+};
+const OPENAI_CODEX_OAUTH_MODEL_PREFIXES = ["gpt-5.3-codex"];
+function normalizeAliasKey(value) {
+	return value.trim().toLowerCase();
+}
+function modelKey(provider, model) {
+	return `${provider}/${model}`;
+}
+function normalizeProviderId(provider) {
+	const normalized = provider.trim().toLowerCase();
+	if (normalized === "z.ai" || normalized === "z-ai") return "zai";
+	if (normalized === "opencode-zen") return "opencode";
+	if (normalized === "qwen") return "qwen-portal";
+	if (normalized === "kimi-code") return "kimi-coding";
+	return normalized;
+}
+function isCliProvider(provider, cfg) {
+	const normalized = normalizeProviderId(provider);
+	if (normalized === "claude-cli") return true;
+	if (normalized === "codex-cli") return true;
+	const backends = cfg?.agents?.defaults?.cliBackends ?? {};
+	return Object.keys(backends).some((key) => normalizeProviderId(key) === normalized);
+}
+function normalizeAnthropicModelId(model) {
+	const trimmed = model.trim();
+	if (!trimmed) return trimmed;
+	return ANTHROPIC_MODEL_ALIASES[trimmed.toLowerCase()] ?? trimmed;
+}
+function normalizeProviderModelId(provider, model) {
+	if (provider === "anthropic") return normalizeAnthropicModelId(model);
+	if (provider === "google") return normalizeGoogleModelId(model);
+	return model;
+}
+function shouldUseOpenAICodexProvider(provider, model) {
+	if (provider !== "openai") return false;
+	const normalized = model.trim().toLowerCase();
+	if (!normalized) return false;
+	return OPENAI_CODEX_OAUTH_MODEL_PREFIXES.some((prefix) => normalized === prefix || normalized.startsWith(`${prefix}-`));
+}
+function normalizeModelRef(provider, model) {
+	const normalizedProvider = normalizeProviderId(provider);
+	const normalizedModel = normalizeProviderModelId(normalizedProvider, model.trim());
+	if (shouldUseOpenAICodexProvider(normalizedProvider, normalizedModel)) return {
+		provider: "openai-codex",
+		model: normalizedModel
+	};
+	return {
+		provider: normalizedProvider,
+		model: normalizedModel
+	};
+}
+function parseModelRef(raw, defaultProvider) {
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	const slash = trimmed.indexOf("/");
+	if (slash === -1) return normalizeModelRef(defaultProvider, trimmed);
+	const providerRaw = trimmed.slice(0, slash).trim();
+	const model = trimmed.slice(slash + 1).trim();
+	if (!providerRaw || !model) return null;
+	return normalizeModelRef(providerRaw, model);
+}
+function resolveAllowlistModelKey(raw, defaultProvider) {
+	const parsed = parseModelRef(raw, defaultProvider);
+	if (!parsed) return null;
+	return modelKey(parsed.provider, parsed.model);
+}
+function buildConfiguredAllowlistKeys(params) {
+	const rawAllowlist = Object.keys(params.cfg?.agents?.defaults?.models ?? {});
+	if (rawAllowlist.length === 0) return null;
+	const keys = /* @__PURE__ */ new Set();
+	for (const raw of rawAllowlist) {
+		const key = resolveAllowlistModelKey(String(raw ?? ""), params.defaultProvider);
+		if (key) keys.add(key);
+	}
+	return keys.size > 0 ? keys : null;
+}
+function buildModelAliasIndex(params) {
+	const byAlias = /* @__PURE__ */ new Map();
+	const byKey = /* @__PURE__ */ new Map();
+	const rawModels = params.cfg.agents?.defaults?.models ?? {};
+	for (const [keyRaw, entryRaw] of Object.entries(rawModels)) {
+		const parsed = parseModelRef(String(keyRaw ?? ""), params.defaultProvider);
+		if (!parsed) continue;
+		const alias = String(entryRaw?.alias ?? "").trim();
+		if (!alias) continue;
+		const aliasKey = normalizeAliasKey(alias);
+		byAlias.set(aliasKey, {
+			alias,
+			ref: parsed
+		});
+		const key = modelKey(parsed.provider, parsed.model);
+		const existing = byKey.get(key) ?? [];
+		existing.push(alias);
+		byKey.set(key, existing);
+	}
+	return {
+		byAlias,
+		byKey
+	};
+}
+function resolveModelRefFromString(params) {
+	const trimmed = params.raw.trim();
+	if (!trimmed) return null;
+	if (!trimmed.includes("/")) {
+		const aliasKey = normalizeAliasKey(trimmed);
+		const aliasMatch = params.aliasIndex?.byAlias.get(aliasKey);
+		if (aliasMatch) return {
+			ref: aliasMatch.ref,
+			alias: aliasMatch.alias
+		};
+	}
+	const parsed = parseModelRef(trimmed, params.defaultProvider);
+	if (!parsed) return null;
+	return { ref: parsed };
+}
+function resolveConfiguredModelRef(params) {
+	const rawModel = (() => {
+		const raw = params.cfg.agents?.defaults?.model;
+		if (typeof raw === "string") return raw.trim();
+		return raw?.primary?.trim() ?? "";
+	})();
+	if (rawModel) {
+		const trimmed = rawModel.trim();
+		const aliasIndex = buildModelAliasIndex({
+			cfg: params.cfg,
+			defaultProvider: params.defaultProvider
+		});
+		if (!trimmed.includes("/")) {
+			const aliasKey = normalizeAliasKey(trimmed);
+			const aliasMatch = aliasIndex.byAlias.get(aliasKey);
+			if (aliasMatch) return aliasMatch.ref;
+			console.warn(`[anima] Model "${trimmed}" specified without provider. Falling back to "anthropic/${trimmed}". Please use "anthropic/${trimmed}" in your config.`);
+			return {
+				provider: "anthropic",
+				model: trimmed
+			};
+		}
+		const resolved = resolveModelRefFromString({
+			raw: trimmed,
+			defaultProvider: params.defaultProvider,
+			aliasIndex
+		});
+		if (resolved) return resolved.ref;
+	}
+	return {
+		provider: params.defaultProvider,
+		model: params.defaultModel
+	};
+}
+function resolveDefaultModelForAgent(params) {
+	const agentModelOverride = params.agentId ? resolveAgentModelPrimary(params.cfg, params.agentId) : void 0;
+	return resolveConfiguredModelRef({
+		cfg: agentModelOverride && agentModelOverride.length > 0 ? {
+			...params.cfg,
+			agents: {
+				...params.cfg.agents,
+				defaults: {
+					...params.cfg.agents?.defaults,
+					model: {
+						...typeof params.cfg.agents?.defaults?.model === "object" ? params.cfg.agents.defaults.model : void 0,
+						primary: agentModelOverride
+					}
+				}
+			}
+		} : params.cfg,
+		defaultProvider: DEFAULT_PROVIDER,
+		defaultModel: DEFAULT_MODEL
+	});
+}
+function buildAllowedModelSet(params) {
+	const rawAllowlist = (() => {
+		const modelMap = params.cfg.agents?.defaults?.models ?? {};
+		return Object.keys(modelMap);
+	})();
+	const allowAny = rawAllowlist.length === 0;
+	const defaultModel = params.defaultModel?.trim();
+	const defaultKey = defaultModel && params.defaultProvider ? modelKey(params.defaultProvider, defaultModel) : void 0;
+	const catalogKeys = new Set(params.catalog.map((entry) => modelKey(entry.provider, entry.id)));
+	if (allowAny) {
+		if (defaultKey) catalogKeys.add(defaultKey);
+		return {
+			allowAny: true,
+			allowedCatalog: params.catalog,
+			allowedKeys: catalogKeys
+		};
+	}
+	const allowedKeys = /* @__PURE__ */ new Set();
+	const configuredProviders = params.cfg.models?.providers ?? {};
+	for (const raw of rawAllowlist) {
+		const parsed = parseModelRef(String(raw), params.defaultProvider);
+		if (!parsed) continue;
+		const key = modelKey(parsed.provider, parsed.model);
+		const providerKey = normalizeProviderId(parsed.provider);
+		if (isCliProvider(parsed.provider, params.cfg)) allowedKeys.add(key);
+		else if (catalogKeys.has(key)) allowedKeys.add(key);
+		else if (configuredProviders[providerKey] != null) allowedKeys.add(key);
+	}
+	if (defaultKey) allowedKeys.add(defaultKey);
+	const allowedCatalog = params.catalog.filter((entry) => allowedKeys.has(modelKey(entry.provider, entry.id)));
+	if (allowedCatalog.length === 0 && allowedKeys.size === 0) {
+		if (defaultKey) catalogKeys.add(defaultKey);
+		return {
+			allowAny: true,
+			allowedCatalog: params.catalog,
+			allowedKeys: catalogKeys
+		};
+	}
+	return {
+		allowAny: false,
+		allowedCatalog,
+		allowedKeys
+	};
+}
+function resolveThinkingDefault(params) {
+	const configured = params.cfg.agents?.defaults?.thinkingDefault;
+	if (configured) return configured;
+	if ((params.catalog?.find((entry) => entry.provider === params.provider && entry.id === params.model))?.reasoning) return "low";
+	return "off";
+}
+
+//#endregion
+//#region src/plugin-sdk/file-lock.ts
+const HELD_LOCKS_KEY = Symbol.for("anima.fileLockHeldLocks");
+function resolveHeldLocks() {
+	const proc = process;
+	if (!proc[HELD_LOCKS_KEY]) proc[HELD_LOCKS_KEY] = /* @__PURE__ */ new Map();
+	return proc[HELD_LOCKS_KEY];
+}
+const HELD_LOCKS = resolveHeldLocks();
+function isAlive(pid) {
+	if (!Number.isFinite(pid) || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function computeDelayMs(retries, attempt) {
+	const base = Math.min(retries.maxTimeout, Math.max(retries.minTimeout, retries.minTimeout * retries.factor ** attempt));
+	const jitter = retries.randomize ? 1 + Math.random() : 1;
+	return Math.min(retries.maxTimeout, Math.round(base * jitter));
+}
+async function readLockPayload(lockPath) {
+	try {
+		const raw = await fs.readFile(lockPath, "utf8");
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.pid !== "number" || typeof parsed.createdAt !== "string") return null;
+		return {
+			pid: parsed.pid,
+			createdAt: parsed.createdAt
+		};
+	} catch {
+		return null;
+	}
+}
+async function resolveNormalizedFilePath(filePath) {
+	const resolved = path.resolve(filePath);
+	const dir = path.dirname(resolved);
+	await fs.mkdir(dir, { recursive: true });
+	try {
+		const realDir = await fs.realpath(dir);
+		return path.join(realDir, path.basename(resolved));
+	} catch {
+		return resolved;
+	}
+}
+async function isStaleLock(lockPath, staleMs) {
+	const payload = await readLockPayload(lockPath);
+	if (payload?.pid && !isAlive(payload.pid)) return true;
+	if (payload?.createdAt) {
+		const createdAt = Date.parse(payload.createdAt);
+		if (!Number.isFinite(createdAt) || Date.now() - createdAt > staleMs) return true;
+	}
+	try {
+		const stat = await fs.stat(lockPath);
+		return Date.now() - stat.mtimeMs > staleMs;
+	} catch {
+		return true;
+	}
+}
+async function acquireFileLock(filePath, options) {
+	const normalizedFile = await resolveNormalizedFilePath(filePath);
+	const lockPath = `${normalizedFile}.lock`;
+	const held = HELD_LOCKS.get(normalizedFile);
+	if (held) {
+		held.count += 1;
+		return {
+			lockPath,
+			release: async () => {
+				const current = HELD_LOCKS.get(normalizedFile);
+				if (!current) return;
+				current.count -= 1;
+				if (current.count > 0) return;
+				HELD_LOCKS.delete(normalizedFile);
+				await current.handle.close().catch(() => void 0);
+				await fs.rm(current.lockPath, { force: true }).catch(() => void 0);
+			}
+		};
+	}
+	const attempts = Math.max(1, options.retries.retries + 1);
+	for (let attempt = 0; attempt < attempts; attempt += 1) try {
+		const handle = await fs.open(lockPath, "wx");
+		await handle.writeFile(JSON.stringify({
+			pid: process.pid,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}, null, 2), "utf8");
+		HELD_LOCKS.set(normalizedFile, {
+			count: 1,
+			handle,
+			lockPath
+		});
+		return {
+			lockPath,
+			release: async () => {
+				const current = HELD_LOCKS.get(normalizedFile);
+				if (!current) return;
+				current.count -= 1;
+				if (current.count > 0) return;
+				HELD_LOCKS.delete(normalizedFile);
+				await current.handle.close().catch(() => void 0);
+				await fs.rm(current.lockPath, { force: true }).catch(() => void 0);
+			}
+		};
+	} catch (err) {
+		if (err.code !== "EEXIST") throw err;
+		if (await isStaleLock(lockPath, options.stale)) {
+			await fs.rm(lockPath, { force: true }).catch(() => void 0);
+			continue;
+		}
+		if (attempt >= attempts - 1) break;
+		await new Promise((resolve) => setTimeout(resolve, computeDelayMs(options.retries, attempt)));
+	}
+	throw new Error(`file lock timeout for ${normalizedFile}`);
+}
+async function withFileLock(filePath, options, fn) {
+	const lock = await acquireFileLock(filePath, options);
+	try {
+		return await fn();
+	} finally {
+		await lock.release();
+	}
+}
+
+//#endregion
+//#region src/infra/json-file.ts
+function loadJsonFile(pathname) {
+	try {
+		if (!fs$1.existsSync(pathname)) return;
+		const raw = fs$1.readFileSync(pathname, "utf8");
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+function saveJsonFile(pathname, data) {
+	const dir = path.dirname(pathname);
+	if (!fs$1.existsSync(dir)) fs$1.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	fs$1.writeFileSync(pathname, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+	fs$1.chmodSync(pathname, 384);
+}
+
+//#endregion
+//#region src/agents/cli-credentials.ts
+const log = createSubsystemLogger("agents/auth-profiles");
+const QWEN_CLI_CREDENTIALS_RELATIVE_PATH = ".qwen/oauth_creds.json";
+const MINIMAX_CLI_CREDENTIALS_RELATIVE_PATH = ".minimax/oauth_creds.json";
+let qwenCliCache = null;
+let minimaxCliCache = null;
+function resolveQwenCliCredentialsPath(homeDir) {
+	const baseDir = homeDir ?? resolveUserPath("~");
+	return path.join(baseDir, QWEN_CLI_CREDENTIALS_RELATIVE_PATH);
+}
+function resolveMiniMaxCliCredentialsPath(homeDir) {
+	const baseDir = homeDir ?? resolveUserPath("~");
+	return path.join(baseDir, MINIMAX_CLI_CREDENTIALS_RELATIVE_PATH);
+}
+function readQwenCliCredentials(options) {
+	return readPortalCliOauthCredentials(resolveQwenCliCredentialsPath(options?.homeDir), "qwen-portal");
+}
+function readPortalCliOauthCredentials(credPath, provider) {
+	const raw = loadJsonFile(credPath);
+	if (!raw || typeof raw !== "object") return null;
+	const data = raw;
+	const accessToken = data.access_token;
+	const refreshToken = data.refresh_token;
+	const expiresAt = data.expiry_date;
+	if (typeof accessToken !== "string" || !accessToken) return null;
+	if (typeof refreshToken !== "string" || !refreshToken) return null;
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
+	return {
+		type: "oauth",
+		provider,
+		access: accessToken,
+		refresh: refreshToken,
+		expires: expiresAt
+	};
+}
+function readMiniMaxCliCredentials(options) {
+	return readPortalCliOauthCredentials(resolveMiniMaxCliCredentialsPath(options?.homeDir), "minimax-portal");
+}
+function readQwenCliCredentialsCached(options) {
+	const ttlMs = options?.ttlMs ?? 0;
+	const now = Date.now();
+	const cacheKey = resolveQwenCliCredentialsPath(options?.homeDir);
+	if (ttlMs > 0 && qwenCliCache && qwenCliCache.cacheKey === cacheKey && now - qwenCliCache.readAt < ttlMs) return qwenCliCache.value;
+	const value = readQwenCliCredentials({ homeDir: options?.homeDir });
+	if (ttlMs > 0) qwenCliCache = {
+		value,
+		readAt: now,
+		cacheKey
+	};
+	return value;
+}
+function readMiniMaxCliCredentialsCached(options) {
+	const ttlMs = options?.ttlMs ?? 0;
+	const now = Date.now();
+	const cacheKey = resolveMiniMaxCliCredentialsPath(options?.homeDir);
+	if (ttlMs > 0 && minimaxCliCache && minimaxCliCache.cacheKey === cacheKey && now - minimaxCliCache.readAt < ttlMs) return minimaxCliCache.value;
+	const value = readMiniMaxCliCredentials({ homeDir: options?.homeDir });
+	if (ttlMs > 0) minimaxCliCache = {
+		value,
+		readAt: now,
+		cacheKey
+	};
+	return value;
+}
+
+//#endregion
+//#region src/agents/auth-profiles/external-cli-sync.ts
+function shallowEqualOAuthCredentials(a, b) {
+	if (!a) return false;
+	if (a.type !== "oauth") return false;
+	return a.provider === b.provider && a.access === b.access && a.refresh === b.refresh && a.expires === b.expires && a.email === b.email && a.enterpriseUrl === b.enterpriseUrl && a.projectId === b.projectId && a.accountId === b.accountId;
+}
+function isExternalProfileFresh(cred, now) {
+	if (!cred) return false;
+	if (cred.type !== "oauth" && cred.type !== "token") return false;
+	if (cred.provider !== "qwen-portal" && cred.provider !== "minimax-portal") return false;
+	if (typeof cred.expires !== "number") return true;
+	return cred.expires > now + EXTERNAL_CLI_NEAR_EXPIRY_MS;
+}
+/** Sync external CLI credentials into the store for a given provider. */
+function syncExternalCliCredentialsForProvider(store, profileId, provider, readCredentials, now) {
+	const existing = store.profiles[profileId];
+	const creds = !existing || existing.provider !== provider || !isExternalProfileFresh(existing, now) ? readCredentials() : null;
+	if (!creds) return false;
+	const existingOAuth = existing?.type === "oauth" ? existing : void 0;
+	if ((!existingOAuth || existingOAuth.provider !== provider || existingOAuth.expires <= now || creds.expires > existingOAuth.expires) && !shallowEqualOAuthCredentials(existingOAuth, creds)) {
+		store.profiles[profileId] = creds;
+		log$2.info(`synced ${provider} credentials from external cli`, {
+			profileId,
+			expires: new Date(creds.expires).toISOString()
+		});
+		return true;
+	}
+	return false;
+}
+/**
+* Sync OAuth credentials from external CLI tools (Qwen Code CLI, MiniMax CLI) into the store.
+*
+* Returns true if any credentials were updated.
+*/
+function syncExternalCliCredentials(store) {
+	let mutated = false;
+	const now = Date.now();
+	const existingQwen = store.profiles[QWEN_CLI_PROFILE_ID];
+	const qwenCreds = !existingQwen || existingQwen.provider !== "qwen-portal" || !isExternalProfileFresh(existingQwen, now) ? readQwenCliCredentialsCached({ ttlMs: EXTERNAL_CLI_SYNC_TTL_MS }) : null;
+	if (qwenCreds) {
+		const existing = store.profiles[QWEN_CLI_PROFILE_ID];
+		const existingOAuth = existing?.type === "oauth" ? existing : void 0;
+		if ((!existingOAuth || existingOAuth.provider !== "qwen-portal" || existingOAuth.expires <= now || qwenCreds.expires > existingOAuth.expires) && !shallowEqualOAuthCredentials(existingOAuth, qwenCreds)) {
+			store.profiles[QWEN_CLI_PROFILE_ID] = qwenCreds;
+			mutated = true;
+			log$2.info("synced qwen credentials from qwen cli", {
+				profileId: QWEN_CLI_PROFILE_ID,
+				expires: new Date(qwenCreds.expires).toISOString()
+			});
+		}
+	}
+	if (syncExternalCliCredentialsForProvider(store, MINIMAX_CLI_PROFILE_ID, "minimax-portal", () => readMiniMaxCliCredentialsCached({ ttlMs: EXTERNAL_CLI_SYNC_TTL_MS }), now)) mutated = true;
+	return mutated;
+}
+
+//#endregion
+//#region src/agents/agent-paths.ts
+function resolveAnimaAgentDir() {
+	const override = process.env.ANIMA_AGENT_DIR?.trim() || process.env.OPENCLAW_AGENT_DIR?.trim() || process.env.PI_CODING_AGENT_DIR?.trim();
+	if (override) return resolveUserPath(override);
+	return resolveUserPath(path.join(resolveStateDir(), "agents", DEFAULT_AGENT_ID, "agent"));
+}
+
+//#endregion
+//#region src/agents/auth-profiles/paths.ts
+function resolveAuthStorePath(agentDir) {
+	const resolved = resolveUserPath(agentDir ?? resolveAnimaAgentDir());
+	return path.join(resolved, AUTH_PROFILE_FILENAME);
+}
+function resolveLegacyAuthStorePath(agentDir) {
+	const resolved = resolveUserPath(agentDir ?? resolveAnimaAgentDir());
+	return path.join(resolved, LEGACY_AUTH_FILENAME);
+}
+function resolveAuthStorePathForDisplay(agentDir) {
+	const pathname = resolveAuthStorePath(agentDir);
+	return pathname.startsWith("~") ? pathname : resolveUserPath(pathname);
+}
+function ensureAuthStoreFile(pathname) {
+	if (fs$1.existsSync(pathname)) return;
+	saveJsonFile(pathname, {
+		version: AUTH_STORE_VERSION,
+		profiles: {}
+	});
+}
+
+//#endregion
+//#region src/agents/auth-profiles/store.ts
+function coerceLegacyStore(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const record = raw;
+	if ("profiles" in record) return null;
+	const entries = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (!value || typeof value !== "object") continue;
+		const typed = value;
+		if (typed.type !== "api_key" && typed.type !== "oauth" && typed.type !== "token") continue;
+		entries[key] = {
+			...typed,
+			provider: String(typed.provider ?? key)
+		};
+	}
+	return Object.keys(entries).length > 0 ? entries : null;
+}
+function coerceAuthStore(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const record = raw;
+	if (!record.profiles || typeof record.profiles !== "object") return null;
+	const profiles = record.profiles;
+	const normalized = {};
+	for (const [key, value] of Object.entries(profiles)) {
+		if (!value || typeof value !== "object") continue;
+		const typed = value;
+		if (typed.type !== "api_key" && typed.type !== "oauth" && typed.type !== "token") continue;
+		if (!typed.provider) continue;
+		normalized[key] = typed;
+	}
+	const order = record.order && typeof record.order === "object" ? Object.entries(record.order).reduce((acc, [provider, value]) => {
+		if (!Array.isArray(value)) return acc;
+		const list = value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean);
+		if (list.length === 0) return acc;
+		acc[provider] = list;
+		return acc;
+	}, {}) : void 0;
+	return {
+		version: Number(record.version ?? AUTH_STORE_VERSION),
+		profiles: normalized,
+		order,
+		lastGood: record.lastGood && typeof record.lastGood === "object" ? record.lastGood : void 0,
+		usageStats: record.usageStats && typeof record.usageStats === "object" ? record.usageStats : void 0
+	};
+}
+function mergeRecord(base, override) {
+	if (!base && !override) return;
+	if (!base) return { ...override };
+	if (!override) return { ...base };
+	return {
+		...base,
+		...override
+	};
+}
+function mergeAuthProfileStores(base, override) {
+	if (Object.keys(override.profiles).length === 0 && !override.order && !override.lastGood && !override.usageStats) return base;
+	return {
+		version: Math.max(base.version, override.version ?? base.version),
+		profiles: {
+			...base.profiles,
+			...override.profiles
+		},
+		order: mergeRecord(base.order, override.order),
+		lastGood: mergeRecord(base.lastGood, override.lastGood),
+		usageStats: mergeRecord(base.usageStats, override.usageStats)
+	};
+}
+function mergeOAuthFileIntoStore(store) {
+	const oauthRaw = loadJsonFile(resolveOAuthPath());
+	if (!oauthRaw || typeof oauthRaw !== "object") return false;
+	const oauthEntries = oauthRaw;
+	let mutated = false;
+	for (const [provider, creds] of Object.entries(oauthEntries)) {
+		if (!creds || typeof creds !== "object") continue;
+		const profileId = `${provider}:default`;
+		if (store.profiles[profileId]) continue;
+		store.profiles[profileId] = {
+			type: "oauth",
+			provider,
+			...creds
+		};
+		mutated = true;
+	}
+	return mutated;
+}
+function applyLegacyStore(store, legacy) {
+	for (const [provider, cred] of Object.entries(legacy)) {
+		const profileId = `${provider}:default`;
+		if (cred.type === "api_key") {
+			store.profiles[profileId] = {
+				type: "api_key",
+				provider: String(cred.provider ?? provider),
+				key: cred.key,
+				...cred.email ? { email: cred.email } : {}
+			};
+			continue;
+		}
+		if (cred.type === "token") {
+			store.profiles[profileId] = {
+				type: "token",
+				provider: String(cred.provider ?? provider),
+				token: cred.token,
+				...typeof cred.expires === "number" ? { expires: cred.expires } : {},
+				...cred.email ? { email: cred.email } : {}
+			};
+			continue;
+		}
+		store.profiles[profileId] = {
+			type: "oauth",
+			provider: String(cred.provider ?? provider),
+			access: cred.access,
+			refresh: cred.refresh,
+			expires: cred.expires,
+			...cred.enterpriseUrl ? { enterpriseUrl: cred.enterpriseUrl } : {},
+			...cred.projectId ? { projectId: cred.projectId } : {},
+			...cred.accountId ? { accountId: cred.accountId } : {},
+			...cred.email ? { email: cred.email } : {}
+		};
+	}
+}
+function loadAuthProfileStoreForAgent(agentDir, _options) {
+	const authPath = resolveAuthStorePath(agentDir);
+	const asStore = coerceAuthStore(loadJsonFile(authPath));
+	if (asStore) {
+		if (syncExternalCliCredentials(asStore)) saveJsonFile(authPath, asStore);
+		return asStore;
+	}
+	if (agentDir) {
+		const mainStore = coerceAuthStore(loadJsonFile(resolveAuthStorePath()));
+		if (mainStore && Object.keys(mainStore.profiles).length > 0) {
+			saveJsonFile(authPath, mainStore);
+			log$2.info("inherited auth-profiles from main agent", { agentDir });
+			return mainStore;
+		}
+	}
+	const legacy = coerceLegacyStore(loadJsonFile(resolveLegacyAuthStorePath(agentDir)));
+	const store = {
+		version: AUTH_STORE_VERSION,
+		profiles: {}
+	};
+	if (legacy) applyLegacyStore(store, legacy);
+	const mergedOAuth = mergeOAuthFileIntoStore(store);
+	const syncedCli = syncExternalCliCredentials(store);
+	const shouldWrite = legacy !== null || mergedOAuth || syncedCli;
+	if (shouldWrite) saveJsonFile(authPath, store);
+	if (shouldWrite && legacy !== null) {
+		const legacyPath = resolveLegacyAuthStorePath(agentDir);
+		try {
+			fs$1.unlinkSync(legacyPath);
+		} catch (err) {
+			if (err?.code !== "ENOENT") log$2.warn("failed to delete legacy auth.json after migration", {
+				err,
+				legacyPath
+			});
+		}
+	}
+	return store;
+}
+function ensureAuthProfileStore(agentDir, options) {
+	const store = loadAuthProfileStoreForAgent(agentDir, options);
+	const authPath = resolveAuthStorePath(agentDir);
+	const mainAuthPath = resolveAuthStorePath();
+	if (!agentDir || authPath === mainAuthPath) return store;
+	return mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, options), store);
+}
+function saveAuthProfileStore(store, agentDir) {
+	saveJsonFile(resolveAuthStorePath(agentDir), {
+		version: AUTH_STORE_VERSION,
+		profiles: store.profiles,
+		order: store.order ?? void 0,
+		lastGood: store.lastGood ?? void 0,
+		usageStats: store.usageStats ?? void 0
+	});
+}
+
+//#endregion
+//#region src/agents/auth-profiles/profiles.ts
+function listProfilesForProvider(store, provider) {
+	const providerKey = normalizeProviderId(provider);
+	return Object.entries(store.profiles).filter(([, cred]) => normalizeProviderId(cred.provider) === providerKey).map(([id]) => id);
+}
+
+//#endregion
+//#region src/agents/auth-profiles/repair.ts
+function getProfileSuffix(profileId) {
+	const idx = profileId.indexOf(":");
+	if (idx < 0) return "";
+	return profileId.slice(idx + 1);
+}
+function isEmailLike(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return false;
+	return trimmed.includes("@") && trimmed.includes(".");
+}
+function suggestOAuthProfileIdForLegacyDefault(params) {
+	const providerKey = normalizeProviderId(params.provider);
+	if (getProfileSuffix(params.legacyProfileId) !== "default") return null;
+	const legacyCfg = params.cfg?.auth?.profiles?.[params.legacyProfileId];
+	if (legacyCfg && normalizeProviderId(legacyCfg.provider) === providerKey && legacyCfg.mode !== "oauth") return null;
+	const oauthProfiles = listProfilesForProvider(params.store, providerKey).filter((id) => params.store.profiles[id]?.type === "oauth");
+	if (oauthProfiles.length === 0) return null;
+	const configuredEmail = legacyCfg?.email?.trim();
+	if (configuredEmail) {
+		const byEmail = oauthProfiles.find((id) => {
+			const cred = params.store.profiles[id];
+			if (!cred || cred.type !== "oauth") return false;
+			return cred.email?.trim() === configuredEmail || id === `${providerKey}:${configuredEmail}`;
+		});
+		if (byEmail) return byEmail;
+	}
+	const lastGood = params.store.lastGood?.[providerKey] ?? params.store.lastGood?.[params.provider];
+	if (lastGood && oauthProfiles.includes(lastGood)) return lastGood;
+	const nonLegacy = oauthProfiles.filter((id) => id !== params.legacyProfileId);
+	if (nonLegacy.length === 1) return nonLegacy[0] ?? null;
+	const emailLike = nonLegacy.filter((id) => isEmailLike(getProfileSuffix(id)));
+	if (emailLike.length === 1) return emailLike[0] ?? null;
+	return null;
+}
+
+//#endregion
+//#region src/agents/auth-profiles/doctor.ts
+function formatAuthDoctorHint(params) {
+	const providerKey = normalizeProviderId(params.provider);
+	if (providerKey !== "anthropic") return "";
+	const legacyProfileId = params.profileId ?? "anthropic:default";
+	const suggested = suggestOAuthProfileIdForLegacyDefault({
+		cfg: params.cfg,
+		store: params.store,
+		provider: providerKey,
+		legacyProfileId
+	});
+	if (!suggested || suggested === legacyProfileId) return "";
+	const storeOauthProfiles = listProfilesForProvider(params.store, providerKey).filter((id) => params.store.profiles[id]?.type === "oauth").join(", ");
+	const cfgMode = params.cfg?.auth?.profiles?.[legacyProfileId]?.mode;
+	const cfgProvider = params.cfg?.auth?.profiles?.[legacyProfileId]?.provider;
+	return [
+		"Doctor hint (for GitHub issue):",
+		`- provider: ${providerKey}`,
+		`- config: ${legacyProfileId}${cfgProvider || cfgMode ? ` (provider=${cfgProvider ?? "?"}, mode=${cfgMode ?? "?"})` : ""}`,
+		`- auth store oauth profiles: ${storeOauthProfiles || "(none)"}`,
+		`- suggested profile: ${suggested}`,
+		`Fix: run "${formatCliCommand("anima doctor --yes")}"`
+	].join("\n");
+}
+
+//#endregion
+//#region src/providers/qwen-portal-oauth.ts
+async function refreshQwenPortalCredentials(_opts) {
+	return null;
+}
+
+//#endregion
+//#region src/agents/chutes-oauth.ts
+const CHUTES_OAUTH_ISSUER = "https://api.chutes.ai";
+const CHUTES_AUTHORIZE_ENDPOINT = `${CHUTES_OAUTH_ISSUER}/idp/authorize`;
+const CHUTES_TOKEN_ENDPOINT = `${CHUTES_OAUTH_ISSUER}/idp/token`;
+const CHUTES_USERINFO_ENDPOINT = `${CHUTES_OAUTH_ISSUER}/idp/userinfo`;
+const DEFAULT_EXPIRES_BUFFER_MS = 300 * 1e3;
+function coerceExpiresAt(expiresInSeconds, now) {
+	const value = now + Math.max(0, Math.floor(expiresInSeconds)) * 1e3 - DEFAULT_EXPIRES_BUFFER_MS;
+	return Math.max(value, now + 3e4);
+}
+async function refreshChutesTokens(params) {
+	const fetchFn = params.fetchFn ?? fetch;
+	const now = params.now ?? Date.now();
+	const refreshToken = params.credential.refresh?.trim();
+	if (!refreshToken) throw new Error("Chutes OAuth credential is missing refresh token");
+	const clientId = params.credential.clientId?.trim() ?? process.env.CHUTES_CLIENT_ID?.trim();
+	if (!clientId) throw new Error("Missing CHUTES_CLIENT_ID for Chutes OAuth refresh (set env var or re-auth).");
+	const clientSecret = process.env.CHUTES_CLIENT_SECRET?.trim() || void 0;
+	const body = new URLSearchParams({
+		grant_type: "refresh_token",
+		client_id: clientId,
+		refresh_token: refreshToken
+	});
+	if (clientSecret) body.set("client_secret", clientSecret);
+	const response = await fetchFn(CHUTES_TOKEN_ENDPOINT, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body
+	});
+	if (!response.ok) {
+		const text = await response.text();
+		throw new Error(`Chutes token refresh failed: ${text}`);
+	}
+	const data = await response.json();
+	const access = data.access_token?.trim();
+	const newRefresh = data.refresh_token?.trim();
+	const expiresIn = data.expires_in ?? 0;
+	if (!access) throw new Error("Chutes token refresh returned no access_token");
+	return {
+		...params.credential,
+		access,
+		refresh: newRefresh || refreshToken,
+		expires: coerceExpiresAt(expiresIn, now),
+		clientId
+	};
+}
+
+//#endregion
+//#region src/agents/auth-profiles/oauth.ts
+const OAUTH_PROVIDER_IDS = new Set(getOAuthProviders().map((provider) => provider.id));
+const isOAuthProvider = (provider) => OAUTH_PROVIDER_IDS.has(provider);
+const resolveOAuthProvider = (provider) => isOAuthProvider(provider) ? provider : null;
+function buildOAuthApiKey(provider, credentials) {
+	return provider === "google-gemini-cli" || provider === "google-antigravity" ? JSON.stringify({
+		token: credentials.access,
+		projectId: credentials.projectId
+	}) : credentials.access;
+}
+async function refreshOAuthTokenWithLock(params) {
+	const authPath = resolveAuthStorePath(params.agentDir);
+	ensureAuthStoreFile(authPath);
+	return await withFileLock(authPath, AUTH_STORE_LOCK_OPTIONS, async () => {
+		const store = ensureAuthProfileStore(params.agentDir);
+		const cred = store.profiles[params.profileId];
+		if (!cred || cred.type !== "oauth") return null;
+		if (Date.now() < cred.expires) return {
+			apiKey: buildOAuthApiKey(cred.provider, cred),
+			newCredentials: cred
+		};
+		const oauthCreds = { [cred.provider]: cred };
+		const result = String(cred.provider) === "chutes" ? await (async () => {
+			const newCredentials = await refreshChutesTokens({ credential: cred });
+			return {
+				apiKey: newCredentials.access,
+				newCredentials
+			};
+		})() : String(cred.provider) === "qwen-portal" ? await (async () => {
+			const newCredentials = await refreshQwenPortalCredentials(cred);
+			return {
+				apiKey: newCredentials.access,
+				newCredentials
+			};
+		})() : await (async () => {
+			const oauthProvider = resolveOAuthProvider(cred.provider);
+			if (!oauthProvider) return null;
+			return await getOAuthApiKey(oauthProvider, oauthCreds);
+		})();
+		if (!result) return null;
+		store.profiles[params.profileId] = {
+			...cred,
+			...result.newCredentials,
+			type: "oauth"
+		};
+		saveAuthProfileStore(store, params.agentDir);
+		return result;
+	});
+}
+async function tryResolveOAuthProfile(params) {
+	const { cfg, store, profileId } = params;
+	const cred = store.profiles[profileId];
+	if (!cred || cred.type !== "oauth") return null;
+	const profileConfig = cfg?.auth?.profiles?.[profileId];
+	if (profileConfig && profileConfig.provider !== cred.provider) return null;
+	if (profileConfig && profileConfig.mode !== cred.type) return null;
+	if (Date.now() < cred.expires) return {
+		apiKey: buildOAuthApiKey(cred.provider, cred),
+		provider: cred.provider,
+		email: cred.email
+	};
+	const refreshed = await refreshOAuthTokenWithLock({
+		profileId,
+		agentDir: params.agentDir
+	});
+	if (!refreshed) return null;
+	return {
+		apiKey: refreshed.apiKey,
+		provider: cred.provider,
+		email: cred.email
+	};
+}
+async function resolveApiKeyForProfile(params) {
+	const { cfg, store, profileId } = params;
+	const cred = store.profiles[profileId];
+	if (!cred) return null;
+	const profileConfig = cfg?.auth?.profiles?.[profileId];
+	if (profileConfig && profileConfig.provider !== cred.provider) return null;
+	if (profileConfig && profileConfig.mode !== cred.type) {
+		if (!(profileConfig.mode === "oauth" && cred.type === "token")) return null;
+	}
+	if (cred.type === "api_key") {
+		const key = cred.key?.trim();
+		if (!key) return null;
+		return {
+			apiKey: key,
+			provider: cred.provider,
+			email: cred.email
+		};
+	}
+	if (cred.type === "token") {
+		const token = cred.token?.trim();
+		if (!token) return null;
+		if (typeof cred.expires === "number" && Number.isFinite(cred.expires) && cred.expires > 0 && Date.now() >= cred.expires) return null;
+		return {
+			apiKey: token,
+			provider: cred.provider,
+			email: cred.email
+		};
+	}
+	if (Date.now() < cred.expires) return {
+		apiKey: buildOAuthApiKey(cred.provider, cred),
+		provider: cred.provider,
+		email: cred.email
+	};
+	try {
+		const result = await refreshOAuthTokenWithLock({
+			profileId,
+			agentDir: params.agentDir
+		});
+		if (!result) return null;
+		return {
+			apiKey: result.apiKey,
+			provider: cred.provider,
+			email: cred.email
+		};
+	} catch (error) {
+		const refreshedStore = ensureAuthProfileStore(params.agentDir);
+		const refreshed = refreshedStore.profiles[profileId];
+		if (refreshed?.type === "oauth" && Date.now() < refreshed.expires) return {
+			apiKey: buildOAuthApiKey(refreshed.provider, refreshed),
+			provider: refreshed.provider,
+			email: refreshed.email ?? cred.email
+		};
+		const fallbackProfileId = suggestOAuthProfileIdForLegacyDefault({
+			cfg,
+			store: refreshedStore,
+			provider: cred.provider,
+			legacyProfileId: profileId
+		});
+		if (fallbackProfileId && fallbackProfileId !== profileId) try {
+			const fallbackResolved = await tryResolveOAuthProfile({
+				cfg,
+				store: refreshedStore,
+				profileId: fallbackProfileId,
+				agentDir: params.agentDir
+			});
+			if (fallbackResolved) return fallbackResolved;
+		} catch {}
+		if (params.agentDir) try {
+			const mainCred = ensureAuthProfileStore(void 0).profiles[profileId];
+			if (mainCred?.type === "oauth" && Date.now() < mainCred.expires) {
+				refreshedStore.profiles[profileId] = { ...mainCred };
+				saveAuthProfileStore(refreshedStore, params.agentDir);
+				log$2.info("inherited fresh OAuth credentials from main agent", {
+					profileId,
+					agentDir: params.agentDir,
+					expires: new Date(mainCred.expires).toISOString()
+				});
+				return {
+					apiKey: buildOAuthApiKey(mainCred.provider, mainCred),
+					provider: mainCred.provider,
+					email: mainCred.email
+				};
+			}
+		} catch {}
+		const message = error instanceof Error ? error.message : String(error);
+		const hint = formatAuthDoctorHint({
+			cfg,
+			store: refreshedStore,
+			provider: cred.provider,
+			profileId
+		});
+		throw new Error(`OAuth token refresh failed for ${cred.provider}: ${message}. Please try again or re-authenticate.` + (hint ? `\n\n${hint}` : ""), { cause: error });
+	}
+}
+
+//#endregion
+//#region src/agents/auth-profiles/usage.ts
+function resolveProfileUnusableUntil$1(stats) {
+	const values = [stats.cooldownUntil, stats.disabledUntil].filter((value) => typeof value === "number").filter((value) => Number.isFinite(value) && value > 0);
+	if (values.length === 0) return null;
+	return Math.max(...values);
+}
+/**
+* Check if a profile is currently in cooldown (due to rate limiting or errors).
+*/
+function isProfileInCooldown(store, profileId) {
+	const stats = store.usageStats?.[profileId];
+	if (!stats) return false;
+	const unusableUntil = resolveProfileUnusableUntil$1(stats);
+	return unusableUntil ? Date.now() < unusableUntil : false;
+}
+
+//#endregion
+//#region src/agents/auth-profiles/order.ts
+function resolveProfileUnusableUntil(stats) {
+	const values = [stats.cooldownUntil, stats.disabledUntil].filter((value) => typeof value === "number").filter((value) => Number.isFinite(value) && value > 0);
+	if (values.length === 0) return null;
+	return Math.max(...values);
+}
+function resolveAuthProfileOrder(params) {
+	const { cfg, store, provider, preferredProfile } = params;
+	const providerKey = normalizeProviderId(provider);
+	const now = Date.now();
+	const storedOrder = (() => {
+		const order = store.order;
+		if (!order) return;
+		for (const [key, value] of Object.entries(order)) if (normalizeProviderId(key) === providerKey) return value;
+	})();
+	const configuredOrder = (() => {
+		const order = cfg?.auth?.order;
+		if (!order) return;
+		for (const [key, value] of Object.entries(order)) if (normalizeProviderId(key) === providerKey) return value;
+	})();
+	const explicitOrder = storedOrder ?? configuredOrder;
+	const explicitProfiles = cfg?.auth?.profiles ? Object.entries(cfg.auth.profiles).filter(([, profile]) => normalizeProviderId(profile.provider) === providerKey).map(([profileId]) => profileId) : [];
+	const baseOrder = explicitOrder ?? (explicitProfiles.length > 0 ? explicitProfiles : listProfilesForProvider(store, providerKey));
+	if (baseOrder.length === 0) return [];
+	const filtered = baseOrder.filter((profileId) => {
+		const cred = store.profiles[profileId];
+		if (!cred) return false;
+		if (normalizeProviderId(cred.provider) !== providerKey) return false;
+		const profileConfig = cfg?.auth?.profiles?.[profileId];
+		if (profileConfig) {
+			if (normalizeProviderId(profileConfig.provider) !== providerKey) return false;
+			if (profileConfig.mode !== cred.type) {
+				if (!(profileConfig.mode === "oauth" && cred.type === "token")) return false;
+			}
+		}
+		if (cred.type === "api_key") return Boolean(cred.key?.trim());
+		if (cred.type === "token") {
+			if (!cred.token?.trim()) return false;
+			if (typeof cred.expires === "number" && Number.isFinite(cred.expires) && cred.expires > 0 && now >= cred.expires) return false;
+			return true;
+		}
+		if (cred.type === "oauth") return Boolean(cred.access?.trim() || cred.refresh?.trim());
+		return false;
+	});
+	const deduped = [];
+	for (const entry of filtered) if (!deduped.includes(entry)) deduped.push(entry);
+	if (explicitOrder && explicitOrder.length > 0) {
+		const available = [];
+		const inCooldown = [];
+		for (const profileId of deduped) {
+			const cooldownUntil = resolveProfileUnusableUntil(store.usageStats?.[profileId] ?? {}) ?? 0;
+			if (typeof cooldownUntil === "number" && Number.isFinite(cooldownUntil) && cooldownUntil > 0 && now < cooldownUntil) inCooldown.push({
+				profileId,
+				cooldownUntil
+			});
+			else available.push(profileId);
+		}
+		const cooldownSorted = inCooldown.toSorted((a, b) => a.cooldownUntil - b.cooldownUntil).map((entry) => entry.profileId);
+		const ordered = [...available, ...cooldownSorted];
+		if (preferredProfile && ordered.includes(preferredProfile)) return [preferredProfile, ...ordered.filter((e) => e !== preferredProfile)];
+		return ordered;
+	}
+	const sorted = orderProfilesByMode(deduped, store);
+	if (preferredProfile && sorted.includes(preferredProfile)) return [preferredProfile, ...sorted.filter((e) => e !== preferredProfile)];
+	return sorted;
+}
+function orderProfilesByMode(order, store) {
+	const now = Date.now();
+	const available = [];
+	const inCooldown = [];
+	for (const profileId of order) if (isProfileInCooldown(store, profileId)) inCooldown.push(profileId);
+	else available.push(profileId);
+	const sorted = available.map((profileId) => {
+		const type = store.profiles[profileId]?.type;
+		return {
+			profileId,
+			typeScore: type === "oauth" ? 0 : type === "token" ? 1 : type === "api_key" ? 2 : 3,
+			lastUsed: store.usageStats?.[profileId]?.lastUsed ?? 0
+		};
+	}).toSorted((a, b) => {
+		if (a.typeScore !== b.typeScore) return a.typeScore - b.typeScore;
+		return a.lastUsed - b.lastUsed;
+	}).map((entry) => entry.profileId);
+	const cooldownSorted = inCooldown.map((profileId) => ({
+		profileId,
+		cooldownUntil: resolveProfileUnusableUntil(store.usageStats?.[profileId] ?? {}) ?? now
+	})).toSorted((a, b) => a.cooldownUntil - b.cooldownUntil).map((entry) => entry.profileId);
+	return [...sorted, ...cooldownSorted];
+}
+
+//#endregion
+//#region src/agents/auth-profiles.ts
+var auth_profiles_exports = /* @__PURE__ */ __exportAll({ ensureAuthProfileStore: () => ensureAuthProfileStore });
+
+//#endregion
+export { normalizeSecretInput as A, resolveAuthProfileDisplayLabel as B, resolveThinkingDefault as C, resolveApiKeyForProvider as D, requireApiKey as E, shouldEnableShellEnvFallback as F, isTruthyEnvValue as I, DEFAULT_CONTEXT_TOKENS as L, loadShellEnvFallback as M, resolveShellEnvFallbackTimeoutMs as N, resolveEnvApiKey as O, shouldDeferShellEnvFallback as P, DEFAULT_MODEL as R, resolveModelRefFromString as S, getCustomProviderApiKey as T, normalizeModelRef as _, listProfilesForProvider as a, resolveConfiguredModelRef as b, resolveAnimaAgentDir as c, withFileLock as d, buildAllowedModelSet as f, modelKey as g, isCliProvider as h, resolveApiKeyForProfile as i, getShellPathFromLoginShell as j, resolveModelAuthMode as k, loadJsonFile as l, buildModelAliasIndex as m, resolveAuthProfileOrder as n, ensureAuthProfileStore as o, buildConfiguredAllowlistKeys as p, isProfileInCooldown as r, resolveAuthStorePathForDisplay as s, auth_profiles_exports as t, saveJsonFile as u, normalizeProviderId as v, getApiKeyForModel as w, resolveDefaultModelForAgent as x, parseModelRef as y, DEFAULT_PROVIDER as z };