@ouro.bot/cli 0.1.0-alpha.55 → 0.1.0-alpha.550

package/dist/heart/provider-failover.js

@@ -0,0 +1,301 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatCredentialProvenanceLabel = formatCredentialProvenanceLabel;
+exports.formatReadyProviderLabel = formatReadyProviderLabel;
+exports.buildFailoverContext = buildFailoverContext;
+exports.handleFailoverReply = handleFailoverReply;
+exports.runMachineProviderFailoverInventory = runMachineProviderFailoverInventory;
+exports.validateFailoverSwitchCandidate = validateFailoverSwitchCandidate;
+const identity_1 = require("./identity");
+const provider_ping_1 = require("./provider-ping");
+const provider_models_1 = require("./provider-models");
+const provider_credentials_1 = require("./provider-credentials");
+const runtime_1 = require("../nerves/runtime");
+const CLASSIFICATION_LABELS = {
+    "auth-failure": "authentication failed",
+    "usage-limit": "hit its usage limit",
+    "rate-limit": "is being rate limited",
+    "server-error": "is experiencing an outage",
+    "network-error": "is unreachable (network error)",
+    "unknown": "encountered an error",
+};
+function formatProviderWithModel(provider, model) {
+    if (!model)
+        return provider;
+    if ((0, provider_models_1.getProviderModelMismatchMessage)(provider, model)) {
+        return `${provider} [configured model: ${model}]`;
+    }
+    return `${provider} (${model})`;
+}
+function formatErrorDetail(errorMessage, errorSummary) {
+    const detail = errorMessage.replace(/\s+/g, " ").trim();
+    if (!detail || detail === errorSummary)
+        return "";
+    return detail.length > 300 ? `${detail.slice(0, 297)}...` : detail;
+}
+function formatCredentialProvenanceLabel(candidate) {
+    if (candidate.source) {
+        return `credentials in vault via ${candidate.source}`;
+    }
+    return undefined;
+}
+function formatReadyProviderLabel(candidate) {
+    const provenance = formatCredentialProvenanceLabel(candidate);
+    const provenanceSuffix = provenance ? `; ${provenance}` : "";
+    return `${candidate.provider} (${candidate.model}${provenanceSuffix})`;
+}
+function formatFailingProviderLine(provider, classification, agentName) {
+    const authCommand = `ouro auth --agent ${agentName} --provider ${provider}`;
+    switch (classification) {
+        case "auth-failure":
+            return `  - ${provider}: credentials need to be refreshed. Run \`${authCommand}\`.`;
+        case "network-error":
+            return `  - ${provider}: could not be reached. Check network/provider availability; if credentials may be stale, run \`${authCommand}\`.`;
+        case "server-error":
+            return `  - ${provider}: provider outage or server error. Retry later; if it keeps failing, run \`${authCommand}\`.`;
+        case "rate-limit":
+            return `  - ${provider}: rate limited. Wait and retry, or switch to a ready provider below.`;
+        case "usage-limit":
+            return `  - ${provider}: usage limit hit. Wait for quota reset, raise quota, or switch to a ready provider below.`;
+        case "unknown":
+            return `  - ${provider}: could not be reached. Run \`${authCommand}\` if credentials may be stale.`;
+    }
+}
+function isProviderFailoverInventory(inventory) {
+    const candidate = inventory;
+    return Array.isArray(candidate.ready) && Array.isArray(candidate.unavailable) && Array.isArray(candidate.unconfigured);
+}
+function normalizeLegacyInventory(inventory, providerModels) {
+    const ready = [];
+    const unavailable = [];
+    const unconfigured = [];
+    for (const [provider, result] of Object.entries(inventory)) {
+        if (result.ok) {
+            ready.push({
+                provider,
+                model: (0, provider_models_1.resolveModelForProviderDisplay)(provider, providerModels[provider]),
+                result,
+            });
+        }
+        else if (result.classification === "auth-failure" && result.message === "no credentials configured") {
+            unconfigured.push(provider);
+        }
+        else {
+            // Configured but ping failed (expired token, provider also down, etc.)
+            unavailable.push({
+                provider,
+                model: (0, provider_models_1.resolveModelForProviderDisplay)(provider, providerModels[provider]),
+                result,
+            });
+        }
+    }
+    return { ready, unavailable, unconfigured };
+}
+function normalizeFailoverInventory(inventory, providerModels) {
+    if (!isProviderFailoverInventory(inventory)) {
+        return normalizeLegacyInventory(inventory, providerModels);
+    }
+    return {
+        ready: inventory.ready.map((candidate) => ({
+            ...candidate,
+            model: (0, provider_models_1.resolveModelForProviderDisplay)(candidate.provider, candidate.model),
+        })),
+        unavailable: inventory.unavailable.map((candidate) => ({
+            ...candidate,
+            model: candidate.model ? (0, provider_models_1.resolveModelForProviderDisplay)(candidate.provider, candidate.model) : undefined,
+        })),
+        unconfigured: [...inventory.unconfigured],
+    };
+}
+function buildFailoverContext(errorMessage, classification, currentProvider, currentModel, agentName, inventory, providerModels, options = {}) {
+    const currentLane = options.currentLane ?? "outward";
+    const label = CLASSIFICATION_LABELS[classification];
+    const providerWithModel = formatProviderWithModel(currentProvider, currentModel);
+    const errorSummary = `${providerWithModel} ${label}`;
+    const errorDetail = formatErrorDetail(errorMessage, errorSummary);
+    const modelMismatch = (0, provider_models_1.getProviderModelMismatchMessage)(currentProvider, currentModel);
+    const normalizedInventory = normalizeFailoverInventory(inventory, providerModels);
+    const readyProviders = normalizedInventory.ready;
+    const workingProviders = readyProviders.map((candidate) => candidate.provider);
+    const unconfiguredProviders = normalizedInventory.unconfigured;
+    const failingProviders = normalizedInventory.unavailable;
+    const lines = [`${errorSummary}.`];
+    if (errorDetail) {
+        lines.push(`provider detail: ${errorDetail}`);
+    }
+    if (classification === "auth-failure") {
+        lines.push("");
+        lines.push("To keep using the current provider:");
+        lines.push(`  1. Run \`ouro auth --agent ${agentName} --provider ${currentProvider}\``);
+    }
+    if (modelMismatch) {
+        const defaultModel = (0, provider_models_1.getDefaultModelForProvider)(currentProvider);
+        lines.push("");
+        lines.push("Config warning:");
+        lines.push(`  - ${modelMismatch}`);
+        lines.push("  - Repair the configured model with:");
+        lines.push(`    \`ouro use --agent ${agentName} --lane ${currentLane} --provider ${currentProvider} --model ${defaultModel}\``);
+    }
+    if (readyProviders.length > 0) {
+        lines.push("");
+        lines.push("Ready providers:");
+        for (const candidate of readyProviders) {
+            lines.push(`  - ${formatReadyProviderLabel(candidate)}: reply "switch to ${candidate.provider}"`);
+        }
+    }
+    if (failingProviders.length > 0) {
+        lines.push("");
+        lines.push("Configured but unavailable:");
+        for (const candidate of failingProviders) {
+            lines.push(formatFailingProviderLine(candidate.provider, candidate.result.classification, agentName));
+        }
+    }
+    if (unconfiguredProviders.length > 0) {
+        lines.push("");
+        lines.push("Not configured:");
+        for (const provider of unconfiguredProviders) {
+            lines.push(`  - ${provider}: run \`ouro auth --agent ${agentName} --provider ${provider}\``);
+        }
+    }
+    if (workingProviders.length === 0 && unconfiguredProviders.length === 0 && failingProviders.length === 0) {
+        lines.push("");
+        lines.push(`No other providers are available. Run \`ouro auth --agent ${agentName}\` in terminal to configure one.`);
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "engine",
+        event: "engine.failover_context_built",
+        message: "built provider failover context",
+        meta: { currentProvider, currentLane, classification, workingProviders, unconfiguredProviders },
+    });
+    return {
+        errorSummary,
+        classification,
+        currentProvider,
+        currentModel,
+        currentLane,
+        agentName,
+        workingProviders,
+        readyProviders,
+        unconfiguredProviders,
+        userMessage: lines.join("\n"),
+    };
+}
+function handleFailoverReply(reply, context) {
+    const lower = reply.toLowerCase().trim();
+    const readyProviders = context.readyProviders ?? context.workingProviders.map((provider) => ({
+        provider,
+        model: (0, provider_models_1.resolveModelForProviderDisplay)(provider),
+    }));
+    const currentLane = context.currentLane ?? "outward";
+    for (const candidate of readyProviders) {
+        if (lower.includes(`switch to ${candidate.provider}`) || lower === candidate.provider) {
+            return {
+                action: "switch",
+                provider: candidate.provider,
+                model: candidate.model,
+                lane: currentLane,
+                ...(candidate.credentialRevision ? { credentialRevision: candidate.credentialRevision } : {}),
+                ...(candidate.source ? { source: candidate.source } : {}),
+            };
+        }
+    }
+    return { action: "dismiss" };
+}
+function candidateFromCredentialRecord(record) {
+    return {
+        provider: record.provider,
+        credentialRevision: record.revision,
+        source: record.provenance.source,
+    };
+}
+async function runMachineProviderFailoverInventory(agentName, currentProvider, options = {}) {
+    const ping = options.ping ?? provider_ping_1.pingProvider;
+    const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName);
+    const providers = Object.keys(identity_1.PROVIDER_CREDENTIALS).filter((provider) => provider !== currentProvider);
+    const inventory = { ready: [], unavailable: [], unconfigured: [] };
+    if (!poolResult.ok) {
+        inventory.unconfigured.push(...providers);
+        (0, runtime_1.emitNervesEvent)({
+            component: "engine",
+            event: "engine.machine_failover_inventory_built",
+            message: "built machine provider failover inventory",
+            meta: { agentName, currentProvider, credentialPoolStatus: poolResult.reason, readyCount: 0, unavailableCount: 0, unconfiguredCount: inventory.unconfigured.length },
+        });
+        return inventory;
+    }
+    const results = await Promise.all(providers.map(async (provider) => {
+        const record = poolResult.pool.providers[provider];
+        if (!record)
+            return { provider, record: undefined, result: undefined };
+        const model = (0, provider_models_1.getDefaultModelForProvider)(provider);
+        const config = { ...record.credentials, ...record.config };
+        const result = await ping(provider, config, { model });
+        return { provider, record, model, result };
+    }));
+    for (const entry of results) {
+        if (!entry.record) {
+            inventory.unconfigured.push(entry.provider);
+        }
+        else if (entry.result.ok) {
+            inventory.ready.push({
+                ...candidateFromCredentialRecord(entry.record),
+                model: entry.model,
+                result: entry.result,
+            });
+        }
+        else {
+            inventory.unavailable.push({
+                ...candidateFromCredentialRecord(entry.record),
+                model: entry.model,
+                result: entry.result,
+            });
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "engine",
+        event: "engine.machine_failover_inventory_built",
+        message: "built machine provider failover inventory",
+        meta: {
+            agentName,
+            currentProvider,
+            credentialPoolStatus: "present",
+            readyCount: inventory.ready.length,
+            unavailableCount: inventory.unavailable.length,
+            unconfiguredCount: inventory.unconfigured.length,
+        },
+    });
+    return inventory;
+}
+/**
+ * Re-verify a failover candidate is actually reachable right before we mutate
+ * provider state. The inventory ping that produced the candidate may be stale
+ * (creds revoked between inventory and reply); without this preflight, an
+ * agent-driven "switch to <provider>" can move the lane onto an unreachable
+ * provider and brick the next turn.
+ */
+async function validateFailoverSwitchCandidate(agentName, candidate, options = {}) {
+    const ping = options.ping ?? provider_ping_1.pingProvider;
+    const refreshPool = options.refreshPool ?? provider_credentials_1.refreshProviderCredentialPool;
+    const poolResult = await refreshPool(agentName);
+    if (!poolResult.ok) {
+        return {
+            ok: false,
+            classification: "auth-failure",
+            message: `provider credential pool unavailable (${poolResult.reason}): ${poolResult.error}`,
+        };
+    }
+    const record = poolResult.pool.providers[candidate.provider];
+    if (!record) {
+        return {
+            ok: false,
+            classification: "auth-failure",
+            message: `no credentials configured for ${candidate.provider}`,
+        };
+    }
+    const config = { ...record.credentials, ...record.config };
+    const result = await ping(candidate.provider, config, { model: candidate.model });
+    if (!result.ok) {
+        return { ok: false, classification: result.classification, message: result.message };
+    }
+    return { ok: true };
+}

package/dist/heart/provider-models.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PROVIDER_MODELS = void 0;
+exports.getProviderDisplayName = getProviderDisplayName;
+exports.getDefaultModelForProvider = getDefaultModelForProvider;
+exports.isModelClearlyIncompatibleWithProvider = isModelClearlyIncompatibleWithProvider;
+exports.resolveModelForProviderSelection = resolveModelForProviderSelection;
+exports.resolveModelForProviderDisplay = resolveModelForProviderDisplay;
+exports.getProviderModelMismatchMessage = getProviderModelMismatchMessage;
+const runtime_1 = require("../nerves/runtime");
+exports.DEFAULT_PROVIDER_MODELS = {
+    anthropic: "claude-opus-4-6",
+    azure: "gpt-4o-mini",
+    minimax: "MiniMax-M2.7",
+    "openai-codex": "gpt-5.4",
+    "github-copilot": "claude-sonnet-4.6",
+};
+const PROVIDER_NAMES = {
+    anthropic: "Anthropic",
+    azure: "Azure OpenAI",
+    minimax: "MiniMax",
+    "openai-codex": "OpenAI Codex",
+    "github-copilot": "GitHub Copilot",
+};
+function normalized(model) {
+    return model.trim().toLowerCase();
+}
+function getProviderDisplayName(provider) {
+    return PROVIDER_NAMES[provider];
+}
+function getDefaultModelForProvider(provider) {
+    return exports.DEFAULT_PROVIDER_MODELS[provider];
+}
+function isModelClearlyIncompatibleWithProvider(provider, model) {
+    const value = normalized(model);
+    if (!value)
+        return true;
+    switch (provider) {
+        case "anthropic":
+            return !value.startsWith("claude-");
+        case "minimax":
+            return !value.startsWith("minimax");
+        case "openai-codex":
+            return value.startsWith("claude-") || value.startsWith("minimax");
+        case "azure":
+            return value.startsWith("claude-") || value.startsWith("minimax");
+        case "github-copilot":
+            return false;
+    }
+}
+function resolveModelForProviderSelection(provider, currentModel) {
+    const trimmed = currentModel.trim();
+    if (trimmed && !isModelClearlyIncompatibleWithProvider(provider, trimmed)) {
+        return { model: trimmed, preserved: true };
+    }
+    const model = getDefaultModelForProvider(provider);
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config_identity.provider_model_defaulted",
+        message: "defaulted provider model during provider selection",
+        meta: { provider, previousModel: currentModel, model },
+    });
+    return { model, preserved: false };
+}
+function resolveModelForProviderDisplay(provider, modelHint) {
+    const hint = modelHint?.trim() ?? "";
+    if (hint && !isModelClearlyIncompatibleWithProvider(provider, hint))
+        return hint;
+    return getDefaultModelForProvider(provider);
+}
+function getProviderModelMismatchMessage(provider, model) {
+    const trimmed = model.trim();
+    if (!isModelClearlyIncompatibleWithProvider(provider, trimmed))
+        return null;
+    const providerName = getProviderDisplayName(provider);
+    const defaultModel = getDefaultModelForProvider(provider);
+    if (!trimmed) {
+        return `${providerName} has no model set. Suggested model: ${defaultModel}.`;
+    }
+    return `${providerName} is currently paired with ${trimmed}, which does not look like a model for ${providerName}. Suggested model: ${defaultModel}.`;
+}

package/dist/heart/provider-ping.js

@@ -0,0 +1,262 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeErrorMessage = sanitizeErrorMessage;
+exports.pingGithubCopilotModel = pingGithubCopilotModel;
+exports.createProviderRuntimeForConfig = createProviderRuntimeForConfig;
+exports.pingProvider = pingProvider;
+exports.runHealthInventory = runHealthInventory;
+const identity_1 = require("./identity");
+const anthropic_1 = require("./providers/anthropic");
+const azure_1 = require("./providers/azure");
+const minimax_1 = require("./providers/minimax");
+const openai_codex_1 = require("./providers/openai-codex");
+const github_copilot_1 = require("./providers/github-copilot");
+const provider_models_1 = require("./provider-models");
+const runtime_1 = require("../nerves/runtime");
+const provider_attempt_1 = require("./provider-attempt");
+const provider_credentials_1 = require("./provider-credentials");
+const PING_TIMEOUT_MS = 10_000;
+const PING_PROMPT = "ping";
+const CHAT_PING_MAX_TOKENS = 1;
+const RESPONSE_PING_MAX_OUTPUT_TOKENS = 16;
+const DEFAULT_AZURE_API_VERSION = "2025-04-01-preview";
+function createPingMessages() {
+    return [{ role: "user", content: PING_PROMPT }];
+}
+function createChatPingRequest(model) {
+    return { model, max_tokens: CHAT_PING_MAX_TOKENS, messages: createPingMessages() };
+}
+function createResponsePingRequest(model) {
+    return { model, input: PING_PROMPT, max_output_tokens: RESPONSE_PING_MAX_OUTPUT_TOKENS };
+}
+/**
+ * Strip raw JSON/HTML API response bodies from error messages.
+ * SDK errors often include the full response: "400 {"type":"error",...}" or "403 <html>...".
+ * Extract just the HTTP status and a short human-readable summary.
+ */
+function sanitizeErrorMessage(message) {
+    const statusMatch = message.match(/^(\d{3})\s/);
+    if (!statusMatch)
+        return message;
+    const status = statusMatch[1];
+    const body = message.slice(status.length).trim();
+    // HTML response (Cloudflare challenge, error pages, etc.)
+    if (body.startsWith("<") || body.includes("<!DOCTYPE") || body.includes("<html")) {
+        return `HTTP ${status}`;
+    }
+    // JSON response
+    if (body.startsWith("{")) {
+        try {
+            const json = JSON.parse(body);
+            const inner = json?.error?.message;
+            if (typeof inner === "string" && inner && inner !== "Error") {
+                return `${status} ${inner}`;
+            }
+        }
+        catch { /* not valid JSON */ }
+        return `HTTP ${status}`;
+    }
+    // Already clean (e.g., "401 Provided authentication token is expired.")
+    return message;
+}
+async function readGithubCopilotModelPingError(response) {
+    let detail = `HTTP ${response.status}`;
+    try {
+        const json = await response.json();
+        /* v8 ignore start -- error format parsing: all branches tested via config-models.test.ts @preserve */
+        if (typeof json.error === "string")
+            detail = json.error;
+        else if (typeof json.error === "object" && json.error !== null) {
+            const errObj = json.error;
+            if (typeof errObj.message === "string")
+                detail = errObj.message;
+        }
+        else if (typeof json.message === "string")
+            detail = json.message;
+        /* v8 ignore stop */
+    }
+    catch {
+        // response body not JSON — keep HTTP status
+    }
+    return detail;
+}
+function createStatusError(message, status) {
+    return Object.assign(new Error(message), { status });
+}
+function normalizePingTimeoutMs(timeoutMs) {
+    if (timeoutMs === undefined)
+        return PING_TIMEOUT_MS;
+    if (!Number.isFinite(timeoutMs))
+        return PING_TIMEOUT_MS;
+    return Math.max(1, Math.floor(timeoutMs));
+}
+function createPingTimeoutError(timeoutMs) {
+    return Object.assign(new Error(`provider ping timed out after ${timeoutMs}ms`), {
+        code: "ETIMEDOUT",
+    });
+}
+async function runPingWithHardTimeout(runtime, timeoutMs) {
+    const controller = new AbortController();
+    let timeout;
+    const timeoutPromise = new Promise((_, reject) => {
+        timeout = setTimeout(() => {
+            controller.abort();
+            reject(createPingTimeoutError(timeoutMs));
+        }, timeoutMs);
+    });
+    try {
+        await Promise.race([
+            Promise.resolve().then(() => runtime.ping(controller.signal)),
+            timeoutPromise,
+        ]);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function pingGithubCopilotModel(baseUrl, token, model, fetchImpl = fetch) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const isClaude = model.startsWith("claude");
+    const url = isClaude ? `${base}/chat/completions` : `${base}/responses`;
+    const body = isClaude
+        ? JSON.stringify(createChatPingRequest(model))
+        : JSON.stringify(createResponsePingRequest(model));
+    const attempt = await (0, provider_attempt_1.runProviderAttempt)({
+        operation: "model-ping",
+        provider: "github-copilot",
+        model,
+        classifyError: github_copilot_1.classifyGithubCopilotError,
+        policy: {
+            maxAttempts: 3,
+            baseDelayMs: 0,
+            backoffMultiplier: 2,
+        },
+        run: async () => {
+            const response = await fetchImpl(url, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    "Content-Type": "application/json",
+                },
+                body,
+            });
+            if (!response.ok) {
+                throw createStatusError(await readGithubCopilotModelPingError(response), response.status);
+            }
+        },
+    });
+    return attempt.ok ? { ok: true } : { ok: false, error: attempt.error.message };
+}
+function hasEmptyCredentials(provider, config) {
+    const record = config;
+    if (provider === "azure") {
+        const hasManagedIdentity = typeof record.endpoint === "string" && record.endpoint.length > 0 &&
+            typeof record.deployment === "string" && record.deployment.length > 0 &&
+            typeof record.managedIdentityClientId === "string" && record.managedIdentityClientId.length > 0;
+        if (hasManagedIdentity)
+            return false;
+    }
+    return identity_1.PROVIDER_CREDENTIALS[provider].required.some((key) => !record[key]);
+}
+function createProviderRuntimeForConfig(provider, config, options = {}) {
+    // Use the same provider defaults as auth switch and hatch so verification
+    // cannot drift to stale provider/model pairings, and pass the checked
+    // credentials directly so daemon-side pings do not depend on --agent globals.
+    const resolvedModel = options.model ?? (0, provider_models_1.getDefaultModelForProvider)(provider);
+    switch (provider) {
+        case "anthropic":
+            return (0, anthropic_1.createAnthropicProviderRuntime)(resolvedModel, config);
+        case "azure":
+            return (0, azure_1.createAzureProviderRuntime)(resolvedModel, {
+                ...config,
+                apiVersion: config.apiVersion ?? DEFAULT_AZURE_API_VERSION,
+            });
+        case "minimax":
+            return (0, minimax_1.createMinimaxProviderRuntime)(resolvedModel, config);
+        case "openai-codex":
+            return (0, openai_codex_1.createOpenAICodexProviderRuntime)(resolvedModel, config);
+        case "github-copilot":
+            return (0, github_copilot_1.createGithubCopilotProviderRuntime)(resolvedModel, config);
+        /* v8 ignore next 2 -- exhaustive: all providers handled above @preserve */
+        default:
+            throw new Error(`unsupported provider for ping: ${provider}`);
+    }
+}
+async function pingProvider(provider, config, options = {}) {
+    if (hasEmptyCredentials(provider, config)) {
+        return { ok: false, classification: "auth-failure", message: "no credentials configured" };
+    }
+    let runtime;
+    try {
+        runtime = createProviderRuntimeForConfig(provider, config, { model: options.model });
+        /* v8 ignore start -- factory creation failure: tested via individual provider init tests @preserve */
+    }
+    catch (error) {
+        return {
+            ok: false,
+            classification: "auth-failure",
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+    /* v8 ignore stop */
+    const attempt = await (0, provider_attempt_1.runProviderAttempt)({
+        operation: "ping",
+        provider,
+        model: runtime.model,
+        classifyError: (error) => runtime.classifyError(error),
+        policy: {
+            maxAttempts: 3,
+            baseDelayMs: 0,
+            backoffMultiplier: 2,
+            ...options.attemptPolicy,
+        },
+        sleep: options.sleep,
+        onAttemptStart: options.onAttemptStart,
+        onRetry: options.onRetry,
+        run: async () => {
+            await runPingWithHardTimeout(runtime, normalizePingTimeoutMs(options.timeoutMs));
+        },
+    });
+    if (attempt.ok) {
+        return { ok: true, attempts: attempt.attempts };
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "engine",
+        event: "engine.provider_ping_fail",
+        message: `provider ping failed: ${provider}`,
+        meta: { provider, classification: attempt.classification, error: attempt.error.message },
+    });
+    return {
+        ok: false,
+        classification: attempt.classification,
+        message: sanitizeErrorMessage(attempt.error.message),
+        attempts: attempt.attempts,
+    };
+}
+const PINGABLE_PROVIDERS = ["anthropic", "openai-codex", "azure", "minimax", "github-copilot"];
+async function runHealthInventory(agentName, currentProvider, deps = {}) {
+    /* v8 ignore next -- default: tests inject ping dep @preserve */
+    const ping = deps.ping ?? pingProvider;
+    const poolResult = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName);
+    const providers = PINGABLE_PROVIDERS.filter((p) => p !== currentProvider);
+    if (!poolResult.ok) {
+        return Object.fromEntries(providers.map((provider) => [
+            provider,
+            { ok: false, classification: "auth-failure", message: poolResult.error },
+        ]));
+    }
+    const results = await Promise.all(providers.map(async (provider) => {
+        const record = poolResult.pool.providers[provider];
+        if (!record) {
+            return [provider, { ok: false, classification: "auth-failure", message: "no credentials configured" }];
+        }
+        const config = { ...record.config, ...record.credentials };
+        const result = await ping(provider, config);
+        return [provider, result];
+    }));
+    const inventory = {};
+    for (const [provider, result] of results) {
+        inventory[provider] = result;
+    }
+    return inventory;
+}