@phuetz/code-buddy 1.0.0 → 1.2.0

package/dist/utils/disk-guard.js

@@ -0,0 +1,404 @@
+/**
+ * disk-guard — the single place that bounds disk access.
+ *
+ * Motivation: on 2026-06-17 a tight build/Electron restart loop leaked temp
+ * dirs until the disk filled mid-run, corrupting command-output capture
+ * (ENOSPC). The fix at the time guarded ONE call site (the Cowork pilot). This
+ * module generalizes that lesson into reusable primitives so the failure class
+ * — "unbounded resource accumulation in a tight loop without monitoring or
+ * cleanup" — is handled in one place:
+ *
+ *   - free-space preflight   → {@link getFreeSpaceInfo}, {@link ensureFreeSpace}
+ *   - managed temp lifecycle → {@link createManagedTempDir} (auto-cleaned on exit)
+ *   - orphan sweep backstop  → {@link sweepOrphans} (catches SIGKILL'd leaks)
+ *   - byte budget            → {@link DiskBudget}
+ *   - bounded writes / logs  → {@link boundedWriteFile}, {@link boundedAppendFile},
+ *                              {@link rotateIfLarge}
+ *
+ * Scope is deliberately focused. It is adopted at the highest-risk sites
+ * (disk-space checks, leaky /tmp dirs, unbounded append logs) rather than
+ * routing every fs write through it. It deliberately does NOT bound:
+ *   - general / user-intentional workspace writes (the user asked for them),
+ *   - third-party writers (Electron / Docker / Playwright) — covered instead by
+ *     the startup {@link sweepOrphans} backstop,
+ *   - low-traffic logs (add a one-line {@link rotateIfLarge} as needed).
+ *
+ * Config (read from the environment at call time, validated, with fallbacks —
+ * see {@link DISK_GUARD_DEFAULTS}; registered in `src/config/env-schema.ts`):
+ *   CODEBUDDY_MIN_FREE_MB, CODEBUDDY_DISK_QUOTA_MB, CODEBUDDY_TEMP_MAX_AGE_MS,
+ *   CODEBUDDY_LOG_MAX_MB, CODEBUDDY_LOG_MAX_FILES.
+ */
+import { statfsSync, readdirSync, statSync, existsSync, renameSync, unlinkSync, rmSync, } from 'node:fs';
+import { mkdtemp, rm, writeFile, appendFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, dirname, basename, extname } from 'node:path';
+import { logger } from './logger.js';
+import { CodeBuddyError } from '../errors/base-error.js';
+import { registerDisposable, unregisterDisposable } from './disposable.js';
+import { GracefulShutdownManager } from './graceful-shutdown.js';
+const MB = 1024 * 1024;
+/** Built-in fallbacks, used when the matching env var is unset/invalid. */
+export const DISK_GUARD_DEFAULTS = {
+    /** Min free space (MB) before a guarded write/launch is refused. Matches the pilot's 500MB. */
+    minFreeMb: 500,
+    /** Per-session byte budget (MB); 0 = unlimited. */
+    quotaMb: 0,
+    /** Orphan-sweep age cutoff (ms); 0 = presence-based (remove any match). */
+    tempMaxAgeMs: 0,
+    /** Append-log rotation size (MB). Matches logger.ts. */
+    logMaxMb: 10,
+    /** Append-log retention count. Matches logger.ts. */
+    logMaxFiles: 5,
+};
+/** Parse a non-negative integer env var with range validation + fallback (mirrors AutoCompactConfig.fromEnv). */
+function readIntEnv(name, fallback, min, max) {
+    const raw = process.env[name];
+    if (raw !== undefined && raw !== '') {
+        const parsed = parseInt(raw, 10);
+        if (!Number.isNaN(parsed) && parsed >= min && parsed <= max) {
+            return parsed;
+        }
+    }
+    return fallback;
+}
+function defaultMinFreeBytes() {
+    return readIntEnv('CODEBUDDY_MIN_FREE_MB', DISK_GUARD_DEFAULTS.minFreeMb, 0, 1_000_000) * MB;
+}
+function defaultQuotaBytes() {
+    return readIntEnv('CODEBUDDY_DISK_QUOTA_MB', DISK_GUARD_DEFAULTS.quotaMb, 0, 100_000_000) * MB;
+}
+function defaultTempMaxAgeMs() {
+    return readIntEnv('CODEBUDDY_TEMP_MAX_AGE_MS', DISK_GUARD_DEFAULTS.tempMaxAgeMs, 0, Number.MAX_SAFE_INTEGER);
+}
+function defaultLogMaxBytes() {
+    return readIntEnv('CODEBUDDY_LOG_MAX_MB', DISK_GUARD_DEFAULTS.logMaxMb, 1, 100_000) * MB;
+}
+function defaultLogMaxFiles() {
+    return readIntEnv('CODEBUDDY_LOG_MAX_FILES', DISK_GUARD_DEFAULTS.logMaxFiles, 1, 1000);
+}
+function formatMb(bytes) {
+    return `${Math.round(bytes / MB)}MB`;
+}
+function byteLength(data) {
+    return typeof data === 'string' ? Buffer.byteLength(data) : data.byteLength;
+}
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+/** Thrown by {@link ensureFreeSpace} when free disk space is below the threshold. */
+export class DiskSpaceError extends CodeBuddyError {
+    constructor(message, context) {
+        super('DISK_SPACE_LOW', message, { context });
+        this.name = 'DiskSpaceError';
+    }
+}
+/** Thrown by {@link boundedWriteFile} when a {@link DiskBudget} reservation is refused. */
+export class DiskBudgetError extends CodeBuddyError {
+    constructor(message, context) {
+        super('DISK_BUDGET_EXCEEDED', message, { context });
+        this.name = 'DiskBudgetError';
+    }
+}
+/**
+ * Free-space info for the filesystem containing `targetPath`, or `null` when
+ * `fs.statfsSync` is unavailable / the path can't be stat'd (never throws).
+ * Uses `bavail` (blocks available to non-root) — the honest free figure a
+ * normal process can actually use — not `bfree`.
+ */
+export function getFreeSpaceInfo(targetPath) {
+    try {
+        const st = statfsSync(targetPath);
+        const bsize = Number(st.bsize);
+        const totalBytes = Number(st.blocks) * bsize;
+        const freeBytes = Number(st.bavail) * bsize;
+        const freePercent = totalBytes > 0 ? (freeBytes / totalBytes) * 100 : 0;
+        return { freeBytes, totalBytes, freePercent };
+    }
+    catch {
+        return null;
+    }
+}
+/** Free bytes for the filesystem containing `targetPath`, or `null` if unavailable. */
+export function getFreeBytes(targetPath) {
+    return getFreeSpaceInfo(targetPath)?.freeBytes ?? null;
+}
+/**
+ * Throw {@link DiskSpaceError} if free space on `targetPath`'s filesystem is
+ * below `minBytes` (default {@link DISK_GUARD_DEFAULTS.minFreeMb}). No-op when
+ * statfs is unavailable — we can't guard, so we don't block (matches the
+ * platform-resilient behavior of the original pilot guard).
+ */
+export function ensureFreeSpace(targetPath, minBytes, opts = {}) {
+    const min = minBytes ?? defaultMinFreeBytes();
+    const info = getFreeSpaceInfo(targetPath);
+    if (info === null)
+        return;
+    if (info.freeBytes < min) {
+        const label = opts.label ? `${opts.label}: ` : '';
+        throw new DiskSpaceError(`${label}only ${formatMb(info.freeBytes)} free on ${targetPath} — refusing to proceed ` +
+            `(needs ${formatMb(min)} headroom; free disk space first).`, { path: targetPath, freeBytes: info.freeBytes, minBytes: min });
+    }
+}
+/**
+ * Remove orphaned entries named `<prefix>*` directly under `root`. This is the
+ * durable backstop for the leak class: managed temp dirs are auto-disposed on a
+ * graceful exit, but a SIGKILL'd / crashed run skips cleanup and leaks its dir
+ * until the next startup sweep.
+ *
+ * - `maxAgeMs: 0` (default) → presence-based: remove every match (the original
+ *   pilot semantics — safe when only one instance runs at a time).
+ * - `maxAgeMs > 0` → age-safe: only remove matches whose mtime is older than
+ *   `maxAgeMs`, so a concurrently-running peer's fresh dir is never nuked.
+ */
+export function sweepOrphans(root, prefix, opts = {}) {
+    const maxAgeMs = opts.maxAgeMs ?? defaultTempMaxAgeMs();
+    const dryRun = opts.dryRun ?? false;
+    const removed = [];
+    const skipped = [];
+    let names;
+    try {
+        names = readdirSync(root);
+    }
+    catch {
+        return { removed, skipped };
+    }
+    const now = Date.now();
+    for (const name of names) {
+        if (!name.startsWith(prefix))
+            continue;
+        const full = join(root, name);
+        if (maxAgeMs > 0) {
+            try {
+                const st = statSync(full);
+                if (now - st.mtimeMs < maxAgeMs) {
+                    skipped.push(full);
+                    continue;
+                }
+            }
+            catch {
+                skipped.push(full);
+                continue;
+            }
+        }
+        if (dryRun) {
+            removed.push(full);
+            continue;
+        }
+        try {
+            rmSync(full, { recursive: true, force: true });
+            removed.push(full);
+        }
+        catch {
+            skipped.push(full);
+        }
+    }
+    return { removed, skipped };
+}
+/**
+ * One-shot startup janitor: remove our own stale scratch dirs/files left in the
+ * system temp dir by crashed or SIGKILL'd runs (the durable backstop for the
+ * leak class). Age-gated (default 24h) so a concurrently-running session's fresh
+ * scratch dirs are never touched. Matches both `codebuddy-*` and `codebuddy_*`.
+ * Never throws.
+ */
+export function sweepStaleCodebuddyTemp(maxAgeMs = 24 * 60 * 60 * 1000) {
+    return sweepOrphans(tmpdir(), 'codebuddy', { maxAgeMs });
+}
+const managedTempDirs = new Set();
+let shutdownHandlerRegistered = false;
+class ManagedTempDirImpl {
+    path;
+    disposed = false;
+    constructor(path) {
+        this.path = path;
+    }
+    async dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        managedTempDirs.delete(this);
+        unregisterDisposable(this);
+        try {
+            await rm(this.path, { recursive: true, force: true });
+        }
+        catch (err) {
+            logger.warn(`disk-guard: failed to remove managed temp dir ${this.path}`, {
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+}
+/** Lazily wire a single shutdown handler the first time a managed temp dir is created. */
+function ensureShutdownHandler() {
+    if (shutdownHandlerRegistered)
+        return;
+    shutdownHandlerRegistered = true;
+    try {
+        GracefulShutdownManager.getInstance().registerHandler({
+            name: 'disk-guard:temp-cleanup',
+            priority: 100,
+            handler: async () => {
+                await disposeAllManagedTempDirs();
+            },
+        });
+    }
+    catch (err) {
+        logger.debug('disk-guard: could not register shutdown handler', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/** Dispose every still-tracked managed temp dir (invoked on graceful shutdown). */
+export async function disposeAllManagedTempDirs() {
+    await Promise.allSettled([...managedTempDirs].map((d) => d.dispose()));
+}
+/**
+ * Create a temp directory that is tracked and auto-removed on graceful exit
+ * (and via the {@link Disposable} registry). Preflights {@link ensureFreeSpace}
+ * on the parent so we fail fast instead of mkdtemp'ing into a full disk.
+ *
+ * Pair this with a startup {@link sweepOrphans} on the same `parentDir`/`prefix`
+ * as the durable backstop for crashed runs that never reach `dispose()`.
+ */
+export async function createManagedTempDir(prefix, opts = {}) {
+    const parent = opts.parentDir ?? tmpdir();
+    ensureFreeSpace(parent, opts.minFreeBytes, { label: `createManagedTempDir(${prefix})` });
+    const dir = await mkdtemp(join(parent, prefix));
+    const handle = new ManagedTempDirImpl(dir);
+    managedTempDirs.add(handle);
+    registerDisposable(handle);
+    ensureShutdownHandler();
+    return handle;
+}
+/**
+ * Tracks cumulative bytes written against a quota
+ * (default {@link DISK_GUARD_DEFAULTS.quotaMb} → `CODEBUDDY_DISK_QUOTA_MB`).
+ * A quota of 0 means unlimited — every reservation is allowed.
+ */
+export class DiskBudget {
+    quotaBytes;
+    usedBytes = 0;
+    constructor(quotaBytes) {
+        this.quotaBytes = quotaBytes ?? defaultQuotaBytes();
+    }
+    /** Check (without recording) whether `bytes` more would fit. */
+    reserve(bytes) {
+        if (this.quotaBytes <= 0)
+            return { allowed: true };
+        if (this.usedBytes + bytes > this.quotaBytes) {
+            return {
+                allowed: false,
+                reason: `disk budget exceeded: ${formatMb(this.usedBytes + bytes)} would exceed ` +
+                    `quota ${formatMb(this.quotaBytes)}`,
+            };
+        }
+        return { allowed: true };
+    }
+    record(bytes) {
+        this.usedBytes += bytes;
+    }
+    release(bytes) {
+        this.usedBytes = Math.max(0, this.usedBytes - bytes);
+    }
+    used() {
+        return this.usedBytes;
+    }
+    remaining() {
+        return this.quotaBytes <= 0 ? Infinity : Math.max(0, this.quotaBytes - this.usedBytes);
+    }
+}
+// ---------------------------------------------------------------------------
+// Bounded writes + log rotation
+// ---------------------------------------------------------------------------
+function rotatedPath(filePath, index) {
+    const ext = extname(filePath);
+    const base = filePath.slice(0, filePath.length - ext.length);
+    return `${base}.${index}${ext}`;
+}
+/**
+ * Rotate `filePath` when it reaches `maxBytes`, keeping at most `maxFiles`
+ * generations (`name.1.ext` … `name.N.ext`, oldest dropped). Ports the
+ * algorithm in logger.ts so unbounded append logs can't fill the disk.
+ * Returns true if a rotation happened. Never throws.
+ */
+export function rotateIfLarge(filePath, maxBytes, maxFiles) {
+    const max = maxBytes ?? defaultLogMaxBytes();
+    const keep = maxFiles ?? defaultLogMaxFiles();
+    try {
+        const st = statSync(filePath);
+        if (st.size < max)
+            return false;
+    }
+    catch {
+        return false; // file doesn't exist yet → nothing to rotate
+    }
+    // Shift existing rotated files (N -> N+1), dropping anything beyond `keep`.
+    for (let i = keep - 1; i >= 1; i--) {
+        const src = rotatedPath(filePath, i);
+        const dst = rotatedPath(filePath, i + 1);
+        try {
+            if (existsSync(src)) {
+                if (i + 1 > keep)
+                    unlinkSync(src);
+                else
+                    renameSync(src, dst);
+            }
+        }
+        catch {
+            /* ignore individual file rotation errors */
+        }
+    }
+    try {
+        const overflow = rotatedPath(filePath, keep + 1);
+        if (existsSync(overflow))
+            unlinkSync(overflow);
+    }
+    catch {
+        /* ignore */
+    }
+    try {
+        renameSync(filePath, rotatedPath(filePath, 1));
+    }
+    catch {
+        /* if rename fails, continue appending to the existing file */
+    }
+    return true;
+}
+/**
+ * Write a file after preflighting free space (and, if a {@link DiskBudget} is
+ * supplied, reserving + recording its size). Throws {@link DiskSpaceError} or
+ * {@link DiskBudgetError} before touching disk when bounds would be breached.
+ */
+export async function boundedWriteFile(filePath, data, opts = {}) {
+    ensureFreeSpace(dirname(filePath), opts.minFreeBytes, { label: `write ${basename(filePath)}` });
+    const size = byteLength(data);
+    if (opts.budget) {
+        const res = opts.budget.reserve(size);
+        if (!res.allowed) {
+            throw new DiskBudgetError(res.reason ?? 'disk budget exceeded', {
+                usedBytes: opts.budget.used(),
+                quotaBytes: opts.budget.used() + opts.budget.remaining(),
+                requestedBytes: size,
+            });
+        }
+    }
+    await writeFile(filePath, data);
+    opts.budget?.record(size);
+}
+/**
+ * Append to a file after optionally rotating it ({@link rotateIfLarge}) and
+ * preflighting free space. The append-log counterpart to {@link boundedWriteFile}.
+ */
+export async function boundedAppendFile(filePath, data, opts = {}) {
+    if (opts.rotate) {
+        rotateIfLarge(filePath, opts.rotate.maxBytes, opts.rotate.maxFiles);
+    }
+    ensureFreeSpace(dirname(filePath), opts.minFreeBytes, { label: `append ${basename(filePath)}` });
+    await appendFile(filePath, data);
+}
+/** Test helper: clear tracked temp dirs + reset the lazy shutdown-handler flag. */
+export function resetDiskGuardForTests() {
+    managedTempDirs.clear();
+    shutdownHandlerRegistered = false;
+}
+//# sourceMappingURL=disk-guard.js.map

package/dist/utils/interactive-setup.js

@@ -12,6 +12,7 @@ import { logger } from "./logger.js";
 import path from 'path';
 import readline from 'readline';
 import { getCodeBuddyHome, ensureCodeBuddyHome } from './codebuddy-home.js';
+import { getApiKey as getStoredApiKey, setApiKey as setStoredApiKey, } from '../security/credential-manager.js';
 // ============================================================================
 // Readline Utilities
 // ============================================================================
@@ -208,6 +209,15 @@ export async function runSetup() {
  * Load existing API key from settings
  */
 function loadExistingApiKey() {
+    // Encrypted credential store first; fall back to a legacy plaintext key.
+    try {
+        const stored = getStoredApiKey();
+        if (stored)
+            return stored;
+    }
+    catch {
+        // Ignore — fall through to the legacy settings file.
+    }
     try {
         const settingsPath = path.join(getCodeBuddyHome(), 'user-settings.json');
         if (fs.existsSync(settingsPath)) {
@@ -232,9 +242,25 @@ async function saveConfig(config) {
         if (fs.existsSync(settingsPath)) {
             settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
         }
-        // Update settings
+        // Update settings.
+        // API keys are secrets: persist them to the encrypted credential store,
+        // NEVER plaintext in user-settings.json. Mirrors the onboarding wizard
+        // (src/wizard/onboarding.ts → persistProviderSelection).
         if (config.apiKey) {
-            settings.apiKey = config.apiKey;
+            try {
+                setStoredApiKey(config.apiKey);
+            }
+            catch (err) {
+                logger.warn('Could not persist API key to the credential store', {
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+            if (!process.env.GROK_API_KEY)
+                process.env.GROK_API_KEY = config.apiKey;
+        }
+        // Migrate any legacy plaintext key out of the settings file.
+        if (typeof settings.apiKey === 'string') {
+            delete settings.apiKey;
         }
         if (config.baseURL) {
             settings.baseURL = config.baseURL;
@@ -263,6 +289,13 @@ export function needsSetup() {
     if (process.env.GROK_API_KEY) {
         return false;
     }
+    try {
+        if (getStoredApiKey())
+            return false;
+    }
+    catch {
+        // Ignore — fall through to the legacy settings file.
+    }
     try {
         const settingsPath = path.join(getCodeBuddyHome(), 'user-settings.json');
         if (fs.existsSync(settingsPath)) {

package/dist/utils/model-utils.js

@@ -9,13 +9,22 @@ import { ValidationError } from './errors.js';
 export function isSupportedModel(model) {
     return model in SUPPORTED_MODELS;
 }
+function resolveSupportedModelName(model) {
+    if (isSupportedModel(model))
+        return model;
+    const withoutLatest = model.endsWith(':latest') ? model.slice(0, -':latest'.length) : '';
+    if (withoutLatest && isSupportedModel(withoutLatest))
+        return withoutLatest;
+    return null;
+}
 /**
  * Get information about a model
  */
 export function getModelInfo(model) {
-    if (isSupportedModel(model)) {
+    const supportedModel = resolveSupportedModelName(model);
+    if (supportedModel) {
         return {
-            ...SUPPORTED_MODELS[model],
+            ...SUPPORTED_MODELS[supportedModel],
             isSupported: true,
         };
     }

package/dist/utils/output-sanitizer.js

@@ -30,6 +30,14 @@ const CHATML_TOKEN_PATTERN = /<\|(?:im_start|im_end|endoftext|assistant|user|sys
  * Kept as a separate pass to avoid over-matching legitimate content.
  */
 const GENERIC_CONTROL_TOKEN_PATTERN = /<\|[^|>]+\|>/g;
+/**
+ * Some local OpenAI-compatible runtimes leak malformed channel tokens that
+ * miss one side of the ChatML pipe pair, e.g. `thought\n<channel|>42` or
+ * `<|tool_call>...`. Require at least one pipe so legitimate XML/HTML tags
+ * such as `<message>` are preserved.
+ */
+const LOCAL_CHANNEL_HEADER_PATTERN = /^(?:thought|analysis|commentary)\s*\n\s*(?=<(?:\|(?:channel|message|tool_call|constrain)\|?|(?:channel|message|tool_call|constrain)\|)>)/i;
+const MALFORMED_PIPE_CONTROL_TOKEN_PATTERN = /<(?:\|(?:channel|message|tool_call|constrain)\|?|(?:channel|message|tool_call|constrain)\|)>/gi;
 /**
  * JSON-escaped control tokens: \u003c|token|\u003e
  */
@@ -67,6 +75,9 @@ const SANITIZATION_RULES = [
     { pattern: CHATML_TOKEN_PATTERN, replacement: '' },
     // Generic <|...|> control tokens
     { pattern: GENERIC_CONTROL_TOKEN_PATTERN, replacement: '' },
+    // Local malformed channel/control markers
+    { pattern: LOCAL_CHANNEL_HEADER_PATTERN, replacement: '' },
+    { pattern: MALFORMED_PIPE_CONTROL_TOKEN_PATTERN, replacement: '' },
     // JSON-escaped control tokens
     { pattern: JSON_ESCAPED_CONTROL_TOKEN_PATTERN, replacement: '' },
     // LLaMA system prompt blocks

package/dist/utils/provider-detector.d.ts

@@ -5,21 +5,22 @@
  * a Code Buddy session. Pure function (no side effects beyond stat/read
  * on the OAuth file) so it's unit-testable.
  *
- * Priority order:
+ * Priority order is defined in `src/providers/provider-catalog.ts`:
  *   0. CODEBUDDY_PROVIDER override (always wins when set + valid)
  *   1. ChatGPT OAuth credentials present (~/.codebuddy/codex-auth.json)
  *      → explicit "I logged in" act beats ambient env vars
- *   2. OLLAMA_HOST    → ollama (local, free, unlimited)
- *   3. GROK_API_KEY   → grok / OpenAI-compat (incl. xAI)
- *   4. GEMINI/GOOGLE  → gemini
- *   5. OPENAI         → openai
- *   6. ANTHROPIC      → anthropic
+ *   2. Local providers (Ollama / LM Studio / vLLM)
+ *   3. Cloud providers in catalog priority order
  *   else null (no provider available)
  */
+import { type RuntimeProviderId, type ProviderApiMode, type ProviderAuthMode } from '../providers/provider-catalog.js';
 export interface DetectedProvider {
-    provider: 'gemini' | 'grok' | 'openai' | 'anthropic' | 'ollama' | 'chatgpt' | 'unknown';
+    provider: RuntimeProviderId | 'unknown';
     apiKey: string;
     baseURL: string;
     defaultModel: string;
+    apiMode?: ProviderApiMode;
+    authMode?: ProviderAuthMode;
+    source?: 'oauth' | 'environment' | 'override';
 }
 export declare function detectProviderFromEnv(): DetectedProvider | null;

package/dist/utils/provider-detector.js

@@ -5,93 +5,35 @@
  * a Code Buddy session. Pure function (no side effects beyond stat/read
  * on the OAuth file) so it's unit-testable.
  *
- * Priority order:
+ * Priority order is defined in `src/providers/provider-catalog.ts`:
  *   0. CODEBUDDY_PROVIDER override (always wins when set + valid)
  *   1. ChatGPT OAuth credentials present (~/.codebuddy/codex-auth.json)
  *      → explicit "I logged in" act beats ambient env vars
- *   2. OLLAMA_HOST    → ollama (local, free, unlimited)
- *   3. GROK_API_KEY   → grok / OpenAI-compat (incl. xAI)
- *   4. GEMINI/GOOGLE  → gemini
- *   5. OPENAI         → openai
- *   6. ANTHROPIC      → anthropic
+ *   2. Local providers (Ollama / LM Studio / vLLM)
+ *   3. Cloud providers in catalog priority order
  *   else null (no provider available)
  */
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { resolveProviderFromCatalog, } from '../providers/provider-catalog.js';
 export function detectProviderFromEnv() {
-    const override = process.env.CODEBUDDY_PROVIDER?.toLowerCase();
-    // ChatGPT subscription auth — explicit login wins over ambient
-    // env-detected providers. User who ran `buddy login chatgpt` recently
-    // expects subsequent calls to route through their ChatGPT plan, not
-    // get hijacked by an OLLAMA_HOST set in their shell rc weeks ago.
-    if (override === 'chatgpt' || !override) {
-        try {
-            const authPath = path.join(os.homedir(), '.codebuddy', 'codex-auth.json');
-            if (fs.existsSync(authPath)) {
-                const raw = fs.readFileSync(authPath, 'utf-8').trim();
-                const parsed = raw ? JSON.parse(raw) : null;
-                if (parsed?.tokens?.access_token) {
-                    return {
-                        provider: 'chatgpt',
-                        apiKey: 'oauth-chatgpt',
-                        baseURL: 'https://chatgpt.com/backend-api/codex',
-                        defaultModel: process.env.CHATGPT_MODEL || 'gpt-5.5',
-                    };
-                }
-            }
-        }
-        catch {
-            // Malformed auth file or unexpected — fall through.
-        }
-    }
-    if (override === 'ollama' || (!override && process.env.OLLAMA_HOST)) {
-        let host = process.env.OLLAMA_HOST || 'http://localhost:11434';
-        if (!/^https?:\/\//i.test(host))
-            host = `http://${host}`;
-        if (!host.endsWith('/v1'))
-            host = host.replace(/\/+$/, '') + '/v1';
-        return {
-            provider: 'ollama',
-            apiKey: 'ollama',
-            baseURL: host,
-            defaultModel: process.env.GROK_MODEL || process.env.OLLAMA_MODEL || 'qwen2.5-coder:7b',
-        };
-    }
-    if ((override === 'grok' || override === 'xai') ||
-        (!override && (process.env.GROK_API_KEY || process.env.XAI_API_KEY))) {
-        return {
-            provider: 'grok',
-            apiKey: process.env.GROK_API_KEY || process.env.XAI_API_KEY || '',
-            baseURL: process.env.GROK_BASE_URL || 'https://api.x.ai/v1',
-            defaultModel: process.env.GROK_MODEL || 'grok-3-fast',
-        };
-    }
-    if ((override === 'gemini' || override === 'google') ||
-        (!override && (process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY))) {
-        return {
-            provider: 'gemini',
-            apiKey: process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY || '',
-            baseURL: 'https://generativelanguage.googleapis.com/v1beta',
-            defaultModel: process.env.GEMINI_MODEL || 'gemini-2.5-flash',
-        };
-    }
-    if (override === 'openai' || (!override && process.env.OPENAI_API_KEY)) {
-        return {
-            provider: 'openai',
-            apiKey: process.env.OPENAI_API_KEY || '',
-            baseURL: process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1',
-            defaultModel: process.env.OPENAI_MODEL || 'gpt-4o',
-        };
+    return resolveProviderFromCatalog({
+        hasChatGptOAuth: hasChatGptOAuthCredentials(),
+    });
+}
+function hasChatGptOAuthCredentials() {
+    try {
+        const authPath = path.join(os.homedir(), '.codebuddy', 'codex-auth.json');
+        if (!fs.existsSync(authPath))
+            return false;
+        const raw = fs.readFileSync(authPath, 'utf-8').trim();
+        const parsed = raw ? JSON.parse(raw) : null;
+        return Boolean(parsed?.tokens?.access_token);
     }
-    if (override === 'anthropic' || (!override && process.env.ANTHROPIC_API_KEY)) {
-        return {
-            provider: 'anthropic',
-            apiKey: process.env.ANTHROPIC_API_KEY || '',
-            baseURL: 'https://api.anthropic.com/v1',
-            defaultModel: process.env.ANTHROPIC_MODEL || 'claude-sonnet-4-20250514',
-        };
+    catch {
+        // Malformed auth file or unexpected — fall through to env providers.
+        return false;
     }
-    return null;
 }
 //# sourceMappingURL=provider-detector.js.map

package/dist/utils/settings-manager.d.ts

@@ -20,6 +20,13 @@ export interface ProjectSettings {
     model?: string;
     mcpServers?: Record<string, unknown>;
     thinkingLevel?: 'off' | 'minimal' | 'low' | 'medium' | 'high';
+    goals?: {
+        maxTurns?: number;
+        judgeModel?: string;
+        plannerModel?: string;
+        judgeMaxTokens?: number;
+        judgeTimeoutMs?: number;
+    };
 }
 /**
  * Unified settings manager that handles both user-level and project-level settings