@phuetz/code-buddy 1.1.0 → 1.3.0

package/dist/utils/disk-guard.js

@@ -0,0 +1,404 @@
+/**
+ * disk-guard — the single place that bounds disk access.
+ *
+ * Motivation: on 2026-06-17 a tight build/Electron restart loop leaked temp
+ * dirs until the disk filled mid-run, corrupting command-output capture
+ * (ENOSPC). The fix at the time guarded ONE call site (the Cowork pilot). This
+ * module generalizes that lesson into reusable primitives so the failure class
+ * — "unbounded resource accumulation in a tight loop without monitoring or
+ * cleanup" — is handled in one place:
+ *
+ *   - free-space preflight   → {@link getFreeSpaceInfo}, {@link ensureFreeSpace}
+ *   - managed temp lifecycle → {@link createManagedTempDir} (auto-cleaned on exit)
+ *   - orphan sweep backstop  → {@link sweepOrphans} (catches SIGKILL'd leaks)
+ *   - byte budget            → {@link DiskBudget}
+ *   - bounded writes / logs  → {@link boundedWriteFile}, {@link boundedAppendFile},
+ *                              {@link rotateIfLarge}
+ *
+ * Scope is deliberately focused. It is adopted at the highest-risk sites
+ * (disk-space checks, leaky /tmp dirs, unbounded append logs) rather than
+ * routing every fs write through it. It deliberately does NOT bound:
+ *   - general / user-intentional workspace writes (the user asked for them),
+ *   - third-party writers (Electron / Docker / Playwright) — covered instead by
+ *     the startup {@link sweepOrphans} backstop,
+ *   - low-traffic logs (add a one-line {@link rotateIfLarge} as needed).
+ *
+ * Config (read from the environment at call time, validated, with fallbacks —
+ * see {@link DISK_GUARD_DEFAULTS}; registered in `src/config/env-schema.ts`):
+ *   CODEBUDDY_MIN_FREE_MB, CODEBUDDY_DISK_QUOTA_MB, CODEBUDDY_TEMP_MAX_AGE_MS,
+ *   CODEBUDDY_LOG_MAX_MB, CODEBUDDY_LOG_MAX_FILES.
+ */
+import { statfsSync, readdirSync, statSync, existsSync, renameSync, unlinkSync, rmSync, } from 'node:fs';
+import { mkdtemp, rm, writeFile, appendFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, dirname, basename, extname } from 'node:path';
+import { logger } from './logger.js';
+import { CodeBuddyError } from '../errors/base-error.js';
+import { registerDisposable, unregisterDisposable } from './disposable.js';
+import { GracefulShutdownManager } from './graceful-shutdown.js';
+const MB = 1024 * 1024;
+/** Built-in fallbacks, used when the matching env var is unset/invalid. */
+export const DISK_GUARD_DEFAULTS = {
+    /** Min free space (MB) before a guarded write/launch is refused. Matches the pilot's 500MB. */
+    minFreeMb: 500,
+    /** Per-session byte budget (MB); 0 = unlimited. */
+    quotaMb: 0,
+    /** Orphan-sweep age cutoff (ms); 0 = presence-based (remove any match). */
+    tempMaxAgeMs: 0,
+    /** Append-log rotation size (MB). Matches logger.ts. */
+    logMaxMb: 10,
+    /** Append-log retention count. Matches logger.ts. */
+    logMaxFiles: 5,
+};
+/** Parse a non-negative integer env var with range validation + fallback (mirrors AutoCompactConfig.fromEnv). */
+function readIntEnv(name, fallback, min, max) {
+    const raw = process.env[name];
+    if (raw !== undefined && raw !== '') {
+        const parsed = parseInt(raw, 10);
+        if (!Number.isNaN(parsed) && parsed >= min && parsed <= max) {
+            return parsed;
+        }
+    }
+    return fallback;
+}
+function defaultMinFreeBytes() {
+    return readIntEnv('CODEBUDDY_MIN_FREE_MB', DISK_GUARD_DEFAULTS.minFreeMb, 0, 1_000_000) * MB;
+}
+function defaultQuotaBytes() {
+    return readIntEnv('CODEBUDDY_DISK_QUOTA_MB', DISK_GUARD_DEFAULTS.quotaMb, 0, 100_000_000) * MB;
+}
+function defaultTempMaxAgeMs() {
+    return readIntEnv('CODEBUDDY_TEMP_MAX_AGE_MS', DISK_GUARD_DEFAULTS.tempMaxAgeMs, 0, Number.MAX_SAFE_INTEGER);
+}
+function defaultLogMaxBytes() {
+    return readIntEnv('CODEBUDDY_LOG_MAX_MB', DISK_GUARD_DEFAULTS.logMaxMb, 1, 100_000) * MB;
+}
+function defaultLogMaxFiles() {
+    return readIntEnv('CODEBUDDY_LOG_MAX_FILES', DISK_GUARD_DEFAULTS.logMaxFiles, 1, 1000);
+}
+function formatMb(bytes) {
+    return `${Math.round(bytes / MB)}MB`;
+}
+function byteLength(data) {
+    return typeof data === 'string' ? Buffer.byteLength(data) : data.byteLength;
+}
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+/** Thrown by {@link ensureFreeSpace} when free disk space is below the threshold. */
+export class DiskSpaceError extends CodeBuddyError {
+    constructor(message, context) {
+        super('DISK_SPACE_LOW', message, { context });
+        this.name = 'DiskSpaceError';
+    }
+}
+/** Thrown by {@link boundedWriteFile} when a {@link DiskBudget} reservation is refused. */
+export class DiskBudgetError extends CodeBuddyError {
+    constructor(message, context) {
+        super('DISK_BUDGET_EXCEEDED', message, { context });
+        this.name = 'DiskBudgetError';
+    }
+}
+/**
+ * Free-space info for the filesystem containing `targetPath`, or `null` when
+ * `fs.statfsSync` is unavailable / the path can't be stat'd (never throws).
+ * Uses `bavail` (blocks available to non-root) — the honest free figure a
+ * normal process can actually use — not `bfree`.
+ */
+export function getFreeSpaceInfo(targetPath) {
+    try {
+        const st = statfsSync(targetPath);
+        const bsize = Number(st.bsize);
+        const totalBytes = Number(st.blocks) * bsize;
+        const freeBytes = Number(st.bavail) * bsize;
+        const freePercent = totalBytes > 0 ? (freeBytes / totalBytes) * 100 : 0;
+        return { freeBytes, totalBytes, freePercent };
+    }
+    catch {
+        return null;
+    }
+}
+/** Free bytes for the filesystem containing `targetPath`, or `null` if unavailable. */
+export function getFreeBytes(targetPath) {
+    return getFreeSpaceInfo(targetPath)?.freeBytes ?? null;
+}
+/**
+ * Throw {@link DiskSpaceError} if free space on `targetPath`'s filesystem is
+ * below `minBytes` (default {@link DISK_GUARD_DEFAULTS.minFreeMb}). No-op when
+ * statfs is unavailable — we can't guard, so we don't block (matches the
+ * platform-resilient behavior of the original pilot guard).
+ */
+export function ensureFreeSpace(targetPath, minBytes, opts = {}) {
+    const min = minBytes ?? defaultMinFreeBytes();
+    const info = getFreeSpaceInfo(targetPath);
+    if (info === null)
+        return;
+    if (info.freeBytes < min) {
+        const label = opts.label ? `${opts.label}: ` : '';
+        throw new DiskSpaceError(`${label}only ${formatMb(info.freeBytes)} free on ${targetPath} — refusing to proceed ` +
+            `(needs ${formatMb(min)} headroom; free disk space first).`, { path: targetPath, freeBytes: info.freeBytes, minBytes: min });
+    }
+}
+/**
+ * Remove orphaned entries named `<prefix>*` directly under `root`. This is the
+ * durable backstop for the leak class: managed temp dirs are auto-disposed on a
+ * graceful exit, but a SIGKILL'd / crashed run skips cleanup and leaks its dir
+ * until the next startup sweep.
+ *
+ * - `maxAgeMs: 0` (default) → presence-based: remove every match (the original
+ *   pilot semantics — safe when only one instance runs at a time).
+ * - `maxAgeMs > 0` → age-safe: only remove matches whose mtime is older than
+ *   `maxAgeMs`, so a concurrently-running peer's fresh dir is never nuked.
+ */
+export function sweepOrphans(root, prefix, opts = {}) {
+    const maxAgeMs = opts.maxAgeMs ?? defaultTempMaxAgeMs();
+    const dryRun = opts.dryRun ?? false;
+    const removed = [];
+    const skipped = [];
+    let names;
+    try {
+        names = readdirSync(root);
+    }
+    catch {
+        return { removed, skipped };
+    }
+    const now = Date.now();
+    for (const name of names) {
+        if (!name.startsWith(prefix))
+            continue;
+        const full = join(root, name);
+        if (maxAgeMs > 0) {
+            try {
+                const st = statSync(full);
+                if (now - st.mtimeMs < maxAgeMs) {
+                    skipped.push(full);
+                    continue;
+                }
+            }
+            catch {
+                skipped.push(full);
+                continue;
+            }
+        }
+        if (dryRun) {
+            removed.push(full);
+            continue;
+        }
+        try {
+            rmSync(full, { recursive: true, force: true });
+            removed.push(full);
+        }
+        catch {
+            skipped.push(full);
+        }
+    }
+    return { removed, skipped };
+}
+/**
+ * One-shot startup janitor: remove our own stale scratch dirs/files left in the
+ * system temp dir by crashed or SIGKILL'd runs (the durable backstop for the
+ * leak class). Age-gated (default 24h) so a concurrently-running session's fresh
+ * scratch dirs are never touched. Matches both `codebuddy-*` and `codebuddy_*`.
+ * Never throws.
+ */
+export function sweepStaleCodebuddyTemp(maxAgeMs = 24 * 60 * 60 * 1000) {
+    return sweepOrphans(tmpdir(), 'codebuddy', { maxAgeMs });
+}
+const managedTempDirs = new Set();
+let shutdownHandlerRegistered = false;
+class ManagedTempDirImpl {
+    path;
+    disposed = false;
+    constructor(path) {
+        this.path = path;
+    }
+    async dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        managedTempDirs.delete(this);
+        unregisterDisposable(this);
+        try {
+            await rm(this.path, { recursive: true, force: true });
+        }
+        catch (err) {
+            logger.warn(`disk-guard: failed to remove managed temp dir ${this.path}`, {
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+}
+/** Lazily wire a single shutdown handler the first time a managed temp dir is created. */
+function ensureShutdownHandler() {
+    if (shutdownHandlerRegistered)
+        return;
+    shutdownHandlerRegistered = true;
+    try {
+        GracefulShutdownManager.getInstance().registerHandler({
+            name: 'disk-guard:temp-cleanup',
+            priority: 100,
+            handler: async () => {
+                await disposeAllManagedTempDirs();
+            },
+        });
+    }
+    catch (err) {
+        logger.debug('disk-guard: could not register shutdown handler', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/** Dispose every still-tracked managed temp dir (invoked on graceful shutdown). */
+export async function disposeAllManagedTempDirs() {
+    await Promise.allSettled([...managedTempDirs].map((d) => d.dispose()));
+}
+/**
+ * Create a temp directory that is tracked and auto-removed on graceful exit
+ * (and via the {@link Disposable} registry). Preflights {@link ensureFreeSpace}
+ * on the parent so we fail fast instead of mkdtemp'ing into a full disk.
+ *
+ * Pair this with a startup {@link sweepOrphans} on the same `parentDir`/`prefix`
+ * as the durable backstop for crashed runs that never reach `dispose()`.
+ */
+export async function createManagedTempDir(prefix, opts = {}) {
+    const parent = opts.parentDir ?? tmpdir();
+    ensureFreeSpace(parent, opts.minFreeBytes, { label: `createManagedTempDir(${prefix})` });
+    const dir = await mkdtemp(join(parent, prefix));
+    const handle = new ManagedTempDirImpl(dir);
+    managedTempDirs.add(handle);
+    registerDisposable(handle);
+    ensureShutdownHandler();
+    return handle;
+}
+/**
+ * Tracks cumulative bytes written against a quota
+ * (default {@link DISK_GUARD_DEFAULTS.quotaMb} → `CODEBUDDY_DISK_QUOTA_MB`).
+ * A quota of 0 means unlimited — every reservation is allowed.
+ */
+export class DiskBudget {
+    quotaBytes;
+    usedBytes = 0;
+    constructor(quotaBytes) {
+        this.quotaBytes = quotaBytes ?? defaultQuotaBytes();
+    }
+    /** Check (without recording) whether `bytes` more would fit. */
+    reserve(bytes) {
+        if (this.quotaBytes <= 0)
+            return { allowed: true };
+        if (this.usedBytes + bytes > this.quotaBytes) {
+            return {
+                allowed: false,
+                reason: `disk budget exceeded: ${formatMb(this.usedBytes + bytes)} would exceed ` +
+                    `quota ${formatMb(this.quotaBytes)}`,
+            };
+        }
+        return { allowed: true };
+    }
+    record(bytes) {
+        this.usedBytes += bytes;
+    }
+    release(bytes) {
+        this.usedBytes = Math.max(0, this.usedBytes - bytes);
+    }
+    used() {
+        return this.usedBytes;
+    }
+    remaining() {
+        return this.quotaBytes <= 0 ? Infinity : Math.max(0, this.quotaBytes - this.usedBytes);
+    }
+}
+// ---------------------------------------------------------------------------
+// Bounded writes + log rotation
+// ---------------------------------------------------------------------------
+function rotatedPath(filePath, index) {
+    const ext = extname(filePath);
+    const base = filePath.slice(0, filePath.length - ext.length);
+    return `${base}.${index}${ext}`;
+}
+/**
+ * Rotate `filePath` when it reaches `maxBytes`, keeping at most `maxFiles`
+ * generations (`name.1.ext` … `name.N.ext`, oldest dropped). Ports the
+ * algorithm in logger.ts so unbounded append logs can't fill the disk.
+ * Returns true if a rotation happened. Never throws.
+ */
+export function rotateIfLarge(filePath, maxBytes, maxFiles) {
+    const max = maxBytes ?? defaultLogMaxBytes();
+    const keep = maxFiles ?? defaultLogMaxFiles();
+    try {
+        const st = statSync(filePath);
+        if (st.size < max)
+            return false;
+    }
+    catch {
+        return false; // file doesn't exist yet → nothing to rotate
+    }
+    // Shift existing rotated files (N -> N+1), dropping anything beyond `keep`.
+    for (let i = keep - 1; i >= 1; i--) {
+        const src = rotatedPath(filePath, i);
+        const dst = rotatedPath(filePath, i + 1);
+        try {
+            if (existsSync(src)) {
+                if (i + 1 > keep)
+                    unlinkSync(src);
+                else
+                    renameSync(src, dst);
+            }
+        }
+        catch {
+            /* ignore individual file rotation errors */
+        }
+    }
+    try {
+        const overflow = rotatedPath(filePath, keep + 1);
+        if (existsSync(overflow))
+            unlinkSync(overflow);
+    }
+    catch {
+        /* ignore */
+    }
+    try {
+        renameSync(filePath, rotatedPath(filePath, 1));
+    }
+    catch {
+        /* if rename fails, continue appending to the existing file */
+    }
+    return true;
+}
+/**
+ * Write a file after preflighting free space (and, if a {@link DiskBudget} is
+ * supplied, reserving + recording its size). Throws {@link DiskSpaceError} or
+ * {@link DiskBudgetError} before touching disk when bounds would be breached.
+ */
+export async function boundedWriteFile(filePath, data, opts = {}) {
+    ensureFreeSpace(dirname(filePath), opts.minFreeBytes, { label: `write ${basename(filePath)}` });
+    const size = byteLength(data);
+    if (opts.budget) {
+        const res = opts.budget.reserve(size);
+        if (!res.allowed) {
+            throw new DiskBudgetError(res.reason ?? 'disk budget exceeded', {
+                usedBytes: opts.budget.used(),
+                quotaBytes: opts.budget.used() + opts.budget.remaining(),
+                requestedBytes: size,
+            });
+        }
+    }
+    await writeFile(filePath, data);
+    opts.budget?.record(size);
+}
+/**
+ * Append to a file after optionally rotating it ({@link rotateIfLarge}) and
+ * preflighting free space. The append-log counterpart to {@link boundedWriteFile}.
+ */
+export async function boundedAppendFile(filePath, data, opts = {}) {
+    if (opts.rotate) {
+        rotateIfLarge(filePath, opts.rotate.maxBytes, opts.rotate.maxFiles);
+    }
+    ensureFreeSpace(dirname(filePath), opts.minFreeBytes, { label: `append ${basename(filePath)}` });
+    await appendFile(filePath, data);
+}
+/** Test helper: clear tracked temp dirs + reset the lazy shutdown-handler flag. */
+export function resetDiskGuardForTests() {
+    managedTempDirs.clear();
+    shutdownHandlerRegistered = false;
+}
+//# sourceMappingURL=disk-guard.js.map

package/dist/utils/init-project.d.ts

@@ -81,4 +81,11 @@ export declare function initCodeBuddyProject(workingDirectory?: string, options?
  * Format init result for display (ASCII markers, no emojis)
  */
 export declare function formatInitResult(result: InitResult): string;
+/**
+ * Build the prompt for the agent-driven `/init`. Instructs the model to analyze
+ * the repository and write/improve a tailored root `AGENTS.md`, grounded on the
+ * RepoProfiler's verified facts so it cannot hallucinate build/test commands.
+ * Modeled on Codex's `prompt_for_init_command.md`.
+ */
+export declare function buildInitPrompt(contextPack: string): string;
 export {};

package/dist/utils/init-project.js

@@ -495,6 +495,13 @@ ${archLines.join('\n')}
 ## More Context
 ${moreLines.join('\n')}
 
+<sub>**How instruction files load:** Code Buddy reads from \`~/.codebuddy/\` (global), the
+project root, and subdirectories — the file closest to what you're editing wins.
+Accepted names compose in order: **AGENTS.md** (this file, primary), then \`CODEBUDDY.md\`,
+\`CLAUDE.md\`, \`GEMINI.md\`, \`CONTEXT.md\`, \`INSTRUCTIONS.md\`. Drop \`@./path.md\` to import
+another file. Override a file in the same directory with \`AGENTS.override.md\` (committed)
+or \`AGENTS.local.md\` (gitignored).</sub>
+
 ---
 *Auto-generated by \`buddy init\`. Re-run with \`--force\` to refresh, or edit by hand — \`buddy init\` won't overwrite without explicit force.*
 `;
@@ -772,6 +779,8 @@ Safety checks:
 .codebuddy/tool-results/
 .codebuddy/cache/
 .codebuddy/user-settings.json
+# Personal, uncommitted instruction overrides (AGENTS.local.md, CODEBUDDY.local.md, …)
+*.local.md
 `;
         if (fs.existsSync(gitignorePath)) {
             const currentContent = fs.readFileSync(gitignorePath, 'utf-8');
@@ -897,6 +906,34 @@ export function formatInitResult(result) {
     output += '  5. Use /starter to browse framework starter packs for new projects\n';
     return output;
 }
+/**
+ * Build the prompt for the agent-driven `/init`. Instructs the model to analyze
+ * the repository and write/improve a tailored root `AGENTS.md`, grounded on the
+ * RepoProfiler's verified facts so it cannot hallucinate build/test commands.
+ * Modeled on Codex's `prompt_for_init_command.md`.
+ */
+export function buildInitPrompt(contextPack) {
+    const facts = contextPack && contextPack.trim()
+        ? `\nVERIFIED FACTS about this repository (auto-detected — use these, do not invent commands):\n${contextPack.trim()}\n`
+        : '';
+    return `Analyze THIS repository and write a tailored \`AGENTS.md\` at the project root — a concise contributor/agent guide (the cross-CLI standard read by Claude Code, Cursor, Codex, Gemini CLI and Code Buddy).
+${facts}
+How to do it:
+1. Explore the real code first — use \`list_directory\`, \`view_file\`, \`search\` (and \`code_graph\` if available) to understand the actual structure, entry points, scripts and conventions. Read \`package.json\` / \`pyproject.toml\` / \`Cargo.toml\`, the README, and a few representative source files.
+2. Trust any auto-detected facts shown above for build/test/lint commands, languages and directories — do NOT invent commands. Confirm anything else by reading the config files.
+3. Write a clear, concise document (aim for 200–400 words, Markdown headings), adapting or omitting sections as appropriate:
+   - **Project Structure & Module Organization** — where source, tests and assets live.
+   - **Build, Test & Dev Commands** — the real commands, each briefly explained.
+   - **Coding Style & Naming Conventions** — indentation, language style, naming, lint/format tools.
+   - **Testing Guidelines** — framework, how to run, naming.
+   - **Commit & Pull Request Guidelines** — infer conventions from the git history.
+   - *(optional)* **Architecture Overview** — for non-obvious design.
+
+Important:
+- Write ONLY \`AGENTS.md\` at the project root. Do NOT modify anything under \`.codebuddy/\` — that config was just scaffolded deterministically.
+- If \`AGENTS.md\` already has meaningful content, IMPROVE it in place: preserve the user's good wording, refine and fill gaps; never blank-overwrite.
+- Keep it specific to THIS repository and actionable. No filler.`;
+}
 // ============================================================================
 // Data flow renderer — shows how key components connect
 // ============================================================================

package/dist/utils/interactive-setup.js

@@ -12,6 +12,7 @@ import { logger } from "./logger.js";
 import path from 'path';
 import readline from 'readline';
 import { getCodeBuddyHome, ensureCodeBuddyHome } from './codebuddy-home.js';
+import { getApiKey as getStoredApiKey, setApiKey as setStoredApiKey, } from '../security/credential-manager.js';
 // ============================================================================
 // Readline Utilities
 // ============================================================================
@@ -208,6 +209,15 @@ export async function runSetup() {
  * Load existing API key from settings
  */
 function loadExistingApiKey() {
+    // Encrypted credential store first; fall back to a legacy plaintext key.
+    try {
+        const stored = getStoredApiKey();
+        if (stored)
+            return stored;
+    }
+    catch {
+        // Ignore — fall through to the legacy settings file.
+    }
     try {
         const settingsPath = path.join(getCodeBuddyHome(), 'user-settings.json');
         if (fs.existsSync(settingsPath)) {
@@ -232,9 +242,25 @@ async function saveConfig(config) {
         if (fs.existsSync(settingsPath)) {
             settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
         }
-        // Update settings
+        // Update settings.
+        // API keys are secrets: persist them to the encrypted credential store,
+        // NEVER plaintext in user-settings.json. Mirrors the onboarding wizard
+        // (src/wizard/onboarding.ts → persistProviderSelection).
         if (config.apiKey) {
-            settings.apiKey = config.apiKey;
+            try {
+                setStoredApiKey(config.apiKey);
+            }
+            catch (err) {
+                logger.warn('Could not persist API key to the credential store', {
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+            if (!process.env.GROK_API_KEY)
+                process.env.GROK_API_KEY = config.apiKey;
+        }
+        // Migrate any legacy plaintext key out of the settings file.
+        if (typeof settings.apiKey === 'string') {
+            delete settings.apiKey;
         }
         if (config.baseURL) {
             settings.baseURL = config.baseURL;
@@ -263,6 +289,13 @@ export function needsSetup() {
     if (process.env.GROK_API_KEY) {
         return false;
     }
+    try {
+        if (getStoredApiKey())
+            return false;
+    }
+    catch {
+        // Ignore — fall through to the legacy settings file.
+    }
     try {
         const settingsPath = path.join(getCodeBuddyHome(), 'user-settings.json');
         if (fs.existsSync(settingsPath)) {

package/dist/utils/model-utils.js

@@ -9,13 +9,22 @@ import { ValidationError } from './errors.js';
 export function isSupportedModel(model) {
     return model in SUPPORTED_MODELS;
 }
+function resolveSupportedModelName(model) {
+    if (isSupportedModel(model))
+        return model;
+    const withoutLatest = model.endsWith(':latest') ? model.slice(0, -':latest'.length) : '';
+    if (withoutLatest && isSupportedModel(withoutLatest))
+        return withoutLatest;
+    return null;
+}
 /**
  * Get information about a model
  */
 export function getModelInfo(model) {
-    if (isSupportedModel(model)) {
+    const supportedModel = resolveSupportedModelName(model);
+    if (supportedModel) {
         return {
-            ...SUPPORTED_MODELS[model],
+            ...SUPPORTED_MODELS[supportedModel],
             isSupported: true,
         };
     }

package/dist/utils/output-sanitizer.js

@@ -30,6 +30,14 @@ const CHATML_TOKEN_PATTERN = /<\|(?:im_start|im_end|endoftext|assistant|user|sys
  * Kept as a separate pass to avoid over-matching legitimate content.
  */
 const GENERIC_CONTROL_TOKEN_PATTERN = /<\|[^|>]+\|>/g;
+/**
+ * Some local OpenAI-compatible runtimes leak malformed channel tokens that
+ * miss one side of the ChatML pipe pair, e.g. `thought\n<channel|>42` or
+ * `<|tool_call>...`. Require at least one pipe so legitimate XML/HTML tags
+ * such as `<message>` are preserved.
+ */
+const LOCAL_CHANNEL_HEADER_PATTERN = /^(?:thought|analysis|commentary)\s*\n\s*(?=<(?:\|(?:channel|message|tool_call|constrain)\|?|(?:channel|message|tool_call|constrain)\|)>)/i;
+const MALFORMED_PIPE_CONTROL_TOKEN_PATTERN = /<(?:\|(?:channel|message|tool_call|constrain)\|?|(?:channel|message|tool_call|constrain)\|)>/gi;
 /**
  * JSON-escaped control tokens: \u003c|token|\u003e
  */
@@ -67,6 +75,9 @@ const SANITIZATION_RULES = [
     { pattern: CHATML_TOKEN_PATTERN, replacement: '' },
     // Generic <|...|> control tokens
     { pattern: GENERIC_CONTROL_TOKEN_PATTERN, replacement: '' },
+    // Local malformed channel/control markers
+    { pattern: LOCAL_CHANNEL_HEADER_PATTERN, replacement: '' },
+    { pattern: MALFORMED_PIPE_CONTROL_TOKEN_PATTERN, replacement: '' },
     // JSON-escaped control tokens
     { pattern: JSON_ESCAPED_CONTROL_TOKEN_PATTERN, replacement: '' },
     // LLaMA system prompt blocks

package/dist/utils/provider-detector.d.ts

@@ -5,21 +5,22 @@
  * a Code Buddy session. Pure function (no side effects beyond stat/read
  * on the OAuth file) so it's unit-testable.
  *
- * Priority order:
+ * Priority order is defined in `src/providers/provider-catalog.ts`:
  *   0. CODEBUDDY_PROVIDER override (always wins when set + valid)
  *   1. ChatGPT OAuth credentials present (~/.codebuddy/codex-auth.json)
  *      → explicit "I logged in" act beats ambient env vars
- *   2. OLLAMA_HOST    → ollama (local, free, unlimited)
- *   3. GROK_API_KEY   → grok / OpenAI-compat (incl. xAI)
- *   4. GEMINI/GOOGLE  → gemini
- *   5. OPENAI         → openai
- *   6. ANTHROPIC      → anthropic
+ *   2. Local providers (Ollama / LM Studio / vLLM)
+ *   3. Cloud providers in catalog priority order
  *   else null (no provider available)
  */
+import { type RuntimeProviderId, type ProviderApiMode, type ProviderAuthMode } from '../providers/provider-catalog.js';
 export interface DetectedProvider {
-    provider: 'gemini' | 'grok' | 'openai' | 'anthropic' | 'ollama' | 'chatgpt' | 'unknown';
+    provider: RuntimeProviderId | 'unknown';
     apiKey: string;
     baseURL: string;
     defaultModel: string;
+    apiMode?: ProviderApiMode;
+    authMode?: ProviderAuthMode;
+    source?: 'oauth' | 'environment' | 'override';
 }
 export declare function detectProviderFromEnv(): DetectedProvider | null;