@shomra/agent 0.3.28 → 0.3.30

package/src/inventory/discovery/mcp-servers.mjs

@@ -1,76 +1,166 @@
+import fs from 'node:fs';
 import path from 'node:path';
-import { readJson } from './fs-read.mjs';
+import { readText } from './fs-read.mjs';
 import { redactEnv } from './model-keys.mjs';
-import { APPDATA, HOME, PLAT, vscodeUserDir } from './platform.mjs';
+import { APPDATA, HOME, LOCALAPPDATA, PLAT, vscodeUserDir } from './platform.mjs';
 import { walkWorkspace } from './workspace.mjs';
+import { parseConfigDoc, readMcpServers } from '../../detect/signals/mcp-config.mjs';
+import { jetbrainsOptionFiles, readClaudeExtensions, readJetbrainsMcpServers, readSqliteMcpServers, warpDatabases } from './mcp-stores.mjs';
 
 export function vendorFromPath(file) {
   if (/[\\/]\.cursor[\\/]/.test(file)) return 'cursor';
   if (/[\\/]\.vscode[\\/]/.test(file)) return 'vscode';
   if (/[\\/]\.gemini[\\/]/.test(file)) return 'gemini';
   if (/[\\/]\.zed[\\/]/.test(file)) return 'zed';
+  if (/[\\/]\.kiro[\\/]/.test(file)) return 'kiro';
+  if (/[\\/]\.amazonq[\\/]/.test(file)) return 'amazonq';
+  if (/[\\/]\.roo[\\/]/.test(file)) return 'roo';
+  if (/[\\/]\.windsurf[\\/]/.test(file)) return 'windsurf';
+  if (/[\\/]\.codex[\\/]/.test(file)) return 'codex';
   return 'project';
 }
 
+function appSupport(...rel) {
+  if (PLAT === 'darwin') return path.join(HOME, 'Library', 'Application Support', ...rel);
+  if (PLAT === 'win32') return path.join(APPDATA, ...rel);
+  return path.join(HOME, '.config', ...rel);
+}
+
+function claudeMsixConfigs() {
+  if (PLAT !== 'win32') return [];
+  try {
+    return fs.readdirSync(path.join(LOCALAPPDATA, 'Packages'))
+      .filter((d) => /^(?:Claude|AnthropicPBC\.Claude)_/i.test(d))
+      .map((d) => path.join(LOCALAPPDATA, 'Packages', d, 'LocalCache', 'Roaming', 'Claude', 'claude_desktop_config.json'));
+  } catch {
+    return [];
+  }
+}
+
+function managedClaudeMcp() {
+  if (PLAT === 'darwin') return path.join('/Library', 'Application Support', 'ClaudeCode', 'managed-mcp.json');
+  if (PLAT === 'win32') return path.join(process.env.ProgramData || 'C:\\ProgramData', 'ClaudeCode', 'managed-mcp.json');
+  return path.join('/etc', 'claude-code', 'managed-mcp.json');
+}
+
+
 function globalMcpCandidates() {
   const c = [];
-  if (PLAT === 'win32') c.push({ vendor: 'claude', file: path.join(APPDATA, 'Claude', 'claude_desktop_config.json') });
-  else if (PLAT === 'darwin') c.push({ vendor: 'claude', file: path.join(HOME, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json') });
-  else c.push({ vendor: 'claude', file: path.join(HOME, '.config', 'Claude', 'claude_desktop_config.json') });
+  c.push({ vendor: 'claude', file: appSupport('Claude', 'claude_desktop_config.json') });
+  for (const file of claudeMsixConfigs()) c.push({ vendor: 'claude', file });
+  c.push({ vendor: 'claude-code', file: path.join(HOME, '.claude.json') }); // user + per-project (projects.*.mcpServers)
+  c.push({ vendor: 'claude-code', file: managedClaudeMcp() });
   c.push({ vendor: 'cursor', file: path.join(HOME, '.cursor', 'mcp.json') });
   c.push({ vendor: 'windsurf', file: path.join(HOME, '.codeium', 'windsurf', 'mcp_config.json') });
   c.push({ vendor: 'continue', file: path.join(HOME, '.continue', 'config.json') });
-  c.push({ vendor: 'claude-code', file: path.join(HOME, '.claude.json') });
+  c.push({ vendor: 'continue', file: path.join(HOME, '.continue', 'config.yaml') });
   c.push({ vendor: 'gemini', file: path.join(HOME, '.gemini', 'settings.json') });
-  c.push({ vendor: 'cline', file: path.join(vscodeUserDir(), 'globalStorage', 'saoudrizwan.claude-dev', 'settings', 'cline_mcp_settings.json') });
-  c.push({ vendor: 'roo', file: path.join(vscodeUserDir(), 'globalStorage', 'rooveterinaryinc.roo-cline', 'settings', 'mcp_settings.json') });
+  c.push({ vendor: 'qwen-code', file: path.join(HOME, '.qwen', 'settings.json') });
+  c.push({ vendor: 'codex', file: path.join(HOME, '.codex', 'config.toml') });
+  c.push({ vendor: 'copilot', file: path.join(HOME, '.copilot', 'mcp-config.json') });
+  c.push({ vendor: 'kiro', file: path.join(HOME, '.kiro', 'settings', 'mcp.json') });
+  c.push({ vendor: 'amazonq', file: path.join(HOME, '.aws', 'amazonq', 'mcp.json') });
+  c.push({ vendor: 'opencode', file: path.join(HOME, '.config', 'opencode', 'opencode.json') });
+  c.push({ vendor: 'crush', file: path.join(HOME, '.config', 'crush', 'crush.json') });
+  c.push({ vendor: 'goose', file: PLAT === 'win32' ? path.join(APPDATA, 'Block', 'goose', 'config', 'config.yaml') : path.join(HOME, '.config', 'goose', 'config.yaml') });
+  c.push({ vendor: 'lmstudio', file: path.join(HOME, '.lmstudio', 'mcp.json') });
+  c.push({ vendor: 'junie', file: path.join(HOME, '.junie', 'mcp', 'mcp.json') });
+  c.push({ vendor: 'visualstudio', file: path.join(HOME, '.mcp.json') }); // Visual Studio's user-scope config
+  c.push({ vendor: 'copilot', file: PLAT === 'win32' ? path.join(LOCALAPPDATA, 'github-copilot', 'intellij', 'mcp.json') : path.join(HOME, '.config', 'github-copilot', 'intellij', 'mcp.json') });
+  for (const file of warpDatabases()) c.push({ vendor: 'warp', file, store: 'sqlite' });
+  for (const file of jetbrainsOptionFiles()) c.push({ vendor: 'jetbrains', file, store: 'jetbrains-xml' });
 
-  c.push({ vendor: 'vscode', file: path.join(vscodeUserDir(), 'mcp.json') });
-  c.push({ vendor: 'vscode', file: path.join(vscodeUserDir(), 'settings.json') });
-  c.push({ vendor: 'cursor', file: path.join(vscodeUserDir('Cursor'), 'settings.json') });
-  c.push({ vendor: 'zed', file: PLAT === 'darwin' ? path.join(HOME, 'Library', 'Application Support', 'Zed', 'settings.json') : path.join(HOME, '.config', 'zed', 'settings.json') });
+  const FORKS = [
+    { variant: 'Code', vendor: 'vscode' },
+    { variant: 'Code - Insiders', vendor: 'vscode' },
+    { variant: 'VSCodium', vendor: 'vscode' },
+    { variant: 'Cursor', vendor: 'cursor' },
+    { variant: 'Windsurf', vendor: 'windsurf' },
+  ];
+  for (const { variant, vendor } of FORKS) {
+    const user = vscodeUserDir(variant);
+    c.push({ vendor, file: path.join(user, 'mcp.json') });
+    c.push({ vendor, file: path.join(user, 'settings.json') });
+    c.push({ vendor: 'cline', file: path.join(user, 'globalStorage', 'saoudrizwan.claude-dev', 'settings', 'cline_mcp_settings.json') });
+    c.push({ vendor: 'roo', file: path.join(user, 'globalStorage', 'rooveterinaryinc.roo-cline', 'settings', 'mcp_settings.json') });
+  }
+  c.push({ vendor: 'zed', file: PLAT === 'darwin' ? path.join(HOME, 'Library', 'Application Support', 'Zed', 'settings.json') : PLAT === 'win32' ? path.join(APPDATA, 'Zed', 'settings.json') : path.join(HOME, '.config', 'zed', 'settings.json') });
   return c;
 }
 
-function extractServers(json) {
-  if (!json || typeof json !== 'object') return {};
-  return (
-    json.mcpServers ||
-    json.servers ||
-    json['mcp.servers'] ||
-    json.mcp?.servers ||
-    json.context_servers ||
-    {}
-  );
+/** Project-scope configs in the directories being swept (the workspace walker finds `.mcp.json` / `mcp.json` itself). */
+function projectMcpCandidates(roots) {
+  const rels = [
+    ['.cursor', 'mcp.json'], ['.vscode', 'mcp.json'], ['.gemini', 'settings.json'], ['.kiro', 'settings', 'mcp.json'],
+    ['.amazonq', 'mcp.json'], ['.roo', 'mcp.json'], ['.windsurf', 'mcp.json'], ['.codex', 'config.toml'],
+    ['.junie', 'mcp', 'mcp.json'], ['opencode.json'], ['.zed', 'settings.json'], ['.vs', 'mcp.json'],
+  ];
+  return roots.flatMap((root) => rels.map((rel) => ({ vendor: vendorFromPath(path.join(root, ...rel)), file: path.join(root, ...rel) })));
+}
+
+function readServers(file, store) {
+  if (store === 'sqlite') {
+    const { servers, state } = readSqliteMcpServers(file);
+    if (state !== 'read') unreadStores.push({ file, state });
+    return servers.length ? servers : null;
+  }
+  if (store === 'jetbrains-xml') {
+    const servers = readJetbrainsMcpServers(file);
+    return servers.length ? servers : null;
+  }
+  const text = readText(file, 1_000_000);
+  if (!text) return null;
+  const doc = parseConfigDoc(text, file);
+  return doc ? readMcpServers(doc) : null;
+}
+
+let unreadStores = [];
+export function unreadMcpStores() {
+  return unreadStores.slice();
 }
 
 export function discoverMcpServers(roots = [process.cwd()], files = null) {
   const walk = files || walkWorkspace(roots);
   const candidates = [
     ...globalMcpCandidates(),
+    ...projectMcpCandidates(roots),
     ...walk.mcp.map(({ file }) => ({ vendor: vendorFromPath(file), file })),
   ];
+  unreadStores = [];
   const assets = [];
   const seen = new Set();
-  for (const { vendor, file } of candidates) {
-    const json = readJson(file);
-    if (!json) continue;
-    const servers = extractServers(json);
-    for (const [name, cfg] of Object.entries(servers)) {
-      if (!cfg || typeof cfg !== 'object') continue;
-      const command = [cfg.command, ...(Array.isArray(cfg.args) ? cfg.args : [])].filter(Boolean).join(' ');
-      const identifier = cfg.url || cfg.serverUrl || command || name;
-      const key = `${name}:${identifier}`;
+  const seenFile = new Set();
+  const sources = [];
+  for (const { vendor, file, store } of candidates) {
+    const key0 = path.resolve(file).toLowerCase();
+    if (seenFile.has(key0)) continue;
+    seenFile.add(key0);
+    const servers = readServers(file, store);
+    if (servers) sources.push({ vendor, file, servers });
+  }
+  for (const s of readClaudeExtensions()) sources.push({ vendor: 'claude', file: s.file, servers: [s] });
+
+  for (const { vendor, file, servers } of sources) {
+    for (const s of servers) {
+      const command = [s.command, ...(s.args ?? [])].filter(Boolean).join(' ');
+      const identifier = s.url || command || s.name;
+      const key = `${s.name}:${identifier}`;
       if (seen.has(key)) continue;
       seen.add(key);
       assets.push({
         type: 'MCP_SERVER',
-        name,
+        name: s.name,
         identifier,
         vendor,
-        metadata: { command, url: cfg.url || cfg.serverUrl || null, configFile: file, env: redactEnv(cfg.env) },
-
-        content: JSON.stringify({ command, url: cfg.url || cfg.serverUrl, env: cfg.env || {} }),
+        metadata: {
+          command,
+          url: s.url || null,
+          configFile: file,
+          env: redactEnv(s.env),
+          ...(s.scope ? { projectScope: s.scope } : {}),
+          ...(s.disabled ? { disabled: true } : {}),
+        },
+        content: JSON.stringify({ command, url: s.url, env: s.env || {}, server: s }),
       });
     }
   }

package/src/inventory/discovery/mcp-stores.mjs

@@ -0,0 +1,207 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { extensionBundleServer, normalizeServerEntry, readMcpServers } from '../../detect/signals/mcp-config.mjs';
+import { APPDATA, HOME, LOCALAPPDATA, PLAT } from './platform.mjs';
+
+const require = createRequire(import.meta.url);
+const MAX_DB_BYTES = 256 * 1024 * 1024;
+const MAX_ROWS = 400;
+const MAX_XML_BYTES = 2 * 1024 * 1024;
+const MAX_EXTENSIONS = 200;
+
+let sqlite;
+function loadSqlite() {
+  if (sqlite !== undefined) return sqlite;
+  const original = process.emitWarning;
+  process.emitWarning = function (warning, ...rest) {
+    if (/sqlite/i.test(String(warning?.message ?? warning))) return;
+    return original.call(process, warning, ...rest);
+  };
+  try { sqlite = require('node:sqlite'); } catch { sqlite = null; } finally { process.emitWarning = original; }
+  return sqlite;
+}
+
+const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const looksLikeServer = (v) => isObj(v) && (typeof v.command === 'string' || Array.isArray(v.command) || typeof v.url === 'string' || typeof v.serverUrl === 'string' || typeof v.httpUrl === 'string');
+
+export function serversInValue(value, fallbackName) {
+  if (value == null) return [];
+  let v = value;
+  if (typeof v === 'string' || Buffer.isBuffer(v) || v instanceof Uint8Array) {
+    const text = Buffer.from(v).toString('utf8').trim();
+    if (!/^[[{]/.test(text)) return [];
+    try { v = JSON.parse(text); } catch { return []; }
+  }
+  const mapped = readMcpServers(v);
+  if (mapped) return mapped;
+  if (looksLikeServer(v)) return [normalizeServerEntry(String(v.name ?? v.title ?? fallbackName ?? 'server'), v)];
+  if (Array.isArray(v)) return v.filter(looksLikeServer).slice(0, 100).map((s, i) => normalizeServerEntry(String(s.name ?? `${fallbackName ?? 'server'}-${i + 1}`), s));
+  return [];
+}
+
+/* ─── Warp ─────────────────────────────────────────────────────────────── */
+
+export function warpDatabases() {
+  const out = [];
+  if (PLAT === 'darwin') {
+    const group = path.join(HOME, 'Library', 'Group Containers');
+    try {
+      for (const g of fs.readdirSync(group).filter((d) => /\.dev\.warp$/i.test(d))) {
+        const base = path.join(group, g, 'Library', 'Application Support');
+        for (const app of safeList(base).filter((d) => /^dev\.warp\.Warp/i.test(d))) out.push(path.join(base, app, 'warp.sqlite'));
+      }
+    } catch { /* no Warp */ }
+  } else if (PLAT === 'win32') {
+    for (const d of ['warp', 'Warp']) out.push(path.join(LOCALAPPDATA, d, 'Warp', 'data', 'warp.sqlite'));
+  } else {
+    for (const d of ['warp-terminal', 'warp-terminal-preview']) {
+      out.push(path.join(HOME, '.local', 'state', d, 'warp.sqlite'));
+      out.push(path.join(HOME, '.local', 'share', d, 'warp.sqlite'));
+    }
+  }
+  return [...new Set(out)].filter((f) => { try { return fs.statSync(f).isFile(); } catch { return false; } });
+}
+
+export function readSqliteMcpServers(file) {
+  const lib = loadSqlite();
+  if (!lib?.DatabaseSync) return { servers: [], state: 'no-sqlite' };
+  let st;
+  try { st = fs.statSync(file); } catch { return { servers: [], state: 'unreadable' }; }
+  if (st.size > MAX_DB_BYTES) return { servers: [], state: 'oversized' };
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'shomra-mcpdb-'));
+  const copy = path.join(dir, 'store.sqlite');
+  let db;
+  try {
+    fs.copyFileSync(file, copy);
+    for (const s of ['-wal', '-shm']) if (fs.existsSync(file + s)) fs.copyFileSync(file + s, copy + s);
+    db = new lib.DatabaseSync(copy, { readOnly: true });
+    const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => String(r.name));
+    const servers = [];
+    for (const t of tables.filter((n) => /mcp/i.test(n)).slice(0, 20)) {
+      const quoted = `"${t.replace(/"/g, '""')}"`;
+      const cols = db.prepare(`PRAGMA table_info(${quoted})`).all().map((c) => String(c.name));
+      const nameCol = cols.find((c) => /^(?:name|title|display_name|server_name)$/i.test(c));
+      for (const row of db.prepare(`SELECT * FROM ${quoted} LIMIT ${MAX_ROWS}`).all()) {
+        const fallback = nameCol ? String(row[nameCol] ?? '') : undefined;
+        if (cols.some((c) => /^(?:command|url)$/i.test(c))) {
+          const entry = {};
+          for (const c of cols) {
+            const v = row[c];
+            if (v == null) continue;
+            if (/^(?:args|env|environment|headers)$/i.test(c) && typeof v === 'string' && /^[[{]/.test(v.trim())) { try { entry[c.toLowerCase()] = JSON.parse(v); continue; } catch { /* keep raw */ } }
+            entry[c.toLowerCase()] = v;
+          }
+          if (looksLikeServer(entry)) servers.push(normalizeServerEntry(String(entry.name ?? fallback ?? t), entry));
+        }
+        for (const c of cols) for (const s of serversInValue(row[c], fallback)) servers.push(s);
+      }
+    }
+    return { servers: dedupe(servers), state: 'read' };
+  } catch {
+    return { servers: [], state: 'unreadable' };
+  } finally {
+    try { db?.close(); } catch { /* ignore */ }
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/* ─── JetBrains ────────────────────────────────────────────────────────── */
+
+export function jetbrainsOptionFiles() {
+  const roots = PLAT === 'win32' ? [path.join(APPDATA, 'JetBrains')] : PLAT === 'darwin' ? [path.join(HOME, 'Library', 'Application Support', 'JetBrains')] : [path.join(HOME, '.config', 'JetBrains')];
+  const out = [];
+  for (const root of roots) {
+    for (const product of safeList(root)) {
+      const options = path.join(root, product, 'options');
+      for (const f of safeList(options)) if (/mcp|llm|ai[-_]?assistant|junie/i.test(f) && /\.xml$/i.test(f)) out.push(path.join(options, f));
+    }
+  }
+  return out.slice(0, 200);
+}
+
+const unescapeXml = (s) => s.replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&#10;/g, '\n').replace(/&#13;/g, '\r').replace(/&#(\d+);/g, (_, n) => String.fromCharCode(Number(n))).replace(/&amp;/g, '&');
+
+function jsonBlobs(text) {
+  const out = [];
+  for (let i = text.indexOf('{'); i !== -1 && out.length < 50; i = text.indexOf('{', i + 1)) {
+    let depth = 0, q = false, esc = false;
+    for (let j = i; j < text.length && j - i < 500_000; j++) {
+      const c = text[j];
+      if (q) { if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') q = false; continue; }
+      if (c === '"') q = true;
+      else if (c === '{') depth++;
+      else if (c === '}' && --depth === 0) {
+        try { out.push(JSON.parse(text.slice(i, j + 1))); i = j; } catch { /* not JSON, keep scanning */ }
+        break;
+      }
+    }
+  }
+  return out;
+}
+
+export function readJetbrainsMcpServers(file) {
+  let xml;
+  try {
+    if (fs.statSync(file).size > MAX_XML_BYTES) return [];
+    xml = fs.readFileSync(file, 'utf8');
+  } catch { return []; }
+  const servers = [];
+  for (const blob of jsonBlobs(unescapeXml(xml))) servers.push(...serversInValue(blob));
+  const attrsOf = (s) => Object.fromEntries([...s.matchAll(/([\w:-]+)="([^"]*)"/g)].map(([, k, v]) => [k.toLowerCase(), unescapeXml(v)]));
+  const records = [];
+  for (const m of xml.matchAll(/<[\w:-]+\s[^<>]*\b(?:command|url)="[^"]*"[^<>]*>/g)) records.push(attrsOf(m[0]));
+  for (const m of xml.matchAll(/<[\w:-]+(\s[^<>]*)?>((?:\s*<option\s[^<>]*\/>)+)\s*<\/[\w:-]+>/g)) {
+    records.push({ ...Object.fromEntries([...m[2].matchAll(/<option\s+name="([^"]+)"\s+value="([^"]*)"/g)].map(([, k, v]) => [k.toLowerCase(), unescapeXml(v)])), ...attrsOf(m[1] ?? '') });
+  }
+  for (const e of records.slice(0, 200)) {
+    if (!(typeof e.command === 'string' || typeof e.url === 'string')) continue;
+    if (typeof e.args === 'string') e.args = /^\[/.test(e.args.trim()) ? safeJson(e.args) ?? e.args.split(/\s+/) : e.args.split(/\s+/).filter(Boolean);
+    if (typeof e.env === 'string' && /^\{/.test(e.env.trim())) e.env = safeJson(e.env);
+    servers.push(normalizeServerEntry(String(e.name ?? e.id ?? path.basename(file, '.xml')), e));
+  }
+  return dedupe(servers);
+}
+
+/* ─── Claude Desktop extensions ────────────────────────────────────────── */
+
+function claudeDataDir() {
+  if (PLAT === 'darwin') return path.join(HOME, 'Library', 'Application Support', 'Claude');
+  if (PLAT === 'win32') return path.join(APPDATA, 'Claude');
+  return path.join(HOME, '.config', 'Claude');
+}
+
+export function readClaudeExtensions(dataDir = claudeDataDir()) {
+  const root = path.join(dataDir, 'Claude Extensions');
+  const settingsDir = path.join(dataDir, 'Claude Extensions Settings');
+  const out = [];
+  for (const id of safeList(root).slice(0, MAX_EXTENSIONS)) {
+    const manifestFile = path.join(root, id, 'manifest.json');
+    let json;
+    try { json = JSON.parse(fs.readFileSync(manifestFile, 'utf8')); } catch { continue; }
+    const s = extensionBundleServer(json);
+    if (!s) continue;
+    let settings = null;
+    try { settings = JSON.parse(fs.readFileSync(path.join(settingsDir, `${id}.json`), 'utf8')); } catch { /* none */ }
+    const resolve = (v) => (typeof v === 'string' ? v.replace(/\$\{__dirname\}/g, path.join(root, id)) : v);
+    out.push({ ...s, command: resolve(s.command), args: (s.args ?? []).map(resolve), disabled: s.disabled || settings?.isEnabled === false, file: manifestFile });
+  }
+  return out;
+}
+
+function safeList(dir) {
+  try { return fs.readdirSync(dir); } catch { return []; }
+}
+function safeJson(s) {
+  try { return JSON.parse(s); } catch { return null; }
+}
+function dedupe(servers) {
+  const seen = new Set();
+  return servers.filter((s) => {
+    const k = `${s.name}|${s.command ?? ''}|${(s.args ?? []).join(' ')}|${s.url ?? ''}`;
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+}

package/src/inventory/env-redirect.mjs

@@ -0,0 +1,148 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+const HOME = os.homedir();
+const PLAT = process.platform;
+const MAX_BYTES = 256 * 1024;
+const MAX_ITEMS = 10;
+
+const ENDPOINT_KEY =
+  /^(?:ANTHROPIC_(?:BASE_URL|BEDROCK_BASE_URL|VERTEX_BASE_URL|FOUNDRY_BASE_URL)|OPENAI_(?:BASE_URL|API_BASE(?:_URL)?)|AZURE_OPENAI_ENDPOINT|GOOGLE_GEMINI_BASE_URL|GEMINI_(?:API_)?BASE_URL|CODEX_BASE_URL|LITELLM_(?:BASE_URL|PROXY_URL))$/i;
+const PROXY_KEY = /^(?:HTTPS?_PROXY|ALL_PROXY)$/i;
+const TLS_OFF = [
+  [/^NODE_TLS_REJECT_UNAUTHORIZED$/i, (v) => v.trim() === '0'],
+  [/^PYTHONHTTPSVERIFY$/i, (v) => v.trim() === '0'],
+  [/^GIT_SSL_NO_VERIFY$/i, (v) => /^(?:1|true|yes)$/i.test(v.trim())],
+];
+
+const PROCESS_KEYS = {
+  'claude-code': /^ANTHROPIC_/i,
+  codex: /^(?:OPENAI_|CODEX_)/i,
+  gemini: /^(?:GEMINI_|GOOGLE_GEMINI_)/i,
+  qwen: /^(?:OPENAI_|QWEN_)/i,
+  'qwen-code': /^(?:OPENAI_|QWEN_)/i,
+};
+
+function managedSettingsPath() {
+  if (PLAT === 'win32') return path.join(process.env.ProgramData || 'C:\\ProgramData', 'ClaudeCode', 'managed-settings.json');
+  if (PLAT === 'darwin') return '/Library/Application Support/ClaudeCode/managed-settings.json';
+  return '/etc/claude-code/managed-settings.json';
+}
+
+function sourcesFor(vendor, cwd) {
+  switch (vendor) {
+    case 'claude-code':
+      return [
+        { file: path.join(HOME, '.claude', 'settings.json'), scope: 'user', shape: 'env-json' },
+        { file: path.join(HOME, '.claude', 'settings.local.json'), scope: 'user', shape: 'env-json' },
+        { file: path.join(cwd, '.claude', 'settings.json'), scope: 'project', shape: 'env-json' },
+        { file: path.join(cwd, '.claude', 'settings.local.json'), scope: 'project', shape: 'env-json' },
+        { file: managedSettingsPath(), scope: 'managed', shape: 'env-json' },
+      ];
+    case 'gemini':
+    case 'qwen':
+    case 'qwen-code': {
+      const dir = vendor === 'gemini' ? '.gemini' : '.qwen';
+      return [
+        { file: path.join(HOME, dir, '.env'), scope: 'user', shape: 'dotenv' },
+        { file: path.join(cwd, dir, '.env'), scope: 'project', shape: 'dotenv' },
+        { file: path.join(HOME, dir, 'settings.json'), scope: 'user', shape: 'gemini-settings' },
+        { file: path.join(cwd, dir, 'settings.json'), scope: 'project', shape: 'gemini-settings' },
+      ];
+    }
+    case 'codex':
+      return [
+        { file: path.join(HOME, '.codex', 'config.toml'), scope: 'user', shape: 'codex-toml' },
+        { file: path.join(cwd, '.codex', 'config.toml'), scope: 'project', shape: 'codex-toml' },
+      ];
+    default:
+      return [];
+  }
+}
+
+function readSmall(file) {
+  try {
+    const st = fs.statSync(file);
+    if (!st.isFile() || st.size > MAX_BYTES) return null;
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+function parseJsonc(raw) {
+  try {
+    return JSON.parse(raw.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:"\\])\/\/.*$/gm, '$1'));
+  } catch {
+    return null;
+  }
+}
+
+function pairsOf(shape, raw) {
+  const pairs = [];
+  if (shape === 'dotenv') {
+    for (const line of raw.split(/\r?\n/)) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/.exec(line);
+      if (m) pairs.push([m[1], m[2].replace(/^(['"])(.*)\1$/, '$2')]);
+    }
+    return pairs;
+  }
+  if (shape === 'codex-toml') {
+    let section = '';
+    for (const line of raw.split(/\r?\n/)) {
+      const s = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+      if (s) { section = s[1].trim(); continue; }
+      const m = /^\s*(base_url|openai_base_url)\s*=\s*["']([^"']*)["']/.exec(line);
+      if (m) pairs.push([section ? `${section}.${m[1]}` : m[1], m[2]]);
+    }
+    return pairs;
+  }
+  const doc = parseJsonc(raw);
+  if (!doc || typeof doc !== 'object') return pairs;
+  const env = doc.env && typeof doc.env === 'object' && !Array.isArray(doc.env) ? doc.env : {};
+  for (const [k, v] of Object.entries(env)) if (['string', 'number', 'boolean'].includes(typeof v)) pairs.push([k, String(v)]);
+  if (shape === 'gemini-settings' && typeof doc.proxy === 'string') pairs.push(['proxy', doc.proxy]);
+  return pairs;
+}
+
+function hostOf(value) {
+  const s = /^[a-z][\w+.-]*:\/\//i.test(value) ? value : `http://${value}`;
+  try {
+    const u = new URL(s);
+    return u.hostname ? { host: u.hostname.toLowerCase(), scheme: u.protocol.replace(':', '') } : null;
+  } catch {
+    return null;
+  }
+}
+
+export function classifyPair(key, value) {
+  const v = String(value ?? '');
+  if (TLS_OFF.some(([re, bad]) => re.test(key) && bad(v))) return { key, kind: 'tls-off' };
+  const endpoint = ENDPOINT_KEY.test(key) || /(?:^|\.)(?:base_url|openai_base_url)$/.test(key);
+  const proxy = PROXY_KEY.test(key) || key === 'proxy';
+  if (!endpoint && !proxy) return null;
+  const h = hostOf(v.trim());
+  return h ? { key, kind: proxy ? 'proxy' : 'model-endpoint', host: h.host, scheme: h.scheme } : null;
+}
+
+export function readEnvRedirects(vendor, cwd = process.cwd(), env = process.env) {
+  const out = [];
+  for (const src of sourcesFor(vendor, cwd)) {
+    const raw = readSmall(src.file);
+    if (raw == null) continue;
+    for (const [k, v] of pairsOf(src.shape, raw)) {
+      const hit = classifyPair(k, v);
+      if (hit && out.length < MAX_ITEMS) out.push({ ...hit, scope: src.scope, source: src.file });
+    }
+  }
+  const scoped = PROCESS_KEYS[vendor];
+  if (scoped) {
+    for (const [k, v] of Object.entries(env)) {
+      if (!scoped.test(k) && !TLS_OFF.some(([re]) => re.test(k))) continue;
+      const hit = classifyPair(k, v);
+      if (hit && hit.kind !== 'proxy' && out.length < MAX_ITEMS) out.push({ ...hit, scope: 'process', source: 'environment' });
+    }
+  }
+  return out;
+}