@skaile/workspaces 3.27.0 → 4.0.0

package/dist/{chunk-YLL65VXQ.js → chunk-HO2FQ76C.js}

@@ -1,30 +1,31 @@
-import { buildWorkspaceToolDefs } from './chunk-FFE7YLYO.js';
+import { WorkspacePlugin } from './chunk-NR6BPOW5.js';
+import { buildWorkspaceToolDefs } from './chunk-XEVWRSLS.js';
 import { findAiAssetsRoot } from './chunk-7IRJ4K4F.js';
-import { WorkspacePlugin } from './chunk-DY5GHUTC.js';
-import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
-import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-T3YLZQS4.js';
-import { resolveFlowPath } from './chunk-5UWAOYDN.js';
+import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
+import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-45LLHKQ2.js';
+import { resolveFlowPath } from './chunk-Y6E62LFB.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-N27DSFA7.js';
-import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-SIREWRZE.js';
-import { EventNormalizer } from './chunk-XMULHVKX.js';
-import { SUPPORTED_CLOUDS, probeResumeTranscript, CLOUD_SECRET_ENV_KEYS } from './chunk-3NCGSSCU.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-RM4C5AU3.js';
+import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-KW7YIRYL.js';
+import { EventNormalizer } from './chunk-FODAC4RE.js';
+import { probeResumeTranscript } from './chunk-WLFRA5RM.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { dispatchCapability } from './chunk-UL4LD7KD.js';
+import { dispatchCapability } from './chunk-QQL3ET3J.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver } from './chunk-AQW4BWNR.js';
-import { loadFlow } from './chunk-JMYOJ3PA.js';
+import { deriveRegistryFromLegacyApiKeys, createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv } from './chunk-SG4D2UOK.js';
+import { loadFlow } from './chunk-MIP4IC3O.js';
 import { parseFlowDefinition } from './chunk-53ORCYPJ.js';
 import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
-import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-72DG6GSB.js';
-import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-HSRHO7SK.js';
+import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-YS4XBN7O.js';
+import { resolveSettings, loadProviderRegistry } from './chunk-C3QLJTMB.js';
+import { resolveRuntimeAssets } from './chunk-REILIKVM.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
-import { resolveRuntimeAssets } from './chunk-IB4XKQMQ.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, cloudConfigFromProfile, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-MBARHWMZ.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-K27T47OO.js';
 import { withFsDeadline, fsDeadlineMs, FsDeadlineError, tryWithFsDeadline } from './chunk-MKZOK4JU.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink } from './chunk-FTG7CRFD.js';
+import { registryEntries, resolveEntryBaseUrl } from './chunk-ILG4BXYE.js';
 import { getLogStore, registerLogStore, resetLogStore, createLogger, isUnwritableStreamError, markStreamBroken, isBrokenPipeError } from './chunk-W4IPN3DD.js';
 import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
@@ -33,7 +34,7 @@ import { markedTerminal } from 'marked-terminal';
 import fs4, { readFile, stat, rm, unlink, mkdir, writeFile, readdir, realpath, lstat, rename, readlink, mkdtemp } from 'fs/promises';
 import { createHash, randomBytes, timingSafeEqual, randomUUID } from 'crypto';
 import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } from 'path';
-import { existsSync, lstatSync, realpathSync, readFileSync, mkdirSync, writeFileSync, watch, chmodSync, accessSync, constants, rmSync } from 'fs';
+import { existsSync, lstatSync, realpathSync, readFileSync, mkdirSync, writeFileSync, watch, chmodSync, accessSync, constants } from 'fs';
 import { homedir } from 'os';
 import * as z7 from 'zod';
 import { z } from 'zod';
@@ -250,11 +251,11 @@ async function resolveMixin(ref, defaultKind, agentDir, repos) {
   return { content: stripFrontmatter(raw).trim(), source: entry.source };
 }
 async function resolveAgentMixins(manifest, agentDir, repos) {
-  const resolve5 = (refs, kind) => Promise.all((refs ?? []).map((r) => resolveMixin(r, kind, agentDir, repos)));
+  const resolve4 = (refs, kind) => Promise.all((refs ?? []).map((r) => resolveMixin(r, kind, agentDir, repos)));
   const [personaResults, rulesResults, knowledgeResults] = await Promise.all([
-    resolve5(manifest.persona, "persona"),
-    resolve5(manifest.rules, "ruleset"),
-    resolve5(manifest.knowledge, "knowledge")
+    resolve4(manifest.persona, "persona"),
+    resolve4(manifest.rules, "ruleset"),
+    resolve4(manifest.knowledge, "knowledge")
   ]);
   return {
     personas: personaResults.filter((r) => r !== null),
@@ -892,7 +893,7 @@ async function prepareCodexTools(options) {
     options.signal.removeEventListener("abort", abort);
     await Promise.allSettled([...peers].map((peer) => peer.close()));
     http.closeAllConnections();
-    if (http.listening) await new Promise((resolve5) => http.close(() => resolve5()));
+    if (http.listening) await new Promise((resolve4) => http.close(() => resolve4()));
   })();
   const abort = () => {
     void dispose();
@@ -900,9 +901,9 @@ async function prepareCodexTools(options) {
   options.signal.addEventListener("abort", abort, { once: true });
   try {
     signal.throwIfAborted();
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve4, reject) => {
       http.once("error", reject);
-      http.listen(0, "127.0.0.1", resolve5);
+      http.listen(0, "127.0.0.1", resolve4);
     });
     signal.throwIfAborted();
     const address = http.address();
@@ -940,7 +941,7 @@ async function prepareCodexTools(options) {
   } catch {
     await dispose();
     http.closeAllConnections();
-    if (http.listening) await new Promise((resolve5) => http.close(() => resolve5()));
+    if (http.listening) await new Promise((resolve4) => http.close(() => resolve4()));
     throw new Error("CODEX_REQUIRED_TOOL_UNAVAILABLE");
   }
 }
@@ -1012,7 +1013,6 @@ async function registerCodexResourceTools(options) {
     projectDir: options.projectDir,
     connectorManager: options.manager ?? void 0,
     driver: "codex",
-    provider: "openai",
     model: options.model
   });
   await plugin.store.load();
@@ -2105,7 +2105,6 @@ async function buildInProcessMcpServers(resourceManager, projectDir, driverType,
     projectDir,
     connectorManager: resourceManager ?? void 0,
     driver: driverType,
-    provider: sessionMeta?.provider,
     model: sessionMeta?.model
   });
   const wsServer = await workspacePlugin.buildWorkspaceMcpServer();
@@ -2214,7 +2213,7 @@ function toSdkMcpServerConfig(decl, secrets) {
 // runner/src/session-builder.ts
 async function createAgentSession(config) {
   const managed = config.managedCodex;
-  if (managed && (config.driver !== "codex" || config.provider !== "openai" || !config.model || !config.aiProviderConfigId || !config.capabilityRegistry || !config.capabilities || config.apiKey || config.cloud && config.cloud !== "default" || config.cloudConfig || config.cloudSecrets))
+  if (managed && (config.driver !== "codex" || !config.model || !config.aiProviderConfigId || !config.capabilityRegistry || !config.capabilities))
     throw new Error("AI_PROFILE_INVALID");
   const {
     projectDir,
@@ -2222,7 +2221,6 @@ async function createAgentSession(config) {
     agentDir,
     driver: driverOverride,
     model: modelOverride,
-    provider: providerOverride,
     sessionId,
     resumeSessionId,
     externalPromptFile,
@@ -2252,15 +2250,20 @@ async function createAgentSession(config) {
   });
   const settings = await resolveSettings(projectDir, {
     driver: driverOverride,
-    provider: providerOverride,
     model: modelOverride
   });
   const driverType = managed ? "codex" : settings.driver ?? "omp";
-  const provider = managed ? config.provider : settings.provider;
   const model = managed ? config.model : settings.model;
-  const cloud = managed ? "default" : config.cloud ?? settings.cloud ?? "default";
-  const cloudConfig = managed ? void 0 : config.cloudConfig ?? settings.cloudConfig;
-  const apiKey = managed ? void 0 : cloud === "bedrock" || cloud === "vertex" || cloud === "azure" ? config.apiKey : config.apiKey ?? resolveApiKey(provider ?? "anthropic", settings);
+  const legacyKeys = managed ? void 0 : deriveRegistryFromLegacyApiKeys(settings.apiKeys, { env: process.env });
+  if (legacyKeys?.deprecation) sessionLog.debug(legacyKeys.deprecation);
+  const registry = loadSessionRegistry(
+    projectDir,
+    config.registry,
+    legacyKeys?.providers,
+    sessionLog
+  );
+  const modelRef = config.modelRef?.trim() || model?.trim() || void 0;
+  const credentialEnv = { ...legacyKeys?.credentialEnv, ...config.credentialEnv };
   const manifest = agentDir ? await loadAgentManifest(agentDir) : void 0;
   const {
     resourceManager,
@@ -2279,7 +2282,6 @@ async function createAgentSession(config) {
     watch,
     secretProvider,
     {
-      provider,
       model,
       sessionId,
       ...managed ? { managedCodex: true } : {}
@@ -2355,20 +2357,19 @@ async function createAgentSession(config) {
       config,
       driverType,
       agentCwd,
-      provider,
       model,
-      cloud,
-      cloudConfig,
       manifest,
       maxTurns,
-      apiKey,
       systemPrompt,
       thinking,
       effort,
       sessionId,
       resumeSessionId,
       mcpServers: driverMcpServers,
-      agentDir
+      agentDir,
+      registry,
+      modelRef,
+      credentialEnv
     });
   } catch (error) {
     try {
@@ -2390,8 +2391,10 @@ async function createAgentSession(config) {
     composition,
     manifest,
     driverType,
-    provider,
     model,
+    registry,
+    credentialEnv,
+    modelRef,
     dispose: disposeSessionResources,
     startWatching,
     getOrCreateExternalMcpManager,
@@ -2412,7 +2415,6 @@ function createManagedCodexSubpromptDriver(config, model, cwd, privateDirectory)
   });
   return createDriver("codex", {
     cwd,
-    provider: "openai",
     model,
     sessionId: `${config.sessionId}:subprompt:${randomUUID()}`,
     maxTurns: 1,
@@ -2439,6 +2441,22 @@ function createManagedCodexSubpromptDriver(config, model, cwd, privateDirectory)
     }
   });
 }
+function loadSessionRegistry(projectDir, sessionRegistry, legacyApiKeyProviders, log) {
+  const extraLayers = [];
+  if (legacyApiKeyProviders && Object.keys(legacyApiKeyProviders).length > 0)
+    extraLayers.push({ layer: "user", providers: legacyApiKeyProviders });
+  if (sessionRegistry && Object.keys(sessionRegistry).length > 0)
+    extraLayers.push({ layer: "session", providers: sessionRegistry });
+  const first = loadProviderRegistry({ projectDir, extraLayers });
+  const catalog = catalogLayer(first.patches);
+  const final = Object.keys(catalog.providers).length === 0 ? first : loadProviderRegistry({ projectDir, extraLayers: [...extraLayers, catalog] });
+  for (const diagnostic of final.diagnostics) {
+    const message = diagnostic.path ? `providers registry: ${diagnostic.path}: ${diagnostic.message}` : `providers registry: ${diagnostic.message}`;
+    if (diagnostic.severity === "error") log.error(message, void 0, { code: diagnostic.code });
+    else log.warn(message, { code: diagnostic.code });
+  }
+  return final.registry;
+}
 async function loadPromptExtensions(paths, projectDir, log) {
   if (!paths?.length) return [];
   const loaded = await Promise.all(
@@ -2527,20 +2545,19 @@ function createSessionDriver(args) {
     config,
     driverType,
     agentCwd,
-    provider,
     model,
-    cloud,
-    cloudConfig,
     manifest,
     maxTurns,
-    apiKey,
     systemPrompt,
     thinking,
     effort,
     sessionId,
     resumeSessionId,
     mcpServers,
-    agentDir
+    agentDir,
+    registry,
+    modelRef,
+    credentialEnv
   } = args;
   return createDriver(driverType, {
     ...config.managedCodex ? {
@@ -2563,17 +2580,17 @@ function createSessionDriver(args) {
       }
     } : {},
     cwd: agentCwd,
-    provider,
     model: model ?? manifest?.model?.preferred,
     maxTurns,
-    apiKeys: apiKey ? { [provider ?? "anthropic"]: apiKey } : void 0,
     systemPrompt,
     tools: manifest?.tools,
-    // Cloud transport dimension — omitted entirely for `default` so the
-    // driver config stays byte-identical to pre-cloud behavior.
-    ...cloud !== "default" ? { cloud } : {},
-    ...cloudConfig ? { cloudConfig } : {},
-    ...config.cloudSecrets ? { cloudSecrets: config.cloudSecrets } : {},
+    // The session's only provider surface: every endpoint it may address,
+    // plus the credential values under the `SKAILE_AIP_<ID>_KEY` names the
+    // entries reference. A registry with no entries leaves the driver on its
+    // own native auth.
+    registry,
+    ...modelRef ? { modelRef } : {},
+    ...Object.keys(credentialEnv).length > 0 ? { env: credentialEnv } : {},
     ...thinking ? { thinking } : {},
     ...effort ? { effort } : {},
     ...sessionId ? { sessionId } : {},
@@ -2632,14 +2649,14 @@ async function runAgentChat(opts) {
 ${message}`;
   }
   try {
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve4, reject) => {
       const onEvent = (event) => {
         if (event.type === "agent_end") {
           driver.off("agent-event", onEvent);
           mdStream.end();
           process.stdout.write("\n");
           driver.kill();
-          resolve5();
+          resolve4();
         } else if (event.type === "error") {
           driver.off("agent-event", onEvent);
           const err = Object.assign(new Error(String(event.error)), {
@@ -2670,7 +2687,6 @@ async function buildDriver(opts) {
     agentDir,
     driver: opts.driver,
     model: opts.model,
-    provider: opts.provider,
     promptsDir: opts.promptsDir,
     onLog: opts.onLog
   });
@@ -3086,7 +3102,7 @@ function buildClientCapabilityHandler(args) {
       });
       return {};
     }
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve4, reject) => {
       const timer = setTimeout(() => {
         args.pending.delete(callId);
         reject(
@@ -3095,7 +3111,7 @@ function buildClientCapabilityHandler(args) {
           )
         );
       }, timeoutMs);
-      args.pending.set(callId, { resolve: resolve5, reject, timer });
+      args.pending.set(callId, { resolve: resolve4, reject, timer });
       args.emit({
         type: "capability_invoked",
         callId,
@@ -3488,7 +3504,7 @@ function validateCodexInit(cmd, supported, previous) {
     (key) => previous[key] !== cmd.identity[key]
   ))
     throw new Error("Invalid managed AI session identity");
-  if (!managed || profile?.provider !== "openai" || !["subscription", "api-key"].includes(profile.authMode ?? ""))
+  if (!managed || !["subscription", "api-key"].includes(profile?.authMode ?? ""))
     throw new Error("Invalid managed OpenAI profile");
   const credential = parseCodexCredential(cmd.credentials.ai);
   if (credential.configId !== cmd.resolvedConfig.aiProviderConfigId || profile.authMode === "subscription" !== (credential.kind === "codex-subscription"))
@@ -3583,7 +3599,7 @@ function loadManagedCodexHostConfig(file, projectDir) {
 function bindManagedCodexInit(host, cmd, refreshCredential) {
   const profile = cmd.resolvedConfig.agentConfig;
   const credential = parseCodexCredential(cmd.credentials.ai);
-  if (!profile?.authMode || !["subscription", "api-key"].includes(profile.authMode) || cmd.identity.sessionId !== host.sessionId || profile?.driver !== "codex" || profile.provider !== "openai" || profile.cloud !== void 0 && profile.cloud !== "default" || profile.cloudConfig || !profile.model || !host.subpromptModels.available.includes(profile.model) || credential.configId !== cmd.resolvedConfig.aiProviderConfigId || profile.authMode === "subscription" !== (credential.kind === "codex-subscription"))
+  if (!profile?.authMode || !["subscription", "api-key"].includes(profile.authMode) || cmd.identity.sessionId !== host.sessionId || profile?.driver !== "codex" || !profile.model || !host.subpromptModels.available.includes(profile.model) || credential.configId !== cmd.resolvedConfig.aiProviderConfigId || profile.authMode === "subscription" !== (credential.kind === "codex-subscription"))
     throw refused();
   const reasoningEffort = profile.effort ?? host.reasoningEffort;
   if (!["minimal", "low", "medium", "high", "xhigh"].includes(reasoningEffort)) throw refused();
@@ -3876,34 +3892,6 @@ function planRuntimeSessionEmit(input) {
   }
   return { type: "runtime_session", driverSessionId, model, capabilitySignature };
 }
-var GCP_SA_JSON_KEY = "GOOGLE_APPLICATION_CREDENTIALS_JSON";
-var GCP_SA_RELATIVE_PATH = join(".skaile", "gcp-sa.json");
-function resolveCloudSecretBundle(args) {
-  const { cloud, secrets, projectDir } = args;
-  const cloudSecrets = {};
-  const bundleKeys = CLOUD_SECRET_ENV_KEYS[cloud];
-  if (!secrets || !bundleKeys) return { cloudSecrets };
-  for (const key of bundleKeys) {
-    if (key === GCP_SA_JSON_KEY) continue;
-    const value = secrets[key];
-    if (value) cloudSecrets[key] = value;
-  }
-  const saJson = secrets[GCP_SA_JSON_KEY];
-  if (bundleKeys.includes(GCP_SA_JSON_KEY) && saJson) {
-    const saPath = resolve(projectDir, GCP_SA_RELATIVE_PATH);
-    mkdirSync(dirname(saPath), { recursive: true });
-    rmSync(saPath, { force: true });
-    writeFileSync(saPath, saJson, { mode: 384 });
-    cloudSecrets.GOOGLE_APPLICATION_CREDENTIALS = saPath;
-  }
-  return { cloudSecrets };
-}
-function cleanupCloudCredentialFiles(projectDir) {
-  try {
-    rmSync(resolve(projectDir, GCP_SA_RELATIVE_PATH), { force: true });
-  } catch {
-  }
-}
 
 // runner/src/compaction-gate.ts
 var CompactionGate = class {
@@ -3928,8 +3916,8 @@ var CompactionGate = class {
   begin() {
     const hold = /* @__PURE__ */ Symbol("compaction");
     if (this.held.size === 0) {
-      this.opened = new Promise((resolve5) => {
-        this.release = resolve5;
+      this.opened = new Promise((resolve4) => {
+        this.release = resolve4;
       });
     }
     this.held.add(hold);
@@ -3986,8 +3974,8 @@ var CompactionGate = class {
 };
 async function raceDeadline(opened, ms) {
   let timer;
-  const expired = new Promise((resolve5) => {
-    timer = setTimeout(() => resolve5("timeout"), ms);
+  const expired = new Promise((resolve4) => {
+    timer = setTimeout(() => resolve4("timeout"), ms);
     timer.unref?.();
   });
   try {
@@ -4025,8 +4013,8 @@ var DriverSwapGate = class {
    */
   beginTurn() {
     let resolveTurn;
-    const turn = new Promise((resolve5) => {
-      resolveTurn = resolve5;
+    const turn = new Promise((resolve4) => {
+      resolveTurn = resolve4;
     });
     this.turnTail = this.turnTail.then(() => turn);
     let ended = false;
@@ -4119,7 +4107,7 @@ async function dispatchFlowTurn(deps, prompt, timeoutMs) {
   }
 }
 function awaitAgentEnd(driver, prompt, timeoutMs) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve4, reject) => {
     let settled = false;
     const onEvent = (raw) => {
       const event = raw;
@@ -4134,7 +4122,7 @@ function awaitAgentEnd(driver, prompt, timeoutMs) {
       if (driver.off) driver.off("agent-event", onEvent);
       else driver.removeListener("agent-event", onEvent);
       if (err) reject(err);
-      else resolve5();
+      else resolve4();
     };
     const timer = setTimeout(
       () => done(new Error(`Flow turn timed out after ${timeoutMs / 1e3}s`)),
@@ -4588,8 +4576,8 @@ var CompactionOrchestrator = class {
     try {
       this.driver.on("agent-event", captureHandler);
       const running = this.driver.prompt(prompt);
-      const expiry = new Promise((resolve5) => {
-        timer = setTimeout(() => resolve5("expired"), timeoutMs);
+      const expiry = new Promise((resolve4) => {
+        timer = setTimeout(() => resolve4("expired"), timeoutMs);
       });
       const outcome = await Promise.race([running.then(() => "settled"), expiry]);
       if (outcome === "expired") {
@@ -4605,8 +4593,8 @@ var CompactionOrchestrator = class {
           this.opts.onLog?.(`[compaction] abort after timeout failed: ${String(abortErr)}`);
         });
         let settleTimer;
-        const graceExpired = new Promise((resolve5) => {
-          settleTimer = setTimeout(resolve5, ABORT_SETTLE_GRACE_MS);
+        const graceExpired = new Promise((resolve4) => {
+          settleTimer = setTimeout(resolve4, ABORT_SETTLE_GRACE_MS);
           settleTimer.unref?.();
         });
         await Promise.race([Promise.all([aborted, settled]), graceExpired]);
@@ -5597,9 +5585,9 @@ function createSessionStimulusBus(opts) {
         connectorId,
         fragmentLength: sig.promptFragment.length
       });
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve4, reject) => {
         const q = getQueue(connectorId);
-        q.pending.push({ signal: sig, resolve: resolve5, reject });
+        q.pending.push({ signal: sig, resolve: resolve4, reject });
         startTimerIfNeeded(connectorId, q, coalesceMs);
       });
     }
@@ -5640,6 +5628,12 @@ function emitSystemPromptComposed(agentSession, sendEvent) {
     composedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
+var REMOVED_RESOLVED_CONFIG_KEYS = ["provider", "cloud", "cloudConfig"];
+function legacyResolvedConfigKeys(agentConfig) {
+  if (!agentConfig) return [];
+  const raw = agentConfig;
+  return REMOVED_RESOLVED_CONFIG_KEYS.filter((key) => raw[key] !== void 0);
+}
 var DRIVER_START_ATTEMPTS = 3;
 var FRAMEWORK_PACKAGES = [
   "@skaile/workspaces/runner",
@@ -5965,19 +5959,19 @@ function createFlowConnectorReadiness(isReady) {
     wait(timeoutMs, isSatisfied) {
       const satisfied = isSatisfied ?? isReady;
       if (satisfied()) return Promise.resolve(true);
-      return new Promise((resolve5) => {
+      return new Promise((resolve4) => {
         let timer;
         const waiter = {
           satisfied,
           release: () => {
             clearTimeout(timer);
-            resolve5(true);
+            resolve4(true);
           }
         };
         timer = setTimeout(() => {
           const idx = waiters.indexOf(waiter);
           if (idx >= 0) waiters.splice(idx, 1);
-          resolve5(false);
+          resolve4(false);
         }, timeoutMs);
         timer.unref?.();
         waiters.push(waiter);
@@ -6400,7 +6394,7 @@ async function startAgentServer(opts) {
   const pendingCapabilityCalls = /* @__PURE__ */ new Map();
   const remoteCapabilityInvoker = (name, input, timeoutMs, signal) => {
     const callId = typeof crypto?.randomUUID === "function" ? crypto.randomUUID() : `rcap-${Date.now()}-${Math.floor(Math.random() * 1e9)}`;
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve4, reject) => {
       if (!transport.connected) {
         reject(new Error(`Transport disconnected; cannot invoke remote capability ${name}`));
         return;
@@ -6414,7 +6408,7 @@ async function startAgentServer(opts) {
         signal?.removeEventListener("abort", abort);
         pendingCapabilityCalls.delete(callId);
         if (error) reject(error);
-        else resolve5(value);
+        else resolve4(value);
       };
       const abort = () => finish(signal?.reason ?? new Error("Remote capability aborted"));
       const timer = setTimeout(
@@ -6435,8 +6429,8 @@ async function startAgentServer(opts) {
     });
   };
   let aiProviderConfigId;
-  const sleep = (ms) => new Promise((resolve5) => {
-    const t = setTimeout(resolve5, ms);
+  const sleep = (ms) => new Promise((resolve4) => {
+    const t = setTimeout(resolve4, ms);
     t.unref?.();
   });
   async function mintAndPersistAiCredential(args) {
@@ -6606,32 +6600,17 @@ async function startAgentServer(opts) {
   }
   const secretsMode = managedHost ? "provisioned" : wsConfig.secrets?.provider ?? "env";
   wsConfig.secrets?.timeoutMs ?? 3e4;
-  const rawCloud = profile?.cloud ?? "default";
-  const effectiveCloud = SUPPORTED_CLOUDS.includes(rawCloud) ? rawCloud : "default";
-  if (effectiveCloud !== rawCloud) {
-    log(
-      `[serve] WARNING: unknown cloud "${rawCloud}" in agent-config \u2014 falling back to the default transport`
-    );
-  }
-  const effectiveCloudConfig = cloudConfigFromProfile(profile);
-  const diskProfileHasAgentSettings = (p) => !!p && !!(p.driver || p.provider || p.model || p.cloud || p.cloud_config || p.thinking || p.effort);
-  function resolveEffectiveCloudForSession() {
-    if (managedCodex) return { cloud: "default" };
-    if (effectiveCloud !== "default" || !wireAgentConfig) {
-      return { cloud: effectiveCloud, cloudConfig: effectiveCloudConfig };
-    }
-    const raw = wireAgentConfig.cloud ?? "default";
-    const cloud = SUPPORTED_CLOUDS.includes(raw) ? raw : "default";
-    return { cloud, cloudConfig: wireAgentConfig.cloudConfig };
-  }
-  function buildSessionConfig(secretProvider2, apiKey, cloudSecrets, fallbackConnectorDeclarations) {
-    const { cloud: sessionCloud, cloudConfig: sessionCloudConfig } = resolveEffectiveCloudForSession();
+  const diskProfileHasAgentSettings = (p) => !!p && !!(p.driver || p.model || p.thinking || p.effort);
+  function buildSessionConfig(secretProvider2, credentialEnv, fallbackConnectorDeclarations) {
     return {
       projectDir: opts.projectDir,
       agentDir,
       driver: managedCodex ? "codex" : opts.driver ?? wireAgentConfig?.driver,
       model: managedCodex ? wireAgentConfig?.model : opts.model ?? wireAgentConfig?.model,
-      provider: managedCodex ? "openai" : opts.provider ?? wireAgentConfig?.provider,
+      // The control-plane registry layer, normalized to the bare `id → entry`
+      // map the session builder layers `providers.yml` under.
+      ...wireAgentConfig?.registry ? { registry: toMergedRegistry(wireAgentConfig.registry).providers } : {},
+      ...wireAgentConfig?.modelRef ? { modelRef: wireAgentConfig.modelRef } : {},
       promptsDir: opts.promptsDir,
       sessionId,
       resumeSessionId: managedCodex ? void 0 : resumeSessionId,
@@ -6643,14 +6622,10 @@ async function startAgentServer(opts) {
       onAuthError: managedCodex ? void 0 : onAuthError,
       onLimitBlocked,
       onProviderResponse,
-      ...apiKey ? { apiKey } : {},
-      // Non-default cloud transport from skaile.yaml agent-config.default,
-      // plus the platform-resolved credential bundle (Vertex SA JSON already
-      // materialized to a file path by resolveCloudSecretBundle). Omitted
-      // entirely for `default` so the session config stays byte-identical.
-      ...sessionCloud !== "default" ? { cloud: sessionCloud } : {},
-      ...sessionCloudConfig ? { cloudConfig: sessionCloudConfig } : {},
-      ...cloudSecrets ? { cloudSecrets } : {},
+      // Credential values the runner resolved out of the `session_init`
+      // secrets map, keyed by the `SKAILE_AIP_<ID>_KEY` name each registry
+      // entry references. Omitted entirely when nothing resolved.
+      ...credentialEnv && Object.keys(credentialEnv).length > 0 ? { credentialEnv } : {},
       ...wireAgentConfig?.thinking ? { thinking: wireAgentConfig.thinking } : {},
       ...wireAgentConfig?.effort ? { effort: wireAgentConfig.effort } : {},
       // Every claude-sdk driver carries the flow tools, so a run can start mid-turn.
@@ -6728,10 +6703,10 @@ async function startAgentServer(opts) {
   let resolveSessionReady;
   let rejectSessionReady;
   let sessionReadyOutcome = "pending";
-  const sessionReady = new Promise((resolve5, reject) => {
+  const sessionReady = new Promise((resolve4, reject) => {
     resolveSessionReady = () => {
       if (sessionReadyOutcome === "pending") sessionReadyOutcome = "resolved";
-      resolve5();
+      resolve4();
     };
     rejectSessionReady = (err) => {
       if (sessionReadyOutcome === "pending") sessionReadyOutcome = "rejected";
@@ -6812,12 +6787,28 @@ async function startAgentServer(opts) {
       bakedMcpServerIds
     )
   );
+  function logResolvedProviderTargets() {
+    const registry = agentSession?.registry;
+    if (!registry) return;
+    const entries = registryEntries(registry);
+    if (entries.length === 0) return;
+    const described = entries.map(
+      ([id, entry]) => `${id} -> ${resolveEntryBaseUrl(entry) ?? "(vendor default)"} [${providerCredentialEnvName(id)}]`
+    );
+    log(
+      `[serve] AI provider registry: ${described.join(", ")} (selector ${agentSession?.modelRef ?? "(driver default)"})`
+    );
+  }
   if (secretsMode === "env") {
-    if (!agentSession.provider) {
+    if (agentSession.registry.order.length === 0) {
       log(
-        `[serve] WARNING: no API key found for ${agentSession.provider ?? "anthropic"} \u2014 agent calls will fail`
+        "[serve] WARNING: no AI provider registry entry for this session \u2014 agent calls fall back to the backend's own login, if it has one"
       );
-      log(`[serve] Pass via env var (e.g. ANTHROPIC_API_KEY) or .skaile/settings.json`);
+      log(
+        "[serve] Define one with `skaile providers add <id> --preset <preset> --credential env:<VAR>`"
+      );
+    } else {
+      logResolvedProviderTargets();
     }
     if (resourceManager) {
       const watched = resourceManager.watchedResources ?? [];
@@ -7116,13 +7107,11 @@ async function startAgentServer(opts) {
     if (sessionConfig.managedCodex && !managedSubprompts) throw new Error("AI_PROFILE_INVALID");
     const generativeSubpromptRunner = new SessionSubpromptRunner({
       driverType: agentSession.driverType,
-      provider: agentSession.provider,
       sessionModel: agentSession.model,
       workspaceDir: opts.projectDir,
-      apiKey: sessionConfig.apiKey,
-      cloud: sessionConfig.cloud,
-      cloudConfig: sessionConfig.cloudConfig,
-      cloudSecrets: sessionConfig.cloudSecrets,
+      registry: agentSession.registry,
+      ...agentSession.modelRef ? { modelRef: agentSession.modelRef } : {},
+      credentialEnv: agentSession.credentialEnv,
       ...managedSubprompts ? {
         modelTierOverrides: {
           small: managedSubprompts.small,
@@ -7322,8 +7311,8 @@ async function startAgentServer(opts) {
     try {
       await Promise.race([
         sessionReady,
-        new Promise((resolve5) => {
-          const t = setTimeout(resolve5, 2e3);
+        new Promise((resolve4) => {
+          const t = setTimeout(resolve4, 2e3);
           t.unref?.();
         })
       ]);
@@ -7356,10 +7345,6 @@ async function startAgentServer(opts) {
       } catch {
       }
     }
-    try {
-      cleanupCloudCredentialFiles(opts.projectDir);
-    } catch {
-    }
   }
   async function awaitSessionReadyOrFail() {
     try {
@@ -7421,24 +7406,14 @@ async function startAgentServer(opts) {
     return initialAiCredentialExpiresAt;
   }
   async function buildSessionFromInit(secrets, fallbackConnectorDeclarations) {
-    let apiKeyFromSecrets;
-    let cloudSecrets;
-    const { cloud: initCloud } = resolveEffectiveCloudForSession();
-    if (!managedCodex && initCloud === "default") {
-      const effectiveProvider = opts.provider ?? wireAgentConfig?.provider ?? "anthropic";
-      const envKey = providerEnvKey(effectiveProvider);
-      apiKeyFromSecrets = secrets?.[envKey];
-    } else if (!managedCodex) {
-      ({ cloudSecrets } = resolveCloudSecretBundle({
-        cloud: initCloud,
-        secrets,
-        projectDir: opts.projectDir
-      }));
-    }
+    const wireRegistry = managedCodex ? void 0 : wireAgentConfig?.registry;
+    const credentialEnv = wireRegistry ? registryCredentialEnv(wireRegistry, {
+      secrets: secrets ?? {},
+      allowCommand: false
+    }) : void 0;
     sessionConfig = buildSessionConfig(
       secretProvider,
-      apiKeyFromSecrets,
-      cloudSecrets,
+      credentialEnv,
       fallbackConnectorDeclarations
     );
     let needsWireFallbackRecreate = false;
@@ -7495,8 +7470,8 @@ async function startAgentServer(opts) {
   async function recreateAgentSession(overrides) {
     let markSwapDone;
     driverSwapGate.beginSwap(
-      new Promise((resolve5) => {
-        markSwapDone = resolve5;
+      new Promise((resolve4) => {
+        markSwapDone = resolve4;
       })
     );
     try {
@@ -7859,6 +7834,17 @@ async function startAgentServer(opts) {
       return;
     }
     runtimeIdentity = cmd.identity;
+    const legacyWireKeys = legacyResolvedConfigKeys(cmd.resolvedConfig.agentConfig);
+    if (legacyWireKeys.length > 0) {
+      const message = `session_init resolvedConfig.agentConfig carries removed field(s) ${legacyWireKeys.join(", ")}: @skaile/workspaces 4.0.0 deleted the provider/cloud axis. Send \`registry\` (an AI provider registry keyed by endpoint id, each entry referencing its credential as \`platform:<configId>\`) plus \`modelRef\` ("<providerId>/<modelId>", a bare model id, or "@role") instead. See MIGRATION.md 4.0.0.`;
+      log(`[serve] ${message}`);
+      sendEvent({ type: "error", fatal: true, category: "config", message });
+      await cleanup();
+      teardownProcessHandlers();
+      disposeLogStore();
+      await transport.close();
+      return;
+    }
     registerInitClientCapabilities(cmd.capabilities ?? []);
     sendEvent({
       type: "protocol_info",
@@ -7872,7 +7858,8 @@ async function startAgentServer(opts) {
       aiProviderConfigId = cmd.resolvedConfig.aiProviderConfigId;
       log(`[serve] stashed aiProviderConfigId=${aiProviderConfigId}`);
     }
-    wireAgentConfig = managedCodex ? cmd.resolvedConfig.agentConfig : diskProfileHasAgentSettings(profile) ? void 0 : cmd.resolvedConfig.agentConfig ?? wireAgentConfig;
+    const wireCandidate = cmd.resolvedConfig.agentConfig ?? wireAgentConfig;
+    wireAgentConfig = managedCodex ? cmd.resolvedConfig.agentConfig : diskProfileHasAgentSettings(profile) ? wireCandidate?.registry ? { registry: wireCandidate.registry } : void 0 : wireCandidate;
     if (!managedCodex && aiProviderConfigId && initialAiCredentialExpiresAt) {
       aiCredentialRefreshScheduler.schedule(initialAiCredentialExpiresAt);
     }
@@ -7935,6 +7922,17 @@ async function startAgentServer(opts) {
           resuming: !!pendingResumeSessionId
         });
       }
+      const deliveredRegistry = cmd.resolvedConfig.agentConfig?.registry;
+      if (deliveredRegistry) {
+        const delivered = Object.keys(toMergedRegistry(deliveredRegistry).providers);
+        const resolved = Object.keys(agentSession?.registry.providers ?? {});
+        if (delivered.length > 0 && !delivered.some((id) => resolved.includes(id))) {
+          throw new Error(
+            `session_init: AI provider registry ${delivered.length === 1 ? "entry" : "entries"} ${delivered.join(", ")} delivered by the control plane did not reach the session (resolved: ${resolved.join(", ") || "none"}) \u2014 it has no endpoint and no credential for its configured provider`
+          );
+        }
+      }
+      logResolvedProviderTargets();
       if (cfg.sharedState) {
         const handled = await applyInitSharedState(cfg.sharedState);
         if (!handled) throw new Error("session_init: shared-state setup failed");
@@ -8211,7 +8209,6 @@ async function startAgentServer(opts) {
         return {
           driver: agentSession?.driverType,
           model: liveModel,
-          provider: agentSession?.provider,
           maxTurns,
           secretsMode,
           driverStarted,
@@ -8467,7 +8464,7 @@ async function startAgentServer(opts) {
   });
   if (secretsMode === "env") {
     log(
-      `[serve] driver=${agentSession.driverType} model=${agentSession.model ?? "(default)"} provider=${agentSession.provider ?? "(default)"} maxTurns=${maxTurns ?? "(default)"}`
+      `[serve] driver=${agentSession.driverType} model=${agentSession.model ?? "(default)"} maxTurns=${maxTurns ?? "(default)"}`
     );
   } else {
     log(`[serve] secrets=provisioned \u2014 session will initialize after provision_secrets`);
@@ -8632,5 +8629,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-YLL65VXQ.js.map
-//# sourceMappingURL=chunk-YLL65VXQ.js.map
+//# sourceMappingURL=chunk-HO2FQ76C.js.map
+//# sourceMappingURL=chunk-HO2FQ76C.js.map