@skylandnpm/octopus-proxy 0.1.8 → 0.1.12

package/README.md

@@ -67,3 +67,9 @@ npm run publish
 ```
 
 预览包内容可运行 `pnpm build && npm pack --dry-run`。直接运行 `npm publish` 会提示使用 `npm run publish`，以防绕过版本递增和编译。
+
+## 编码工具账号与 OpenCode 服务
+
+OpenCode 只支持 external：先自行运行 `opencode serve --hostname 127.0.0.1 --port 4096`，配置 `tool.mode: "external"` 和 `tool.baseUrl`。旧 managed 配置必须迁移，Proxy 不再管理 OpenCode 生命周期。
+
+Claw 的“编码工具账号”窗口支持 Codex API Key/设备码、ZCode 原生 Z.AI OAuth、OpenCode 原生 API Key/OAuth。凭据由编码工具保存，模型列表从原生接口读取。详细行为与验证边界见 [编码工具账号](../../docs/tool-authentication.md)。

package/dist/{chunk-2SGNDVCO.js → chunk-AGWRSSBQ.js}

@@ -11602,10 +11602,12 @@ var ToolSchema = z.object({
   kind: z.enum(TOOL_KINDS).default("opencode"),
   command: z.string().default(""),
   baseUrl: z.string().url().optional(),
-  mode: z.enum(["managed", "external"]).default("managed"),
-  autoStart: z.boolean().default(true),
+  mode: z.enum(["managed", "external"]).optional(),
+  autoStart: z.boolean().optional(),
   password: z.string().optional()
-});
+}).superRefine((tool, context) => {
+  if (tool.kind === "opencode" && tool.mode === "managed") context.addIssue({ code: z.ZodIssueCode.custom, path: ["mode"], message: "OpenCode \u4EC5\u652F\u6301 external \u6A21\u5F0F\uFF1B\u8BF7\u5148\u81EA\u884C\u542F\u52A8 opencode serve\uFF0C\u518D\u5C06 tool.mode \u6539\u4E3A external" });
+}).transform((tool) => ({ ...tool, mode: tool.kind === "opencode" ? "external" : tool.mode ?? "managed", autoStart: tool.kind === "opencode" ? false : tool.autoStart ?? true }));
 var ConfigSchema = z.object({
   hubUrl: z.string().url(),
   botId: z.string().uuid(),
@@ -11658,11 +11660,15 @@ async function loadConfig(path) {
 import WebSocket2 from "ws";
 import { mkdir as mkdir5 } from "node:fs/promises";
 import { join as join9 } from "node:path";
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 
 // ../../packages/protocol/src/index.ts
 var PROTOCOL_VERSION = "1.0";
 var Operations = [
+  "auth.status",
+  "auth.login",
+  "auth.poll",
+  "auth.cancel",
   "runtime.status",
   "runtime.snapshot",
   "runtime.start",
@@ -12145,6 +12151,69 @@ var Uploads = class {
   }
 };
 
+// src/auth.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+var AUTH_OPERATIONS = ["auth.status", "auth.login", "auth.poll", "auth.cancel"];
+var AuthFlows = class {
+  flows = /* @__PURE__ */ new Map();
+  create(project, cancel) {
+    if ([...this.flows.values()].some((f) => ["pending", "input"].includes(f.state.status))) throw new Error("\u5DF2\u6709\u767B\u5F55\u6B63\u5728\u8FDB\u884C\uFF0C\u8BF7\u5148\u5B8C\u6210\u6216\u53D6\u6D88");
+    const state = { flowId: randomUUID4(), status: "pending" };
+    const timer = setTimeout(() => {
+      void this.cancel(project, state.flowId).catch(() => {
+      });
+      this.flows.delete(state.flowId);
+    }, 10 * 6e4);
+    timer.unref();
+    this.flows.set(state.flowId, { project, state, cancel, timer });
+    return state;
+  }
+  get(project, id) {
+    const flow = this.flows.get(String(id));
+    if (!flow || flow.project !== project) throw new Error("\u767B\u5F55\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u5F00\u59CB");
+    return flow;
+  }
+  update(project, id, patch) {
+    const flow = this.flows.get(id);
+    if (!flow || flow.project !== project || flow.state.status === "cancelled") return;
+    Object.assign(flow.state, patch);
+    if (["completed", "failed"].includes(flow.state.status)) {
+      delete flow.state.url;
+      delete flow.state.code;
+      delete flow.state.fields;
+      flow.submit = void 0;
+    }
+  }
+  async poll(project, payload) {
+    const flow = this.get(project, payload.flowId);
+    if (payload.input && flow.submit && flow.state.status === "input") {
+      flow.state.status = "pending";
+      const submit = flow.submit;
+      flow.submit = void 0;
+      void submit(payload.input).catch(() => this.update(project, flow.state.flowId, { status: "failed", message: "\u8BA4\u8BC1\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u8BA4\u8BC1\u4FE1\u606F\u540E\u91CD\u8BD5" }));
+    }
+    return { ...flow.state };
+  }
+  async cancel(project, id) {
+    const flow = this.get(project, id);
+    if (["pending", "input"].includes(flow.state.status)) await flow.cancel?.();
+    flow.state = { flowId: flow.state.flowId, status: "cancelled" };
+    flow.submit = void 0;
+    return flow.state;
+  }
+  close() {
+    for (const flow of this.flows.values()) {
+      clearTimeout(flow.timer);
+      void Promise.resolve(flow.cancel?.()).catch(() => {
+      });
+    }
+    this.flows.clear();
+  }
+};
+function isAuthentication(operation) {
+  return operation.startsWith("auth.") || ["configuration.auth", "configuration.oauthAuthorize", "configuration.oauthCallback"].includes(operation);
+}
+
 // src/journal.ts
 import { join as join3 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
@@ -12162,7 +12231,7 @@ var Journal = class {
     }
     const run3 = async () => {
       const path = join3(this.directory, `${command.id}.json`);
-      const readOnly = isReadOperation(command.operation);
+      const readOnly = isReadOperation(command.operation) || isAuthentication(command.operation);
       if (!readOnly) {
         const old = await readJson(path);
         if (old) {
@@ -12175,7 +12244,7 @@ var Journal = class {
       try {
         response = { type: "response", id: command.id, botId: command.botId, status: "completed", data: await action() };
       } catch (error) {
-        response = this.failure(command, error instanceof Error ? error.message : "Operation failed");
+        response = this.failure(command, isAuthentication(command.operation) ? "\u8BA4\u8BC1\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u7F16\u7801\u5DE5\u5177\u7684\u767B\u5F55\u72B6\u6001\u540E\u91CD\u8BD5" : error instanceof Error ? error.message : "Operation failed");
         if (!readOnly && error instanceof Error && ["TimeoutError", "AbortError", "UnknownResultError"].includes(error.name)) response.status = "unknown";
       }
       if (!readOnly) await atomicJson(path, { hash, response, finishedAt: (/* @__PURE__ */ new Date()).toISOString() });
@@ -12197,7 +12266,7 @@ var Journal = class {
     return result;
   }
   queueKey(c) {
-    if (isReadOperation(c.operation)) return void 0;
+    if (isReadOperation(c.operation) || isAuthentication(c.operation)) return void 0;
     const [group] = c.operation.split(".");
     if (c.operation === "sessions.abort") return JSON.stringify(["abort", c.projectId, c.sessionId]);
     if (group === "sessions") return JSON.stringify(["session", c.projectId, c.sessionId ?? c.id]);
@@ -12390,7 +12459,7 @@ var EventStream = class {
 };
 
 // src/proxy-snapshot.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 function record(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -12419,34 +12488,13 @@ async function buildProxySnapshot(config, runtime, adapter, requestedProjectId)
   let modelCatalogStatus = capabilities.includes("configuration.models") ? "unavailable" : "unsupported";
   if (status.healthy === true && projectId && capabilities.includes("configuration.models")) {
     try {
-      const command = { type: "command", id: randomUUID4(), botId: config.botId, operation: "configuration.models", projectId, payload: {} };
+      const command = { type: "command", id: randomUUID5(), botId: config.botId, operation: "configuration.models", projectId, payload: {} };
       models.push(...publicModels(await adapter.dispatch(command)));
-      modelCatalogStatus = "available";
+      modelCatalogStatus = models.length ? "available" : "unavailable";
     } catch {
       modelCatalogStatus = "unavailable";
     }
   }
-  let recentModel;
-  if (status.healthy === true && projectId && modelCatalogStatus === "unsupported" && capabilities.includes("sessions.list")) {
-    try {
-      const command = { type: "command", id: randomUUID4(), botId: config.botId, operation: "sessions.list", projectId, payload: {} };
-      const sessions = await adapter.dispatch(command);
-      if (Array.isArray(sessions)) {
-        const withModel = sessions.map(record).filter((session) => {
-          const model = record(session.model);
-          return typeof model.providerId === "string" && typeof model.modelId === "string";
-        }).sort((left, right) => {
-          const leftTime = record(left.time).updated, rightTime = record(right.time).updated;
-          return (typeof rightTime === "number" ? rightTime : 0) - (typeof leftTime === "number" ? leftTime : 0);
-        })[0];
-        if (withModel) {
-          const model = record(withModel.model);
-          recentModel = { providerId: model.providerId, modelId: model.modelId };
-        }
-      }
-    } catch {
-    }
-  }
   return {
     runtime: { ...status, capabilities },
     config: {
@@ -12462,12 +12510,12 @@ async function buildProxySnapshot(config, runtime, adapter, requestedProjectId)
       }
     },
     projects,
-    modelCatalog: { projectId, status: modelCatalogStatus, models, ...recentModel ? { recentModel } : {} }
+    modelCatalog: { projectId, status: modelCatalogStatus, models }
   };
 }
 
 // src/media.ts
-import { createHash as createHash5, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID6 } from "node:crypto";
 import { constants as constants3 } from "node:fs";
 import { open as open3, unlink as unlink3, realpath as realpath3 } from "node:fs/promises";
 import { basename as basename3, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
@@ -12684,7 +12732,7 @@ var RemoteMedia = class {
     if (bytes.length === 0 || bytes.length > this.imageLimit()) throw new Error("Image is empty or exceeds size limit");
     const extension = { "image/png": "png", "image/jpeg": "jpg", "image/gif": "gif", "image/webp": "webp", "application/pdf": "pdf" }[mime] ?? "bin";
     const directory = await this.workspace.attachmentDirectory(project, "media", sha256), path = directory + "/asset." + extension;
-    const temp = await this.workspace.path(project, directory + "/.octopus-media-" + randomUUID5(), true);
+    const temp = await this.workspace.path(project, directory + "/.octopus-media-" + randomUUID6(), true);
     const file = await open3(temp, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
     try {
       await file.writeFile(bytes);
@@ -14102,7 +14150,7 @@ function applyEdits(text, edits) {
 
 // src/project-config.ts
 import { readFile as readFile4, writeFile as writeFile3, unlink as unlink4 } from "node:fs/promises";
-import { createHash as createHash6, randomUUID as randomUUID6 } from "node:crypto";
+import { createHash as createHash6, randomUUID as randomUUID7 } from "node:crypto";
 var ProjectConfig = class {
   constructor(workspace, request) {
     this.workspace = workspace;
@@ -14153,7 +14201,7 @@ var ProjectConfig = class {
     if (!this.validator(parse2(updated))) throw new Error("Merged OpenCode configuration is invalid: " + JSON.stringify(this.validator.errors));
     if (exists) await this.workspace.write(project, name, updated, createHash6("sha256").update(original).digest("hex"));
     else {
-      const temporary = await this.workspace.path(project, `.octopus-config-${randomUUID6()}.tmp`, true);
+      const temporary = await this.workspace.path(project, `.octopus-config-${randomUUID7()}.tmp`, true);
       try {
         await writeFile3(temporary, updated, { mode: 384, flag: "wx" });
         await this.workspace.publish(project, temporary, name);
@@ -14178,8 +14226,11 @@ var OpenCodeAdapter = class {
     this.media = new RemoteMedia(workspace, () => uploads.limits.imageBytes);
   }
   supportedOperations() {
-    return Operations;
+    return Operations.filter((op) => !["runtime.start", "runtime.stop", "runtime.restart", "runtime.logs"].includes(op));
   }
+  auth = new AuthFlows();
+  authDirty = /* @__PURE__ */ new Set();
+  authRefreshing = /* @__PURE__ */ new Map();
   streams = /* @__PURE__ */ new Map();
   terminals = /* @__PURE__ */ new Map();
   // OpenCode 1.1.32 only buffers output while no client is attached.
@@ -14188,10 +14239,10 @@ var OpenCodeAdapter = class {
   resolving = /* @__PURE__ */ new Set();
   config;
   media;
-  async request(project, method, path, body) {
+  async request(project, method, path, body, signal) {
     const root = await this.workspace.root(project), url = new URL(path, this.runtime.config.tool.baseUrl);
     url.searchParams.set("directory", root);
-    const response = await fetch(url, { method, headers: { ...this.runtime.headers(), "Content-Type": "application/json" }, body: body === void 0 ? void 0 : JSON.stringify(body), signal: AbortSignal.timeout(35e3) }).catch((error) => {
+    const response = await fetch(url, { method, headers: { ...this.runtime.headers(), "Content-Type": "application/json" }, body: body === void 0 ? void 0 : JSON.stringify(body), signal: signal ?? AbortSignal.timeout(35e3) }).catch((error) => {
       if (method !== "GET") {
         const unknown = new Error("Transport interrupted; inspect remote state before retrying");
         unknown.name = "UnknownResultError";
@@ -14220,6 +14271,7 @@ var OpenCodeAdapter = class {
     this.workspace.project(project);
     this.subscribe(project);
     const op = command.operation, p = command.payload, id = command.sessionId;
+    if (op.startsWith("auth.")) return this.authentication(project, op, p);
     const needsSession = op.startsWith("sessions.") && !["sessions.list", "sessions.create", "sessions.status"].includes(op);
     if (needsSession) {
       if (!id) throw new Error("Session required");
@@ -14259,6 +14311,11 @@ var OpenCodeAdapter = class {
       "terminal.list": ["GET", "/pty"],
       "terminal.create": ["POST", "/pty"]
     };
+    if (op === "configuration.models") {
+      await this.refreshAuth(project);
+      const result2 = await this.request(project, "GET", "/provider");
+      return redact({ providers: result2.all.filter((provider) => result2.connected.includes(provider.id)) });
+    }
     if (op === "sessions.prompt") {
       const parts = [];
       if (typeof p.text === "string" && p.text.trim()) parts.push({ type: "text", text: screenshotPrompt(p.text) });
@@ -14317,6 +14374,71 @@ var OpenCodeAdapter = class {
     if (op.startsWith("sessions.")) return this.media.normalize(project, result);
     return result;
   }
+  async refreshAuth(project) {
+    if (!this.authDirty.has(project)) return;
+    const pending = this.authRefreshing.get(project);
+    if (pending) return pending;
+    const refresh = (async () => {
+      const statuses = await this.request(project, "GET", "/session/status");
+      if (Object.values(statuses).some((status) => status.type !== "idle")) return;
+      await this.request(project, "POST", "/instance/dispose");
+      this.authDirty.delete(project);
+    })();
+    this.authRefreshing.set(project, refresh);
+    try {
+      await refresh;
+    } finally {
+      this.authRefreshing.delete(project);
+    }
+  }
+  async authentication(project, operation, payload) {
+    if (operation === "auth.poll") return this.auth.poll(project, payload);
+    if (operation === "auth.cancel") return this.auth.cancel(project, payload.flowId);
+    await this.refreshAuth(project);
+    const methods = await this.request(project, "GET", "/provider/auth");
+    const providers = await this.request(project, "GET", "/provider");
+    for (const provider2 of providers.all) if (!methods[provider2.id]?.length) methods[provider2.id] = [{ type: "api", label: "API Key" }];
+    if (operation === "auth.status") {
+      const choices = Object.entries(methods).flatMap(([provider2, entries]) => entries.map((method2, index2) => ({
+        id: `${provider2}:${index2}`,
+        label: `${providers.all.find((p) => p.id === provider2)?.name ?? provider2} \xB7 ${method2.label}`,
+        fields: method2.type === "api" ? [{ id: "key", label: "API Key", secret: true }] : (method2.prompts ?? []).map((prompt) => ({ id: prompt.key, label: prompt.message, secret: prompt.type !== "select", ...prompt.options ? { options: prompt.options.map(({ label, value }) => ({ label, value })) } : {} }))
+      })));
+      return { status: providers.connected.length ? "authenticated" : "unauthenticated", message: providers.connected.length ? "OpenCode \u5DF2\u914D\u7F6E\u4F9B\u5E94\u5546" : "OpenCode \u672A\u914D\u7F6E\u53EF\u7528\u4F9B\u5E94\u5546", providers: providers.connected, methods: choices };
+    }
+    const methodId = String(payload.method ?? ""), split = methodId.lastIndexOf(":");
+    const provider = methodId.slice(0, split), index = Number(methodId.slice(split + 1));
+    const method = methods[provider]?.[index];
+    if (split < 0 || !method || !["api", "oauth"].includes(method.type)) throw new Error("\u4E0D\u652F\u6301\u7684 OpenCode \u767B\u5F55\u65B9\u5F0F");
+    const input = payload.input ?? {};
+    const controller = new AbortController();
+    const flow = this.auth.create(project, () => controller.abort());
+    const run3 = async () => {
+      if (method.type === "api") {
+        if (typeof input.key !== "string" || !input.key.trim()) throw new Error("API Key required");
+        await this.request(project, "PUT", `/auth/${this.identifier(provider)}`, { type: "api", key: input.key }, controller.signal);
+        for (const entry of this.runtime.config.projects) this.authDirty.add(entry.id);
+        await this.refreshAuth(project);
+        this.auth.update(project, flow.flowId, { status: "completed", message: this.authDirty.has(project) ? "\u8BA4\u8BC1\u4FE1\u606F\u5DF2\u4FDD\u5B58\uFF1B\u5F53\u524D\u4EFB\u52A1\u7ED3\u675F\u540E\u5237\u65B0\u6A21\u578B\u5217\u8868" : "\u8BA4\u8BC1\u4FE1\u606F\u5DF2\u7531 OpenCode \u4FDD\u5B58" });
+        return;
+      }
+      const result = await this.request(project, "POST", `/provider/${this.identifier(provider)}/oauth/authorize`, { method: index, inputs: input }, controller.signal);
+      this.auth.update(project, flow.flowId, { url: result.url, message: result.instructions });
+      const callback = async (code) => {
+        await this.request(project, "POST", `/provider/${this.identifier(provider)}/oauth/callback`, { method: index, ...typeof code === "string" ? { code } : {} }, controller.signal);
+        for (const entry of this.runtime.config.projects) this.authDirty.add(entry.id);
+        await this.refreshAuth(project);
+        this.auth.update(project, flow.flowId, { status: "completed", message: this.authDirty.has(project) ? "\u767B\u5F55\u6210\u529F\uFF1B\u5F53\u524D\u4EFB\u52A1\u7ED3\u675F\u540E\u5237\u65B0\u6A21\u578B\u5217\u8868" : "\u767B\u5F55\u6210\u529F" });
+      };
+      if (result.method === "auto") await callback();
+      else {
+        this.auth.update(project, flow.flowId, { status: "input", fields: [{ id: "code", label: "\u6388\u6743\u7801\u6216\u56DE\u8C03\u5730\u5740", secret: true }] });
+        this.auth.get(project, flow.flowId).submit = (values) => callback(values.code);
+      }
+    };
+    void run3().catch(() => this.auth.update(project, flow.flowId, { status: "failed", message: "OpenCode \u8BA4\u8BC1\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u8BA4\u8BC1\u4FE1\u606F\u4E0E\u4F9B\u5E94\u5546\u914D\u7F6E\u540E\u91CD\u8BD5" }));
+    return { ...flow };
+  }
   subscribe(project) {
     if (this.streams.has(project)) return;
     const controller = new AbortController();
@@ -14369,7 +14491,9 @@ var OpenCodeAdapter = class {
       const history = this.terminalOutput.get(key) ?? "";
       this.emit(project, "terminal.reset", { id: p.id });
       for (let offset = 0; offset < history.length; offset += 65536) this.emit(project, "terminal.output", { id: p.id, data: history.slice(offset, offset + 65536) });
-      this.terminals.get(key)?.close();
+      const previous = this.terminals.get(key);
+      this.terminals.delete(key);
+      previous?.close();
       const url = new URL(`/pty/${id}/connect`, this.runtime.config.tool.baseUrl);
       url.protocol = "ws:";
       url.searchParams.set("directory", await this.workspace.root(project));
@@ -14405,6 +14529,7 @@ var OpenCodeAdapter = class {
     return true;
   }
   close() {
+    this.auth.close();
     for (const c of this.streams.values()) c.abort();
     for (const t of this.terminals.values()) t.close();
   }
@@ -14416,79 +14541,27 @@ function redact(value) {
 }
 
 // src/runtime.ts
-import { spawn, execFile as execFile2 } from "node:child_process";
-import { promisify as promisify2 } from "node:util";
-import { randomBytes } from "node:crypto";
-import { open as open4 } from "node:fs/promises";
-import { join as join5 } from "node:path";
 var Runtime = class {
   constructor(config) {
     this.config = config;
   }
-  detached = false;
-  child;
-  wanted = false;
-  attempts = 0;
-  timer;
-  lines = [];
-  starting;
-  owned;
-  monitor;
   kind = "opencode";
-  password = "";
   version = "";
-  state = "stopped";
-  lastError = "";
-  async identity(pid) {
-    try {
-      return (await promisify2(execFile2)("ps", ["-p", String(pid), "-o", "lstart=", "-o", "command="])).stdout.trim();
-    } catch {
-      return "";
-    }
-  }
-  async save() {
-    await atomicJson(join5(this.config.stateDirectory, "runtime.json"), { password: this.password, wanted: this.wanted, ...this.owned, baseUrl: this.config.tool.baseUrl, command: this.config.tool.command });
-  }
-  async stillOwned() {
-    const owned = this.owned;
-    return !!owned && await this.identity(owned.pid) === owned.identity && this.owned === owned;
-  }
+  state = "external";
   async init() {
-    const saved = await readJson(join5(this.config.stateDirectory, "runtime.json"));
-    this.password = this.config.tool.password ?? saved?.password ?? randomBytes(32).toString("hex");
-    if (this.config.tool.mode === "external") {
-      this.password = this.config.tool.password ?? "";
-      this.state = "external";
-      return;
-    }
-    this.wanted = saved?.wanted ?? this.config.tool.autoStart;
-    if (saved?.pid && saved.identity && saved.baseUrl === this.config.tool.baseUrl && saved.command === this.config.tool.command) {
-      this.owned = { pid: saved.pid, identity: saved.identity };
-      if (await this.stillOwned() && await this.health()) this.state = "running";
-      else this.owned = void 0;
-    }
-    await this.save();
-    this.monitor = setInterval(() => {
-      if (this.owned && !this.child) void this.stillOwned().then((alive) => {
-        if (!alive) {
-          this.owned = void 0;
-          this.exited();
-        }
-      });
-    }, 3e3);
-    this.monitor.unref();
-    if (this.wanted && !this.owned) await this.start();
+    await this.health();
   }
   headers() {
-    return this.password ? { Authorization: `Basic ${Buffer.from(`opencode:${this.password}`).toString("base64")}` } : {};
+    const password = this.config.tool.password;
+    return password ? { Authorization: `Basic ${Buffer.from(`opencode:${password}`).toString("base64")}` } : {};
   }
   async health() {
     try {
-      const r = await fetch(`${this.config.tool.baseUrl}/global/health`, { headers: this.headers(), signal: AbortSignal.timeout(2e3) });
-      if (!r.ok) return false;
-      const data = await r.json();
+      const response = await fetch(`${this.config.tool.baseUrl}/global/health`, { headers: this.headers(), signal: AbortSignal.timeout(2e3) });
+      if (!response.ok) return false;
+      const data = await response.json();
       this.version = data.version ?? this.version;
-      return true;
+      return data.healthy === true;
     } catch {
       return false;
     }
@@ -14497,145 +14570,49 @@ var Runtime = class {
     const healthy = await this.health();
     return {
       tool: this.kind,
-      mode: this.config.tool.mode,
+      mode: "external",
       state: this.state,
       healthy,
       version: this.version,
-      pid: this.owned?.pid,
-      attempts: this.attempts,
-      ...healthy ? {} : { error: this.lastError || `OpenCode at ${this.config.tool.baseUrl} did not pass its health check` }
+      ...healthy ? {} : { error: `\u65E0\u6CD5\u8FDE\u63A5 OpenCode\uFF1A${this.config.tool.baseUrl}\u3002\u8BF7\u5728\u8BE5\u4E3B\u673A\u542F\u52A8 opencode serve\uFF0C\u5E76\u68C0\u67E5\u670D\u52A1\u5730\u5740\u548C\u5BC6\u7801\u3002` }
     };
   }
-  start() {
-    if (this.detached) throw new Error("Runtime supervisor is detached");
-    if (this.config.tool.mode !== "managed") throw new Error("External instance is not owned; configure managed mode after stopping it explicitly");
-    if (this.starting) return this.starting;
-    this.starting = this.startOwned().then((result) => {
-      this.lastError = "";
-      return result;
-    }).catch((error) => {
-      this.lastError = error instanceof Error ? error.message : String(error);
-      if (this.wanted && this.state !== "unowned") this.state = "failed";
-      throw error;
-    }).finally(() => {
-      this.starting = void 0;
-    });
-    return this.starting;
-  }
-  exited() {
-    if (this.detached) return;
-    this.state = this.wanted ? "failed" : "stopped";
-    if (this.wanted && !this.lastError) this.lastError = "OpenCode process exited unexpectedly";
-    void this.save();
-    if (this.wanted && this.attempts < 5) {
-      const delay = Math.min(3e4, 1e3 * 2 ** this.attempts++);
-      this.timer = setTimeout(() => this.start().catch((e) => this.lines.push(String(e))), delay);
-    }
-  }
-  // Detach supervision when Proxy exits; the independently running tool is kept alive.
-  detach() {
-    this.detached = true;
-    clearTimeout(this.timer);
-    clearInterval(this.monitor);
-  }
-  async startOwned() {
-    this.wanted = true;
-    await this.save();
-    if (await this.stillOwned()) return this.status();
-    if (await this.health()) {
-      this.state = "unowned";
-      throw new Error("A server already occupies the endpoint; refusing implicit takeover");
-    }
-    const { stdout } = await promisify2(execFile2)(this.config.tool.command, ["--version"], { timeout: 15e3 });
-    this.version = stdout.trim();
-    if (this.version !== "1.1.32") throw new Error(`Unsupported OpenCode ${this.version}; verified baseline is 1.1.32`);
-    const url = new URL(this.config.tool.baseUrl);
-    this.state = "starting";
-    const log = await open4(join5(this.config.stateDirectory, "opencode.log"), "a", 384);
-    const child = spawn(this.config.tool.command, ["serve", "--hostname", "127.0.0.1", "--port", url.port || "4096"], { detached: true, cwd: this.config.projects[0].directory, env: { ...process.env, OPENCODE_SERVER_PASSWORD: this.password }, stdio: ["ignore", log.fd, log.fd] });
-    await log.close();
-    this.child = child;
-    child.unref();
-    child.once("error", (e) => {
-      this.lines.push(e.message);
-      if (this.child === child) {
-        this.child = void 0;
-        this.owned = void 0;
-        this.exited();
-      }
-    });
-    child.once("exit", () => {
-      if (this.child === child) {
-        this.child = void 0;
-        this.owned = void 0;
-        this.exited();
-      }
-    });
-    if (child.pid) {
-      const identity = await this.identity(child.pid);
-      if (identity) {
-        this.owned = { pid: child.pid, identity };
-        await this.save();
-      }
-    }
-    for (let i = 0; i < 100; i++) {
-      if (await this.health()) {
-        this.state = "running";
-        return this.status();
-      }
-      if (!this.child) throw new Error("OpenCode exited during startup");
-      await new Promise((resolve4) => setTimeout(resolve4, 200));
-    }
-    await this.stop();
-    throw new Error("OpenCode startup timed out");
+  async start() {
+    throw new Error("OpenCode \u4EC5\u652F\u6301 external \u6A21\u5F0F\uFF0C\u8BF7\u5728\u4E3B\u673A\u4E0A\u8FD0\u884C opencode serve");
   }
   async stop() {
-    if (this.config.tool.mode !== "managed") throw new Error("Cannot stop an externally managed instance");
-    this.wanted = false;
-    clearTimeout(this.timer);
-    await this.save();
-    if (this.owned && await this.stillOwned()) {
-      const pid = this.owned.pid;
-      process.kill(pid, "SIGTERM");
-      for (let i = 0; i < 50 && await this.stillOwned(); i++) await new Promise((resolve4) => setTimeout(resolve4, 100));
-      if (await this.stillOwned()) process.kill(pid, "SIGKILL");
-    }
-    this.child = void 0;
-    this.owned = void 0;
-    this.state = "stopped";
-    await this.save();
-    return this.status();
+    throw new Error("OpenCode \u670D\u52A1\u7531\u5916\u90E8\u7BA1\u7406\uFF0CProxy \u4E0D\u652F\u6301\u505C\u6B62");
   }
   async restart() {
-    await this.stop();
-    this.attempts = 0;
-    return this.start();
+    throw new Error("OpenCode \u670D\u52A1\u7531\u5916\u90E8\u7BA1\u7406\uFF0CProxy \u4E0D\u652F\u6301\u91CD\u542F");
   }
   async logs() {
-    let log = "";
-    const file = await open4(join5(this.config.stateDirectory, "opencode.log"), "r").catch(() => void 0);
-    if (file) {
-      try {
-        const size = (await file.stat()).size, bytes = Buffer.alloc(Math.min(size, 1e5));
-        await file.read(bytes, 0, bytes.length, Math.max(0, size - bytes.length));
-        log = bytes.toString("utf8");
-      } finally {
-        await file.close();
-      }
-    }
-    const result = log + this.lines.slice(-100).join("\n");
-    return this.password ? result.replaceAll(this.password, "[redacted]") : result;
+    throw new Error("OpenCode \u65E5\u5FD7\u7531\u5916\u90E8\u670D\u52A1\u7BA1\u7406");
+  }
+  detach() {
   }
 };
 
+// src/tools/zcode-env.ts
+import { existsSync } from "node:fs";
+import { dirname as dirname4, join as join5 } from "node:path";
+function zcodeEnvironment(command) {
+  const env = { ...process.env };
+  if (!env.ZCODE_BUILTIN_PROVIDER_CONFIG_FILE) {
+    const bundled = join5(dirname4(command), "..", "config", "provider", "zcode-builtin.json");
+    if (existsSync(bundled)) env.ZCODE_BUILTIN_PROVIDER_CONFIG_FILE = bundled;
+  }
+  return env;
+}
+
 // src/tools/stdio-runtime.ts
-import { spawn as spawn2, execFile as execFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
-import { open as open5 } from "node:fs/promises";
+import { spawn, execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+import { open as open4 } from "node:fs/promises";
 import { join as join6 } from "node:path";
 
 // src/tools/line-rpc.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { crc32 } from "node:zlib";
 import { StringDecoder } from "node:string_decoder";
 function interrupted(message) {
@@ -14820,11 +14797,11 @@ var LineRpc = class {
   }
 };
 function wrapEnvelope(frame) {
-  return { wireVersion: 3, kind: "complete", deliveryKind: "desktop-continuous", logicalFrameId: randomUUID7(), logicalFrameOrdinal: 1, topic: "outbound", subscriptionId: "outbound", frame };
+  return { wireVersion: 3, kind: "complete", deliveryKind: "desktop-continuous", logicalFrameId: randomUUID8(), logicalFrameOrdinal: 1, topic: "outbound", subscriptionId: "outbound", frame };
 }
 
 // src/tools/stdio-runtime.ts
-var run = promisify3(execFile3);
+var run = promisify2(execFile2);
 var StdioRuntime = class {
   constructor(config) {
     this.config = config;
@@ -14842,6 +14819,7 @@ var StdioRuntime = class {
   launching = /* @__PURE__ */ new Map();
   attempts = /* @__PURE__ */ new Map();
   timers = /* @__PURE__ */ new Map();
+  refreshing = /* @__PURE__ */ new Set();
   wanted = false;
   detached = false;
   async init() {
@@ -14873,10 +14851,22 @@ var StdioRuntime = class {
     await Promise.allSettled(this.config.projects.map((project) => this.track(project.id, project.directory)));
     return this.status();
   }
+  async reconnectProject(projectId) {
+    const child = this.children.get(projectId);
+    if (!child) return;
+    this.refreshing.add(projectId);
+    try {
+      const exited = child.exitCode !== null || child.signalCode !== null ? Promise.resolve() : new Promise((resolve4) => child.once("exit", () => resolve4()));
+      this.kill(projectId);
+      await exited;
+    } finally {
+      this.refreshing.delete(projectId);
+    }
+  }
   async logs() {
     const chunks = [];
     for (const [projectId, logPath] of this.logPaths) {
-      const file = await open5(logPath, "r").catch(() => void 0);
+      const file = await open4(logPath, "r").catch(() => void 0);
       if (!file) continue;
       try {
         const size = (await file.stat()).size, bytes = Buffer.alloc(Math.min(size, 3e4));
@@ -14943,8 +14933,8 @@ ${bytes.toString("utf8")}`);
     if (inFlight) return inFlight;
     const spawnOnce = (async () => {
       const logPath = join6(this.config.stateDirectory, `${this.kind}-${projectId}.log`);
-      const log = await open5(logPath, "a", 384).catch(() => void 0);
-      const child = spawn2(this.config.tool.command, [...this.descriptor.serverArgs], { cwd: directory, env: { ...process.env }, stdio: ["pipe", "pipe", log ? log.fd : "ignore"] });
+      const log = await open4(logPath, "a", 384).catch(() => void 0);
+      const child = spawn(this.config.tool.command, [...this.descriptor.serverArgs], { cwd: directory, env: this.kind === "zcode" ? zcodeEnvironment(this.config.tool.command) : { ...process.env }, stdio: ["pipe", "pipe", log ? log.fd : "ignore"] });
       if (log) child.once("exit", () => {
         void log.close();
       });
@@ -14960,7 +14950,7 @@ ${bytes.toString("utf8")}`);
     return spawnOnce;
   }
   onExited(projectId, _reason) {
-    if (this.detached || !this.wanted) return;
+    if (this.detached || !this.wanted || this.refreshing.has(projectId)) return;
     const attempts = (this.attempts.get(projectId) ?? 0) + 1;
     if (attempts > 5) {
       console.error(`${projectId}: app server exited; retry budget exhausted`);
@@ -15023,9 +15013,10 @@ function unsupportedOperation(kind, operation) {
 }
 
 // src/tools/codex.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 var OPERATIONS = [
   ...DAEMON_OPERATIONS,
+  ...AUTH_OPERATIONS,
   "sessions.list",
   "sessions.create",
   "sessions.get",
@@ -15049,6 +15040,10 @@ var CodexAdapter = class {
     this.emit = emit;
     this.media = new RemoteMedia(workspace, () => uploads.limits.imageBytes);
   }
+  auth = new AuthFlows();
+  authDirty = /* @__PURE__ */ new Set();
+  authReloading = /* @__PURE__ */ new Map();
+  logins = /* @__PURE__ */ new Map();
   media;
   liveTurns = /* @__PURE__ */ new Map();
   approvals = /* @__PURE__ */ new Map();
@@ -15058,10 +15053,36 @@ var CodexAdapter = class {
   supportedOperations() {
     return OPERATIONS;
   }
+  accountChanged(project) {
+    for (const entry of this.runtime.config.projects) if (entry.id !== project) this.authDirty.add(entry.id);
+  }
   async rpc(project) {
     this.workspace.project(project);
+    if (this.authDirty.has(project) && ![...this.activeTurns.keys()].some((id) => this.loadedThreads.get(project)?.has(id))) {
+      let pending = this.authReloading.get(project);
+      if (!pending) {
+        pending = this.runtime.reconnectProject(project).then(() => {
+          this.authDirty.delete(project);
+        }).finally(() => {
+          this.authReloading.delete(project);
+        });
+        this.authReloading.set(project, pending);
+      }
+      await pending;
+    }
     const rpc = await this.runtime.connect(project, {
       onNotification: (method, params) => {
+        if (method === "account/login/completed") {
+          const result = params;
+          if (result.success) this.accountChanged(project);
+          const login = this.logins.get(project);
+          if (login && result.loginId) {
+            if (login.loginId === result.loginId) this.auth.update(project, login.flowId, { status: result.success ? "completed" : "failed", message: result.success ? "\u767B\u5F55\u6210\u529F" : "\u767B\u5F55\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u8BD5" });
+            else if (!login.loginId && login.early.size < 8) login.early.set(result.loginId, result.success === true);
+          }
+          return;
+        }
+        if (method.startsWith("account/")) return;
         if (method === "deprecationNotice") return;
         this.trackNotification(project, method, params);
         if (method === "turn/completed") {
@@ -15087,7 +15108,7 @@ var CodexAdapter = class {
   }
   onServerRequest(project, id, method, params, respond) {
     const detail = params ?? {};
-    const requestId = randomUUID8();
+    const requestId = randomUUID9();
     const threadId = String(detail.threadId ?? "");
     if (["item/permissions/requestApproval", "item/commandExecution/requestApproval", "item/fileChange/requestApproval"].includes(method)) {
       this.approvals.set(requestId, { project, method, requestId, threadId, detail, respond });
@@ -15264,6 +15285,7 @@ var CodexAdapter = class {
     await this.rpc(project);
   }
   close() {
+    this.auth.close();
     for (const approval of this.approvals.values()) approval.respond(this.approvalResponse(approval, "reject"));
     for (const input of this.inputs.values()) input.respond({ answers: {} });
     this.approvals.clear();
@@ -15275,8 +15297,47 @@ var CodexAdapter = class {
     if (!project) throw new Error("Project required");
     this.workspace.project(project);
     const op = command.operation, p = command.payload, id = command.sessionId;
+    if (op === "auth.poll") return this.auth.poll(project, p);
+    if (op === "auth.cancel") return this.auth.cancel(project, p.flowId);
     const rpc = await this.rpc(project);
+    if (op === "auth.status") {
+      const result = await rpc.request("account/read", { refreshToken: false });
+      return {
+        status: result.account ? "authenticated" : result.requiresOpenaiAuth ? "unauthenticated" : "notRequired",
+        account: result.account ? { type: result.account.type, email: result.account.email, planType: result.account.planType } : null,
+        methods: [{ id: "chatgptDeviceCode", label: "ChatGPT \u8BBE\u5907\u7801\u767B\u5F55" }, { id: "apiKey", label: "OpenAI API Key", fields: [{ id: "apiKey", label: "API Key", secret: true }] }]
+      };
+    }
+    if (op === "auth.login") {
+      if (!["apiKey", "chatgptDeviceCode"].includes(String(p.method))) throw new Error("\u4E0D\u652F\u6301\u7684 Codex \u767B\u5F55\u65B9\u5F0F");
+      const input = p.input ?? {};
+      if (p.method === "apiKey" && (typeof input.apiKey !== "string" || !input.apiKey.trim())) throw new Error("\u8BF7\u8F93\u5165 API Key");
+      let loginId;
+      const flow = this.auth.create(project, async () => {
+        if (loginId) await rpc.request("account/login/cancel", { loginId });
+      });
+      const login = { flowId: flow.flowId, loginId: void 0, early: /* @__PURE__ */ new Map() };
+      this.logins.set(project, login);
+      void rpc.request("account/login/start", { type: p.method, ...p.method === "apiKey" ? { apiKey: input.apiKey } : {} }).then(async (result) => {
+        if (result.type === "apiKey") this.accountChanged(project);
+        loginId = result.loginId;
+        login.loginId = loginId;
+        if (this.auth.get(project, flow.flowId).state.status === "cancelled") {
+          if (loginId) await rpc.request("account/login/cancel", { loginId });
+          return;
+        }
+        if (loginId && login.early.has(loginId)) {
+          this.auth.update(project, flow.flowId, { status: login.early.get(loginId) ? "completed" : "failed", message: login.early.get(loginId) ? "\u767B\u5F55\u6210\u529F" : "\u767B\u5F55\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u8BD5" });
+          login.early.clear();
+          return;
+        }
+        this.auth.update(project, flow.flowId, result.type === "apiKey" ? { status: "completed", message: "\u8BA4\u8BC1\u4FE1\u606F\u5DF2\u7531 Codex \u4FDD\u5B58" } : { url: result.verificationUrl, code: result.userCode, message: "\u6253\u5F00\u94FE\u63A5\u5E76\u8F93\u5165\u8BBE\u5907\u7801\u5B8C\u6210\u767B\u5F55" });
+      }).catch(() => this.auth.update(project, flow.flowId, { status: "failed", message: "Codex \u767B\u5F55\u5931\u8D25\uFF1B\u8BF7\u68C0\u67E5\u767B\u5F55\u65B9\u5F0F\u662F\u5426\u53D7\u5F53\u524D\u7248\u672C\u53CA\u8D26\u53F7\u652F\u6301" }));
+      return { ...flow };
+    }
     if (op === "configuration.models") {
+      const account = await rpc.request("account/read", { refreshToken: false });
+      if (!account.account && account.requiresOpenaiAuth) return { providers: [] };
       const models = [];
       let cursor = null;
       const seenCursors = /* @__PURE__ */ new Set();
@@ -15416,10 +15477,13 @@ var CodexAdapter = class {
 };
 
 // src/tools/zcode.ts
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { randomUUID as randomUUID10 } from "node:crypto";
 import { realpath as realpath5 } from "node:fs/promises";
 var OPERATIONS2 = [
   ...DAEMON_OPERATIONS,
+  ...AUTH_OPERATIONS,
+  "configuration.models",
   "sessions.list",
   "sessions.create",
   "sessions.get",
@@ -15442,6 +15506,7 @@ var ZcodeAdapter = class {
     this.emit = emit;
     this.media = new RemoteMedia(workspace, () => uploads.limits.imageBytes);
   }
+  auth = new AuthFlows();
   media;
   permissions = /* @__PURE__ */ new Map();
   inputs = /* @__PURE__ */ new Map();
@@ -15468,7 +15533,7 @@ var ZcodeAdapter = class {
   }
   onServerRequest(project, id, method, params, respond, respondError) {
     const detail = params ?? {};
-    const requestId = randomUUID9();
+    const requestId = randomUUID10();
     const sessionId = String(detail.sessionId ?? "");
     if (method === "session/requestRuntimePreferences") {
       respond({ nativeSearchEnhancementsEnabled: false });
@@ -15569,6 +15634,7 @@ var ZcodeAdapter = class {
     await this.rpc(project);
   }
   close() {
+    this.auth.close();
     for (const entry of this.permissions.values()) entry.respond({ decision: "deny" });
     for (const entry of this.inputs.values()) entry.respond({ action: "decline" });
     this.permissions.clear();
@@ -15579,7 +15645,54 @@ var ZcodeAdapter = class {
     if (!project) throw new Error("Project required");
     this.workspace.project(project);
     const op = command.operation, p = command.payload, id = command.sessionId;
+    if (op === "auth.poll") return this.auth.poll(project, p);
+    if (op === "auth.cancel") return this.auth.cancel(project, p.flowId);
     const rpc = await this.rpc(project);
+    if (op === "configuration.models" || op === "auth.status") {
+      const snapshot = await rpc.request("session/create", { workspace: await this.workspaceRef(project), persistence: "deferred", titleGenerationEnabled: false, toolAllowlist: [] });
+      try {
+        const model = snapshot.settings.model;
+        if (op === "auth.status") return { status: model.available.length ? "authenticated" : "unauthenticated", message: model.available.length ? "ZCode \u5DF2\u914D\u7F6E\u53EF\u7528\u6A21\u578B\uFF08\u51ED\u636E\u6709\u6548\u6027\u7531\u5DE5\u5177\u5728\u8C03\u7528\u65F6\u68C0\u67E5\uFF09" : "ZCode \u672A\u914D\u7F6E\u53EF\u7528\u6A21\u578B", methods: [{ id: "zai", label: "Z.AI \u6D4F\u89C8\u5668\u767B\u5F55" }] };
+        const providers = /* @__PURE__ */ new Map();
+        for (const entry of model.available) {
+          const provider = providers.get(entry.ref.providerId) ?? { id: entry.ref.providerId, name: entry.providerLabel, models: /* @__PURE__ */ Object.create(null) };
+          provider.models[entry.ref.modelId] = { id: entry.ref.modelId, name: entry.label, isDefault: entry.ref.providerId === model.current?.providerId && entry.ref.modelId === model.current?.modelId };
+          providers.set(provider.id, provider);
+        }
+        return { providers: [...providers.values()] };
+      } finally {
+        await rpc.request("session/close", { sessionId: snapshot.session.sessionId, expectedPersistence: "deferred" });
+      }
+    }
+    if (op === "auth.login") {
+      if (p.method !== "zai") throw new Error("\u4E0D\u652F\u6301\u7684 ZCode \u767B\u5F55\u65B9\u5F0F");
+      let child;
+      const flow = this.auth.create(project, () => {
+        child?.kill("SIGTERM");
+      });
+      child = spawn2(this.runtime.config.tool.command, ["login", "--no-browser", "--json"], { cwd: await this.workspace.root(project), env: zcodeEnvironment(this.runtime.config.tool.command), stdio: ["ignore", "pipe", "pipe"] });
+      let output = "", diagnostic = "";
+      child.stdout?.on("data", (data) => {
+        output = (output + data.toString()).slice(-65536);
+      });
+      child.stderr?.on("data", (data) => {
+        diagnostic = (diagnostic + data.toString()).slice(-8192);
+        const match = /Open this URL to sign in:\s*(https?:\/\/[^\s]+)/.exec(diagnostic);
+        if (match) this.auth.update(project, flow.flowId, { url: match[1], message: "\u5728\u6D4F\u89C8\u5668\u5B8C\u6210 Z.AI \u6388\u6743\uFF0CZCode \u5C06\u81EA\u884C\u4FDD\u5B58\u8BA4\u8BC1\u4FE1\u606F" });
+      });
+      child.once("error", () => this.auth.update(project, flow.flowId, { status: "failed", message: "\u65E0\u6CD5\u542F\u52A8 ZCode \u539F\u751F\u767B\u5F55" }));
+      child.once("exit", (code) => {
+        let ready = false;
+        try {
+          ready = JSON.parse(output).status === "ready";
+        } catch {
+        }
+        output = "";
+        diagnostic = "";
+        this.auth.update(project, flow.flowId, { status: code === 0 && ready ? "completed" : "failed", message: code === 0 && ready ? "ZCode \u767B\u5F55\u6210\u529F" : "ZCode \u767B\u5F55\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u8BD5" });
+      });
+      return { ...flow };
+    }
     if (op === "sessions.list") {
       const result = await rpc.request("session/list", { workspace: await this.workspaceRef(project) });
       return (result.sessions ?? []).map((session) => this.sessionProjection(session));
@@ -15618,6 +15731,8 @@ var ZcodeAdapter = class {
         lines.push(`Attached file: ${upload.destination} (${upload.name}, ${upload.mime}). Read this file if relevant to the task.`);
       }
       if (!lines.length) throw new Error("Message or attachments required");
+      const selected = p.model;
+      if (selected?.providerID && selected.modelID) await rpc.request("session/setModel", { sessionId: id, model: { providerId: selected.providerID, modelId: selected.modelID } });
       return await rpc.request("session/send", { sessionId: id, content: lines.join("\n") });
     }
     if (op === "sessions.abort") {
@@ -15693,9 +15808,9 @@ var ZcodeAdapter = class {
 };
 
 // src/tools/pi.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import { readFile as readFile5, readdir as readdir3, rm } from "node:fs/promises";
-import { dirname as dirname4 } from "node:path";
+import { dirname as dirname5 } from "node:path";
 var OPERATIONS3 = [
   ...DAEMON_OPERATIONS,
   "sessions.list",
@@ -15706,6 +15821,7 @@ var OPERATIONS3 = [
   "sessions.prompt",
   "sessions.abort",
   "sessions.delete",
+  "auth.status",
   "configuration.models",
   "permissions.list",
   "questions.list",
@@ -15787,7 +15903,7 @@ var PiAdapter = class {
   }
   onQuestion(project, sessionId, detail) {
     if (!["select", "confirm", "input", "editor"].includes(String(detail.method))) return;
-    const id = randomUUID10();
+    const id = randomUUID11();
     void this.rpc(project, sessionId).then((rpc) => {
       if (rpc.exited) return;
       const question = { id, project, sessionId, detail, rpc };
@@ -15866,6 +15982,11 @@ var PiAdapter = class {
   async execute(command, project) {
     const op = command.operation, p = command.payload, id = command.sessionId;
     if (!OPERATIONS3.includes(op)) unsupportedOperation("pi", op);
+    if (op === "auth.status") {
+      const rpc2 = await this.runtime.connect(project);
+      const result = await rpc2.request("get_available_models");
+      return { status: result.models.length ? "authenticated" : "unknown", methods: [], message: result.models.length ? "Pi \u5DF2\u914D\u7F6E\u53EF\u7528\u6A21\u578B" : "Pi RPC \u672A\u63D0\u4F9B\u8FDC\u7A0B\u767B\u5F55\u63A5\u53E3\uFF1B\u8BF7\u5728\u4E3B\u673A\u4F7F\u7528 Pi \u539F\u751F\u767B\u5F55\u540E\u5237\u65B0" };
+    }
     if (op === "configuration.models") {
       const rpc2 = await this.runtime.connect(project);
       const { models } = await rpc2.request("get_available_models");
@@ -15878,7 +15999,7 @@ var PiAdapter = class {
       return { providers: [...providers.values()] };
     }
     if (op === "sessions.list") {
-      const directory = dirname4(this.metadataPath(project, "00000000-0000-0000-0000-000000000000"));
+      const directory = dirname5(this.metadataPath(project, "00000000-0000-0000-0000-000000000000"));
       const files = await readdir3(directory).catch((error) => {
         if (error.code === "ENOENT") return [];
         throw error;
@@ -15887,7 +16008,7 @@ var PiAdapter = class {
       return sessions.sort((a, b) => b.time.updated - a.time.updated);
     }
     if (op === "sessions.create") {
-      const session2 = { id: randomUUID10(), title: typeof p.title === "string" && p.title.trim() ? p.title : "\u65B0\u4EFB\u52A1", directory: await this.workspace.root(project), time: { created: Date.now(), updated: Date.now() } };
+      const session2 = { id: randomUUID11(), title: typeof p.title === "string" && p.title.trim() ? p.title : "\u65B0\u4EFB\u52A1", directory: await this.workspace.root(project), time: { created: Date.now(), updated: Date.now() } };
       try {
         const rpc2 = await this.rpc(project, session2.id);
         await rpc2.request("set_session_name", { name: session2.title });
@@ -15985,11 +16106,11 @@ var PiAdapter = class {
 };
 
 // src/tools/pi-runtime.ts
-import { execFile as execFile4, spawn as spawn3 } from "node:child_process";
-import { mkdir as mkdir4, open as open6 } from "node:fs/promises";
+import { execFile as execFile3, spawn as spawn3 } from "node:child_process";
+import { mkdir as mkdir4, open as open5 } from "node:fs/promises";
 import { join as join8 } from "node:path";
-import { promisify as promisify4 } from "node:util";
-var run2 = promisify4(execFile4);
+import { promisify as promisify3 } from "node:util";
+var run2 = promisify3(execFile3);
 var PiRuntime = class {
   constructor(config) {
     this.config = config;
@@ -16049,7 +16170,7 @@ var PiRuntime = class {
   async logs() {
     const chunks = [];
     for (const path of this.logPaths) {
-      const file = await open6(path, "r").catch(() => void 0);
+      const file = await open5(path, "r").catch(() => void 0);
       if (!file) continue;
       try {
         const size = (await file.stat()).size, bytes = Buffer.alloc(Math.min(size, 3e4));
@@ -16098,7 +16219,7 @@ ${bytes.toString("utf8")}`);
     const directory = this.project(projectId).directory;
     await mkdir4(join8(this.config.stateDirectory, "pi-sessions", projectId), { recursive: true, mode: 448 });
     const logPath = join8(this.config.stateDirectory, `pi-${key}.log`);
-    const log = await open6(logPath, "a", 384);
+    const log = await open5(logPath, "a", 384);
     if (generation !== this.generation) {
       await log.close();
       throw new Error("Pi runtime stopped during startup");
@@ -16163,7 +16284,7 @@ async function runDaemon(configPath) {
   const config = await loadConfig(configPath);
   await mkdir5(config.stateDirectory, { recursive: true, mode: 448 });
   const workspace = new Workspace(config.projects), runtime = createRuntime(config), uploads = new Uploads(workspace, join9(config.stateDirectory, "uploads")), journal = new Journal(join9(config.stateDirectory, "journal"));
-  const epoch = randomUUID11();
+  const epoch = randomUUID12();
   let stopping = false, botId = "";
   const sockets = /* @__PURE__ */ new Set();
   const events = new EventStream(epoch, () => {
@@ -16174,6 +16295,7 @@ async function runDaemon(configPath) {
   }
   const adapter = createAdapter(runtime, workspace, uploads, emit), artifacts = new Artifacts(workspace, join9(config.stateDirectory, "artifacts"), emit);
   async function dispatch(c) {
+    if (!adapter.supportedOperations().includes(c.operation)) throw new Error(`Unsupported ${runtime.kind} operation: ${c.operation}`);
     const p = c.payload;
     if (c.operation === "runtime.status") return { ...await runtime.status(), capabilities: adapter.supportedOperations() };
     if (c.operation === "runtime.snapshot") return buildProxySnapshot(config, runtime, adapter, c.projectId);
@@ -16303,6 +16425,10 @@ export {
   describeTool,
   ConfigError,
   loadConfig,
+  Workspace,
   atomicJson,
+  Uploads,
+  createRuntime,
+  createAdapter,
   runDaemon
 };

package/dist/cli.js

@@ -4,7 +4,11 @@ import {
   SERVICE_LABEL,
   SYSTEMD_UNIT,
   TOOL_KINDS,
+  Uploads,
+  Workspace,
   atomicJson,
+  createAdapter,
+  createRuntime,
   daemonEntryPath,
   defaultStateDirectory,
   describeTool,
@@ -17,7 +21,7 @@ import {
   runDaemon,
   supportedPlatform,
   systemdUnitPath
-} from "./chunk-2SGNDVCO.js";
+} from "./chunk-AGWRSSBQ.js";
 
 // src/cli.ts
 import { spawn } from "node:child_process";
@@ -27,7 +31,6 @@ import { access as access4 } from "node:fs/promises";
 // src/doctor.ts
 import { access as access2, chmod, constants, mkdir as mkdir3, stat as stat2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute2, join as join2 } from "node:path";
-import { homedir as homedir2 } from "node:os";
 import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
 
@@ -140,7 +143,12 @@ async function launchdStop() {
   await ignoreMissing(() => run2("launchctl", ["bootout", `${guiDomain()}/${SERVICE_LABEL}`]));
 }
 async function launchdRestart() {
-  await launchdLoad();
+  const target = `${guiDomain()}/${SERVICE_LABEL}`;
+  if ((await launchdStatus()).loaded) {
+    await run2("launchctl", ["kickstart", "-k", target]);
+  } else {
+    await run2("launchctl", ["bootstrap", guiDomain(), launchdPlistPath()]);
+  }
 }
 async function launchdUninstall() {
   await launchdStop();
@@ -322,6 +330,7 @@ function logLocationHint() {
 }
 
 // src/doctor.ts
+import { randomUUID } from "node:crypto";
 var run4 = promisify4(execFile4);
 async function runDoctor(opts) {
   const results = [];
@@ -354,7 +363,9 @@ async function runDoctor(opts) {
     const descriptor = describeTool(config.tool.kind);
     const checkName = `${descriptor.label} \u547D\u4EE4`;
     const command2 = config.tool.command;
-    if (!isAbsolute2(command2)) {
+    if (config.tool.kind === "opencode") {
+      record(checkName, "ok", "external \u6A21\u5F0F\u901A\u8FC7 HTTP \u68C0\u67E5\u670D\u52A1\uFF0C\u4E0D\u9700\u8981 Proxy \u6267\u884C OpenCode \u547D\u4EE4");
+    } else if (!isAbsolute2(command2)) {
       record(checkName, "warn", `\u5F53\u524D\u4E3A\u300C${command2}\u300D\uFF0C\u4F9D\u8D56 PATH \u67E5\u627E\uFF1B\u670D\u52A1\u73AF\u5883\u5EFA\u8BAE\u6539\u7528\u7EDD\u5BF9\u8DEF\u5F84\uFF08\u91CD\u65B0\u8FD0\u884C onboard \u6216\u624B\u5DE5\u4FEE\u6539\u914D\u7F6E\uFF09`);
     } else if (!await access2(command2, constants.X_OK).then(() => true, () => false)) {
       record(checkName, "fail", `${command2} \u4E0D\u5B58\u5728\u6216\u4E0D\u53EF\u6267\u884C`);
@@ -363,22 +374,29 @@ async function runDoctor(opts) {
         const { stdout: stdout2 } = await run4(command2, [...descriptor.versionArgs], { timeout: 15e3 });
         const version = stdout2.trim().split("\n")[0].trim();
         if (version === descriptor.baseline) record(checkName, "ok", `${command2}\uFF08${version}\uFF09`);
-        else if (descriptor.versionPolicy === "exact") record(checkName, "warn", `${command2} \u7248\u672C\u4E3A ${version}\uFF0C\u5DF2\u9A8C\u8BC1\u57FA\u7EBF\u662F ${descriptor.baseline}\uFF08\u4EE3\u7406\u4F1A\u62D2\u7EDD\u6258\u7BA1\u8BE5\u7248\u672C\uFF09`);
+        else if (descriptor.versionPolicy === "exact") record(checkName, "warn", `${command2} \u7248\u672C\u4E3A ${version}\uFF0C\u5DF2\u9A8C\u8BC1\u57FA\u7EBF\u662F ${descriptor.baseline}\uFF08\u8BF7\u786E\u8BA4\u5916\u90E8\u670D\u52A1 API \u517C\u5BB9\uFF09`);
         else record(checkName, "warn", `${command2} \u7248\u672C\u4E3A ${version}\uFF0C\u5DF2\u9A8C\u8BC1\u57FA\u7EBF\u662F ${descriptor.baseline}\uFF1Bapp-server \u534F\u8BAE\u53EF\u80FD\u6F02\u79FB`);
       } catch (error) {
         record(checkName, "warn", `\u6267\u884C ${command2} ${descriptor.versionArgs.join(" ")} \u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}`);
       }
-      if (config.tool.kind === "codex") {
-        try {
-          await run4(command2, ["login", "status"], { timeout: 15e3 });
-        } catch {
-          record("Codex \u767B\u5F55", "warn", "codex login status \u672A\u901A\u8FC7\uFF1B\u65E0\u5934\u4E3B\u673A\u8BF7\u5148\u5B8C\u6210 codex \u767B\u5F55\uFF08--with-api-key \u6216\u590D\u5236 auth.json\uFF09");
-        }
-      }
-      if (config.tool.kind === "zcode") {
-        const credentials = join2(homedir2(), ".zcode", "v2", "credentials.json");
-        if (!await access2(credentials).then(() => true, () => false)) record("ZCode \u767B\u5F55", "warn", `\u672A\u627E\u5230 ${credentials}\uFF1B\u8BF7\u5148\u5728\u8BE5\u4E3B\u673A\u5B8C\u6210 zcode login`);
-      }
+    }
+  }
+  if (config) {
+    const probeConfig = { ...config, tool: { ...config.tool, autoStart: false } };
+    const runtime = createRuntime(probeConfig), workspace = new Workspace(config.projects);
+    const adapter = createAdapter(runtime, workspace, new Uploads(workspace, join2(config.stateDirectory, "uploads")), () => {
+    });
+    try {
+      await runtime.init();
+      const result = await adapter.dispatch({ type: "command", id: randomUUID(), botId: config.botId, projectId: config.projects[0].id, operation: "auth.status", payload: {} });
+      const ready = ["authenticated", "notRequired"].includes(result.status);
+      record("\u7F16\u7801\u5DE5\u5177\u8D26\u53F7", ready ? "ok" : "warn", result.message ?? (ready ? "\u539F\u751F\u5DE5\u5177\u5DF2\u914D\u7F6E\u8D26\u53F7\u6216\u65E0\u9700\u8BA4\u8BC1" : "\u539F\u751F\u5DE5\u5177\u672A\u767B\u5F55\uFF1B\u53EF\u5728 Claw \u7684\u201C\u7F16\u7801\u5DE5\u5177\u8D26\u53F7\u201D\u4E2D\u767B\u5F55"));
+    } catch {
+      record("\u7F16\u7801\u5DE5\u5177\u8D26\u53F7", "warn", "\u65E0\u6CD5\u83B7\u53D6\u539F\u751F\u767B\u5F55\u72B6\u6001\uFF1B\u8BF7\u68C0\u67E5\u5DE5\u5177\u670D\u52A1\u3001\u7248\u672C\u4E0E\u914D\u7F6E\uFF0C\u518D\u5728 Claw \u4E2D\u91CD\u8BD5");
+    } finally {
+      adapter.close();
+      if (config.tool.kind !== "opencode") await runtime.stop();
+      runtime.detach();
     }
   }
   try {
@@ -489,7 +507,7 @@ async function runOnboard(opts) {
   let hubUrl = opts.hubUrl || existing?.hubUrl || DEFAULT_HUB_URL, botId = opts.botId ?? existing?.botId ?? "", secretKey = opts.secretKey ?? existing?.secretKey ?? "", stateDirectory = opts.stateDirectory ?? existing?.stateDirectory ?? defaultStateDirectory();
   let toolKind = opts.toolKind ?? existing?.tool.kind ?? "opencode";
   let toolCommand = opts.toolCommand ?? (toolKind === existing?.tool.kind ? existing.tool.command : "");
-  let mode = toolKind === existing?.tool.kind ? existing.tool.mode : "managed";
+  let baseUrl = existing?.tool.kind === "opencode" ? existing.tool.baseUrl : "http://127.0.0.1:4096";
   let projects = [...existing?.projects ?? [], ...opts.projects].map((project) => ({ ...project, directory: expandHome(project.directory) }));
   if (opts.interactive) {
     const rl = createInterface({ input: stdin, output: stdout });
@@ -506,9 +524,21 @@ async function runOnboard(opts) {
     const descriptor = describeTool(toolKind);
     const found = await resolveCommandOnPath(toolKind, toolSearchDirs(toolKind));
     const example = platform2() === "darwin" ? MACOS_TOOL_EXAMPLES[toolKind] : void 0;
-    toolCommand = expandHome(await ask(rl, found ? `${descriptor.label} \u547D\u4EE4\uFF08\u63A2\u6D4B\u5230 ${found}\uFF1B\u56DE\u8F66\u4F1A\u9A8C\u8BC1\uFF09` : `${descriptor.label} \u547D\u4EE4\uFF08\u56DE\u8F66\u4F1A\u9A8C\u8BC1\u8DEF\u5F84\uFF09`, { default: toolCommand || found || example, validate: (value) => validateToolCommand(value, toolKind) }));
-    console.log(`  \u5DF2\u786E\u8BA4 ${descriptor.label} \u547D\u4EE4\u53EF\u6267\u884C\uFF1A${toolCommand}`);
-    if (toolKind === "opencode") mode = await ask(rl, "OpenCode \u6A21\u5F0F\uFF08managed=\u7531\u4EE3\u7406\u6258\u7BA1\u542F\u52A8\uFF0Cexternal=\u4EC5\u8FDE\u63A5\u5DF2\u6709\u670D\u52A1\uFF09", { default: mode, validate: (value) => value === "managed" || value === "external" ? void 0 : "\u8F93\u5165 managed \u6216 external" });
+    if (toolKind === "opencode") {
+      toolCommand = toolCommand || found || "opencode";
+      console.log("  OpenCode \u7531\u5916\u90E8\u7BA1\u7406\uFF1B\u8BF7\u5728\u8BE5\u4E3B\u673A\u9884\u5148\u542F\u52A8 opencode serve\u3002");
+      baseUrl = await ask(rl, "OpenCode \u670D\u52A1\u5730\u5740", { default: baseUrl || "http://127.0.0.1:4096", validate: (value) => {
+        try {
+          const url = new URL(value);
+          return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname) ? void 0 : "\u8BF7\u8F93\u5165 HTTP loopback \u5730\u5740\uFF0C\u4F8B\u5982 http://127.0.0.1:4096";
+        } catch {
+          return "\u8BF7\u8F93\u5165\u6709\u6548 URL";
+        }
+      } });
+    } else {
+      toolCommand = expandHome(await ask(rl, `${descriptor.label} \u547D\u4EE4\uFF08\u56DE\u8F66\u4F1A\u9A8C\u8BC1\u8DEF\u5F84\uFF09`, { default: toolCommand || found || example, validate: (value) => validateToolCommand(value, toolKind) }));
+      console.log(`  \u5DF2\u786E\u8BA4 ${descriptor.label} \u547D\u4EE4\u53EF\u6267\u884C\uFF1A${toolCommand}`);
+    }
     if (projects.length) console.log("\n\u5DF2\u6709\u6388\u6743\u9879\u76EE\uFF08\u76F4\u63A5\u56DE\u8F66\u4FDD\u7559\u5404\u9879\uFF09\uFF1A");
     for (const [index, project] of projects.entries()) {
       project.name = await ask(rl, "  \u9879\u76EE\u540D\u79F0", { default: project.name });
@@ -597,7 +627,7 @@ async function runOnboard(opts) {
     stateDirectory,
     ...loopbackHttp ? { allowInsecureLocalhost: true } : {},
     projects: projects.map((project) => ({ id: project.id, name: project.name, directory: project.directory, specDirectories: project.specDirectories ?? ["specs", "docs"] })),
-    tool: { kind: toolKind, command: toolCommand || describeTool(toolKind).defaultCommand, ...toolKind === "opencode" ? { baseUrl: toolKind === existing?.tool.kind ? existing.tool.baseUrl : "http://127.0.0.1:4096", mode } : {}, ...toolKind === existing?.tool.kind && existing.tool.password ? { password: existing.tool.password } : {}, autoStart: toolKind === existing?.tool.kind ? existing.tool.autoStart : true }
+    tool: { kind: toolKind, command: toolCommand || describeTool(toolKind).defaultCommand, ...toolKind === "opencode" ? { baseUrl, mode: "external" } : {}, ...toolKind === existing?.tool.kind && existing.tool.password ? { password: existing.tool.password } : {}, ...toolKind === "opencode" ? {} : { autoStart: toolKind === existing?.tool.kind ? existing.tool.autoStart : true } }
   });
   await loadConfig(opts.configPath);
   console.log(`\u5DF2\u5199\u5165\u914D\u7F6E\uFF1A${opts.configPath}\uFF080600\uFF09`);
@@ -626,7 +656,7 @@ async function runOnboard(opts) {
 }
 
 // src/projects-command.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { readFile as readFile2, writeFile as writeFile3 } from "node:fs/promises";
 function asConfig(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value) || !Array.isArray(value.projects)) {
@@ -653,7 +683,7 @@ async function manageProjects(configPath2, remove) {
   const index = Number(remove) - 1;
   if (!Number.isSafeInteger(index) || index >= config.projects.length) throw new Error(`\u9879\u76EE\u5E8F\u53F7\u8D85\u51FA\u8303\u56F4\uFF1A${remove}`);
   if (config.projects.length === 1) throw new Error("\u81F3\u5C11\u9700\u8981\u4FDD\u7559\u4E00\u4E2A\u6388\u6743\u9879\u76EE\uFF1B\u65E0\u6CD5\u5220\u9664\u6700\u540E\u4E00\u9879");
-  const backupPath = `${configPath2}.backup-${randomUUID()}`;
+  const backupPath = `${configPath2}.backup-${randomUUID2()}`;
   await writeFile3(backupPath, original, { mode: 384, flag: "wx" });
   config.projects.splice(index, 1);
   await atomicJson(configPath2, config);

package/dist/main.js

@@ -2,7 +2,7 @@
 import {
   ConfigError,
   runDaemon
-} from "./chunk-2SGNDVCO.js";
+} from "./chunk-AGWRSSBQ.js";
 
 // src/main.ts
 runDaemon(process.env.OCTOPUS_PROXY_CONFIG ?? "proxy.json").catch((error) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skylandnpm/octopus-proxy",
-  "version": "0.1.8",
+  "version": "0.1.12",
   "type": "module",
   "description": "Octopus host proxy: OpenCode, Codex, ZCode and Pi adapters with service installer CLI",
   "bin": {

package/proxy.example.json

@@ -4,5 +4,5 @@
   "botId": "00000000-0000-4000-8000-000000000000",
   "stateDirectory": "/home/developer/.local/state/octopus",
   "projects": [{ "id": "example", "name": "Example project", "directory": "/home/developer/projects/example", "specDirectories": ["specs", "docs"] }],
-  "tool": { "kind": "opencode", "command": "/usr/local/bin/opencode", "baseUrl": "http://127.0.0.1:4096", "mode": "managed", "autoStart": true }
+  "tool": { "kind": "opencode", "command": "/usr/local/bin/opencode", "baseUrl": "http://127.0.0.1:4096", "mode": "external" }
 }