@tangle-network/cli-agent-registry 0.0.0-stage → 0.14.0

package/LICENSE

@@ -0,0 +1,11 @@
+Copyright (c) 2025 Tangle Network
+
+All rights reserved.
+
+This software and associated documentation files (the "Software") are proprietary
+and confidential. No part of this Software may be reproduced, distributed, or
+transmitted in any form or by any means, including photocopying, recording, or
+other electronic or mechanical methods, without the prior written permission of
+Tangle Network.
+
+For licensing inquiries, contact: hello@tangle.tools

package/README.md

@@ -1,3 +1,146 @@
-# Temporary Holding Version
+# @tangle-network/cli-agent-registry
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+CLI harness descriptors, capabilities, model wiring, and local credential discovery.
+Use the narrowest entrypoint for the runtime:
+
+```ts
+import { getSpec } from "@tangle-network/cli-agent-registry/specs";
+import {
+  describeLocalCliAuthExpectation,
+  discoverLocalCliAuthFiles,
+} from "@tangle-network/cli-agent-registry/local-cli-auth";
+```
+
+`/specs` and `/backend-types` are browser-safe. `/local-cli-auth` reads the host
+filesystem and is Node-only. Workspace consumers use the same built declarations
+as published consumers; build the registry before checking or bundling a consumer.
+
+Credential discovery follows `CODEX_HOME`, `CLAUDE_CONFIG_DIR` and Claude's
+`CLAUDE_SECURESTORAGE_CONFIG_DIR`; secure storage does not move settings files.
+Pass `{ credentialOnly: true }` to read only the native credential file, without
+settings. An explicit `homeDir` isolates discovery from ambient environment
+overrides unless `env` is also supplied. Returned contents are sensitive raw files,
+not proof of a valid OAuth subscription. Callers own consent and native login
+validation before enrollment. This filesystem reader does not read macOS Keychain.
+
+## Identity, availability and implementation
+
+Interface describes recognized identities, including historical ones. This
+installation declares its backend vocabulary positively; importing it must not
+require every harness subsequently recognized by Interface. `BackendType` derives
+from the local declaration. Accepted IDs are unchanged. Removing an executable
+must not invalidate saved identities.
+
+`createAdapterRegistry(selectedSpecs)` owns an independent factory map and snapshots
+its wiring requirements. Each selected executable descriptor requires a factory and
+its native-session contract (or the existing explicit unsupported classification).
+Duplicate descriptors and duplicate factory registration fail; the explicit test
+override remains. Later descriptor mutation cannot weaken those requirements.
+
+Existing module-level methods use a default registry over `CLI_AGENT_SPECS`, so
+current consumers retain their requirements. Registration does not authorize execution:
+callers must resolve an admitted descriptor and enforce capabilities. Unregistering a
+selected factory still fails startup; it is not a way to drain live sessions. The
+sidecar's all-provider import composition still needs a selected deployment manifest.
+
+## Adapter-owned profile semantics
+
+`CliProviderAdapterBase` no longer guesses native profile behavior from a storage
+path or owns Pi's private instruction-directory calculation. A subclass explicitly
+supplies `profileHarness` and, when needed, `profileAgentDirectory`. Claude Code,
+Codex, OpenCode, Kimi, NanoClaw, Pi, Hermes and OpenClaw declare their existing
+profile semantics; Pi resolves its own native private directory.
+
+Custom base subclasses using portable profile lowering must declare their identity.
+Ordinary execution without a profile remains available without this declaration.
+Secret concurrent-profile revisions and managed quotes are separate trusted
+implementation capabilities: OpenCode explicitly opts into the existing transports.
+Neither a caller's config key nor the provider name grants them. Native-session,
+private-root, secret-handling and budget checks remain in place.
+
+### System laws
+
+- `tests/adapter-removal.contract.test.ts`: selected descriptors require factories,
+  omitted descriptors do not, registries are isolated, duplicate descriptors fail,
+  and mutation cannot change the captured requirements.
+- `../sdk-provider-cli-base/tests/profile-ownership-process.test.ts`: a real Node
+  child observes materialized profiles and private instruction placement; unsupported
+  profiles fail before spawn; ordinary execution needs no implicit profile support;
+  names/config keys do not grant managed quotes. Node is a process fixture, not a
+  claimed substitute for a native coding harness.
+- Native conformance is separately bound to pinned CLI versions, declared session
+  contracts and adapter/shared-runner source. Stale receipts fail; never edit their
+  hashes to manufacture proof.
+
+## Executed validation
+
+Foundation proof: Actions **38684058864**, artifact **11948704158**, commit
+`64bb4f84358990dbd85d64aaf97eb73985f0a964`. Affected builds/typechecks passed;
+**122 registry tests and 355 runtime-contract tests passed**.
+
+Expanded proof: Actions **38687071248**, artifact **11950383351**, commit
+`559f2550daa698ddb648ec6470aec477aff84a71`:
+
+- The sidecar dependency closure builds.
+- All provider packages and the registry pass typechecking.
+- All 14 provider suites plus the shared base pass: **1,502 tests**, with 65 skipped.
+- Runtime-contract tests: **355 passed**.
+- Registry: **121 passed, 1 failed**. The failure correctly names four stale native
+  receipts after the shared-base change: Claude Code, Codex, OpenCode and Pi.
+
+### Native qualification: not passed
+
+Two native attempts built the pinned CLI image, then failed connecting to the local
+Sandbox shim before any harness execution. No fresh passing receipt was produced.
+
+- Actions **38687071248**, artifact **11950938690**, source
+  `559f2550daa698ddb648ec6470aec477aff84a71`: fetch failure, exit 1; owned-container
+  cleanup passed.
+- Actions **38688402352**, artifact **11951190503**, source
+  `d640034db5ee590c9851daa0049c32d6a3e4c160`: the same attempt with bounded transport
+  cause diagnostics reports `UND_ERR_CONNECT_TIMEOUT` for all four requests.
+  Exit 1; owned-container cleanup passed. Only test-driver diagnostics changed.
+- Actions **38688973460**, artifact **11951770808**: an isolated network diagnostic
+  confirms that the Docker bridge gateway is not a local address in the runner's
+  network namespace. The runner's own loopback server answers, but the gateway
+  probes do not. No proxy environment is involved. A successful diagnostic job is
+  not a successful native qualification.
+
+The driver assumes that its host-side shim and Docker bridge share a reachable
+network context. This runner does not satisfy that assumption. Co-locate the test
+services with the Docker network and expose the client endpoint explicitly, or use
+an appropriate co-located runner, before repeating native qualification. Do not
+weaken TLS, network isolation, receipt checks or production controls to force a pass.
+All temporary branch-only proof/diagnostic workflows were removed after these runs.
+No production endpoint or real model was used. Later documentation and workflow
+cleanup commits are not retroactively included in the source commits named above.
+
+## Exact remaining work
+
+- [ ] Repair the native proof's runner/network topology; obtain genuine passing
+      receipts for the changed runner; rerun the registry/invariant gate.
+- [ ] Select sidecar implementation imports, API catalog admission and image/CLI
+      dependencies from one explicit deployment manifest. Registry omission is not
+      physical package or executable removal.
+- [ ] Supply real start/resume availability to app admission and pickers; preserve
+      old IDs/history; do not pre-coerce saved or explicit requested IDs.
+- [ ] Consolidate remaining per-harness profile/MCP/hooks, auth, invocation, session
+      and packaging facts with their owners. Replace the app's duplicated profile
+      support table. Common-base inference removal is done, not this entire step.
+- [ ] Declare ACP's selected backing dependency, including its current Hermes
+      default; reject missing/retired backings before launch while preserving the
+      closed command allowlist and credential isolation.
+- [ ] Consolidate agent-runtime's local invocation and native usage readers with
+      their owners; keep historical codecs usable without installed executables.
+- [ ] Physically omit each adapter package/CLI in turn and prove remaining startup,
+      cancellation/resume, readable history and secret isolation.
+- [ ] Complete sidecar typecheck and real HTTP/UI/packed-consumer coverage for the
+      selected catalog; update the maintained owner/roadmap indexes.
+- [ ] Independent review, final-head checks, merge, package publication/cohort
+      adoption and authorized served verification through maintained automation.
+
+Continue the same PRs: agent-container **#10961**, agent-sdk **#498**, agent-app
+**#1116**. Their documents retain the executed evidence and remaining adoption.
+Agent-runtime and Braid have no implementation PR from this attempt; change Braid
+only where shared-contract adoption requires it. No production harness is retired
+merely because its implementation was refactored.

package/dist/backend-types-CJH-wHS3.d.mts

@@ -0,0 +1,56 @@
+import { z } from "zod";
+
+//#region ../runtime-contracts/dist/backend-types.d.ts
+/**
+ * This distribution's backend vocabulary, declared positively. The shared
+ * Interface vocabulary also contains historical and differently hosted harnesses;
+ * knowing one upstream must not require installing it here or make this module
+ * throw at import time. Keep old wire identities readable when retiring execution.
+ *
+ * Gemini is not a direct Sandbox backend; it is available only through a backing
+ * transport. Adding it upstream never implicitly makes it dispatchable here.
+ * The spec/adapter composition must still prove every backend it actually enables.
+ */
+declare const BACKEND_TYPE: {
+  readonly OPENCODE: "opencode";
+  readonly CLAUDE_CODE: "claude-code";
+  readonly KIMI_CODE: "kimi-code";
+  readonly CODEX: "codex";
+  readonly AMP: "amp";
+  readonly FACTORY_DROIDS: "factory-droids";
+  readonly PI: "pi";
+  readonly PRIME: "prime";
+  readonly HERMES: "hermes";
+  readonly FORGE: "forge";
+  readonly OPENCLAW: "openclaw";
+  readonly NANOCLAW: "nanoclaw";
+  readonly ACP: "acp";
+  readonly CURSOR: "cursor";
+  readonly CLI_BASE: "cli-base";
+};
+/** Derived from the local declaration, not the complement of the upstream enum. */
+type BackendType = (typeof BACKEND_TYPE)[keyof typeof BACKEND_TYPE];
+/** Stable declaration order; registry tests check the shipped spec composition. */
+declare const ALL_BACKEND_TYPES: [BackendType, ...BackendType[]];
+declare const backendTypeSchema: z.ZodEnum<{
+  "claude-code": "claude-code";
+  nanoclaw: "nanoclaw";
+  codex: "codex";
+  opencode: "opencode";
+  "kimi-code": "kimi-code";
+  pi: "pi";
+  prime: "prime";
+  hermes: "hermes";
+  openclaw: "openclaw";
+  amp: "amp";
+  "factory-droids": "factory-droids";
+  forge: "forge";
+  cursor: "cursor";
+  acp: "acp";
+  "cli-base": "cli-base";
+}>;
+declare function isBackendType(value: string): value is BackendType;
+declare function parseBackendType(value: string): BackendType;
+//#endregion
+export { isBackendType as a, backendTypeSchema as i, BACKEND_TYPE as n, parseBackendType as o, BackendType as r, ALL_BACKEND_TYPES as t };
+//# sourceMappingURL=backend-types-CJH-wHS3.d.mts.map

package/dist/backend-types-CREj4iOY.mjs

@@ -0,0 +1,45 @@
+import { z } from "zod";
+//#region ../runtime-contracts/dist/backend-types.js
+/**
+* This distribution's backend vocabulary, declared positively. The shared
+* Interface vocabulary also contains historical and differently hosted harnesses;
+* knowing one upstream must not require installing it here or make this module
+* throw at import time. Keep old wire identities readable when retiring execution.
+*
+* Gemini is not a direct Sandbox backend; it is available only through a backing
+* transport. Adding it upstream never implicitly makes it dispatchable here.
+* The spec/adapter composition must still prove every backend it actually enables.
+*/
+const BACKEND_TYPE = {
+	OPENCODE: "opencode",
+	CLAUDE_CODE: "claude-code",
+	KIMI_CODE: "kimi-code",
+	CODEX: "codex",
+	AMP: "amp",
+	FACTORY_DROIDS: "factory-droids",
+	PI: "pi",
+	PRIME: "prime",
+	HERMES: "hermes",
+	FORGE: "forge",
+	OPENCLAW: "openclaw",
+	NANOCLAW: "nanoclaw",
+	ACP: "acp",
+	CURSOR: "cursor",
+	CLI_BASE: "cli-base"
+};
+/** Stable declaration order; registry tests check the shipped spec composition. */
+const ALL_BACKEND_TYPES = Object.values(BACKEND_TYPE);
+const backendTypeSchema = z.enum(ALL_BACKEND_TYPES);
+z.string().regex(/^[A-Za-z0-9_.:@-]{1,256}$/);
+const BACKEND_TYPE_SET = new Set(ALL_BACKEND_TYPES);
+function isBackendType(value) {
+	return BACKEND_TYPE_SET.has(value);
+}
+function parseBackendType(value) {
+	if (!isBackendType(value)) throw new Error(`Unknown backend type "${value}". Expected one of: ${ALL_BACKEND_TYPES.join(", ")}`);
+	return value;
+}
+//#endregion
+export { parseBackendType as a, isBackendType as i, BACKEND_TYPE as n, backendTypeSchema as r, ALL_BACKEND_TYPES as t };
+
+//# sourceMappingURL=backend-types-CREj4iOY.mjs.map

package/dist/backend-types.d.mts

@@ -0,0 +1,2 @@
+import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-CJH-wHS3.mjs";
+export { ALL_BACKEND_TYPES, BACKEND_TYPE, BackendType, backendTypeSchema, isBackendType, parseBackendType };

package/dist/backend-types.mjs

@@ -0,0 +1,2 @@
+import { a as parseBackendType, i as isBackendType, n as BACKEND_TYPE, r as backendTypeSchema, t as ALL_BACKEND_TYPES } from "./backend-types-CREj4iOY.mjs";
+export { ALL_BACKEND_TYPES, BACKEND_TYPE, backendTypeSchema, isBackendType, parseBackendType };

package/dist/cli-auth-bundle.d.mts

@@ -0,0 +1,49 @@
+import { z } from "zod";
+
+//#region src/cli-auth-bundle.d.ts
+type LocalCliAuthFile = {
+  path: string;
+  content: string;
+  mode?: number;
+};
+declare const AUTH_BUNDLE_PATHS: Readonly<{
+  readonly codex: ".codex/auth.json";
+  readonly "claude-code": ".claude/.credentials.json";
+}>;
+/** Convert a native credential JSON bundle without reading host credentials. */
+declare function materializeCliAuthBundle(backendType: string, rawBundle: string): LocalCliAuthFile[];
+declare const CLI_AUTH_REFERENCE_ENV_VAR = "AGENT_INTERNAL_CLI_AUTH_REF";
+declare const cliAuthReferenceSchema: z.ZodObject<{
+  account: z.ZodString;
+  secretEnv: z.ZodString;
+  format: z.ZodEnum<{
+    token: "token";
+    bundle: "bundle";
+    files: "files";
+  }>;
+}, z.core.$strict>;
+/** A supplied account binding label, not a verified native account principal. */
+type CliAuthReference = z.infer<typeof cliAuthReferenceSchema>;
+type CliAuthMaterial = {
+  reference: CliAuthReference;
+  authFiles: LocalCliAuthFile[];
+  tokenEnvironment: Record<string, string>;
+};
+declare const cliAuthFilesSchema: z.ZodArray<z.ZodObject<{
+  path: z.ZodString;
+  content: z.ZodString;
+  mode: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>>;
+declare function assertCliAuthReferenceSupported(backendType: string, model: {
+  cliAuth?: CliAuthReference;
+  authMode?: string;
+  apiKey?: string;
+  apiKeyEnv?: string;
+  baseUrl?: string;
+  authFiles?: LocalCliAuthFile[];
+}): CliAuthReference | undefined;
+/** Resolve only the selected injected secret, without copying it into a public config. */
+declare function resolveCliAuthReference(backendType: string, model: Parameters<typeof assertCliAuthReferenceSupported>[1], environment: Readonly<Record<string, string | undefined>>): CliAuthMaterial | undefined;
+//#endregion
+export { AUTH_BUNDLE_PATHS, CLI_AUTH_REFERENCE_ENV_VAR, CliAuthMaterial, CliAuthReference, LocalCliAuthFile, assertCliAuthReferenceSupported, cliAuthFilesSchema, cliAuthReferenceSchema, materializeCliAuthBundle, resolveCliAuthReference };
+//# sourceMappingURL=cli-auth-bundle.d.mts.map

package/dist/cli-auth-bundle.mjs

@@ -0,0 +1,92 @@
+import { l as getSpec } from "./specs-Bbiay_8K.mjs";
+import { z } from "zod";
+//#region src/cli-auth-bundle.ts
+const DEFAULT_MODE = 384;
+const AUTH_BUNDLE_PATHS = Object.freeze({
+	codex: ".codex/auth.json",
+	"claude-code": ".claude/.credentials.json"
+});
+/** Convert a native credential JSON bundle without reading host credentials. */
+function materializeCliAuthBundle(backendType, rawBundle) {
+	if (backendType !== "codex" && backendType !== "claude-code") throw new Error("CLI auth bundle is not supported for the selected backend");
+	if (typeof rawBundle !== "string") throw new Error("CLI auth bundle must be a JSON object");
+	let value;
+	try {
+		value = JSON.parse(rawBundle);
+	} catch {
+		throw new Error("CLI auth bundle must be a JSON object");
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("CLI auth bundle must be a JSON object");
+	return [{
+		path: AUTH_BUNDLE_PATHS[backendType],
+		content: rawBundle,
+		mode: DEFAULT_MODE
+	}];
+}
+const CLI_AUTH_REFERENCE_ENV_VAR = "AGENT_INTERNAL_CLI_AUTH_REF";
+const cliAuthReferenceSchema = z.object({
+	account: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9@._+-]{0,127}$/),
+	secretEnv: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}$/),
+	format: z.enum([
+		"token",
+		"bundle",
+		"files"
+	])
+}).strict();
+const cliAuthFilesSchema = z.array(z.object({
+	path: z.string().min(1).max(4096).refine((value) => !value.startsWith("/") && !/^[A-Za-z]:/.test(value) && !/[\\\0]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..")),
+	content: z.string().max(1024 * 1024),
+	mode: z.number().int().min(0).max(448).refine((mode) => (mode & 63) === 0).optional()
+}).strict()).min(1).max(128);
+function assertCliAuthReferenceSupported(backendType, model) {
+	if (model.cliAuth === void 0) return void 0;
+	const parsedReference = cliAuthReferenceSchema.safeParse(model.cliAuth);
+	if (!parsedReference.success) throw new Error("Invalid native authentication reference");
+	const reference = parsedReference.data;
+	if (model.authMode === "api-key" || model.apiKey !== void 0 || model.apiKeyEnv !== void 0 || model.baseUrl !== void 0 || model.authFiles !== void 0) throw new Error("cliAuth cannot be combined with API credentials, baseUrl, or inline authFiles");
+	const spec = getSpec(backendType);
+	if (!spec?.hasCliAuth) throw new Error(`Native CLI authentication is unsupported by ${backendType}`);
+	if (reference.format === "token" && !spec.envVars.oauthToken) throw new Error(`Native subscription tokens are unsupported by ${backendType}`);
+	if (reference.format === "bundle" && backendType !== "codex" && backendType !== "claude-code") throw new Error(`Native credential bundles are unsupported by ${backendType}`);
+	return reference;
+}
+/** Resolve only the selected injected secret, without copying it into a public config. */
+function resolveCliAuthReference(backendType, model, environment) {
+	const reference = assertCliAuthReferenceSupported(backendType, model);
+	if (!reference) return void 0;
+	const value = environment[reference.secretEnv];
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`Missing native credential environment variable: ${reference.secretEnv}`);
+	if (reference.format === "token") {
+		const tokenEnv = getSpec(backendType)?.envVars.oauthToken;
+		if (!tokenEnv) throw new Error(`Native subscription tokens are unsupported by ${backendType}`);
+		if (/\s/.test(value) || value.startsWith("{") || value.startsWith("[")) throw new Error("Native token authentication requires a raw token, not a credential wrapper");
+		return {
+			reference,
+			authFiles: [],
+			tokenEnvironment: { [tokenEnv]: value }
+		};
+	}
+	if (reference.format === "bundle") return {
+		reference,
+		authFiles: materializeCliAuthBundle(backendType, value),
+		tokenEnvironment: {}
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		throw new Error("Native authFiles secret must contain a JSON array of auth files");
+	}
+	const files = cliAuthFilesSchema.safeParse(parsed);
+	if (!files.success) throw new Error("Native authFiles secret must contain a JSON array of auth files");
+	if (backendType === "codex" && (files.data.length !== 1 || files.data[0]?.path !== AUTH_BUNDLE_PATHS.codex || files.data[0]?.content.trim().length === 0)) throw new Error("Codex native auth files require only .codex/auth.json");
+	return {
+		reference,
+		authFiles: files.data,
+		tokenEnvironment: {}
+	};
+}
+//#endregion
+export { AUTH_BUNDLE_PATHS, CLI_AUTH_REFERENCE_ENV_VAR, assertCliAuthReferenceSupported, cliAuthFilesSchema, cliAuthReferenceSchema, materializeCliAuthBundle, resolveCliAuthReference };
+
+//# sourceMappingURL=cli-auth-bundle.mjs.map

package/dist/cli-auth-placeholder.d.mts

@@ -0,0 +1,54 @@
+import { CliAuthMaterial, CliAuthReference } from "./cli-auth-bundle.mjs";
+import { z } from "zod";
+
+//#region src/cli-auth-placeholder.d.ts
+declare const metadataSchema: z.ZodObject<{
+  accountId: z.ZodOptional<z.ZodString>;
+  planType: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+    free: "free";
+    plus: "plus";
+    pro: "pro";
+    business: "business";
+    enterprise: "enterprise";
+    edu: "edu";
+    team: "team";
+  }>, z.ZodEnum<{
+    free: "free";
+    pro: "pro";
+    enterprise: "enterprise";
+    team: "team";
+    max: "max";
+  }>]>>;
+  accessTokenExpiresAt: z.ZodOptional<z.ZodNumber>;
+  hasRefreshToken: z.ZodBoolean;
+}, z.core.$strict>;
+/** Routing/display hints only; these fields do not verify an account principal. */
+type CliAuthPlaceholderMetadata = z.infer<typeof metadataSchema>;
+type PlaceholderInput = {
+  backendType: string;
+  reference: CliAuthReference; /** The existing egress owner supplies this sandbox's declared-slot token. */
+  placeholder: string; /** CLI compatibility timestamp, never an assertion of provider validity. */
+  now: Date;
+  metadata: CliAuthPlaceholderMetadata;
+};
+/** Build sandbox-safe native material without accepting any provider token. */
+declare function buildCliAuthPlaceholderMaterial(input: PlaceholderInput): CliAuthMaterial;
+/**
+ * TRUSTED OWNER ONLY. The explicit proxyAccessToken result must reach only the
+ * host's existing egress holder. Only nativeMaterial may enter the sandbox.
+ * The uploaded bundle, ID token and refresh token are never returned.
+ */
+declare function resolveCliAuthPlaceholder(input: {
+  backendType: string;
+  reference: CliAuthReference;
+  secretValue: string;
+  placeholder: string;
+  now: Date;
+}): {
+  proxyAccessToken: string;
+  nativeMaterial: CliAuthMaterial;
+  metadata: CliAuthPlaceholderMetadata;
+};
+//#endregion
+export { CliAuthPlaceholderMetadata, buildCliAuthPlaceholderMaterial, resolveCliAuthPlaceholder };
+//# sourceMappingURL=cli-auth-placeholder.d.mts.map

package/dist/cli-auth-placeholder.mjs

@@ -0,0 +1,200 @@
+import { AUTH_BUNDLE_PATHS, assertCliAuthReferenceSupported, resolveCliAuthReference } from "./cli-auth-bundle.mjs";
+import { i as baseProxyToken, r as declaredSecretSlotTokens } from "./harness-DIdVNSwl.mjs";
+import { z } from "zod";
+//#region src/cli-auth-placeholder.ts
+const identity = z.string().regex(/^[A-Za-z0-9_-]{1,256}$/);
+const token = z.string().min(8).max(64 * 1024).regex(/^[^\s\0]+$/);
+const expiry = z.number().int().positive().max(864e13);
+const codexPlan = z.enum([
+	"free",
+	"plus",
+	"pro",
+	"business",
+	"enterprise",
+	"edu",
+	"team"
+]);
+const claudePlan = z.enum([
+	"free",
+	"pro",
+	"max",
+	"team",
+	"enterprise"
+]);
+const metadataSchema = z.object({
+	accountId: identity.optional(),
+	planType: z.union([codexPlan, claudePlan]).optional(),
+	accessTokenExpiresAt: expiry.optional(),
+	hasRefreshToken: z.boolean()
+}).strict();
+const codexBundle = z.object({ tokens: z.object({
+	access_token: token,
+	refresh_token: z.union([token, z.literal("")]).optional(),
+	id_token: token,
+	account_id: identity.nullable().optional()
+}) });
+const codexClaims = z.object({ "https://api.openai.com/auth": z.object({
+	chatgpt_account_id: identity.optional(),
+	chatgpt_plan_type: codexPlan.optional(),
+	chatgpt_account_is_fedramp: z.boolean().optional()
+}).optional() });
+const claudeBundle = z.object({ claudeAiOauth: z.object({
+	accessToken: token,
+	refreshToken: token.nullable().optional(),
+	expiresAt: expiry.nullable().optional(),
+	subscriptionType: claudePlan.nullable().optional()
+}) });
+function invalidMaterial() {
+	throw new Error("Unsupported or invalid native credential material");
+}
+function parseJson(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return invalidMaterial();
+	}
+}
+function jwtClaims(raw) {
+	const parts = raw.split(".");
+	if (parts.length !== 3 || parts.some((part) => !part)) return invalidMaterial();
+	try {
+		const payload = (parts[1] ?? "").replaceAll("-", "+").replaceAll("_", "/");
+		const bytes = Uint8Array.from(atob(payload), (value) => value.charCodeAt(0));
+		return parseJson(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		return invalidMaterial();
+	}
+}
+function accessTokenExpiry(value) {
+	if (value.split(".").length !== 3) return void 0;
+	const parsed = z.object({ exp: z.number().int().positive().optional() }).safeParse(jwtClaims(value));
+	if (!parsed.success) return invalidMaterial();
+	if (parsed.data.exp === void 0) return void 0;
+	const result = expiry.safeParse(parsed.data.exp * 1e3);
+	if (!result.success) return invalidMaterial();
+	return result.data;
+}
+/** Build sandbox-safe native material without accepting any provider token. */
+function buildCliAuthPlaceholderMaterial(input) {
+	const reference = assertCliAuthReferenceSupported(input.backendType, { cliAuth: input.reference });
+	const metadata = metadataSchema.safeParse(input.metadata);
+	const declaredTokens = Object.values(declaredSecretSlotTokens());
+	if (!reference || !metadata.success || !Number.isFinite(input.now.getTime()) || !declaredTokens.includes(baseProxyToken(input.placeholder)) || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.placeholder)) return invalidMaterial();
+	if (input.backendType !== "codex" && input.backendType !== "claude-code") return invalidMaterial();
+	if (input.backendType === "codex" && reference.format === "token") return invalidMaterial();
+	const { accountId, planType, accessTokenExpiresAt, hasRefreshToken } = metadata.data;
+	let content;
+	if (input.backendType === "codex") {
+		if (planType !== void 0 && !codexPlan.safeParse(planType).success) return invalidMaterial();
+		const claims = {
+			sub: input.placeholder,
+			aud: "tangle-sandbox",
+			exp: Math.floor(input.now.getTime() / 1e3)
+		};
+		content = {
+			auth_mode: "chatgpt",
+			OPENAI_API_KEY: null,
+			tokens: {
+				id_token: `e30.${btoa(JSON.stringify(claims)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "")}.tangle-placeholder`,
+				access_token: input.placeholder,
+				refresh_token: hasRefreshToken ? input.placeholder : "",
+				...accountId ? { account_id: accountId } : {}
+			},
+			last_refresh: input.now.toISOString()
+		};
+	} else {
+		if (planType !== void 0 && !claudePlan.safeParse(planType).success) return invalidMaterial();
+		content = { claudeAiOauth: {
+			accessToken: input.placeholder,
+			refreshToken: hasRefreshToken ? input.placeholder : null,
+			expiresAt: accessTokenExpiresAt ?? null,
+			scopes: ["user:inference"],
+			subscriptionType: planType ?? null,
+			rateLimitTier: null
+		} };
+	}
+	return {
+		reference,
+		authFiles: [{
+			path: AUTH_BUNDLE_PATHS[input.backendType],
+			content: JSON.stringify(content),
+			mode: 384
+		}],
+		tokenEnvironment: {}
+	};
+}
+/**
+* TRUSTED OWNER ONLY. The explicit proxyAccessToken result must reach only the
+* host's existing egress holder. Only nativeMaterial may enter the sandbox.
+* The uploaded bundle, ID token and refresh token are never returned.
+*/
+function resolveCliAuthPlaceholder(input) {
+	if (input.secretValue.length > 1024 * 1024) return invalidMaterial();
+	const material = resolveCliAuthReference(input.backendType, { cliAuth: input.reference }, { [input.reference.secretEnv]: input.secretValue });
+	if (!material) return invalidMaterial();
+	let proxyAccessToken;
+	let metadata;
+	let credentials;
+	if (input.backendType === "claude-code" && material.reference.format === "token") {
+		const parsed = token.safeParse(Object.values(material.tokenEnvironment)[0]);
+		if (!parsed.success) return invalidMaterial();
+		proxyAccessToken = parsed.data;
+		credentials = [proxyAccessToken];
+		metadata = { hasRefreshToken: false };
+	} else {
+		const expectedPath = input.backendType === "codex" ? AUTH_BUNDLE_PATHS.codex : AUTH_BUNDLE_PATHS["claude-code"];
+		if (material.authFiles.length !== 1 || material.authFiles[0]?.path !== expectedPath) return invalidMaterial();
+		const bundle = parseJson(material.authFiles[0].content);
+		if (input.backendType === "codex") {
+			const parsed = codexBundle.safeParse(bundle);
+			if (!parsed.success) return invalidMaterial();
+			const tokens = parsed.data.tokens;
+			const parsedClaims = codexClaims.safeParse(jwtClaims(tokens.id_token));
+			if (!parsedClaims.success) return invalidMaterial();
+			const claims = parsedClaims.data["https://api.openai.com/auth"];
+			if (claims?.chatgpt_account_is_fedramp) return invalidMaterial();
+			if (tokens.account_id && claims?.chatgpt_account_id && tokens.account_id !== claims.chatgpt_account_id) return invalidMaterial();
+			proxyAccessToken = tokens.access_token;
+			credentials = [
+				proxyAccessToken,
+				tokens.id_token,
+				tokens.refresh_token ?? ""
+			];
+			metadata = {
+				accountId: tokens.account_id ?? claims?.chatgpt_account_id,
+				planType: claims?.chatgpt_plan_type,
+				accessTokenExpiresAt: accessTokenExpiry(proxyAccessToken),
+				hasRefreshToken: Boolean(tokens.refresh_token)
+			};
+		} else if (input.backendType === "claude-code") {
+			const parsed = claudeBundle.safeParse(bundle);
+			if (!parsed.success) return invalidMaterial();
+			const oauth = parsed.data.claudeAiOauth;
+			proxyAccessToken = oauth.accessToken;
+			credentials = [proxyAccessToken, oauth.refreshToken ?? ""];
+			metadata = {
+				planType: oauth.subscriptionType ?? void 0,
+				accessTokenExpiresAt: oauth.expiresAt ?? void 0,
+				hasRefreshToken: Boolean(oauth.refreshToken)
+			};
+		} else return invalidMaterial();
+	}
+	const nativeMaterial = buildCliAuthPlaceholderMaterial({
+		...input,
+		metadata
+	});
+	const publicOutput = JSON.stringify({
+		nativeMaterial,
+		metadata
+	});
+	if (credentials.some((value) => value && publicOutput.includes(value))) return invalidMaterial();
+	return {
+		proxyAccessToken,
+		nativeMaterial,
+		metadata
+	};
+}
+//#endregion
+export { buildCliAuthPlaceholderMaterial, resolveCliAuthPlaceholder };
+
+//# sourceMappingURL=cli-auth-placeholder.mjs.map