@the-open-engine/zeroshot 6.22.0 → 6.24.0

package/docker/zeroshot-cluster/Dockerfile

@@ -159,5 +159,12 @@ RUN if [ -n "$PROVIDER_INSTALL" ]; then sh -c "$PROVIDER_INSTALL"; fi
 # Switch to non-root user (required for --dangerously-skip-permissions)
 USER node
 
+# Create a provider's config/overlay roots as the non-root container user (owner-only), so a
+# provider whose credential surface is env/broker-only (no host mount) still gets a writable,
+# private state directory. Registry-fed via PROVIDER_CONFIG_ROOTS (docker.configRoots); no
+# provider name appears in this Dockerfile.
+ARG PROVIDER_CONFIG_ROOTS=""
+RUN if [ -n "$PROVIDER_CONFIG_ROOTS" ]; then for d in $PROVIDER_CONFIG_ROOTS; do mkdir -p "$d" && chmod 700 "$d"; done; fi
+
 # Default command (overridden by vibe)
 CMD ["bash"]

package/lib/agent-cli-provider/adapters/omp.d.ts

@@ -1,3 +1,5 @@
-import { type ProviderAdapter } from '../types';
+import { type BuildProviderCommandOptions, type ProviderAdapter } from '../types';
+/** Prompt text sent over the RPC `prompt` command — never part of argv for the rpc-stdio lane. */
+export declare function buildOmpPrompt(context: string, options?: BuildProviderCommandOptions): string;
 export declare const ompAdapter: ProviderAdapter;
 //# sourceMappingURL=omp.d.ts.map

package/lib/agent-cli-provider/adapters/omp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"omp.d.ts","sourceRoot":"","sources":["../../../src/agent-cli-provider/adapters/omp.ts"],"names":[],"mappings":"AAaA,OAAO,EAUL,KAAK,eAAe,EAIrB,MAAM,UAAU,CAAC;AAkZlB,eAAO,MAAM,UAAU,EAAE,eAkBxB,CAAC"}
+{"version":3,"file":"omp.d.ts","sourceRoot":"","sources":["../../../src/agent-cli-provider/adapters/omp.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,2BAA2B,EAQhC,KAAK,eAAe,EAKrB,MAAM,UAAU,CAAC;AAkOlB,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,2BAAgC,GAAG,MAAM,CAEjG;AA8HD,eAAO,MAAM,UAAU,EAAE,eAkBxB,CAAC"}

package/lib/agent-cli-provider/adapters/omp.js

@@ -1,62 +1,169 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ompAdapter = void 0;
-const schema_1 = require("../schema");
+exports.buildOmpPrompt = buildOmpPrompt;
 const contract_errors_1 = require("../contract-errors");
+const errors_1 = require("../errors");
+const schema_1 = require("../schema");
 const json_1 = require("../json");
+const omp_release_1 = require("../omp-release");
+const omp_rpc_events_1 = require("../omp-rpc-events");
+const types_1 = require("../types");
 const common_1 = require("./common");
+function isUnknownFunction(value) {
+    return typeof value === 'function';
+}
+function createOmpConfigOverlay() {
+    const overlayModule = require('../../../src/omp-config-overlay');
+    if (!(0, json_1.isRecord)(overlayModule) || !isUnknownFunction(overlayModule.createOmpConfigOverlay)) {
+        throw new Error('src/omp-config-overlay must export createOmpConfigOverlay.');
+    }
+    const overlay = overlayModule.createOmpConfigOverlay();
+    if (!(0, json_1.isRecord)(overlay) ||
+        typeof overlay.dir !== 'string' ||
+        typeof overlay.file !== 'string') {
+        throw new Error('createOmpConfigOverlay() must return { dir, file } strings.');
+    }
+    return { dir: overlay.dir, file: overlay.file };
+}
 const MODEL_CATALOG = {};
 const LEVEL_MAPPING = {
-    level1: { rank: 1, model: null, reasoningEffort: 'low' },
-    level2: { rank: 2, model: null, reasoningEffort: 'medium' },
-    level3: { rank: 3, model: null, reasoningEffort: 'high' },
+    level1: { rank: 1, model: '@smol' },
+    level2: { rank: 2, model: '@default' },
+    level3: { rank: 3, model: '@slow' },
 };
-const IGNORED_EVENT_TYPES = new Set([
-    'session',
-    'agent_start',
-    'agent_end',
-    'turn_start',
-    'queue_update',
-    'compaction_start',
-    'compaction_end',
-    'auto_retry_start',
-    'auto_retry_end',
-]);
-function detectCliFeatures(helpText) {
+// Verified against tagged v17.2.1 source: docs/environment-variables.md ("Model/provider
+// authentication", "GitHub/Copilot tokens", "Auth broker", web-search credentials, Bedrock,
+// Azure, Vertex sections) plus docs/providers.md's provider/env-var map. This is the full
+// official host credential inventory OMP itself resolves credentials from — distinct from
+// (and broader than) any narrower automatic Docker env-passthrough allowlist — because OMP
+// routes to 70+ downstream model/search providers and every one of their credential env vars
+// must be detected and redacted from Zeroshot logs/output, not just the handful Zeroshot's
+// own cluster config commonly sets.
+const CREDENTIAL_ENV_KEYS = [
+    'AIMLAPI_API_KEY',
+    'AI_GATEWAY_API_KEY',
+    'ALIBABA_CODING_PLAN_API_KEY',
+    'ALIBABA_TOKEN_PLAN_API_KEY',
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_FOUNDRY_API_KEY',
+    'ANTHROPIC_OAUTH_TOKEN',
+    'ANTHROPIC_SEARCH_API_KEY',
+    'AWS_ACCESS_KEY_ID',
+    'AWS_BEARER_TOKEN_BEDROCK',
+    'AWS_SECRET_ACCESS_KEY',
+    'AZURE_OPENAI_API_KEY',
+    'BAILIAN_TOKEN_PLAN_API_KEY',
+    'BRAVE_API_KEY',
+    'CEREBRAS_API_KEY',
+    'CLAUDE_CODE_CLIENT_CERT',
+    'CLAUDE_CODE_CLIENT_KEY',
+    'CLOUDFLARE_AI_GATEWAY_API_KEY',
+    'COPILOT_GITHUB_TOKEN',
+    'CURSOR_ACCESS_TOKEN',
+    'DEEPSEEK_API_KEY',
+    'EXA_API_KEY',
+    'FIREPASS_API_KEY',
+    'FIREWORKS_API_KEY',
+    'GEMINI_API_KEY',
+    'GH_TOKEN',
+    'GITHUB_TOKEN',
+    'GITLAB_TOKEN',
+    'GOOGLE_API_KEY',
+    'GOOGLE_APPLICATION_CREDENTIALS',
+    'GOOGLE_CLOUD_API_KEY',
+    'GROQ_API_KEY',
+    'HF_TOKEN',
+    'HUGGINGFACE_HUB_TOKEN',
+    'JINA_API_KEY',
+    'KAGI_API_KEY',
+    'KILO_API_KEY',
+    'KIMI_SEARCH_API_KEY',
+    'LITELLM_API_KEY',
+    'LLAMA_CPP_API_KEY',
+    'LM_STUDIO_API_KEY',
+    'MINIMAX_API_KEY',
+    'MINIMAX_CODE_API_KEY',
+    'MINIMAX_CODE_CN_API_KEY',
+    'MISTRAL_API_KEY',
+    'MOONSHOT_API_KEY',
+    'MOONSHOT_SEARCH_API_KEY',
+    'NANO_GPT_API_KEY',
+    'NOVITA_API_KEY',
+    'NVIDIA_API_KEY',
+    'OLLAMA_API_KEY',
+    'OLLAMA_CLOUD_API_KEY',
+    'OMP_AUTH_BROKER_TOKEN',
+    'OPENAI_API_KEY',
+    'OPENCODE_API_KEY',
+    'OPENROUTER_API_KEY',
+    'PARALLEL_API_KEY',
+    'PERPLEXITY_API_KEY',
+    'PERPLEXITY_COOKIES',
+    'QIANFAN_API_KEY',
+    'QWEN_OAUTH_TOKEN',
+    'QWEN_PORTAL_API_KEY',
+    'SEARXNG_BASIC_PASSWORD',
+    'SEARXNG_TOKEN',
+    'SILICONFLOW_API_KEY',
+    'SILICONFLOW_CN_API_KEY',
+    'SMITHERY_API_KEY',
+    'SYNTHETIC_API_KEY',
+    'TAVILY_API_KEY',
+    'TOGETHER_API_KEY',
+    'UMANS_AI_CODING_PLAN_API_KEY',
+    'VENICE_API_KEY',
+    'VLLM_API_KEY',
+    'WAFER_SERVERLESS_API_KEY',
+    'XAI_API_KEY',
+    'XAI_OAUTH_TOKEN',
+    'XIAOMI_API_KEY',
+    'XIAOMI_TOKEN_PLAN_AMS_API_KEY',
+    'XIAOMI_TOKEN_PLAN_CN_API_KEY',
+    'XIAOMI_TOKEN_PLAN_SGP_API_KEY',
+    'ZAI_API_KEY',
+    'ZENMUX_API_KEY',
+    'ZHIPU_API_KEY',
+];
+const VERSION_TOKEN_PATTERN = /(?<![\w.])17\.2\.1(?![\w.])/;
+const MODEL_ID_PATTERN = /^@?[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+function detectCliFeatures(helpText, versionText) {
     const help = helpText ?? '';
-    const unknown = !help;
+    const version = (versionText ?? '').trim();
     return {
         provider: 'omp',
-        supportsModeJson: unknown ? true : /--mode\b/.test(help) && /\bjson\b/.test(help),
-        supportsPrint: unknown ? true : /-p\b/.test(help) || /--print\b/.test(help),
-        supportsCwd: unknown ? true : /--cwd\b/.test(help),
-        supportsAutoApprove: unknown ? true : /--auto-approve\b/.test(help),
-        supportsModel: unknown ? true : /--model\b/.test(help),
-        supportsThinking: unknown ? true : /--thinking\b/.test(help),
-        supportsNoExtensions: unknown ? true : /--no-extensions\b/.test(help),
-        supportsNoSkills: unknown ? true : /--no-skills\b/.test(help),
-        supportsNoRules: unknown ? true : /--no-rules\b/.test(help),
-        supportsNoTitle: unknown ? true : /--no-title\b/.test(help),
-        unknown,
+        versionMatches: VERSION_TOKEN_PATTERN.test(version),
+        supportsRpcMode: /(^|\s)rpc(\s|$)/m.test(help),
+        supportsConfig: /--config\b/.test(help),
+        supportsModel: /--model\b/.test(help),
+        supportsThinking: /--thinking\b/.test(help),
+        supportsApprovalMode: /--approval-mode\b/.test(help),
+        supportsNoTitle: /--no-title\b/.test(help),
+        supportsNoSession: /--no-session\b/.test(help),
+        supportsSessionDir: /--session-dir\b/.test(help),
+        supportsResume: /--resume\b/.test(help),
+        unknown: !help,
     };
 }
 function assertRequiredOmpFeatures(options) {
     const features = (0, common_1.optionFeatures)(options);
     const required = [
-        [features.supportsModeJson, '--mode json'],
-        [features.supportsPrint, '-p/--print'],
-        [features.supportsCwd, '--cwd'],
-        [features.supportsAutoApprove, '--auto-approve'],
+        [features.versionMatches, `exact OMP version ${omp_release_1.OMP_SUPPORTED_VERSION}`],
+        [features.supportsRpcMode, '"rpc" mode'],
+        [features.supportsConfig, '--config'],
+        [features.supportsModel, '--model'],
+        [features.supportsApprovalMode, '--approval-mode'],
+        [features.supportsNoTitle, '--no-title'],
+        [features.supportsNoSession, '--no-session'],
     ];
-    const missing = required.filter(([supported]) => supported === false).map(([, flag]) => flag);
+    const missing = required.filter(([supported]) => supported === false).map(([, label]) => label);
     if (missing.length === 0)
         return;
     throw (0, contract_errors_1.contractError)({
         code: 'unsupported-provider-cli',
         exitCode: 2,
-        message: 'omp CLI is missing required non-interactive flag(s): ' +
-            missing.join(', ') +
-            '. Update/install @oh-my-pi/pi-coding-agent; Zeroshot will not silently fall back to Pi or another provider.',
+        message: `omp CLI is missing required evidence: ${missing.join(', ')}. ${omp_release_1.OMP_REMEDIATION} ` +
+            'Zeroshot will not silently fall back to Pi or another provider.',
     });
 }
 function failClosedUnsupportedSessionControl(options) {
@@ -68,235 +175,64 @@ function failClosedUnsupportedSessionControl(options) {
         code: 'invalid-field',
         field,
         exitCode: 2,
-        message: 'OMP CLI does not support resume/continue session control; fail closed and start a fresh run instead.',
+        message: 'OMP RPC lane runs sessionless (--no-session) in this slice; resume/continue session control is capability-gated off (sessionResume: false).',
     });
 }
-function addOptionalFlags(args, options) {
-    const features = (0, common_1.optionFeatures)(options);
-    if (features.supportsNoExtensions !== false)
-        args.push('--no-extensions');
-    if (features.supportsNoSkills !== false)
-        args.push('--no-skills');
-    if (features.supportsNoRules !== false)
-        args.push('--no-rules');
-    if (features.supportsNoTitle !== false)
-        args.push('--no-title');
+function rejectMcpConfig(options) {
+    if (!options.mcpConfig || options.mcpConfig.length === 0)
+        return;
+    throw new errors_1.UnsupportedProviderCapabilityError('omp', 'mcpServers', "OMP does not accept Zeroshot's --mcp-config surface; OMP's own discovered MCP/web tools remain governed by its own harness policy, not translated from Claude/Copilot MCP envelopes.");
 }
-function addModelArgs(args, options) {
-    const features = (0, common_1.optionFeatures)(options);
-    if (options.modelSpec?.model && features.supportsModel !== false) {
-        args.push('--model', options.modelSpec.model);
-    }
-    if (options.modelSpec?.reasoningEffort && features.supportsThinking !== false) {
-        args.push('--thinking', options.modelSpec.reasoningEffort);
-    }
+function resolveModelSelector(options) {
+    const model = options.modelSpec?.model;
+    if (typeof model === 'string' && model.length > 0)
+        return model;
+    throw (0, contract_errors_1.contractError)({
+        code: 'unsupported-provider-cli',
+        exitCode: 2,
+        message: 'omp requires a resolved --model selector; none was resolved for this run.',
+    });
 }
 function collectWarnings(options) {
-    const features = (0, common_1.optionFeatures)(options);
-    const warnings = [];
-    if (options.jsonSchema) {
-        warnings.push((0, common_1.warning)('omp', 'omp-jsonschema', 'OMP CLI does not support provider-native JSON schema; appending schema instructions to the prompt.'));
-    }
-    if (options.modelSpec?.model && features.supportsModel === false) {
-        warnings.push((0, common_1.warning)('omp', 'omp-model-unsupported', "OMP CLI does not advertise --model; continuing with OMP's own configured model."));
-    }
-    if (options.modelSpec?.reasoningEffort && features.supportsThinking === false) {
-        warnings.push((0, common_1.warning)('omp', 'omp-thinking-unsupported', 'OMP CLI does not advertise --thinking; continuing without a reasoning-effort override.'));
-    }
-    return warnings;
+    if (!options.jsonSchema)
+        return [];
+    return [
+        (0, common_1.warning)('omp', 'omp-jsonschema', 'OMP CLI does not support provider-native JSON schema; appending schema instructions to the prompt and validating locally.'),
+    ];
+}
+/** Prompt text sent over the RPC `prompt` command — never part of argv for the rpc-stdio lane. */
+function buildOmpPrompt(context, options = {}) {
+    return options.jsonSchema ? (0, schema_1.appendJsonSchemaPrompt)(context, options.jsonSchema) : context;
 }
-function buildCommand(context, options = {}) {
+function buildCommand(_context, options = {}) {
     assertRequiredOmpFeatures(options);
     failClosedUnsupportedSessionControl(options);
-    const finalContext = options.jsonSchema
-        ? (0, schema_1.appendJsonSchemaPrompt)(context, options.jsonSchema)
-        : context;
-    const args = ['--mode', 'json', '-p'];
-    if (options.cwd)
-        args.push('--cwd', options.cwd);
-    args.push('--auto-approve');
-    addOptionalFlags(args, options);
-    addModelArgs(args, options);
-    args.push(finalContext);
+    rejectMcpConfig(options);
+    const modelSelector = resolveModelSelector(options);
+    const warnings = collectWarnings(options);
+    const overlay = createOmpConfigOverlay();
+    const args = ['--mode', 'rpc', '--no-session', '--model', modelSelector];
+    if (options.modelSpec?.reasoningEffort) {
+        args.push('--thinking', options.modelSpec.reasoningEffort);
+    }
+    args.push('--approval-mode', 'yolo', '--no-title', '--config', overlay.file);
     return (0, common_1.commandSpec)({
         binary: 'omp',
         args,
         env: {},
         ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
-        warnings: collectWarnings(options),
+        cleanup: [overlay.dir],
+        cleanupMetadata: [
+            { kind: 'temp-directory', provider: 'omp', path: overlay.dir, reason: 'isolated-config' },
+        ],
+        warnings,
     });
 }
 function createOmpState() {
-    return {
-        ...(0, common_1.createParserState)('omp'),
-        lastAssistantText: '',
-        lastAssistantThinking: '',
-    };
-}
-function assistantSnapshot(message) {
-    if ((0, json_1.getString)(message, 'role') !== 'assistant')
-        return { text: '', thinking: '' };
-    let text = '';
-    let thinking = '';
-    for (const item of (0, json_1.getArray)(message, 'content')) {
-        if (!(0, json_1.isRecord)(item))
-            continue;
-        const type = (0, json_1.getString)(item, 'type');
-        if (type === 'text') {
-            text += (0, json_1.getString)(item, 'text') ?? '';
-        }
-        else if (type === 'thinking') {
-            thinking += (0, json_1.getString)(item, 'thinking') ?? '';
-        }
-    }
-    return { text, thinking };
-}
-function snapshotDelta(previous, current) {
-    if (!current)
-        return null;
-    if (previous === current)
-        return null;
-    if (current.startsWith(previous))
-        return current.slice(previous.length) || null;
-    return current;
-}
-function emitAssistantSnapshot(message, state) {
-    const snapshot = assistantSnapshot(message);
-    const events = [];
-    const textDelta = snapshotDelta(state.lastAssistantText ?? '', snapshot.text);
-    if (textDelta)
-        events.push({ type: 'text', text: textDelta });
-    state.lastAssistantText = snapshot.text;
-    const thinkingDelta = snapshotDelta(state.lastAssistantThinking ?? '', snapshot.thinking);
-    if (thinkingDelta)
-        events.push({ type: 'thinking', text: thinkingDelta });
-    state.lastAssistantThinking = snapshot.thinking;
-    return events;
-}
-function parseAssistantEvent(event, state) {
-    const type = (0, json_1.getString)(event, 'type');
-    if (type === 'text_delta') {
-        const delta = (0, json_1.getString)(event, 'delta');
-        if (!delta)
-            return null;
-        state.lastAssistantText += delta;
-        return { type: 'text', text: delta };
-    }
-    if (type === 'thinking_delta') {
-        const delta = (0, json_1.getString)(event, 'delta');
-        if (!delta)
-            return null;
-        state.lastAssistantThinking += delta;
-        return { type: 'thinking', text: delta };
-    }
-    return null;
-}
-function parseToolExecutionStart(event, state) {
-    const toolId = (0, json_1.getOptionalString)(event, 'toolCallId');
-    state.lastToolId = toolId;
-    return {
-        type: 'tool_call',
-        toolName: (0, json_1.getOptionalString)(event, 'toolName'),
-        toolId,
-        input: event.args ?? {},
-    };
-}
-function parseToolExecutionUpdate(event, state) {
-    const toolId = (0, json_1.getOptionalString)(event, 'toolCallId') ?? state.lastToolId;
-    if (toolId !== undefined)
-        state.lastToolId = toolId;
-    if (!Object.prototype.hasOwnProperty.call(event, 'partialResult'))
-        return null;
-    return {
-        type: 'tool_result',
-        toolId,
-        content: event.partialResult,
-        isError: false,
-    };
-}
-function parseToolExecutionEnd(event, state) {
-    const toolId = (0, json_1.getOptionalString)(event, 'toolCallId') ?? state.lastToolId;
-    return {
-        type: 'tool_result',
-        toolId,
-        content: event.result ?? '',
-        isError: (0, json_1.getBoolean)(event, 'isError') ?? false,
-    };
-}
-function parseTurnEnd(event, state) {
-    const message = (0, json_1.getRecord)(event, 'message');
-    const events = [];
-    if (message !== null) {
-        events.push(...emitAssistantSnapshot(message, state));
-    }
-    const usage = message ? (0, json_1.getRecord)(message, 'usage') ?? {} : {};
-    const stopReason = message ? (0, json_1.getString)(message, 'stopReason') : null;
-    const errorMessage = message ? (0, json_1.getString)(message, 'errorMessage') : null;
-    const snapshot = message ? assistantSnapshot(message) : { text: '', thinking: '' };
-    const success = stopReason !== 'error' && stopReason !== 'aborted' && !errorMessage;
-    events.push({
-        type: 'result',
-        success,
-        result: success ? snapshot.text || null : null,
-        error: success ? null : (errorMessage ?? stopReason ?? 'OMP turn failed'),
-        inputTokens: (0, json_1.getNumber)(usage, 'input') ?? 0,
-        outputTokens: (0, json_1.getNumber)(usage, 'output') ?? 0,
-        cacheReadInputTokens: (0, json_1.getNumber)(usage, 'cacheRead') ?? 0,
-        cacheCreationInputTokens: (0, json_1.getNumber)(usage, 'cacheWrite') ?? 0,
-        cost: (0, json_1.getRecord)(usage, 'cost') ?? null,
-        modelUsage: usage,
-    });
-    return events;
-}
-function parseMessageEvent(type, event, state) {
-    if (type === 'message_start') {
-        const message = (0, json_1.getRecord)(event, 'message');
-        if (message !== null && (0, json_1.getString)(message, 'role') === 'assistant') {
-            state.lastAssistantText = '';
-            state.lastAssistantThinking = '';
-        }
-        return null;
-    }
-    if (type === 'message_update') {
-        const assistantMessageEvent = (0, json_1.getRecord)(event, 'assistantMessageEvent');
-        if (assistantMessageEvent !== null) {
-            const assistantEvent = parseAssistantEvent(assistantMessageEvent, state);
-            if (assistantEvent !== null)
-                return assistantEvent;
-        }
-        const message = (0, json_1.getRecord)(event, 'message');
-        return message === null ? null : emitAssistantSnapshot(message, state);
-    }
-    if (type !== 'message_end')
-        return undefined;
-    const message = (0, json_1.getRecord)(event, 'message');
-    return message === null ? null : emitAssistantSnapshot(message, state);
-}
-function parseToolEvent(type, event, state) {
-    if (type === 'tool_execution_start')
-        return parseToolExecutionStart(event, state);
-    if (type === 'tool_execution_update')
-        return parseToolExecutionUpdate(event, state);
-    if (type === 'tool_execution_end')
-        return parseToolExecutionEnd(event, state);
-    return undefined;
+    return (0, common_1.createParserState)('omp');
 }
 function parseEvent(line, state) {
-    const parsed = (0, json_1.tryParseJson)(line);
-    if (!(0, json_1.isRecord)(parsed))
-        return null;
-    const type = (0, json_1.getString)(parsed, 'type');
-    if (type === null || IGNORED_EVENT_TYPES.has(type))
-        return null;
-    const messageEvent = parseMessageEvent(type, parsed, state);
-    if (messageEvent !== undefined)
-        return messageEvent;
-    const toolEvent = parseToolEvent(type, parsed, state);
-    if (toolEvent !== undefined)
-        return toolEvent;
-    if (type === 'turn_end')
-        return parseTurnEnd(parsed, state);
-    return null;
+    return (0, omp_rpc_events_1.parseNormalizedOmpRpcEventLine)(line, state);
 }
 function resolveModelSpec(level, overrides) {
     return (0, common_1.resolveModelSpecWithConfig)({
@@ -310,36 +246,83 @@ function resolveModelSpec(level, overrides) {
 function validateModelId(modelId) {
     if (modelId === undefined || modelId === null)
         return modelId;
-    if (typeof modelId !== 'string') {
-        throw new Error(`Invalid model "${(0, json_1.unknownToMessage)(modelId)}" for provider "omp".`);
+    if (typeof modelId !== 'string' || !MODEL_ID_PATTERN.test(modelId)) {
+        throw new types_1.InvalidProviderModelError(`Invalid model "${(0, json_1.unknownToMessage)(modelId)}" for provider "omp": must match ${MODEL_ID_PATTERN.source}.`);
     }
     return modelId;
 }
+const OMP_RETRYABLE_PATTERNS = [
+    /\brate(?:[_ -]?limit| limited)\b/i,
+    /\bquota\b/i,
+    /\bresource[_ -]?exhausted\b/i,
+    /\btemporar(?:y|ily)\b/i,
+    /\boverloaded\b/i,
+    /\bservice unavailable\b/i,
+];
+const OMP_PERMANENT_PATTERNS = [
+    // Driver stopReason tokens (see omp-rpc-driver.ts) that always indicate a permanent,
+    // non-retryable failure: bad binary/protocol/version/limits/selector/config, malformed or
+    // over-bound frames, and missing auth/model evidence.
+    /\bunsupported-protocol\b/i,
+    /\bunsupported-limits\b/i,
+    /\bunsupported-provider-cli\b/i,
+    /\bunsupported-ui-method\b/i,
+    /\bunsupported-capability\b/i,
+    /\bunsafe-config\b/i,
+    /\bmalformed-response\b/i,
+    /\bmalformed-extension-ui-request\b/i,
+    /\bmalformed-host-tool-call\b/i,
+    /\bmalformed-host-uri-request\b/i,
+    /\bextension-error\b/i,
+    /\blocal-only-prompt\b/i,
+    /\blifetime-request-id-exceeded\b/i,
+    /\bpending-request-exceeded\b/i,
+    /\bspawn-hook-failed\b/i,
+    // Frame decoder codes (omp-rpc-protocol.ts OmpRpcProtocolError.code values) — every one of
+    // these means the wire traffic itself is invalid or out-of-bounds, never a transient condition.
+    /\bphysical-frame-too-large\b/i,
+    /\bmalformed-physical-frame\b/i,
+    /\binvalid-chunk-metadata\b/i,
+    /\binvalid-chunk-data\b/i,
+    /\bchunk-sequence-must-start-at-zero\b/i,
+    /\bchunk-sequence-mismatch\b/i,
+    /\bchunk-sequence-exceeds-declared-length\b/i,
+    /\bchunk-sequence-length-mismatch\b/i,
+    /\bmalformed-json-in-reassembled-frame\b/i,
+    /\bnon-object-reassembled-frame\b/i,
+    /\binvalid-utf8-in-reassembled-frame\b/i,
+    /\binflight-reassembly-bytes-exceeded\b/i,
+    /\binterleaved-chunk-sequence\b/i,
+    /\binterrupted-chunk-sequence\b/i,
+    /\bincomplete-physical-frame\b/i,
+    /\bincomplete-chunk-sequence\b/i,
+    /\boutbound-frame-too-large\b/i,
+    /\bpre-negotiation-rpc-chunk\b/i,
+    /\b[\w-]+-bound-exceeded\b/i,
+    // Auth/model absence and permission/usage errors surfaced verbatim in OMP output.
+    /\bno available authenticated\b/i,
+    /\bno keyless model\b/i,
+    /\bno valid authentication\b/i,
+    /\bmissing api key\b/i,
+    /\brun\s*\/login\b/i,
+    /\bunknown option\b/i,
+    /\bfailed to load\b/i,
+    /\bcannot find module\b/i,
+    /\bno such file or directory\b/i,
+];
 function classifyError(error) {
-    return (0, common_1.classifyBaseProviderError)(error, [
-        /\brate(?:[_ -]?limit| limited)\b/i,
-        /\bquota\b/i,
-        /\bresource[_ -]?exhausted\b/i,
-        /\btemporar(?:y|ily)\b/i,
-        /\boverloaded\b/i,
-        /\bservice unavailable\b/i,
-    ], [
-        /\b(cancelled|canceled|aborted|interrupted)\b/i,
-        /\brun\s*\/login\b/i,
-        /\bmissing api key\b/i,
-        /\bno valid authentication\b/i,
-        /\bunknown option\b/i,
-        /\bfailed to load\b/i,
-        /\bcannot find module\b/i,
-        /\bno such file or directory\b/i,
-    ]);
+    const message = (0, json_1.unknownToMessage)(error);
+    if (/\b(cancelled|canceled)\b/i.test(message)) {
+        return { retryable: false, kind: 'cancelled' };
+    }
+    return (0, common_1.classifyBaseProviderError)(error, OMP_RETRYABLE_PATTERNS, OMP_PERMANENT_PATTERNS);
 }
 exports.ompAdapter = {
     id: 'omp',
-    displayName: 'OMP',
+    displayName: 'OMP (Oh My Pi)',
     binary: 'omp',
-    adapterVersion: '1',
-    credentialEnvKeys: [],
+    adapterVersion: '2',
+    credentialEnvKeys: CREDENTIAL_ENV_KEYS,
     modelCatalog: MODEL_CATALOG,
     levelMapping: LEVEL_MAPPING,
     defaultLevel: 'level2',