@the-open-engine/zeroshot 6.37.0 → 6.38.1

package/src/agent/provider-terminal-failure.js

@@ -3,12 +3,23 @@
 const { getProvider } = require('../providers');
 const { isCriticalAgent } = require('./critical-agent-policy');
 const { extractCliFailure } = require('./output-extraction');
+const { getPiTokenUsage, redactPiFailureForControlPlane } = require('./pi-terminal-lifecycle');
+const { parseProviderEvent, providerFailureFields } = require('./provider-control-plane');
+
+const AUTHENTICATION_FAILURE_PATTERNS = [
+  /invalid[_ -]?api[_ -]?key/i,
+  /api[_ -]?key.*invalid/i,
+  /(?:missing|no) api key/i,
+  /run\s*\/login/i,
+  /unauthori[sz]ed/i,
+  /forbidden|authentication|permission denied/i,
+];
 
 function categoryForProviderFailure(error, classification) {
   const isPermanent = classification.retryable === false;
-  const authenticationPattern =
-    /(?:invalid[_ -]?api[_ -]?key|api[_ -]?key.*invalid|unauthori[sz]ed|forbidden|authentication|permission denied)/i;
-  if (isPermanent && authenticationPattern.test(error)) return 'authentication';
+  if (isPermanent && AUTHENTICATION_FAILURE_PATTERNS.some((pattern) => pattern.test(error))) {
+    return 'authentication';
+  }
 
   const quotaPattern = /(?:insufficient[_ -]?quota|quota exceeded|resource_exhausted)/i;
   if (isPermanent && quotaPattern.test(error)) return 'quota';
@@ -30,6 +41,12 @@ function classifyProviderFailure(providerName, error) {
   };
 }
 
+function providerFailureEvent(providerName) {
+  if (providerName === 'codex') return 'turn.failed';
+  if (providerName === 'pi') return 'agent_settled';
+  return 'terminal_error';
+}
+
 function extractProviderFailure(output, providerName) {
   const cliError = extractCliFailure(output, providerName);
   if (!cliError) return null;
@@ -39,41 +56,47 @@ function extractProviderFailure(output, providerName) {
   return {
     error: `Provider ${cliError.provider} failed (${category}; ${classification.kind})`,
     provider: cliError.provider,
-    event: cliError.provider === 'codex' ? 'turn.failed' : 'terminal_error',
+    event: providerFailureEvent(cliError.provider),
     category,
     classification,
     diagnostic: cliError.diagnostic,
   };
 }
 
-function redactTerminalFailureForControlPlane(state, providerName, content) {
-  const failure = extractProviderFailure(content, providerName);
-  if (!failure) return content;
-
-  state.providerFailure = failure;
-  let eventType = 'provider.failure';
-  try {
-    const parsed = JSON.parse(content);
-    if (typeof parsed?.type === 'string') eventType = parsed.type;
-  } catch {
-    // extractProviderFailure already proved a supported terminal envelope.
+function extractProviderCompletionFailure(output, providerName, state = {}) {
+  if (providerName !== 'pi') return extractProviderFailure(output, providerName);
+  if (state.providerFailure) return state.providerFailure;
+  if (state.piProtocolPrefixOmitted) return extractProviderFailure('', 'pi');
+  if (!state.piProtocolObserved) return extractProviderFailure(output, 'pi');
+  if (!state.piProtocolSettled || !state.piLatestAssistantObserved) {
+    return extractProviderFailure('', 'pi');
   }
+  return null;
+}
+
+function redactedFailureEnvelope(failure, providerName, eventType) {
   return JSON.stringify({
     type: eventType,
     ...(providerName === 'claude' ? { is_error: true } : {}),
     ...(providerName === 'gemini' ? { status: 'error', severity: 'error' } : {}),
-    error: { message: failure.error },
-    zeroshot_failure: {
-      provider: failure.provider,
-      event: failure.event,
-      category: failure.category,
-      kind: failure.classification.kind,
-      retryable: failure.classification.retryable,
-      diagnostic: failure.diagnostic,
-    },
+    ...providerFailureFields(failure),
   });
 }
 
+function redactTerminalFailureForControlPlane(state, providerName, content) {
+  if (providerName === 'pi') {
+    return redactPiFailureForControlPlane(state, content, extractProviderFailure);
+  }
+
+  const failure = extractProviderFailure(content, providerName);
+  if (!failure) return content;
+
+  state.providerFailure = failure;
+  const parsed = parseProviderEvent(content);
+  const eventType = typeof parsed?.type === 'string' ? parsed.type : 'provider.failure';
+  return redactedFailureEnvelope(failure, providerName, eventType);
+}
+
 function decorateError(error, failure) {
   if (!failure) return error;
   error.provider = failure.provider || null;
@@ -176,7 +199,9 @@ function buildFinalFailureInfo({
 module.exports = {
   buildFinalFailureInfo,
   decorateError,
+  extractProviderCompletionFailure,
   extractProviderFailure,
+  getPiTokenUsage,
   publishCriticalFailure,
   receiptFields,
   redactTerminalFailureForControlPlane,

package/src/agent-cli-provider/adapters/claude-recovery.ts

@@ -25,8 +25,9 @@ export function detectProviderStreamingModeError(
 }
 
 export function detectProviderFatalError(provider: string, line: unknown): string | null {
-  if (!isClaudeProvider(provider)) return null;
-  return detectClaudeFatalError(line);
+  if (isClaudeProvider(provider)) return detectClaudeFatalError(line);
+  if (provider.toLowerCase() === 'pi') return detectPiFatalError(line);
+  return null;
 }
 
 export function recoverProviderStructuredOutput(
@@ -84,6 +85,18 @@ function detectClaudeFatalError(line: unknown): string | null {
   return null;
 }
 
+function detectPiFatalError(line: unknown): string | null {
+  if (typeof line !== 'string') return null;
+  const message = line.trim();
+  if (/\bno api key found\b/i.test(message)) {
+    return 'Pi authentication required: run /login';
+  }
+  if (/\bmodel\b.*\bnot found\b/i.test(message)) {
+    return 'Pi model not found: run pi --list-models';
+  }
+  return null;
+}
+
 function findSessionJsonlPath(sessionId: string): string | null {
   const claudeDir = process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude');
   const projectsDir = join(claudeDir, 'projects');

package/src/agent-cli-provider/adapters/codex.ts

@@ -222,6 +222,8 @@ function buildCommand(context: string, options: BuildProviderCommandOptions = {}
       : null;
   addWebSearchArgs(args, options);
   if (resumeSessionId) {
+    // Codex 0.147 parses --sandbox on `exec`, not on the `resume` subcommand.
+    addAutoApproveArgs(args, options);
     args.push('resume');
   }
 
@@ -229,8 +231,8 @@ function buildCommand(context: string, options: BuildProviderCommandOptions = {}
   addModelArgs(args, options);
   if (!resumeSessionId) {
     addCwdArgs(args, options);
+    addAutoApproveArgs(args, options);
   }
-  addAutoApproveArgs(args, options);
   addSkipGitArgs(args, options);
   const finalContext = applySchemaArgs(args, cleanup, context, options);
 

package/src/agent-cli-provider/adapters/index.ts

@@ -90,6 +90,12 @@ export function parseProviderChunk(
     }
   }
 
+  const finalEvent = adapter.finishParsing?.(state);
+  if (finalEvent) {
+    if (isOutputEventArray(finalEvent)) events.push(...finalEvent);
+    else events.push(finalEvent);
+  }
+
   return events;
 }
 

package/src/agent-cli-provider/adapters/pi.ts

@@ -1,15 +1,9 @@
 import { appendJsonSchemaPrompt } from '../schema';
 import { contractError } from '../contract-errors';
-import {
-  emitAssistantSnapshot,
-  parseAssistantDelta,
-  parseToolExecutionEnd,
-  parseToolExecutionStart,
-  parseToolExecutionUpdate,
-  parseTurnEndResult,
-  resetAssistantSnapshot,
-} from '../assistant-stream';
-import { getRecord, getString, isRecord, tryParseJson, unknownToMessage } from '../json';
+import { unknownToMessage } from '../json';
+import { PI_CREDENTIAL_ENV_KEYS } from '../pi/credentials';
+import { createPiParserState, finishPiParsing, parsePiEvent } from '../pi/events';
+import { PI_SUPPORTED_VERSION } from '../pi/release';
 import {
   type BuildProviderCommandOptions,
   type CommandSpec,
@@ -18,17 +12,15 @@ import {
   type LevelOverrides,
   type ModelCatalogEntry,
   type ModelLevel,
-  type OutputEvent,
   type PiCliFeatures,
   type ProviderAdapter,
-  type ProviderParserState,
   type ResolvedModelSpec,
   type WarningMetadata,
 } from '../types';
 import {
   classifyBaseProviderError,
   commandSpec,
-  createParserState,
+  isCliVersionAtLeast,
   optionFeatures,
   resolveModelSpecWithConfig,
   warning,
@@ -37,45 +29,104 @@ import {
 const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {};
 
 const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
-  level1: { rank: 1, model: null },
-  level2: { rank: 2, model: null },
-  level3: { rank: 3, model: null },
+  level1: { rank: 1, model: null, reasoningEffort: 'low' },
+  level2: { rank: 2, model: null, reasoningEffort: 'medium' },
+  level3: { rank: 3, model: null, reasoningEffort: 'high' },
 };
 
-const IGNORED_EVENT_TYPES = new Set([
-  'session',
-  'agent_start',
-  'agent_end',
-  'turn_start',
-  'queue_update',
-  'compaction_start',
-  'compaction_end',
-  'auto_retry_start',
-  'auto_retry_end',
-]);
+function supportsFlag(
+  help: string,
+  assumeCurrent: boolean,
+  versionMatches: boolean,
+  pattern: RegExp
+): boolean {
+  return versionMatches && (assumeCurrent || pattern.test(help));
+}
 
-function detectCliFeatures(helpText?: string | null): PiCliFeatures {
+function detectCliFeatures(helpText?: string | null, versionText?: string | null): PiCliFeatures {
   const help = helpText ?? '';
-  const unknown = !help;
+  const versionMatches = isCliVersionAtLeast(versionText, PI_SUPPORTED_VERSION);
+  const assumeCurrent = !help && versionMatches;
   return {
     provider: 'pi',
-    supportsJsonMode: unknown ? true : /--mode\b/.test(help) && /\bjson\b/.test(help),
-    supportsModel: unknown ? true : /--model\b/.test(help),
-    supportsNoSession: unknown ? true : /--no-session\b/.test(help),
-    supportsNoExtensions: unknown ? true : /--no-extensions\b/.test(help),
-    supportsNoSkills: unknown ? true : /--no-skills\b/.test(help),
-    supportsNoPromptTemplates: unknown ? true : /--no-prompt-templates\b/.test(help),
-    supportsNoContextFiles: unknown ? true : /--no-context-files\b/.test(help),
-    supportsNoApprove: unknown ? true : /--no-approve\b/.test(help),
-    unknown,
+    versionMatches,
+    supportsJsonMode:
+      supportsFlag(help, assumeCurrent, versionMatches, /--mode\b/) &&
+      (assumeCurrent || /\bjson\b/.test(help)),
+    supportsModel: supportsFlag(help, assumeCurrent, versionMatches, /--model\b/),
+    supportsThinking: supportsFlag(help, assumeCurrent, versionMatches, /--thinking\b/),
+    supportsNoSession: supportsFlag(help, assumeCurrent, versionMatches, /--no-session\b/),
+    supportsNoExtensions: supportsFlag(help, assumeCurrent, versionMatches, /--no-extensions\b/),
+    supportsNoSkills: supportsFlag(help, assumeCurrent, versionMatches, /--no-skills\b/),
+    supportsNoPromptTemplates: supportsFlag(
+      help,
+      assumeCurrent,
+      versionMatches,
+      /--no-prompt-templates\b/
+    ),
+    supportsNoContextFiles: supportsFlag(
+      help,
+      assumeCurrent,
+      versionMatches,
+      /--no-context-files\b/
+    ),
+    supportsNoApprove: supportsFlag(help, assumeCurrent, versionMatches, /--no-approve\b/),
+    unknown: !help || !(versionText ?? '').trim(),
   };
 }
 
+function assertRequiredControls(options: BuildProviderCommandOptions): void {
+  const features = optionFeatures(options);
+  if (features.versionMatches !== true) {
+    throw contractError({
+      code: 'invalid-field',
+      field: 'options.cliFeatures.versionMatches',
+      exitCode: 2,
+      message:
+        `Pi ${PI_SUPPORTED_VERSION} or newer is required for the agent_settled JSON protocol. ` +
+        `Upgrade with: npm install -g --ignore-scripts ` +
+        `@earendil-works/pi-coding-agent@${PI_SUPPORTED_VERSION}`,
+    });
+  }
+  const required = [
+    ['supportsJsonMode', '--mode json'],
+    ['supportsNoSession', '--no-session'],
+    ['supportsNoSkills', '--no-skills'],
+    ['supportsNoPromptTemplates', '--no-prompt-templates'],
+    ['supportsNoContextFiles', '--no-context-files'],
+    ['supportsNoApprove', '--no-approve'],
+  ] as const;
+  for (const [field, flag] of required) {
+    if (features[field] !== false) continue;
+    throw contractError({
+      code: 'invalid-field',
+      field: `options.cliFeatures.${field}`,
+      exitCode: 2,
+      message: `Pi ${PI_SUPPORTED_VERSION}+ support for ${flag} is required for Zeroshot execution.`,
+    });
+  }
+  if (options.modelSpec?.model && features.supportsModel === false) {
+    throw contractError({
+      code: 'invalid-field',
+      field: 'options.cliFeatures.supportsModel',
+      exitCode: 2,
+      message: `Pi ${PI_SUPPORTED_VERSION}+ support for --model is required for explicit model selection.`,
+    });
+  }
+  if (options.modelSpec?.reasoningEffort && features.supportsThinking === false) {
+    throw contractError({
+      code: 'invalid-field',
+      field: 'options.cliFeatures.supportsThinking',
+      exitCode: 2,
+      message: `Pi ${PI_SUPPORTED_VERSION}+ support for --thinking is required for reasoning effort.`,
+    });
+  }
+}
+
 function addRequiredArgs(args: string[], options: BuildProviderCommandOptions): void {
   const features = optionFeatures(options);
   if (features.supportsJsonMode !== false) args.push('--mode', 'json');
   if (features.supportsNoSession !== false) args.push('--no-session');
-  if (features.supportsNoExtensions !== false) args.push('--no-extensions');
   if (features.supportsNoSkills !== false) args.push('--no-skills');
   if (features.supportsNoPromptTemplates !== false) args.push('--no-prompt-templates');
   if (features.supportsNoContextFiles !== false) args.push('--no-context-files');
@@ -87,6 +138,9 @@ function addOptionalArgs(args: string[], options: BuildProviderCommandOptions):
   if (options.modelSpec?.model && features.supportsModel !== false) {
     args.push('--model', options.modelSpec.model);
   }
+  if (options.modelSpec?.reasoningEffort && features.supportsThinking !== false) {
+    args.push('--thinking', options.modelSpec.reasoningEffort);
+  }
 }
 
 function failClosedUnsupportedSessionControl(options: BuildProviderCommandOptions): void {
@@ -98,12 +152,11 @@ function failClosedUnsupportedSessionControl(options: BuildProviderCommandOption
     field,
     exitCode: 2,
     message:
-      'Pi CLI does not support resume/continue session control; fail closed and start a fresh run instead.',
+      'Pi CLI does not support resume/continue session control with a task-owned identity boundary.',
   });
 }
 
 function collectWarnings(options: BuildProviderCommandOptions): WarningMetadata[] {
-  const features = optionFeatures(options);
   const warnings: WarningMetadata[] = [];
 
   if (options.jsonSchema) {
@@ -115,16 +168,12 @@ function collectWarnings(options: BuildProviderCommandOptions): WarningMetadata[
       )
     );
   }
-  if (features.supportsJsonMode === false) {
-    warnings.push(
-      warning('pi', 'pi-json-mode', 'Pi CLI does not advertise --mode json; continuing anyway.')
-    );
-  }
   return warnings;
 }
 
 function buildCommand(context: string, options: BuildProviderCommandOptions = {}): CommandSpec {
   failClosedUnsupportedSessionControl(options);
+  assertRequiredControls(options);
   const finalContext = options.jsonSchema
     ? appendJsonSchemaPrompt(context, options.jsonSchema)
     : context;
@@ -132,7 +181,9 @@ function buildCommand(context: string, options: BuildProviderCommandOptions = {}
 
   addRequiredArgs(args, options);
   addOptionalArgs(args, options);
-  args.push(finalContext);
+  // Pi has no `--` end-of-options sentinel and interprets leading `-`/`@` positional values as
+  // flags or file arguments. A leading space keeps arbitrary Zeroshot context in prompt mode.
+  args.push(` ${finalContext}`);
 
   return commandSpec({
     binary: 'pi',
@@ -143,80 +194,6 @@ function buildCommand(context: string, options: BuildProviderCommandOptions = {}
   });
 }
 
-function createPiState(): ProviderParserState {
-  return {
-    ...createParserState('pi'),
-    lastAssistantText: '',
-    lastAssistantThinking: '',
-  };
-}
-
-function parsePiTurnEnd(
-  event: Record<string, unknown>,
-  state: ProviderParserState
-): readonly OutputEvent[] {
-  const message = getRecord(event, 'message');
-  const events = message === null ? [] : [...emitAssistantSnapshot(message, state)];
-  events.push(parseTurnEndResult(event, { failureMessage: 'Pi turn failed' }));
-  return events;
-}
-
-function parseMessageEvent(
-  type: string,
-  event: Record<string, unknown>,
-  state: ProviderParserState
-): readonly OutputEvent[] | OutputEvent | null | undefined {
-  if (type === 'message_start') {
-    resetAssistantSnapshot(getRecord(event, 'message'), state);
-    return null;
-  }
-
-  if (type === 'message_update') {
-    const assistantMessageEvent = getRecord(event, 'assistantMessageEvent');
-    if (assistantMessageEvent !== null) {
-      const assistantEvent = parseAssistantDelta(assistantMessageEvent, state);
-      if (assistantEvent !== null) return assistantEvent;
-    }
-    const message = getRecord(event, 'message');
-    return message === null ? null : emitAssistantSnapshot(message, state);
-  }
-
-  if (type !== 'message_end') return undefined;
-  const message = getRecord(event, 'message');
-  return message === null ? null : emitAssistantSnapshot(message, state);
-}
-
-function parseToolEvent(
-  type: string,
-  event: Record<string, unknown>,
-  state: ProviderParserState
-): OutputEvent | null | undefined {
-  if (type === 'tool_execution_start') return parseToolExecutionStart(event, state);
-  if (type === 'tool_execution_update') return parseToolExecutionUpdate(event, state);
-  if (type === 'tool_execution_end') return parseToolExecutionEnd(event, state);
-  return undefined;
-}
-
-function parseEvent(
-  line: string,
-  state: ProviderParserState
-): readonly OutputEvent[] | OutputEvent | null {
-  const parsed = tryParseJson(line);
-  if (!isRecord(parsed)) return null;
-
-  const type = getString(parsed, 'type');
-  if (type === null || IGNORED_EVENT_TYPES.has(type)) return null;
-
-  const messageEvent = parseMessageEvent(type, parsed, state);
-  if (messageEvent !== undefined) return messageEvent;
-
-  const toolEvent = parseToolEvent(type, parsed, state);
-  if (toolEvent !== undefined) return toolEvent;
-
-  if (type === 'turn_end') return parsePiTurnEnd(parsed, state);
-  return null;
-}
-
 function resolveModelSpec(level: ModelLevel, overrides?: LevelOverrides): ResolvedModelSpec {
   return resolveModelSpecWithConfig({
     mapping: LEVEL_MAPPING,
@@ -250,7 +227,9 @@ function classifyError(error: unknown): ErrorClassification {
       /\b(cancelled|canceled|aborted|interrupted)\b/i,
       /\brun\s*\/login\b/i,
       /\bmissing api key\b/i,
+      /\bno api key found\b/i,
       /\bno valid authentication\b/i,
+      /\bmodel\b.*\bnot found\b/i,
       /\bunknown option\b/i,
       /\bfailed to load\b/i,
       /\bcannot find module\b/i,
@@ -263,8 +242,8 @@ export const piAdapter: ProviderAdapter = {
   id: 'pi',
   displayName: 'Pi',
   binary: 'pi',
-  adapterVersion: '1',
-  credentialEnvKeys: [],
+  adapterVersion: '2',
+  credentialEnvKeys: PI_CREDENTIAL_ENV_KEYS,
   modelCatalog: MODEL_CATALOG,
   levelMapping: LEVEL_MAPPING,
   defaultLevel: 'level2',
@@ -272,8 +251,9 @@ export const piAdapter: ProviderAdapter = {
   defaultMinLevel: 'level1',
   detectCliFeatures,
   buildCommand,
-  parseEvent,
-  createParserState: createPiState,
+  parseEvent: parsePiEvent,
+  finishParsing: finishPiParsing,
+  createParserState: createPiParserState,
   resolveModelSpec,
   validateModelId,
   classifyError,

package/src/agent-cli-provider/contract-parse.ts

@@ -62,9 +62,16 @@ export function parseOutputEvents(
   }
 ): { readonly events: readonly OutputEvent[]; readonly diagnostics: readonly ContractEvidence[] } {
   const diagnostics = [...collectParseDiagnostics(fragments.sources)];
+  const protocolChunk =
+    adapter.id === 'pi'
+      ? ((
+          fragments.sources.find((source) => source.name === 'stdout') ??
+          fragments.sources.find((source) => source.name === 'jsonl')
+        )?.value ?? '')
+      : fragments.chunk;
   try {
     return {
-      events: parseProviderChunk(adapter.id, fragments.chunk),
+      events: parseProviderChunk(adapter.id, protocolChunk),
       diagnostics,
     };
   } catch (error) {

package/src/agent-cli-provider/invoke-evidence.ts

@@ -20,6 +20,16 @@ function classifyParsedFailure(
   });
 }
 
+function classifyMissingPiSettlement(
+  adapter: ProviderAdapter,
+  events: readonly OutputEvent[]
+): ErrorClassification | null {
+  if (adapter.id !== 'pi' || events.some((event) => event.type === 'result')) return null;
+  return classifyProviderError('pi', {
+    message: 'Pi JSON stream ended before agent_settled.',
+  });
+}
+
 export function providerFailureClassification(
   adapter: ProviderAdapter,
   result: ProcessResult,
@@ -31,7 +41,7 @@ export function providerFailureClassification(
     });
   }
   if (result.exitCode === 0 && result.signal === null) {
-    return classifyParsedFailure(adapter, events);
+    return classifyParsedFailure(adapter, events) ?? classifyMissingPiSettlement(adapter, events);
   }
   return classifyProviderError(adapter.id, {
     message: result.stderr || result.stdout || `Provider exited with code ${result.exitCode ?? ''}`,

package/src/agent-cli-provider/pi/credentials.ts

@@ -0,0 +1,47 @@
+export const PI_CREDENTIAL_ENV_KEYS = [
+  'ANTHROPIC_AUTH_TOKEN',
+  'ANTHROPIC_OAUTH_TOKEN',
+  'ANTHROPIC_API_KEY',
+  'ANT_LING_API_KEY',
+  'QWEN_TOKEN_PLAN_API_KEY',
+  'QWEN_TOKEN_PLAN_CN_API_KEY',
+  'OPENAI_API_KEY',
+  'AZURE_OPENAI_API_KEY',
+  'NVIDIA_API_KEY',
+  'DEEPSEEK_API_KEY',
+  'GEMINI_API_KEY',
+  'GOOGLE_CLOUD_API_KEY',
+  'GROQ_API_KEY',
+  'CEREBRAS_API_KEY',
+  'XAI_API_KEY',
+  'RADIUS_API_KEY',
+  'OPENROUTER_API_KEY',
+  'AI_GATEWAY_API_KEY',
+  'ZAI_API_KEY',
+  'ZAI_CODING_CN_API_KEY',
+  'MISTRAL_API_KEY',
+  'MINIMAX_API_KEY',
+  'MINIMAX_CN_API_KEY',
+  'MOONSHOT_API_KEY',
+  'HF_TOKEN',
+  'FIREWORKS_API_KEY',
+  'TOGETHER_API_KEY',
+  'BASETEN_API_KEY',
+  'OPENCODE_API_KEY',
+  'KIMI_API_KEY',
+  'CLOUDFLARE_API_KEY',
+  'XIAOMI_API_KEY',
+  'XIAOMI_TOKEN_PLAN_CN_API_KEY',
+  'XIAOMI_TOKEN_PLAN_AMS_API_KEY',
+  'XIAOMI_TOKEN_PLAN_SGP_API_KEY',
+  'COPILOT_GITHUB_TOKEN',
+  'AWS_ACCESS_KEY_ID',
+  'AWS_SECRET_ACCESS_KEY',
+  'AWS_SESSION_TOKEN',
+  'AWS_BEARER_TOKEN_BEDROCK',
+  'AWS_PROFILE',
+  'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+  'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+  'AWS_WEB_IDENTITY_TOKEN_FILE',
+  'GOOGLE_APPLICATION_CREDENTIALS',
+] as const;