@vinihcrosa/lumem-os 0.2.0 → 0.3.0

package/dist/server/main.mjs

@@ -13993,7 +13993,7 @@ var require_redact = __commonJS({
       } = options;
       validatePaths(paths);
       const pathStructure = buildPathStructure(paths);
-      return function redact(obj) {
+      return function redact2(obj) {
         if (strict && (obj === null || typeof obj !== "object")) {
           if (obj === null || obj === void 0) {
             return serialize ? serialize(obj) : obj;
@@ -17554,7 +17554,7 @@ var require_pino = __commonJS({
       const { opts, stream } = normalize5(instance, caller(), ...args);
       if (opts.level && typeof opts.level === "string" && DEFAULT_LEVELS[opts.level.toLowerCase()] !== void 0) opts.level = opts.level.toLowerCase();
       const {
-        redact,
+        redact: redact2,
         crlf,
         serializers: serializers2,
         timestamp,
@@ -17588,8 +17588,8 @@ var require_pino = __commonJS({
       const stringifyFn = stringify2.bind({
         [stringifySafeSym]: stringifySafe
       });
-      const stringifiers = redact ? redaction(redact, stringifyFn) : {};
-      const formatOpts = redact ? { stringify: stringifiers[redactFmtSym] } : { stringify: stringifyFn };
+      const stringifiers = redact2 ? redaction(redact2, stringifyFn) : {};
+      const formatOpts = redact2 ? { stringify: stringifiers[redactFmtSym] } : { stringify: stringifyFn };
       const end = "}" + (crlf ? "\r\n" : "\n");
       const coreChindings = asChindings.bind(null, {
         [chindingsSym]: "",
@@ -55132,7 +55132,7 @@ var require_content_disposition = __commonJS({
     "use strict";
     module.exports = contentDisposition;
     module.exports.parse = parse5;
-    var basename4 = __require("path").basename;
+    var basename5 = __require("path").basename;
     var Buffer2 = require_safe_buffer().Buffer;
     var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g;
     var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/;
@@ -55168,9 +55168,9 @@ var require_content_disposition = __commonJS({
       if (typeof fallback === "string" && NON_LATIN1_REGEXP.test(fallback)) {
         throw new TypeError("fallback must be ISO-8859-1 string");
       }
-      var name = basename4(filename);
+      var name = basename5(filename);
       var isQuotedString = TEXT_REGEXP.test(name);
-      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename4(fallback);
+      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename5(fallback);
       var hasFallback = typeof fallbackName === "string" && fallbackName !== name;
       if (hasFallback || !isQuotedString || HEX_ESCAPE_REGEXP.test(name)) {
         params["filename*"] = name;
@@ -60404,16 +60404,46 @@ function encodeAcpServerMessage(message) {
   return JSON.stringify(message);
 }
 
+// ../shared/src/adapters.ts
+function adapterInstallCommand(spec) {
+  return spec.package === null ? null : `npm i -g ${spec.package}@${spec.pinnedVersion}`;
+}
+var CLAUDE_ADAPTER = {
+  id: "claude",
+  label: "Claude Code",
+  package: "@agentclientprotocol/claude-agent-acp",
+  // Duas strings porque não são a mesma string, e é exatamente essa a armadilha:
+  // o pacote é escopado e o binário não.
+  command: "claude-agent-acp",
+  pinnedVersion: "0.40.0",
+  cli: { command: "claude", install: null },
+  apiKeyEnv: ["ANTHROPIC_API_KEY"]
+};
+var CODEX_ADAPTER = {
+  id: "codex",
+  label: "Codex",
+  package: "@agentclientprotocol/codex-acp",
+  command: "codex-acp",
+  // Medido na fase 0, em 2026-09-06: é o que ele reportou como
+  // `agentInfo.version`.
+  pinnedVersion: "1.10.0",
+  // Null, e não `{ command: "codex" }` por simetria: ele traz o próprio.
+  cli: null,
+  apiKeyEnv: ["CODEX_API_KEY", "OPENAI_API_KEY"]
+};
+var ADAPTERS = [CLAUDE_ADAPTER, CODEX_ADAPTER];
+var DEFAULT_ADAPTER_ID = CLAUDE_ADAPTER.id;
+function adapterById(id) {
+  return ADAPTERS.find((spec) => spec.id === id) ?? null;
+}
+function adapterByCommand(command) {
+  return ADAPTERS.find((spec) => spec.command === command) ?? null;
+}
+
 // ../shared/src/constants.ts
-var LUMEM_VERSION = "0.2.0";
+var LUMEM_VERSION = "0.3.0";
 var DEFAULT_SERVER_PORT = 4317;
-var ACP_ADAPTER_COMMAND = "claude-agent-acp";
-var ACP_ADAPTER_PACKAGE = "@agentclientprotocol/claude-agent-acp";
-var ACP_ADAPTER_INSTALL = `npm i -g ${ACP_ADAPTER_PACKAGE}`;
-var CLAUDE_CLI_COMMAND = "claude";
-var ANTHROPIC_API_KEY_ENV = "ANTHROPIC_API_KEY";
 var MIN_GIT_VERSION = { major: 2, minor: 30 };
-var ACP_ADAPTER_PINNED_VERSION = "0.40.0";
 var ADAPTERS_DIR_NAME = "adapters";
 var ACP_AUTH_REQUIRED_CODE = -32e3;
 
@@ -66888,6 +66918,20 @@ var sessionUsage = sqliteTable(
     projectId: text("project_id").notNull(),
     /** A worktree, quando a sessão rodou numa. `''` quando ela é do projeto. */
     worktreeId: text("worktree_id").notNull().default(""),
+    /**
+     * Qual agente gastou (`second-agent`, F5).
+     *
+     * Resolvido na escrita, como o projeto e a worktree, e pela mesma razão: a
+     * pergunta "quanto cada agente custou" não pode depender de um join com a
+     * `session`, que é uma tabela que muda e de onde a linha pode sumir.
+     *
+     * Anulável, e sem chave estrangeira. Anulável porque a sessão de shell e a de
+     * script não têm agente, e porque a linha gravada **antes** desta coluna não
+     * ganha um agente inventado — ela fica de fora do agrupamento, o que é a
+     * verdade. Sem estrangeira porque consumo é histórico: apagar a configuração
+     * de ontem não pode apagar o que ela gastou.
+     */
+    agentConfigId: text("agent_config_id"),
     /** A variação da janela de contexto neste turno. Nunca negativa. */
     tokens: integer("tokens").notNull().default(0),
     /**
@@ -67046,95 +67090,8 @@ async function withConstraints(run3, translations) {
   }
 }
 
-// src/repositories/agentConfig.ts
-var DEFAULT_AGENT_CONFIG = {
-  name: "claude-code",
-  command: "claude",
-  args: [],
-  env: {},
-  transport: "pty"
-};
-function conflicts(name) {
-  return {
-    "unique:agent_config.name": {
-      code: "DUPLICATE",
-      message: `j\xE1 existe uma configura\xE7\xE3o chamada "${name}"`
-    },
-    foreignKey: {
-      code: "IN_USE",
-      message: "a configura\xE7\xE3o ainda est\xE1 em uso por alguma sess\xE3o"
-    },
-    // Without this the CHECK surfaces as a raw SQLite error, which reads as a
-    // daemon defect rather than as the one thing the caller got wrong.
-    "check:agent_config_adapter_version": {
-      code: "INVALID_ARGUMENT",
-      message: "configura\xE7\xE3o ACP precisa de uma vers\xE3o de adaptador fixa, e configura\xE7\xE3o PTY n\xE3o pode ter uma"
-    },
-    "check:agent_config_transport": {
-      code: "INVALID_ARGUMENT",
-      message: "transporte precisa ser pty ou acp"
-    }
-  };
-}
-function createAgentConfigRepository(db) {
-  async function require_(id) {
-    const found = await db.query.agentConfig.findFirst({ where: eq(agentConfig.id, id) });
-    if (!found) throw new DomainError("NOT_FOUND", `configura\xE7\xE3o ${id} n\xE3o existe`);
-    return found;
-  }
-  return {
-    async create({ name, command, args = [], env = {}, transport = "pty", adapterVersion = null }) {
-      const [row] = await withConstraints(
-        () => db.insert(agentConfig).values({ id: newId(), name, command, args, env, transport, adapterVersion }).returning(),
-        conflicts(name)
-      );
-      return row;
-    },
-    list() {
-      return db.select().from(agentConfig).orderBy(asc(agentConfig.name));
-    },
-    findById(id) {
-      return db.query.agentConfig.findFirst({ where: eq(agentConfig.id, id) });
-    },
-    findByName(name) {
-      return db.query.agentConfig.findFirst({ where: eq(agentConfig.name, name) });
-    },
-    async update(id, input) {
-      const current = await require_(id);
-      const [row] = await withConstraints(
-        () => db.update(agentConfig).set({ ...input, updatedAt: /* @__PURE__ */ new Date() }).where(eq(agentConfig.id, id)).returning(),
-        conflicts(input.name ?? current.name)
-      );
-      return row;
-    },
-    async remove(id) {
-      await require_(id);
-      await withConstraints(
-        () => db.delete(agentConfig).where(eq(agentConfig.id, id)).returning(),
-        conflicts("")
-      );
-    },
-    async seedDefaults() {
-      const existing = await db.query.agentConfig.findFirst({
-        where: eq(agentConfig.name, DEFAULT_AGENT_CONFIG.name)
-      });
-      if (existing) return;
-      await db.insert(agentConfig).values({
-        id: newId(),
-        name: DEFAULT_AGENT_CONFIG.name,
-        command: DEFAULT_AGENT_CONFIG.command,
-        args: DEFAULT_AGENT_CONFIG.args ?? [],
-        env: DEFAULT_AGENT_CONFIG.env ?? {},
-        // Still PTY. The default configuration changes transport when the
-        // conversation can render one end to end, not when the column exists.
-        transport: DEFAULT_AGENT_CONFIG.transport ?? "pty"
-      });
-    }
-  };
-}
-
 // src/repositories/project.ts
-function conflicts2(name, path) {
+function conflicts(name, path) {
   return {
     "unique:project.workspace_id,project.name": {
       code: "DUPLICATE",
@@ -67162,7 +67119,7 @@ function createProjectRepository(db) {
     async create(input) {
       const [row] = await withConstraints(
         () => db.insert(project).values({ id: newId(), ...input }).returning(),
-        conflicts2(input.name, input.path)
+        conflicts(input.name, input.path)
       );
       return row;
     },
@@ -67183,7 +67140,7 @@ function createProjectRepository(db) {
       await require_(id);
       const [row] = await withConstraints(
         () => db.update(project).set({ name, updatedAt: /* @__PURE__ */ new Date() }).where(eq(project.id, id)).returning(),
-        conflicts2(name)
+        conflicts(name)
       );
       return row;
     },
@@ -67333,7 +67290,7 @@ function createWorkspaceRepository(db) {
 }
 
 // src/repositories/worktree.ts
-function conflicts3(name) {
+function conflicts2(name) {
   return {
     "unique:worktree.project_id,worktree.name": {
       code: "DUPLICATE",
@@ -67356,7 +67313,7 @@ function createWorktreeRepository(db) {
     async create(input) {
       const [row] = await withConstraints(
         () => db.insert(worktree).values({ id: newId(), ...input }).returning(),
-        conflicts3(input.name)
+        conflicts2(input.name)
       );
       return row;
     },
@@ -67374,7 +67331,7 @@ function createWorktreeRepository(db) {
       await require_(id);
       const [row] = await withConstraints(
         () => db.update(worktree).set({ state, updatedAt: /* @__PURE__ */ new Date() }).where(eq(worktree.id, id)).returning(),
-        conflicts3("")
+        conflicts2("")
       );
       return row;
     },
@@ -67382,7 +67339,7 @@ function createWorktreeRepository(db) {
       await require_(id);
       const [row] = await withConstraints(
         () => db.update(worktree).set({ path, updatedAt: /* @__PURE__ */ new Date() }).where(eq(worktree.id, id)).returning(),
-        conflicts3("")
+        conflicts2("")
       );
       return row;
     },
@@ -67600,7 +67557,6 @@ async function subdirectories(path) {
   return entries.filter((entry) => entry.isDirectory()).map((entry) => join4(path, entry.name));
 }
 async function reconcileOnBoot(options) {
-  await createAgentConfigRepository(options.db).seedDefaults();
   const layout = await migrateWorktreeLayout(options);
   const clones = await reconcileClones(options).catch(() => 0);
   const worktrees = await reconcileWorktrees(options);
@@ -82698,6 +82654,9 @@ var legacyClientNotificationMethods = /* @__PURE__ */ new Set([
   CLIENT_METHODS.elicitation_complete
 ]);
 
+// src/acp/AcpManager.ts
+import { basename as basename3 } from "node:path";
+
 // src/agents/availability.ts
 import { accessSync, constants } from "node:fs";
 import { delimiter, isAbsolute, join as join5 } from "node:path";
@@ -83945,6 +83904,82 @@ var AcpManager = class {
    * the spike measured both at zero: nothing is generated until `session/prompt`,
    * which never happens here.
    */
+  /**
+   * Entrar no agente, pelo método que o próprio agente ofereceu (F2, T10).
+   *
+   * O caminho que a `agent-login` construiu roda um **comando** num PTY, e ele
+   * continua valendo — é o que o `claude-agent-acp` oferece. Medido na fase 0
+   * (§4.2): o `codex-acp` não oferece comando nenhum. Os métodos dele são
+   * `api-key`, `chat-gpt` e `chat-gpt-device-code`, e os três se atravessam por
+   * **uma chamada**.
+   *
+   * Um processo por tentativa, e ele morre no fim. A credencial não fica aqui: é
+   * o adaptador que a escreve na casa dele — `~/.codex`, no caso — e é por isso
+   * que um processo curto basta. O que o Lumem guarda de tudo isto é nada.
+   *
+   * **Sem `withTimeout` no `authenticate`.** Todos os outros passos do protocolo
+   * são conversa entre dois programas e um limite de 15 s é generoso; este espera
+   * uma pessoa autorizar em outro lugar, e um limite aqui seria o daemon
+   * desistindo de alguém que está digitando um código. Quem desiste é quem
+   * clicou: o `signal` mata o processo.
+   */
+  async authenticate(options) {
+    if (options.methodId.trim() === "") {
+      throw new DomainError("INVALID_ARGUMENT", "sem o m\xE9todo n\xE3o h\xE1 como entrar");
+    }
+    const { session: session2, child } = this.launch(options, { probe: true });
+    session2.elicit = options.onElicitation;
+    session2.elicitDone = options.onElicitationDone;
+    const abort = () => child.kill();
+    options.signal?.addEventListener("abort", abort, { once: true });
+    try {
+      const initialize = await this.initialize(session2);
+      if (initialize.protocolVersion !== ACP_PROTOCOL_VERSION) {
+        throw new DomainError(
+          "SPAWN_FAILED",
+          `o adaptador fala a vers\xE3o ${initialize.protocolVersion} do protocolo, e este daemon fala a ${ACP_PROTOCOL_VERSION}`
+        );
+      }
+      const offered = (initialize.authMethods ?? []).some(
+        (method) => method.id === options.methodId
+      );
+      if (!offered) {
+        throw new DomainError(
+          "NOT_FOUND",
+          `o adaptador n\xE3o oferece o m\xE9todo de login "${options.methodId}"`
+        );
+      }
+      await session2.connection.agent.request("authenticate", {
+        methodId: options.methodId,
+        /*
+         * A chave viaja no `_meta` e não fica em lugar nenhum.
+         *
+         * Medido no pacote: `authenticateWithApiKey` lê
+         * `_meta["api-key"].apiKey` e, na falta dele, o ambiente
+         * (`CODEX_API_KEY`, `OPENAI_API_KEY`). O daemon é o carteiro — ele não
+         * grava, não loga e não devolve.
+         */
+        ...options.apiKey === void 0 ? {} : { _meta: { "api-key": { apiKey: options.apiKey } } }
+      });
+      try {
+        await this.withTimeout(
+          session2.connection.agent.request("session/new", { cwd: options.cwd, mcpServers: [] }),
+          "session/new"
+        );
+      } catch (error40) {
+        if (isAuthRequired(error40)) {
+          throw new DomainError(
+            "BLOCKED",
+            "o adaptador aceitou o login e continua pedindo credencial \u2014 a conta n\xE3o serve para esta sess\xE3o"
+          );
+        }
+        throw error40;
+      }
+    } finally {
+      options.signal?.removeEventListener("abort", abort);
+      child.kill();
+    }
+  }
   async probe(options) {
     const startedAt = this.now();
     const { session: session2, child } = this.launch(options, { probe: true });
@@ -84052,6 +84087,8 @@ var AcpManager = class {
       },
       process: child,
       connection: void 0,
+      elicit: void 0,
+      elicitDone: void 0,
       listeners: /* @__PURE__ */ new Set(),
       openToolCalls: /* @__PURE__ */ new Set(),
       pendingPermissions: /* @__PURE__ */ new Map(),
@@ -84367,6 +84404,21 @@ var AcpManager = class {
     }).onRequest("terminal/release", ({ params }) => {
       this.requireTerminals(session2).release(params.terminalId);
       return {};
+    }).onRequest("elicitation/create", ({ params }) => {
+      const record2 = params;
+      const url2 = record2["url"];
+      if (session2.elicit === void 0 || params.mode !== "url" || typeof url2 !== "string") {
+        return { action: "decline" };
+      }
+      session2.elicit({
+        elicitationId: String(record2["elicitationId"] ?? ""),
+        url: url2,
+        message: params.message,
+        code: codeIn(params.message)
+      });
+      return { action: "accept" };
+    }).onNotification("elicitation/complete", ({ params }) => {
+      session2.elicitDone?.(params.elicitationId);
     }).onRequest("session/request_permission", ({ params }) => {
       const requestId = newId();
       const options = params.options.map((option) => ({
@@ -84518,7 +84570,20 @@ var AcpManager = class {
            * Gated on the `PtyManager` too: the methods it offers are commands, and
            * a client that cannot run one has no business being offered it.
            */
-          ...this.ptyManager ? { auth: { terminal: true } } : {}
+          ...this.ptyManager ? { auth: { terminal: true } } : {},
+          /*
+           * "Eu sei mostrar uma URL", declarado porque os dois métodos existem.
+           *
+           * Medido na fase 0 da `second-agent` (§4.2): sem isto, o `codex-acp`
+           * não oferece `chat-gpt-device-code` — o único método dele que **não**
+           * abre um navegador na máquina do daemon. Declarar é o que faz o
+           * método aparecer, e é por isso que ele não é opcional aqui.
+           *
+           * Não é gatilhado no `ptyManager` como o `auth.terminal`: mostrar uma
+           * URL não precisa de terminal nenhum, e o que responde ao pedido é o
+           * `elicitation/create` acima, que existe sempre.
+           */
+          elicitation: { url: {} }
         },
         ...this.ptyManager ? { _meta: { "terminal-auth": true } } : {},
         clientInfo: { name: "lumem", version: LUMEM_CLIENT_VERSION }
@@ -84618,6 +84683,9 @@ var AcpManager = class {
         modeId: value
       });
       session2.info.mode = value;
+      session2.info.configOptions = session2.info.configOptions.map(
+        (option) => option.id === MODE_OPTION ? { ...option, currentValue: value } : option
+      );
       this.emitConfig(session2);
       return;
     }
@@ -84832,7 +84900,8 @@ function commandOf(toolCall) {
 }
 function notInstalled(command, adapterVersion) {
   const pinned = adapterVersion ?? "";
-  const remedy = pinned ? `npm i -g @agentclientprotocol/claude-agent-acp@${pinned}` : `instale o adaptador e deixe "${command}" no PATH`;
+  const spec = adapterByCommand(basename3(command));
+  const remedy = spec !== null && spec.package !== null ? `npm i -g ${spec.package}@${pinned || spec.pinnedVersion}` : `instale o adaptador e deixe "${command}" no PATH`;
   const version3 = pinned ? ` Esta sess\xE3o fixa a vers\xE3o ${pinned}.` : "";
   return new DomainError(
     "SPAWN_FAILED",
@@ -84848,6 +84917,10 @@ function launchFailure(command, adapterVersion, cause) {
     { cause }
   );
 }
+function codeIn(message) {
+  const match = /\b([A-Z0-9]{4}-[A-Z0-9]{4}|[A-Z0-9]{6,12})\b/.exec(message);
+  return match?.[1] ?? null;
+}
 function isAuthRequired(error40) {
   const code = error40.code;
   return code === ACP_AUTH_REQUIRED_CODE;
@@ -86666,6 +86739,70 @@ function parseWrite(requested) {
   throw new DomainError("INVALID_ARGUMENT", `${field} \u2014 ${issue2?.message ?? "inv\xE1lido"}`);
 }
 
+// src/repositories/agentConfig.ts
+function conflicts3(name) {
+  return {
+    "unique:agent_config.name": {
+      code: "DUPLICATE",
+      message: `j\xE1 existe uma configura\xE7\xE3o chamada "${name}"`
+    },
+    foreignKey: {
+      code: "IN_USE",
+      message: "a configura\xE7\xE3o ainda est\xE1 em uso por alguma sess\xE3o"
+    },
+    // Without this the CHECK surfaces as a raw SQLite error, which reads as a
+    // daemon defect rather than as the one thing the caller got wrong.
+    "check:agent_config_adapter_version": {
+      code: "INVALID_ARGUMENT",
+      message: "configura\xE7\xE3o ACP precisa de uma vers\xE3o de adaptador fixa, e configura\xE7\xE3o PTY n\xE3o pode ter uma"
+    },
+    "check:agent_config_transport": {
+      code: "INVALID_ARGUMENT",
+      message: "transporte precisa ser pty ou acp"
+    }
+  };
+}
+function createAgentConfigRepository(db) {
+  async function require_(id) {
+    const found = await db.query.agentConfig.findFirst({ where: eq(agentConfig.id, id) });
+    if (!found) throw new DomainError("NOT_FOUND", `configura\xE7\xE3o ${id} n\xE3o existe`);
+    return found;
+  }
+  return {
+    async create({ name, command, args = [], env = {}, transport = "pty", adapterVersion = null }) {
+      const [row] = await withConstraints(
+        () => db.insert(agentConfig).values({ id: newId(), name, command, args, env, transport, adapterVersion }).returning(),
+        conflicts3(name)
+      );
+      return row;
+    },
+    list() {
+      return db.select().from(agentConfig).orderBy(asc(agentConfig.name));
+    },
+    findById(id) {
+      return db.query.agentConfig.findFirst({ where: eq(agentConfig.id, id) });
+    },
+    findByName(name) {
+      return db.query.agentConfig.findFirst({ where: eq(agentConfig.name, name) });
+    },
+    async update(id, input) {
+      const current = await require_(id);
+      const [row] = await withConstraints(
+        () => db.update(agentConfig).set({ ...input, updatedAt: /* @__PURE__ */ new Date() }).where(eq(agentConfig.id, id)).returning(),
+        conflicts3(input.name ?? current.name)
+      );
+      return row;
+    },
+    async remove(id) {
+      await require_(id);
+      await withConstraints(
+        () => db.delete(agentConfig).where(eq(agentConfig.id, id)).returning(),
+        conflicts3("")
+      );
+    }
+  };
+}
+
 // src/memory/projection.ts
 import { relative as relative4, isAbsolute as isAbsolute5 } from "node:path";
 var MAX_FILES = 12;
@@ -87155,6 +87292,7 @@ function trackSessionUsage({ db, acpManager, log }) {
         sessionId,
         projectId: scope.projectId,
         worktreeId: scope.worktreeId,
+        agentConfigId: scope.agentConfigId,
         tokens,
         ...cost === null ? {} : { cost: cost.amount, currency: cost.currency }
       }).run();
@@ -87170,10 +87308,95 @@ function trackSessionUsage({ db, acpManager, log }) {
 async function scopeOf(db, sessionId) {
   const row = await createSessionRepository(db).findById(sessionId);
   if (row === void 0) return null;
-  if (row.scopeType === "project") return { projectId: row.scopeId, worktreeId: "" };
+  const agentConfigId = row.agentConfigId ?? null;
+  if (row.scopeType === "project") {
+    return { projectId: row.scopeId, worktreeId: "", agentConfigId };
+  }
   const worktree2 = await createWorktreeRepository(db).findById(row.scopeId);
   if (worktree2 === void 0) return null;
-  return { projectId: worktree2.projectId, worktreeId: worktree2.id };
+  return { projectId: worktree2.projectId, worktreeId: worktree2.id, agentConfigId };
+}
+
+// src/setup/agent-auth.ts
+function redact(message, secret) {
+  if (secret === void 0 || secret === "") return message;
+  return message.split(secret).join("\u2022\u2022\u2022");
+}
+function createAgentAuthService({
+  acpManager
+}) {
+  const attempts = /* @__PURE__ */ new Map();
+  function require_(id) {
+    const attempt = attempts.get(id);
+    if (attempt === void 0) {
+      throw new DomainError("NOT_FOUND", `n\xE3o existe login em andamento com o id ${id}`);
+    }
+    return attempt;
+  }
+  function view({ id, state, elicitation, message }) {
+    return { id, state, elicitation, message };
+  }
+  return {
+    start(options) {
+      const attempt = {
+        id: newId(),
+        state: "running",
+        elicitation: null,
+        message: null,
+        controller: new AbortController()
+      };
+      attempts.set(attempt.id, attempt);
+      void acpManager.authenticate({
+        command: options.command,
+        ...options.args ? { args: options.args } : {},
+        cwd: options.cwd,
+        methodId: options.methodId,
+        ...options.apiKey === void 0 ? {} : { apiKey: options.apiKey },
+        ...options.adapterVersion === void 0 ? {} : { adapterVersion: options.adapterVersion },
+        onElicitation: (elicitation) => {
+          attempt.elicitation = elicitation;
+        },
+        onElicitationDone: (elicitationId) => {
+          if (attempt.elicitation?.elicitationId === elicitationId) {
+            attempt.elicitation = null;
+          }
+        },
+        signal: attempt.controller.signal
+      }).then(() => {
+        if (attempt.state === "running") attempt.state = "ok";
+        attempt.elicitation = null;
+      }).catch((error40) => {
+        if (attempt.state === "cancelled") return;
+        attempt.state = "failed";
+        attempt.elicitation = null;
+        attempt.message = redact(
+          error40 instanceof Error ? error40.message : "o adaptador recusou o login",
+          options.apiKey
+        );
+      });
+      return view(attempt);
+    },
+    status(id) {
+      return view(require_(id));
+    },
+    cancel(id) {
+      const attempt = require_(id);
+      if (attempt.state === "running") {
+        attempt.state = "cancelled";
+        attempt.elicitation = null;
+        attempt.controller.abort();
+      }
+      return view(attempt);
+    },
+    cancelAll() {
+      for (const attempt of attempts.values()) {
+        if (attempt.state === "running") {
+          attempt.state = "cancelled";
+          attempt.controller.abort();
+        }
+      }
+    }
+  };
 }
 
 // src/memory/skill.ts
@@ -94543,7 +94766,7 @@ function allows(options, strategy) {
 // src/routers/project.ts
 import { existsSync as existsSync5 } from "node:fs";
 import { rename as rename4, rm as rm7 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname11, isAbsolute as isAbsolute6, normalize as normalize4 } from "node:path";
+import { basename as basename4, dirname as dirname11, isAbsolute as isAbsolute6, normalize as normalize4 } from "node:path";
 
 // src/git/clone.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -94950,7 +95173,7 @@ var projectRouter = router({
         registerProject(ctx, {
           workspaceId: input.workspaceId,
           path: input.path,
-          name: input.name ?? basename3(input.path)
+          name: input.name ?? basename4(input.path)
         })
       )
     )
@@ -95448,42 +95671,86 @@ async function detectAgents({
   path = process.env["PATH"],
   env = process.env,
   run: run3 = runCommand,
+  specs = ADAPTERS,
   installedAt
 } = {}) {
-  const [claude, adapter] = await Promise.all([
-    inspect(CLAUDE_CLI_COMMAND, null, { path, run: run3 }),
-    inspect(ACP_ADAPTER_COMMAND, ACP_ADAPTER_INSTALL, { path, run: run3, preferred: installedAt })
+  const adapters = await Promise.all(
+    specs.map(async (spec) => reportFor(spec, { path, env, run: run3, installedAt }))
+  );
+  return { adapters };
+}
+async function reportFor(spec, {
+  path,
+  env,
+  run: run3,
+  installedAt
+}) {
+  const [adapter, cli] = await Promise.all([
+    inspect(spec.command, adapterInstallCommand(spec), {
+      path,
+      run: run3,
+      ...installedAt === void 0 ? {} : { preferred: installedAt(spec) }
+    }),
+    spec.cli === null ? Promise.resolve(null) : inspect(spec.cli.command, spec.cli.install, { path, run: run3 })
   ]);
-  const key = env[ANTHROPIC_API_KEY_ENV];
-  return { claude, adapter, apiKeyInEnv: key !== void 0 && key.trim() !== "" };
+  return {
+    id: spec.id,
+    label: spec.label,
+    adapter,
+    cli,
+    apiKeyEnv: spec.apiKeyEnv.find((name) => (env[name] ?? "").trim() !== "") ?? null
+  };
 }
 
 // src/setup/install-adapter.ts
 import { existsSync as existsSync6 } from "node:fs";
 import { mkdir as mkdir8 } from "node:fs/promises";
 import { join as join18 } from "node:path";
-function adapterBinaryPath(dir) {
-  return join18(dir, "node_modules", ".bin", ACP_ADAPTER_COMMAND);
+function adapterDir(dir, spec = CLAUDE_ADAPTER) {
+  return join18(dir, spec.id);
+}
+function adapterBinaryPath(dir, spec = CLAUDE_ADAPTER) {
+  return join18(adapterDir(dir, spec), "node_modules", ".bin", spec.command);
+}
+function legacyAdapterBinaryPath(dir, spec) {
+  return join18(dir, "node_modules", ".bin", spec.command);
 }
 async function installAdapter({
+  spec = CLAUDE_ADAPTER,
   dir,
   run: run3 = runCommand,
-  timeoutMs = 12e4
+  timeoutMs = 12e4,
+  resolve: resolve6 = resolveCommandPath
 }) {
-  const binary = adapterBinaryPath(dir);
+  if (spec.package === null) {
+    const found = resolve6(spec.command);
+    if (found === null) {
+      throw new DomainError(
+        "NOT_FOUND",
+        `${spec.label} n\xE3o tem adaptador para instalar: o bin\xE1rio ${spec.command} tem que estar no PATH, e n\xE3o est\xE1`
+      );
+    }
+    return { path: found, version: spec.pinnedVersion, alreadyInstalled: true };
+  }
+  const target = adapterDir(dir, spec);
+  const binary = adapterBinaryPath(dir, spec);
   if (existsSync6(binary)) {
-    return { path: binary, version: ACP_ADAPTER_PINNED_VERSION, alreadyInstalled: true };
+    return { path: binary, version: spec.pinnedVersion, alreadyInstalled: true };
+  }
+  const legacy = legacyAdapterBinaryPath(dir, spec);
+  if (existsSync6(legacy)) {
+    return { path: legacy, version: spec.pinnedVersion, alreadyInstalled: true };
   }
-  await mkdir8(dir, { recursive: true });
+  await mkdir8(target, { recursive: true });
   const outcome = await run3(
     "npm",
     [
       "install",
       "--prefix",
-      dir,
+      target,
       "--no-fund",
       "--no-audit",
-      `${ACP_ADAPTER_PACKAGE}@${ACP_ADAPTER_PINNED_VERSION}`
+      `${spec.package}@${spec.pinnedVersion}`
     ],
     { timeoutMs }
   );
@@ -95500,10 +95767,10 @@ ${outcome.output}`.trim()
   if (!existsSync6(binary)) {
     throw new DomainError(
       "SPAWN_FAILED",
-      `o npm terminou sem erro mas ${binary} n\xE3o existe \u2014 o pacote ${ACP_ADAPTER_PACKAGE} pode ter mudado de layout`
+      `o npm terminou sem erro mas ${binary} n\xE3o existe \u2014 o pacote ${spec.package} pode ter mudado de layout`
     );
   }
-  return { path: binary, version: ACP_ADAPTER_PINNED_VERSION, alreadyInstalled: false };
+  return { path: binary, version: spec.pinnedVersion, alreadyInstalled: false };
 }
 
 // src/setup/login.ts
@@ -95698,6 +95965,17 @@ function diskCheck(config2, freeBytes) {
 }
 
 // src/routers/setup.ts
+function adaptersDir(stateDir) {
+  return join19(stateDir, ADAPTERS_DIR_NAME);
+}
+function specOf(id) {
+  const spec = adapterById(id ?? DEFAULT_ADAPTER_ID);
+  if (spec === null) {
+    throw new DomainError("INVALID_ARGUMENT", `n\xE3o existe adaptador "${id}" no cat\xE1logo`);
+  }
+  return spec;
+}
+var adapterInput = external_exports.object({ adapterId: external_exports.string().trim().min(1).optional() }).optional();
 var setupRouter = router({
   /** The five checks, each one able to fail without the others. */
   preflight: publicProcedure.query(({ ctx }) => preflight({ config: ctx.config })),
@@ -95709,7 +95987,9 @@ var setupRouter = router({
    * have it globally, and the flow must not ask twice for the same thing.
    */
   agents: publicProcedure.query(
-    ({ ctx }) => detectAgents({ installedAt: adapterBinaryPath(join19(ctx.config.stateDir, ADAPTERS_DIR_NAME)) })
+    ({ ctx }) => detectAgents({
+      installedAt: (spec) => adapterBinaryPath(adaptersDir(ctx.config.stateDir), spec)
+    })
   ),
   /**
    * Installs the adapter into the daemon's own directory, at the pinned version.
@@ -95718,9 +95998,9 @@ var setupRouter = router({
    * costs is named in `install-adapter.ts` — the daemon runs a package manager and
    * then executes what it downloaded.
    */
-  installAdapter: publicProcedure.mutation(
-    ({ ctx }) => domainSafeAsync(
-      () => installAdapter({ dir: join19(ctx.config.stateDir, ADAPTERS_DIR_NAME) })
+  installAdapter: publicProcedure.input(adapterInput).mutation(
+    ({ ctx, input }) => domainSafeAsync(
+      () => installAdapter({ spec: specOf(input?.adapterId), dir: adaptersDir(ctx.config.stateDir) })
     )
   ),
   /**
@@ -95736,6 +96016,8 @@ var setupRouter = router({
       methodId: external_exports.string().trim().min(1),
       /** Which adapter to ask. Defaults to what the flow installed or found. */
       command: external_exports.string().trim().min(1).optional(),
+      /** Which catalogued adapter, when no explicit command is given. */
+      adapterId: external_exports.string().trim().min(1).optional(),
       /**
        * And its arguments, because a command without them is a different program.
        *
@@ -95748,7 +96030,7 @@ var setupRouter = router({
     })
   ).mutation(
     ({ ctx, input }) => domainSafeAsync(async () => {
-      const command = input.command ?? ACP_ADAPTER_COMMAND;
+      const command = input.command ?? specOf(input.adapterId).command;
       const cwd = join19(ctx.config.stateDir, "probe");
       const report = await ctx.acpManager.probe({
         command,
@@ -95778,6 +96060,60 @@ var setupRouter = router({
       });
     })
   ),
+  /**
+   * Entrar no agente, pela chamada que o próprio agente ofereceu (T10, T11).
+   *
+   * Três procedimentos e nenhum bloqueante, porque um deles espera **uma
+   * pessoa**: o `authenticate` de um método de navegador fica pendurado até
+   * alguém autorizar noutro lugar, e o pedido de mostrar uma URL chega no meio
+   * dessa espera. Começar e perguntar é o mesmo desenho do login por comando, que
+   * devolvia um `ptySessionId` para o cliente acompanhar.
+   *
+   * O `command` continua sendo conferido contra o handshake — o cliente manda um
+   * `methodId`, e o que roda é o que o adaptador declarou para aquele id.
+   */
+  authenticate: publicProcedure.input(
+    external_exports.object({
+      methodId: external_exports.string().trim().min(1),
+      /** Qual adaptador, quando não vem um comando explícito. */
+      adapterId: external_exports.string().trim().min(1).optional(),
+      command: external_exports.string().trim().min(1).optional(),
+      args: external_exports.array(external_exports.string()).optional(),
+      /**
+       * A chave, quando o método pede uma.
+       *
+       * Ela entra por aqui, atravessa o daemon e vai para o adaptador. Não é
+       * gravada, não é logada e **não volta** em nenhuma resposta — o que volta
+       * é o estado da tentativa.
+       */
+      apiKey: external_exports.string().min(1).optional()
+    })
+  ).mutation(
+    ({ ctx, input }) => domainSafeAsync(() => {
+      const spec = specOf(input.adapterId);
+      const cwd = join19(ctx.config.stateDir, "probe");
+      mkdirSync4(cwd, { recursive: true });
+      return Promise.resolve(
+        ctx.agentAuth.start({
+          command: input.command ?? spec.command,
+          ...input.args === void 0 ? {} : { args: input.args },
+          cwd,
+          methodId: input.methodId,
+          ...input.apiKey === void 0 ? {} : { apiKey: input.apiKey },
+          adapterVersion: spec.pinnedVersion
+        })
+      );
+    })
+  ),
+  /** O estado de uma tentativa de login. É o que a tela pergunta enquanto espera. */
+  authState: publicProcedure.input(external_exports.object({ loginId: external_exports.string().trim().min(1) })).query(({ ctx, input }) => domainSafe(() => ctx.agentAuth.status(input.loginId))),
+  /**
+   * Desistir: mata o adaptador.
+   *
+   * Não há "cancelar" no protocolo — o `authenticate` está esperando uma pessoa,
+   * e a única forma de parar de esperar é o processo acabar. Ele é do daemon.
+   */
+  cancelAuth: publicProcedure.input(external_exports.object({ loginId: external_exports.string().trim().min(1) })).mutation(({ ctx, input }) => domainSafe(() => ctx.agentAuth.cancel(input.loginId))),
   /**
    * One handshake, then the process dies.
    *
@@ -95789,11 +96125,13 @@ var setupRouter = router({
     external_exports.object({
       /** Defaults to the adapter the flow installs. */
       command: external_exports.string().trim().min(1).optional(),
+      /** Which catalogued adapter, when no explicit command is given. */
+      adapterId: external_exports.string().trim().min(1).optional(),
       args: external_exports.array(external_exports.string()).optional()
     }).optional()
   ).query(
     ({ ctx, input }) => domainSafeAsync(async () => {
-      const command = input?.command ?? ACP_ADAPTER_COMMAND;
+      const command = input?.command ?? specOf(input?.adapterId).command;
       const cwd = join19(ctx.config.stateDir, "probe");
       try {
         mkdirSync4(cwd, { recursive: true });
@@ -95871,6 +96209,32 @@ function usageByWorktree(db, { projectId, period: period2, now }) {
     and(eq(sessionUsage.worktreeId, worktree.id), gte(sessionUsage.createdAt, since))
   ).where(eq(worktree.projectId, projectId)).groupBy(worktree.id).orderBy(sql`${SUM.tokens} desc`, worktree.name).all();
 }
+function usageByProjectAndAgent(db, { workspaceId, period: period2, now }) {
+  const since = windowStart(period2, now);
+  return db.select({
+    projectId: sessionUsage.projectId,
+    agentConfigId: sessionUsage.agentConfigId,
+    // `max` e não `min`: dá no mesmo dentro de um grupo — o join é por id — e
+    // é o mesmo truque que a moeda já usa para atravessar um `GROUP BY`.
+    name: sql`max(${agentConfig.name})`,
+    tokens: SUM.tokens,
+    cost: SUM.cost,
+    currency: SUM.currency,
+    turns: SUM.turns
+  }).from(sessionUsage).innerJoin(project, eq(project.id, sessionUsage.projectId)).leftJoin(agentConfig, eq(agentConfig.id, sessionUsage.agentConfigId)).where(and(eq(project.workspaceId, workspaceId), gte(sessionUsage.createdAt, since))).groupBy(sessionUsage.projectId, sessionUsage.agentConfigId).orderBy(sql`${SUM.tokens} desc`).all();
+}
+function usageByWorktreeAndAgent(db, { projectId, period: period2, now }) {
+  const since = windowStart(period2, now);
+  return db.select({
+    worktreeId: sessionUsage.worktreeId,
+    agentConfigId: sessionUsage.agentConfigId,
+    name: sql`max(${agentConfig.name})`,
+    tokens: SUM.tokens,
+    cost: SUM.cost,
+    currency: SUM.currency,
+    turns: SUM.turns
+  }).from(sessionUsage).leftJoin(agentConfig, eq(agentConfig.id, sessionUsage.agentConfigId)).where(and(eq(sessionUsage.projectId, projectId), gte(sessionUsage.createdAt, since))).groupBy(sessionUsage.worktreeId, sessionUsage.agentConfigId).orderBy(sql`${SUM.tokens} desc`).all();
+}
 function usageOutsideWorktrees(db, { projectId, period: period2, now }) {
   const since = windowStart(period2, now);
   const [row] = db.select({ tokens: SUM.tokens, cost: SUM.cost, currency: SUM.currency, turns: SUM.turns }).from(sessionUsage).where(
@@ -95907,7 +96271,21 @@ var usageRouter = router({
       projectId: input.projectId,
       period: input.period
     })
-  }))
+  })),
+  /*
+   * O mesmo consumo por agente (`second-agent`, F5).
+   *
+   * Procedimentos separados, e não um `groupBy` nos dois de cima: a resposta
+   * agrupada tem uma linha por par, e enfiá-la na mesma chamada mudaria a forma
+   * do que a tela do workspace já lê. A tela só pede isto quando há **mais de um
+   * agente** — com um, a coluna não existe e a chamada não acontece (C5).
+   */
+  byProjectAndAgent: publicProcedure.input(external_exports.object({ workspaceId: external_exports.string().min(1), period })).query(
+    ({ ctx, input }) => usageByProjectAndAgent(ctx.db, { workspaceId: input.workspaceId, period: input.period })
+  ),
+  byWorktreeAndAgent: publicProcedure.input(external_exports.object({ projectId: external_exports.string().min(1), period })).query(
+    ({ ctx, input }) => usageByWorktreeAndAgent(ctx.db, { projectId: input.projectId, period: input.period })
+  )
 });
 
 // src/routers/workspace.ts
@@ -96142,6 +96520,7 @@ async function createServer2({
     // noutra aba aparecer nesta sem esperar o próximo ciclo.
     onChange: (projectId) => events.emit({ type: "pr.changed", projectId })
   }),
+  agentAuth = createAgentAuthService({ acpManager }),
   logger = false
 }) {
   const app = (0, import_fastify2.default)({
@@ -96162,6 +96541,7 @@ async function createServer2({
     clones,
     pr,
     prHost,
+    agentAuth,
     events
   });
   await app.register(fastifyTRPCPlugin, {
@@ -96297,6 +96677,7 @@ async function bootstrap({
       askUrl: `http://${config2.host}:${String(config2.port)}/memory/ask`
     })
   });
+  const agentAuth = createAgentAuthService({ acpManager: acp });
   const sessionStore = createSessionStore({
     db: openedDatabase.db,
     ptyManager,
@@ -96359,6 +96740,7 @@ async function bootstrap({
       }
     }),
     events,
+    agentAuth,
     logger
   });
   bootedApp = app;
@@ -96370,6 +96752,7 @@ async function bootstrap({
       stopUsageTracking();
       await ptyManager.killAll();
       await acp.killAll();
+      agentAuth.cancelAll();
       if (beforeClose) await beforeClose();
       await app.close();
       if (owned) openedDatabase.close();