@wular/coder 0.4.6 → 0.4.8

package/docs/sdk.md

@@ -1,6 +1,6 @@
 # SDK
 
-Everything the CLI does, as a library. The SDK mirrors the CLI exactly: every command group is a namespace, every subcommand a function, with the same names and the same options (`coder --help` is the reference for both).
+Everything the CLI does, as a library. The SDK mirrors the CLI exactly: every command group is a namespace, every subcommand a function, with the same names and the same options (`coder --help` is the reference for both). TypeScript users install `zod` alongside it for the schema types.
 
 ```ts
 import coder from '@wular/coder';
@@ -23,7 +23,7 @@ SDK functions never print and never call `process.exit`; results come back as ty
 
 | CLI                                                                                    | SDK                                                                                                                                                                                                                                                   |
 | -------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `coder run "<text>"`                                                                   | `task.run(prompt, opts?)`                                                                                                                                                                                                                             |
+| `coder run "<text>"`                                                                   | `task.run(prompt, opts?)`; `connections` narrows the task's connections                                                                                                                                                                              |
 | `coder list`                                                                           | `task.list(opts?)`                                                                                                                                                                                                                                    |
 | `coder result [id] [--wait] [--tail N] [--turns]`                                      | `task.result(id?, { wait?, tail? })` - returns `turns` (one entry per finished turn) alongside `result`                                                                                                                                               |
 | `coder task steer <id> "<text>"`                                                       | `task.steer(id, text, { model?, effort?, permissions?, wait? })` - live, or resumes a finished or archived task on the same id                                                                                                                        |
@@ -36,7 +36,7 @@ SDK functions never print and never call `process.exit`; results come back as ty
 | `coder flow run / list / discover / result / watch / stop / resume / archive / delete` | the matching `flow.*` function; `flow.run(nameOrPath, { args?, concurrency?, maxTasks? })`, `flow.stream(id?)` for `watch`                                                                                                                            |
 | `coder model add / update / remove / list / alias / unalias / disable / enable`        | the matching `model.*` function                                                                                                                                                                                                                       |
 | `coder config get / set`                                                               | `config.get(key?)` / `config.set(key, value)`                                                                                                                                                                                                         |
-| `coder mcp add / add-json / list / rm`                                                 | `mcp.add(name, { url?, command?, env?, header?, tools?, user? })` / `mcp.addJson(name, entry, { user? })` / `mcp.list()` / `mcp.remove(name, { user? })`                                                                                              |
+| `coder connection add / list / rm / reconnect / approve`                               | `connection.add(name, { env?, url?, command?, key?, askKey?, header?, access?, me?, credential?, onAuthorize?, server? })` / `connection.list()` / `connection.remove(name)` / `connection.reconnect(name, { key?, askKey?, onAuthorize? })` / `connection.approve(name, { agent? })`, all with `{ server? }` |
 | `coder setup-host [hosts...]`                                                          | `setupHost(hosts?)`                                                                                                                                                                                                                                   |
 | `coder upgrade`                                                                        | `upgrade({ cliOnly?, pluginsOnly? })`                                                                                                                                                                                                                 |
 | `coder docs [topic]`                                                                   | `docs(topic?)`                                                                                                                                                                                                                                        |
@@ -50,7 +50,7 @@ SDK functions never print and never call `process.exit`; results come back as ty
 | `coder agent run --task <id>`                                                          | `agent.runTask(id, options?)` - the runner form, not for application code                                                                                                                                                                             |
 | `coder credentials list / add / remove / default`                                      | `credentials.list()` / `.add(label, { engine, env, workspace?, default?, noCheck? })` / `.remove(label, { workspace? })` / `.default(label, { workspace? })`, all with `{ server? }`                                                                 |
 | `coder agent usage [--since] [--by]`                                                   | `agent.usage({ since?, by?, server?, cwd? })`                                                                                                                                                                                                         |
-| `coder server serve / migrate / rotate-key`                                            | `server.serve(options?)` / `server.migrate(options?)` / `server.rotateKey(options?)`; `server.handler(env)` for serverless hosts, see [Self-hosting](self-host.md#deploy)                                                                             |
+| `coder server serve / rotate-key`                                                                        | `server.serve(options?)` / `server.rotateKey(options?)`; `server.handler(env)` for serverless hosts, see [Self-hosting](self-host.md#deploy)                                                                                                                                                                                                                 |
 
 Options objects take the same names as the CLI flags, camelCased (`--max-tasks` becomes `maxTasks`, `--server` becomes `server`). Every server option accepts `organization`, the `--workspace` flag's slug, which overrides the saved workspace for that call. `server` falls back to `CODER_SERVER`, then the hosted service; authentication comes from `auth.login()`, or from `token` when supplied; `yes: true` acknowledges the first use of a new server origin in non-interactive code.
 

package/docs/self-host.md

@@ -11,7 +11,7 @@ Required variables carry a *.
 | Variable                                   | Type                                                                       | Default                                         | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | ------------------------------------------ | -------------------------------------------------------------------------- | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `PUBLIC_URL`<sup><b>*</b></sup>            | url without a path                                                         |                                                 | The address platforms and browsers reach the server at. Written into every app as its webhook and callback address, and the only origin sign-in trusts. Inferred on Vercel; `serve` defaults to `http://localhost:<port>`                                                                                                                                                                                                                           |
-| `DATABASE_URL` or `POSTGRES_URL`           | url                                                                        |                                                 | Postgres. Everything lives in a `coder` schema, so the database can be shared with other apps; a `coder` schema Coder did not create is refused. Run `coder server migrate` before the first start and after upgrades. Without it `coder server serve` runs the local dashboard; `--memory` selects a throwaway test server. Statements are prepared on each connection, so a query costs one round trip; add `?prepare=false` to the URL for a pooler that cannot keep prepared statements |
+| `DATABASE_URL` or `POSTGRES_URL`           | url                                                                        |                                                 | Postgres. Everything lives in a `coder` schema, so the database can be shared with other apps. Run the database setup command below before the first start and after upgrades. Without it `coder server serve` runs the local dashboard; `--memory` selects a throwaway test server. Statements are prepared on each connection, so a query costs one round trip; add `?prepare=false` to the URL for a pooler that cannot keep prepared statements |
 | `SERVER_ENCRYPTION_KEY`<sup><b>*</b></sup> | base64 32 bytes                                                            |                                                 | Encrypts app keys, tokens, and engine credentials at rest (`openssl rand -base64 32`), and derives the session cookie key and the sign-in client key with HKDF. Required with Postgres                                                                                                                                                                                                                                                              |
 | `AUTH_WULAR_URL`                           | url                                                                        | `https://auth.wular.ai`                         | Wular Auth OpenID issuer, the only identity provider, including for a self-hosted Wular Auth deployment                                                                                                                                                                                                                                                                                                                                             |
 | `RUNNER`                                   | `local`\| `local-docker` \| `vercel-sandbox` \| `github-actions` \| `http` | `local`, `vercel-sandbox` on Vercel             | Where tasks execute. `local` and `local-docker` run them on the server's own machine and work with the memory store, and are refused on Vercel. The other three run them elsewhere and need Postgres. Members' own machines add to this ([Your own machine](#your-own-machine))                                                                                                                                                                     |
@@ -23,6 +23,7 @@ Required variables carry a *.
 | `CODER_CACHE_HOME`                         | path                                                                       | OS cache directory for `wular-coder`            | Archived tasks, flows and usage                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `WORK_DIR`                                 | path                                                                       | `<tmp>/coder`                                   | Where the local runner checks out repositories                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `SERVER_NAME`                              | string                                                                     | `Coder`                                         | What the dashboard calls this server, in its sidebar server menu                                                                                                                                                                                                                                                                                                                                                                                    |
+| `ISSUES_URL`                               | URL                                                                        | `https://github.com/muzam1l/coder/issues/new`   | Where the dashboard sends bug reports from its Report issue button                                                                                                                                                                                                                                                                                                                                                                                  |
 | `SERVER_LIMITS`                            | JSON                                                                       | `{}`                                            | Request rates and task slots ([Limits and monitoring](#limits-and-monitoring))                                                                                                                                                                                                                                                                                                                                                                      |
 | `CLAUDE_SUBSCRIPTIONS`                     | `1`                                                                        | off                                             | Offer "Sign in with Claude" for personal credentials                                                                                                                                                                                                                                                                                                                                                                                                |
 | `CODEX_SUBSCRIPTIONS`                      | `1`                                                                        | off                                             | Offer "Sign in with Codex" for personal credentials                                                                                                                                                                                                                                                                                                                                                                                                 |
@@ -31,7 +32,8 @@ Required variables carry a *.
 | `TASK_TIMEOUT`                             | ms                                                                         | `1800000` (30 minutes)                          | Longest a task may run                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `TASK_STALL`                               | ms                                                                         | `300000` (5 minutes)                            | Silence before the runner is asked whether the task is still alive                                                                                                                                                                                                                                                                                                                                                                                  |
 | `TASK_ATTEMPTS`                            | number                                                                     | `2`                                             | Times a runner start is retried                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `SERVER_INTEGRATIONS`                      | comma-separated ids                                                        | every platform                                  | The platforms this server offers, from `github`, `slack`, `teams`, `gmail` and `linear`. Others get no webhook, catalog entry or app creation. An unknown id stops the server                                                                                                                                                                                                                                                                       |
+| `SERVER_INTEGRATIONS`                      | comma-separated ids                                                        | every platform                                  | The platforms this server offers, from `github`, `slack` and `linear`.                   Others get no webhook, catalog entry or app creation. An unknown id stops the server                                                                                                                                                                                                                                                                       |
+| `SERVER_OPERATORS`                         | comma-separated Wular Auth user ids                                        | none                                            | Postgres servers. Who may open the operator area. Only this variable grants it                                                                                                                                                                                                                                                                                                                                                                      |
 
 Settings, sign-in, pairings and live tasks live in ~/.coder (CODER_HOME). Archived tasks, flows and usage live in the OS cache directory, ~/Library/Caches/wular-coder on macOS, ~/.cache/wular-coder on Linux (CODER_CACHE_HOME overrides). Nothing is ever pruned.
 
@@ -68,9 +70,13 @@ Run `await handler.scheduled()` from an hourly scheduled job to sweep expired st
 
 Completed tasks, their logs and usage remain until a task is explicitly deleted. Sandbox snapshots remain until replaced or deleted. Expiring deliveries, notes, engine sign-ins and chat state are cleaned by the sweep.
 
+### Database setup
+
+Before the first start and each upgrade, set `DATABASE_URL` and run `npx --yes --package=drizzle-kit@0.31.11 --package=drizzle-orm@0.45.2 --package=postgres@3.4.9 drizzle-kit push --config=./node_modules/@wular/coder/dist/schema.config.js` from the directory where Coder is installed. Run it as a deploy step for serverless hosts.
+
 ### Your own host
 
-Install Bun and `@wular/coder`, set the variables above, run `coder server migrate`, then `coder server serve`. The command starts the server under Bun, listens on `PORT` (default 8787), and answers `/health`. Keep it alive with whatever supervises processes on that host. It listens on every interface, as containers and load balancers need; behind a proxy on the same machine, `--host 127.0.0.1` keeps it private. From code, `server.serve()`, `server.migrate()` and `server.rotateKey()` do the same.
+Install Bun and `@wular/coder`, set the variables above, set up the database as above, then run `coder server serve`. The command starts the server under Bun, listens on `PORT` (default 8787), and answers `/health`. Keep it alive with whatever supervises processes on that host. It listens on every interface, as containers and load balancers need; behind a proxy on the same machine, `--host 127.0.0.1` keeps it private. From code, `server.serve()` and `server.rotateKey()` do the same.
 
 ### After the first start
 
@@ -78,13 +84,15 @@ Open `PUBLIC_URL` and sign in with Wular Auth. Workspaces and roles come from Wu
 
 Add an engine [credential](#credentials), or the first task will only reply with a link asking for one.
 
-Create the built-in agent's apps once per server with `coder server app create github` and `coder server app create slack`, run where the server's `DATABASE_URL` and `PUBLIC_URL` are set. Each opens a one-time page that posts the app's manifest to the platform; `--org <org>` creates the GitHub App under an organization you admin. These apps are public and shared by every workspace, and the app's credentials go straight to the server. Slack apps also need public distribution turned on in their settings on api.slack.com before other Slack workspaces can add them.
+Create the built-in agent's apps once per server with `coder server app create <integration>`, such as `github` or `linear`, run where the server's `DATABASE_URL` and `PUBLIC_URL` are set. Each opens a one-time page that posts the app's manifest to the platform; `--org <org>` creates the GitHub App under an organization you admin. These apps are public and shared by every workspace, and the app's credentials go straight to the server. Linear apps need public distribution turned on before other workspaces can add them.
 
 ## Apps and installs
 
-An agent's handle on a platform is its app. The built-in agent `coder` uses the server's shared apps, and it also answers `@coder` and messages that start with `coder` where its app is installed. A custom agent gets its own app from its Platforms tab in the dashboard, under your own GitHub account or an organization whose apps you manage, private to that account.
+An agent's handle on a platform is its app. The built-in agent `coder` uses shared apps on GitHub and Linear; create its Slack app in your workspace from its Platforms tab by pasting a Slack configuration refresh token. A custom agent gets its own app from its Platforms tab in the dashboard, under your own GitHub account or an organization whose apps you manage. Private apps install only on their owner; an app made public on its platform installs on any account.
+
+Installs start from the dashboard. "Connect GitHub" adds the shared GitHub app, and the Platforms tab creates or installs an agent's workspace app. The server binds an install to the workspace that started it with a one-time, expiring state. On GitHub it also requires the installer to authorize the app and checks that the installation appears in their own `GET /user/installations`; on Slack it uses "Add to Slack" OAuth keyed by team. An install started on GitHub asks the installer to sign in and binds only if they are a member of the app's workspace. An install belongs to exactly one workspace, and webhooks route by installation. Removing or suspending an install on the platform stops it.
 
-Installs always start from the dashboard. "Connect GitHub" and "Add to Slack" on the dashboard home add the built-in apps, and the Platforms tab installs an agent's own app. The server binds an install to the workspace that started it with a one-time, expiring state. On GitHub it also requires the installer to authorize the app and checks that the installation appears in their own `GET /user/installations`; on Slack it uses "Add to Slack" OAuth keyed by team. An install belongs to exactly one workspace, and webhooks route by installation. Removing or suspending an install on the platform stops it.
+Operators set up the shared apps in the dashboard's Operator area at `/dash/<workspace>/operator`, one per platform, named `SERVER_NAME` or Wular unless they pick a name, and every operator action lands in its audit log. Entering it asks for a fresh Wular Auth sign-in and lasts an hour, or 15 minutes without activity; on local and memory servers the admin token holder is the operator.
 
 Each task gets the narrowest platform token: on GitHub an installation token for the event's repository with only the permissions its tools need, on Slack the install's bot token.
 
@@ -112,7 +120,7 @@ Workspaces come from Wular Auth, where members and roles are managed; the member
 
 From a terminal, `coder auth login` signs in with Wular Auth (`--device` shows a code to approve elsewhere) and keeps the session in `~/.coder/session.json`. Its tokens are issued for this server only. `--workspace <slug>` picks a workspace and `--server <url>` another instance. Servers must use HTTPS unless they are loopback, and the CLI confirms a new origin the first time it sees it (`--yes` acknowledges it in scripts).
 
-A platform user who addresses an agent must be linked to a member of the workspace that owns the install. The first time an unknown user asks, the agent answers with a link: on Slack a private one-time link, on GitHub a link that signs them in with the app's own GitHub authorization, so no secret appears in a public comment. Write actions on GitHub also need the person's write access to the repository, checked with GitHub. Installing an app links the installer the same way. A trigger with `"actAs": "requester"` runs its tasks with the requester's own GitHub token, kept encrypted and refreshed.
+A platform user who addresses an agent must be linked to a member of the workspace that owns the install, or trusted by the platform there, such as a GitHub user with write access to the repository; trusted users get the workspace's connections only. Anyone else gets a link the first time they ask: on Slack a private one-time link, on GitHub a link that signs them in with the app's own GitHub authorization, so no secret appears in a public comment. Write actions on GitHub also need the person's write access to the repository, checked with GitHub. Installing an app links the installer the same way. A trigger with `"actAs": "requester"` runs its tasks with the requester's own GitHub token, kept encrypted and refreshed.
 
 ## Runners
 
@@ -121,34 +129,37 @@ A platform user who addresses an agent must be linked to a member of the workspa
 | Runner           | Field               | Default                         | Purpose                                                                                                                                                       |
 | ---------------- | ------------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `local`          |                     |                                 | none                                                                                                                                                          |
-| `local-docker`   | `image`             | `node:22`                       | Image the task runs in                                                                                                                                        |
+| `local-docker`   | `image`             | `ghcr.io/muzam1l/coder-runner:latest` | Image the task runs in                                                                                                            |
 |                  | `memory`            | `4g`                            | `--memory`                                                                                                                                                    |
 |                  | `cpus`              | `2`                             | `--cpus`                                                                                                                                                      |
 |                  | `pidsLimit`         | `512`                           | `--pids-limit`                                                                                                                                                |
 |                  | `network`           | `bridge`                        | `--network`                                                                                                                                                   |
-| `vercel-sandbox` | `image`             | the SDK's default image         | Image the base snapshot starts from                                                                                                                           |
+| `vercel-sandbox` | `image`             | the SDK's default image              | Image the task starts from                                                                                                        |
 |                  | `token`             | deployment OIDC                 | Vercel access token for Sandbox; install `@vercel/sandbox` in the adapter app                                                                                 |
 |                  | `team`              | `VERCEL_TEAM_ID`                | Team ID for access-token authentication                                                                                                                       |
 |                  | `projectId`         | `VERCEL_PROJECT_ID`             | Project ID for access-token authentication                                                                                                                    |
 |                  | `region`            | the database's region           | Sandbox region; inferred from an AWS region in the database host, else Vercel's default                                                                       |
-|                  | `tools`             | `[]`                            | Extra global npm packages in the base snapshot, next to `claude`, `codex` and `coder`                                                                         |
 |                  | `timeoutMs`         | `1800000`                       | Sandbox lifetime                                                                                                                                              |
-|                  | `vcpus`             | `2`                             | Sandbox size                                                                                                                                                  |
-| `github-actions` | `token` (required)  |                                 | GitHub token that may dispatch the workflow and read run logs                                                                                                 |
+|                  | `vcpus`             | `1`                                  | Sandbox size                                                                                                                      |
+| `github-actions` | `token` (required)  |                                      | GitHub token that may dispatch the workflow and read its status                                                                   |
 |                  | `repo`              | the event's repository          | `owner/name` holding the workflow                                                                                                                             |
 |                  | `workflow`          | `coder-agent.yml`               | Workflow file to dispatch (`coder server workflow` prints it)                                                                                                 |
 |                  | `ref`               | the repository's default branch | Branch to dispatch on                                                                                                                                         |
-| `http`           | `url` (required)    |                                 | Your controller's base URL; it implements `POST /start`, `POST /messages/<handle>`, `GET /status/<handle>`, `GET /logs/<handle>?after`, `POST /stop/<handle>` |
+| `http`           | `url` (required)    |                                      | Your controller's base URL; it implements `POST /start`, `POST /messages/<handle>`, `GET /status/<handle>`, `POST /stop/<handle>` |
 |                  | `secret` (required) |                                 | Shared secret that signs every request over body, timestamp, and nonce                                                                                        |
 |                  | `headers`           | `{}`                            | Extra headers sent with every request                                                                                                                         |
 
-On `vercel-sandbox` every task gets its own microVM. A base snapshot holds `claude`, `codex` and `coder`, and each repository gets its own snapshot with the repository cloned and its dependencies installed. Both are built on first use and kept current. An API key never enters the sandbox: its firewall adds the key to requests to `api.anthropic.com` or `api.openai.com`, and the task sees a placeholder.
+`local-docker` and `github-actions` run in the runner image, which holds the engines and tools. A custom `image` needs `node`, `bun`, `git`, `curl`, `tar`, `claude`, `codex` and `github-mcp-server`.
+
+`local-docker`, `vercel-sandbox` and `github-actions` download this server's version of Coder from npm at start, with nothing to install. `tarballUrl` points them at another package, such as an unpublished build.
+
+On `vercel-sandbox` each task uses the universal image's engines without their own sandbox, and its machine stops when the task ends. Repository snapshots hold the checkout and its installed dependencies. The default is 1 CPU and 2 GB memory; `vcpus` selects a larger machine.
 
-Access-token authentication needs a token, team ID and project ID. Settings → Runners accepts the IDs directly, or the adapter app can supply `VERCEL_TEAM_ID` and `VERCEL_PROJECT_ID`. A task started before its snapshot is ready installs the same engines and tools in its own sandbox before running.
+Access-token authentication needs a token, team ID and project ID. Settings → Runners accepts the IDs directly, or the adapter app can supply `VERCEL_TEAM_ID` and `VERCEL_PROJECT_ID`. The firewall injects engine API keys into provider requests, and the task sees a placeholder. Below `auto`, a task's machine reaches only this server, npm, its engine, integrations, connections, MCP servers and `allowedNetworkHosts`.
 
-For GitHub Actions, save the output of `coder server workflow` as `.github/workflows/coder-agent.yml` on the workflow repository's default branch. It accepts `task`, `server`, `token` and `mode`, names each run `Coder agent <task ID>`, and calls `coder agent run --task "$TASK"` with the callback URL and attempt token in the environment. The workflow token needs repository Actions read and write; a classic token for a private repository needs `repo`. A result returns through the authenticated task callback. No result artifact is required.
+For GitHub Actions, save the output of `coder server workflow` as `.github/workflows/coder-agent.yml` on the workflow repository's default branch. Save it again after each Coder upgrade. It accepts `task`, `server`, `token`, `mode` and `tarball`, names each run `Coder agent <task ID>`, and runs the task in the runner image with the callback URL and attempt token in the environment. The workflow token needs repository Actions read and write; a classic token for a private repository needs `repo`. A result returns through the authenticated task callback. No result artifact is required.
 
-GitHub job logs become downloadable when the job finishes. The dashboard stream waits for the workflow to finish and copies those archived logs even if the task's result has already arrived. Vercel Sandbox streams stdout and stderr while the command runs.
+Every runner sends the task's log to the server while it runs, and the dashboard shows the stored log.
 
 The server stores steer, ask, approval and cancel messages before delivering them. Local workers receive them over a private Unix socket; HTTP controllers use the same signed requests as task starts, Docker uses the daemon's exec channel, and Vercel Sandbox uses `runCommand`. Workers acknowledge the applied sequence and save it across restarts. Unacknowledged messages retry on server events and the sweep, with backoff. A reconnect fetches pending messages once.
 
@@ -162,7 +173,7 @@ A runner runs only its owner's tasks. An owner or admin can register one with `-
 
 ## Security
 
-The server only verifies, dedupes, and dispatches; agents run in the runner with one checkout, one short-lived platform token, and one engine credential. `permissions` is enforced by the engine sandbox, `tools` by the app's permissions and the MCP allowlist. App credentials are encrypted at rest.
+The server only verifies, dedupes, and dispatches; agents run in the runner with one checkout, one short-lived platform token, and one engine credential. `permissions` is enforced by the engine sandbox, on `vercel-sandbox` by the machine and its firewall, `tools` by the app's permissions and the MCP allowlist. App credentials are encrypted at rest.
 
 ## Limits and monitoring
 
@@ -183,6 +194,6 @@ Local hosts use the connection's peer IP. Vercel uses the IP supplied by its pro
 
 Running tasks and tasks waiting for approval hold slots. Further tasks remain queued, with “Waiting for a task slot” in their status, until a slot opens. `MAX_TASKS`, when set, also bounds runner slots across the deployment. The concurrent cap applies to tasks admitted by the server; standalone CLI tasks do not pass through the server, but active CLI tasks on a local server's machine are counted before it starts another task.
 
-`GET /health` needs no sign-in and returns `{ ok, version, uptime, db, runners: { online, total } }`. `uptime` is seconds since this server process started. `db` is `ok` after a live database query, `down` when it fails, or `none` in local and memory modes. Registered runners are online when their last heartbeat is less than five minutes old. Health counts runners across all workspaces and returns `200` when healthy or `503` when the database or runner records cannot be read. Local mode keeps its usual loopback access restriction.
+`GET /health` needs no sign-in and returns `{ ok }`: `200` when the server and its database answer, `503` when they do not. Local mode keeps its usual loopback access restriction.
 
 `GET /admin/metrics` requires an owner or admin of the selected workspace, or the memory server's admin token. It returns `tasks` with counts for every status among tasks created in the last 24 hours, `queueDepth` for all queued tasks, `runnersOnline`, `requests`, and `rateLimitRejections`. Task and runner counts belong to the selected workspace; request and rejection counters cover this server process since startup.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wular/coder",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Delegating coding-agent runtime",
   "type": "module",
   "main": "./dist/sdk.js",
@@ -13,6 +13,10 @@
     "./flow": {
       "types": "./dist/flow/index.d.ts",
       "import": "./dist/flow/index.js"
+    },
+    "./schema": {
+      "types": "./dist/schema.d.ts",
+      "import": "./dist/schema.js"
     }
   },
   "bin": {
@@ -33,11 +37,12 @@
   "files": [
     "bin",
     "dist",
+    "!dist/cli.d.ts",
+    "!dist/lib/broker.d.ts",
     "plugins",
     ".claude-plugin",
     "README.md",
-    "docs",
-    "migrations"
+    "docs"
   ],
   "publishConfig": {
     "access": "public"
@@ -45,31 +50,34 @@
   "engines": {
     "node": ">=18"
   },
-  "dependencies": {
+  "peerDependencies": {
+    "zod": "^4.4.3"
+  },
+  "peerDependenciesMeta": {
+    "zod": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
     "@chat-adapter/github": "4.41.1",
-    "@chat-adapter/gmail": "4.41.1",
     "@chat-adapter/linear": "4.41.1",
     "@chat-adapter/slack": "4.41.1",
-    "@chat-adapter/teams": "4.41.1",
+    "@electric-sql/pglite": "0.5.8",
     "@octokit/auth-app": "8.3.1",
     "@tanstack/virtual-core": "3.17.1",
-    "@wular/pnext": "0.1.8",
+    "@types/node": "^26.1.2",
+    "@wular/pnext": "0.1.9",
     "chat": "4.41.1",
+    "drizzle-kit": "0.31.11",
     "drizzle-orm": "0.45.2",
     "jose": "6.2.12",
     "openid-client": "6.8.8",
     "postgres": "3.4.9",
     "preact": "10.29.2",
     "preact-render-to-string": "6.7.0",
-    "simple-icons": "15.0.0",
-    "zod": "^4.4.3"
-  },
-  "devDependencies": {
-    "@electric-sql/pglite": "0.5.8",
-    "@types/node": "^26.1.2",
-    "drizzle-kit": "0.31.10",
     "prettier": "^3.6.2",
     "tsdown": "^0.22.13",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "zod": "4.4.3"
   }
 }

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "coder",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Delegate coding tasks to supervised Coder subagents running on Codex, Claude, or any OpenAI-compatible model. Your main context stays clean.",
   "author": {
     "name": "muzam1l"

package/plugins/cursor/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "coder",
   "displayName": "Coder",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Delegate coding tasks to supervised Coder subagents running on Codex, Claude, or any OpenAI-compatible model. Your main context stays clean.",
   "author": {
     "name": "muzam1l"

package/dist/actions-CmfXOVXQ.js

@@ -1,20 +0,0 @@
-import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{A as t,Bt as n,D as r,Dn as i,Dt as a,Et as o,Ht as s,Jt as c,M as l,N as u,Nt as d,O as f,Ot as p,Pt as m,R as h,Sn as g,St as _,Vt as v,Wt as y,Yt as ee,an as b,b as x,bt as S,d as te,dn as C,dt as w,et as T,fn as E,j as ne,ln as D,mn as O,nn as k,on as re,pn as A,pt as ie,tt as ae,xt as oe,zt as se}from"./dispatch-YW1aqjEg.js";import{t as j}from"./chat-bridge-18koyS7c.js";import M from"node:path";import N from"node:process";import P from"node:fs";import{spawn as F}from"node:child_process";import I from"node:os";function L(){let e=process.env.CLAUDE_CONFIG_DIR||M.join(I.homedir(),`.claude`);return M.join(e,`projects`)}function R(e){if(!e)return!1;let t=L(),n=!1;try{for(let r of P.readdirSync(t)){let i=M.join(t,r,`${e}.jsonl`);P.existsSync(i)&&(P.rmSync(i,{force:!0}),n=!0)}}catch{}return n}var z=e({archiveFlagged:()=>ce,askTask:()=>K,claudeAskOptions:()=>G,collectPending:()=>q,collectTasks:()=>Y,deleteTask:()=>$,recentTasks:()=>J,sidecarPrompt:()=>W,spawnArchiveSweep:()=>Q,steerTask:()=>V,stopTask:()=>Z,streamTask:()=>X});async function B(e,t,n,r,i={}){if(t.status!==`running`)return null;let a=t.engine===`claude`?await(i.claude??f)(t.steerEndpoint,n,void 0,r):await(i.codex??l)(e,{endpoint:t.steerEndpoint,threadId:t.threadId,turnId:t.turnId,text:n,command:r});if(a.steered)return o(e,t.id,{kind:`steer`,message:`Steer accepted live:\n${n}`}),{taskId:t.id,steered:`live`};if(!a.retryable)throw o(e,t.id,{kind:`error`,message:`Live steer failed: ${a.detail}`}),Error(`Could not steer running task ${t.id}: ${a.detail}`);let s=v(e,t.id)??t;return E.includes(s.status)?(d(e,s.id,n),o(e,s.id,{kind:`steer`,message:`Steer queued for the next turn:\n${n}`}),{taskId:s.id,steered:`queued`}):null}async function V(e,t,n,r={},i={}){if(!t.threadId)throw new _(`invalid-option`,`Task ${t.id} has no thread to steer yet (status: ${t.status}).`,{hint:`Wait for it to start: coder task watch ${t.id}`});let a=await B(e,t,n,r.command,i);if(a){let n=v(e,t.id)??t;return n.archived&&D(e,n),a}return H(e,t,n,r),{taskId:t.id,steered:`resumed`}}function H(e,t,n,r){t.archived&&D(e,t),C(e,t.id,{status:`queued`,resumedAt:new Date().toISOString(),currentPrompt:n,...r.outputSchema?{outputSchema:r.outputSchema}:{},resumeThreadId:t.threadId,steerEndpoint:null,model:r.model??t.model??null,effort:r.effort??t.effort??null,permissions:r.permissions??t.permissions,error:void 0}),o(e,t.id,{kind:`steer`,message:`Resuming with steer:\n${n}`}),te(t.cwd??e,t.id)}const U=[`Read`,`Glob`,`Grep`];function W(e,t,n){return`You are a read-only sidecar answering a question ABOUT a coder task.
-You are not the task. Never continue, redo, or fix its work. Only answer the question. The task never sees this question or your answer.
-
-Task metadata:
-${[`id: ${e.id}`,...e.name?[`name: ${e.name}`]:[],`status: ${e.status}`,`engine: ${e.engine}${e.model?`/${e.model}`:``}${e.effort?`/${e.effort}`:``}`,...e.cwd?[`workspace: ${e.cwd}`]:[],...e.createdAt?[`created: ${e.createdAt}`]:[],...e.completedAt?[`finished: ${e.completedAt}`]:[]].join(`
-`)}
-
-Task prompt:
-${e.prompt??`(unknown)`}
-
-Inspect as needed (grep/read selectively; events can be large):
-- progress log (jsonl, one event per line): ${M.join(t,`log.jsonl`)}
-- final result: ${M.join(t,`result.json`)}
-- worker output: ${M.join(t,`worker.log`)}
-${e.cwd?`- the task's workspace (its code and changes): ${e.cwd}`:``}
-
-Question: ${n}
-
-Answer the question directly and concisely.`}function G(e,t,n,r){return{prompt:n,model:r.model??e.model,effort:r.effort,permissions:`read-only`,additionalDirectories:[t],taskRoot:t,readOnlyAllowedTools:U}}async function K(e,t,n,i={}){let a=k(e,t.id),o=W(t,a,n)+(i.command?`\n\nCoder command ${h(i.command)}`:``),s=i.command?e=>{let t=M.join(a,`inbox-control`);P.mkdirSync(t,{recursive:!0}),P.appendFileSync(M.join(t,`${h(i.command)}.transcript.jsonl`),JSON.stringify({command:i.command,result:e.finalMessage??e.error?.message??``})+`
-`)}:void 0,c=i.effort??t.effort??null;if(t.engine===`claude`)return r(t.cwd??e,{...G(t,a,o,{model:i.model,effort:c}),command:i.command,onResult:s});let l=ae(e),u=i.model??t.model,d=u?l.models?.[u]:void 0,f=d&&T(d)?d:void 0;if(f?.envKey&&!N.env[f.envKey])throw Error(`Missing environment variable: \`${f.envKey}\`.`);let p=f?await j(f,f.wireApi??`chat`):null,m=ie(l,u,p??void 0);try{return await ne(t.cwd??e,{prompt:o,model:m?.model??w(u??null),modelProvider:m?.modelProvider??null,configOverrides:m?.configOverrides??null,effort:c,sandbox:`read-only`,approvalPolicy:`never`,ephemeral:!0,onResult:s})}finally{await p?.close()}}function q(e){return n(e).filter(e=>E.includes(e.status)).flatMap(t=>x(k(e,t.id)).filter(e=>!e.response).map(e=>({taskId:t.id,id:e.id,summary:String(e.summary??``),createdAt:e.createdAt?String(e.createdAt):void 0})))}function J(e){let t=[],r=n(e).filter(n=>!A.includes(n.status)||!a(Date.parse(n.completedAt??n.updatedAt??n.createdAt??``))||(s(e,n,{auto:!0}),t.push(n.id),!1));return Q(e,t),r}function Y(e,t={}){let n=t.limit===`all`?void 0:t.limit,r=e=>A.includes(e.status),i=y(e),a=new Set(i.map(e=>e.id)),o=e=>e.filter(e=>!a.has(e.id)),s=[...o(J(e)),...i.filter(e=>!e.archived)];if(t.archived?s=[...o(se(e)),...i.filter(e=>e.archived)]:t.running?s=s.filter(e=>E.includes(e.status)):t.stopped&&(s=s.filter(r)),t.dir){let e=b(M.resolve(String(t.dir))),n=new Map;s=s.filter(t=>t.cwd?(n.has(t.cwd)||n.set(t.cwd,b(t.cwd)),n.get(t.cwd)===e):!1)}let c=e=>({rank:oe(e.status),createdAt:Date.parse(e.createdAt??``)||0,id:e.id});s=[...s].sort((e,t)=>S(c(e),c(t)));let l=n===void 0?0:Math.max(0,s.length-n);return n!==void 0&&(s=s.slice(0,n)),{tasks:s,clipped:l}}async function*X(e,t,n={}){let r=new Set([`completed`,`failed`,`cancelled`]),a=v(e,t);if(!a)throw Error(`No task found for "${t}".`);let o=n.tail??1,s=i(M.join(k(e,t),`log.jsonl`)),l=!0,u=()=>{let e=s().map(e=>{try{return JSON.parse(e)}catch{return{message:e}}});return l?(l=!1,o===`all`?e:re(e,o)):e};for(yield*u();!r.has(a.status);)await new Promise(e=>setTimeout(e,400)),a=c(e,v(e,t)??a),yield*u();yield*u()}async function Z(e,n,r={}){let i=n.engine===`claude`?{detail:`claude worker terminated`}:await(r.interrupt??t)(e,{endpoint:n.steerEndpoint,threadId:n.threadId,turnId:n.turnId});if(n.engine!==`claude`&&u(n.steerEndpoint),n.pid&&n.status===`running`)try{N.kill(n.pid,`SIGTERM`)}catch{}return C(e,n.id,{status:`cancelled`,steerEndpoint:null,completedAt:new Date().toISOString()}),{taskId:n.id,status:`cancelled`,interrupt:i.detail}}function Q(e,t,n={}){if(t.length)try{F(N.execPath,[g,`task`,`archive-sweep`,`--cwd`,e,...n.flows?[`--flows`]:[],...t],{detached:!0,stdio:`ignore`}).unref()}catch{}}function $(e,t){return t.threadId&&(t.engine===`claude`?R(t.threadId):O(e,t.threadId)),ee(e,t.id)}function ce(e,t){for(let n of t){let t=m(e,n);t&&A.includes(t.status)&&p(e,t,{auto:!0})}}export{$ as a,V as c,Y as i,Z as l,K as n,J as o,q as r,Q as s,z as t,X as u};

package/dist/adapter-7SEiVsmp.js

@@ -1 +0,0 @@
-import{o as e,s as t}from"./integrations-B2CavXR1.js";import{ConsoleLogger as n}from"chat";import{createGitHubAdapter as r}from"@chat-adapter/github";function i(i){let a=i.credentials?.webhookSecret,o=i.installationId,s;return r({userName:i.name,apiUrl:`https://api.github.com`,botUserId:0,installationToken:()=>o?s??=i.token(o,{tools:t.comment}):Promise.reject(Error(`The webhook names no GitHub installation`)),webhookVerifier:(t,n)=>e(n,t.headers.get(`x-hub-signature-256`),a),logger:new n(`error`)})}export{i as githubAdapter};

package/dist/adapter-BLEfUqoQ.js

@@ -1 +0,0 @@
-import{u as e}from"./integrations-B2CavXR1.js";import{createHmac as t}from"node:crypto";import{ConsoleLogger as n}from"chat";import{LinearAdapter as r}from"@chat-adapter/linear";function i(n,r,i,a=Date.now()){if(!i||!r)return!1;let o=t(`sha256`,i).update(n).digest();if(!e(Buffer.from(r,`hex`),o))return!1;let s=JSON.parse(n).webhookTimestamp;return typeof s==`number`&&Math.abs(a-s)<=6e4}var a=class extends r{organization;constructor(e,t){super(e),this.organization=t}async initialize(e){this.chat=e}bound(e){return this.requestContext.getStore()?e():this.organization?this.withInstallation(this.organization,e):Promise.reject(Error(`No Linear workspace to post for`))}postMessage(e,t){return this.bound(()=>super.postMessage(e,t))}startTyping(e,t){return this.bound(()=>super.startTyping(e,t))}};function o(e){let t=e.credentials?.webhookSecret,r=e.installationId;return new a({mode:`agent-sessions`,userName:e.name,apiUrl:`https://api.linear.app/graphql`,encryptionKey:``,accessToken:()=>r?e.token(r):Promise.reject(Error(`The webhook names no Linear workspace`)),webhookVerifier:(e,n)=>i(n,e.headers.get(`linear-signature`),t),logger:new n(`error`)},r)}export{o as linearAdapter};

package/dist/adapter-DaiJMOYo.js

@@ -1 +0,0 @@
-import{t as e}from"./chat-3Znsevah.js";import{ConsoleLogger as t}from"chat";import{SlackAdapter as n}from"@chat-adapter/slack";const r=`coder-pending:`;function i(e,t){return async n=>{let i=n.data,a=n.headers.toJSON(),o=typeof i==`string`?new URLSearchParams(i):void 0,s=o?.get(`token`);o&&s?.startsWith(r)&&(o.set(`token`,await t(s.slice(14))),i=o.toString());let c=Object.keys(a).find(e=>e.toLowerCase()===`authorization`);c&&a[c].startsWith(`Bearer ${r}`)&&(a[c]=`Bearer ${await t(a[c].slice(`Bearer ${r}`.length))}`);let l=await e(new URL(n.url??``,n.baseURL),{method:n.method?.toUpperCase()??`POST`,headers:a,body:i});return{data:await l.text(),status:l.status,statusText:l.statusText,headers:Object.fromEntries(l.headers),config:n,request:{}}}}var a=class extends n{outbound;constructor(e,t){super(e),this.outbound=t}async initialize(t){let n=new e,r=t.getState(),i=new Proxy(r,{get(e,t){let r=Reflect.get(e,t);return typeof r==`function`?(...r)=>{let i=typeof r[0]==`string`&&/^slack:(?:user:|user-by-name:|thread-participants:)/.test(r[0])?n:e;return Reflect.apply(Reflect.get(i,t),i,r)}:r}});await super.initialize(new Proxy(t,{get:(e,t,n)=>t===`getState`?()=>i:Reflect.get(e,t,n)}))}markEventDelivered(){}async isDuplicateEventDelivery(){return!1}getToken(){return this.requestContext.getStore()?.token||!this.outbound?super.getToken():this.outbound()}};function o(e){let n=e.credentials?.signingSecret,o=e.installationId,s=new Map,c=t=>(s.has(t)||s.set(t,e.token(t)),s.get(t));return new a({userName:e.name,apiUrl:`https://slack.com/api/`,appToken:``,socketForwardingSecret:``,clientId:``,clientSecret:``,encryptionKey:``,...n?{signingSecret:n,installationProvider:{getInstallation:async t=>({botToken:`${r}${t}`,...e.self?{botUserId:e.self}:{}})}}:{webhookVerifier:()=>!1,botToken:()=>o?e.token(o):Promise.reject(Error(`No Slack workspace to post for`))},webClientOptions:{adapter:i(e.fetch,c)},logger:new t(`error`)},n&&o?()=>c(o):void 0)}export{o as slackAdapter};

package/dist/adapter-H4GlcKQz.js

@@ -1 +0,0 @@
-import"./integrations-B2CavXR1.js";import{ConsoleLogger as e}from"chat";import{createTeamsAdapter as t}from"@chat-adapter/teams";function n(n){let r=n.installationId;if(!r)throw Error(`A Teams adapter requires its bound directory`);if(process.env.CLOUD&&process.env.CLOUD!==`Public`)throw Error(`The Teams SDK cannot override CLOUD; Coder requires the public Bot Framework cloud`);return t({appId:n.appId,appType:`SingleTenant`,appTenantId:r,apiUrl:``,userName:n.name,token:async e=>{if(![e].flat().includes(`https://api.botframework.com/.default`))throw Error(`Coder mints only Bot Framework tokens for Teams`);if(!r)throw Error(`The activity names no Teams directory`);return n.token(r)},...n.credentials?{}:{webhookVerifier:()=>!1},logger:new e(`error`)})}export{n as teamsAdapter};

package/dist/adapter-PeKziOUg.js

@@ -1 +0,0 @@
-import{ConsoleLogger as e}from"chat";import{GmailAdapter as t}from"@chat-adapter/gmail";import{GmailWebhookError as n,createGmailWebhookVerifier as r}from"@chat-adapter/gmail/webhook";var i=class extends t{isBound;verify;constructor(e,t,n){super(e),this.isBound=n,this.verify=r(t)}async handleWebhook(e,t){let r=await this.verify(e).catch(e=>{if(e instanceof n)return new Response(e.message,{status:e.status});throw e});return r instanceof Response?r:r.emailAddress===this.userName?!this.isBound||!await this.isBound(r.emailAddress)?new Response(`Gmail mailbox is not bound`,{status:403}):(t?.waitUntil?t.waitUntil(this.sync()):await this.sync(),new Response(null,{status:204})):new Response(`Unexpected Gmail mailbox`,{status:403})}};function a(t){let n=t.credentials,r=t.installationId;if(!r)throw Error(`A Gmail adapter serves one bound mailbox`);let a=n?{subscription:n.subscription,audience:n.audience,serviceAccountEmail:n.serviceAccount}:{subscription:`projects/none/subscriptions/none`,webhookVerifier:()=>!1};return new i({mailbox:r,labelId:n?.label??`INBOX`,accessToken:()=>t.token(r),topicName:n?.topic??``,subscription:a.subscription,pubsubAudience:a.audience??``,pubsubServiceAccountEmail:a.serviceAccountEmail??``,...a.webhookVerifier?{webhookVerifier:a.webhookVerifier}:{},replyAll:!1,fetch:t.fetch,logger:new e(`error`)},a,t.isBound)}export{a as gmailAdapter};

package/dist/add-BIp1t_pT.js

@@ -1 +0,0 @@
-import{i as e,t}from"./cli-IfrPgeYz.js";import{p as n}from"./output-BKeyLbvt.js";import{c as r,n as i,s as a}from"./args-DEMOfLz2.js";import{credentialOptions as o}from"./remove-B6PskfkD.js";import s from"node:process";const c=e({name:`credentials add`,globalFlags:{cwd:!1},help:{usage:`coder credentials add [label] --engine <claude|codex|custom> --env <NAME> [--env <NAME> ...] [--value <secret|->] [--workspace] [--no-check] [--default] [--server [url]]`,summary:`Store an API key, encrypted on the server, as your personal credential or with --workspace for every member. The value comes from the named environment variable unless --value says otherwise, and is never printed. Without subscription sign-in on the server, CLAUDE_CODE_OAUTH_TOKEN takes your own claude setup-token output.`,examples:[[`ANTHROPIC_API_KEY=sk-... coder credentials add --engine claude --env ANTHROPIC_API_KEY`,`your own API key, read from the environment`],[`OPENAI_API_KEY=sk-... coder credentials add team --engine codex --env OPENAI_API_KEY --workspace`,`a workspace key every member's tasks can use`],[`pbpaste | coder credentials add router --engine custom --env OPENROUTER_API_KEY --value -`,`any provider, value from stdin`]],flags:[[`--env <NAME>`,`one environment variable name; repeat for more (reads that variable by default)`],[`--engine <name>`,`claude, codex, or custom`],[`--value <secret|->`,`literal values land in shell history and are visible to other processes; use - for stdin or prefer environment variables`],[`--workspace`,`a workspace credential; owners and admins only`],[`--no-check`,`skip the provider credential check`],[`--default`,`make this the default for its engine`],t]},options:{...o,engine:a,env:r,value:a,"no-check":i,default:i},args:1,run:async({options:e,args:[t]})=>{let{addCredential:n}=await import(`./remote-AcWWfKVS.js`).then(e=>e.a);return n(t,{...e,env:e.env??[],noCheck:e[`no-check`]})},print:(e,{options:t})=>s.stdout.write(`Added ${t.workspace?`workspace`:`personal`} credential ${n.bold(e.label)}.\n`)});export{c as commandCredentialsAdd};

package/dist/add-CKENklTr.js

@@ -1,6 +0,0 @@
-import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{i as t}from"./cli-IfrPgeYz.js";import{p as n}from"./output-BKeyLbvt.js";import{n as r,s as i,t as a}from"./args-DEMOfLz2.js";import{t as o}from"./models-DGPrMV51.js";import s from"node:process";var c=e({commandModelAdd:()=>d,modelOptions:()=>l,modelSavedJson:()=>f,printModelSaved:()=>p,writeOptions:()=>u});const l={...a,"base-url":i,model:i,"env-key":i,workspace:r},u=e=>({baseUrl:e[`base-url`],model:e.model,envKey:e[`env-key`],workspace:e.workspace}),d=t({name:`model add`,help:{usage:`coder model add <name> --base-url <url> --model <id> [--env-key VAR]`,summary:`Connect a custom model behind an OpenAI-compatible endpoint (Ollama, LM Studio,
-vLLM, OpenRouter, ...). It currently runs on the codex engine pointed at your
-URL and is usable anywhere a model is: --model <name>, --engine custom, or as an
-agent default in config. Alias: \`coder model setup\`.`,flags:[[`--base-url <url>`,`OpenAI-compatible API base (e.g. http://localhost:11434/v1)`],[`--model <id>`,`the provider's model id (e.g. qwen2.5-coder:32b)`],[`--env-key <VAR>`,`env var holding the API key (omit for keyless local endpoints)`],[`--workspace`,`write to <repo>/.coder/config.json instead of the user file`]],examples:[[`coder model add qwen --base-url http://localhost:11434/v1 --model qwen2.5-coder:32b`,`local Ollama model, no key`],[`coder model add kimi --base-url https://openrouter.ai/api/v1 --model moonshotai/kimi-k2 --env-key OPENROUTER_API_KEY`,`third-party provider via OpenRouter`],[`coder run --model qwen "explain this repo"`,`dispatch a task on it`]]},options:l,args:1,run:({options:e,args:[t],cwd:n})=>o(n,t,u(e)),json:f,print:e=>p(e,`saved`)});function f({name:e,entry:t,file:n,probe:r,codex:i,install:a,ready:o}){return{name:e,...t,file:n,probe:r,codex:i,...a?{codexInstall:a}:{},ready:o}}function p({name:e,entry:t,file:r,probe:i,codex:a,install:o,nativeResponses:c,keyMissing:l},u){let d=n,f=e=>`  ${d.green(`✔`)} ${e}`,p=e=>`  ${d.red(`✘`)} ${e}`,m=[`${u} ${d.cyan(e)} -> ${t.model} @ ${t.baseUrl}  ${d.dim(`(${r})`)}`,``,i.reachable?f(`${i.detail} ${d.dim(`(${c?`responses api, direct`:`chat api, auto-translated`})`)}`):p(i.detail),a.available?f(o?.installed?`${o.note} ${d.dim(`(${a.detail})`)}`:`codex engine ${d.dim(`(${a.detail})`)}`):p(o?.note??`codex CLI not installed - run: npm install -g @openai/codex`)];l&&m.push(p(`env var ${t.envKey} is not set in this shell`)),m.push(``,d.dim([`Use it:       coder run --model ${e} "<task>"`,`Make default: coder config set engines.custom.model ${e}`].join(`
-`))),s.stdout.write(`${m.join(`
-`)}\n`)}export{u as a,p as i,l as n,f as r,c as t};

package/dist/add-DrbKvzAF.js

@@ -1 +0,0 @@
-import{nt as e}from"./dispatch-YW1aqjEg.js";import{i as t}from"./cli-IfrPgeYz.js";import{n,s as r,t as i}from"./args-DEMOfLz2.js";import a from"node:process";const o=({name:e,file:t})=>a.stdout.write(`Added MCP server "${e}" to ${t}. Attach with --mcp ${e}.\n`),s=a=>t({name:`mcp add`,help:{usage:`coder mcp add <name> [--tools a,b] [--user] (--url <url> [--header K=V] [--transport http|sse] | [--env K=V] -- <command> [args...])`,summary:"Save an MCP server under `mcp.<name>`: a remote url, or the command to spawn after `--`.",flags:[[`--url <url>`,`remote server (streamable HTTP by default)`],[`--header <K=V,...>`,"request headers for a remote server; values may hold ${VAR}"],[`--transport <http|sse>`,`remote transport (default: http)`],[`--env <K=V,...>`,"environment for a stdio server; values may hold ${VAR} or ${VAR:-default}"],[`--tools <a,b>`,`tool allowlist (default: every tool the server offers)`],[`--user`,`write ~/.coder config instead of the repo`]],examples:[[`coder mcp add docs -- npx -y docs-mcp`,`then: coder run --mcp docs "..."`]]},options:{...i,env:r,header:r,url:r,transport:r,tools:r,user:n},args:1,run:({options:t,args:[n],cwd:r})=>e(r,n,{...t,command:a}),print:o}),c=Object.assign(e=>{let t=e.indexOf(`--`);return s(t===-1?[]:e.slice(t+1))(t===-1?e:e.slice(0,t))},s([]));export{c as commandMcpAdd,o as printAdded};

package/dist/add-KkLx1WbE.js

@@ -1 +0,0 @@
-import{St as e}from"./dispatch-YW1aqjEg.js";import{i as t,t as n}from"./cli-IfrPgeYz.js";import{c as r,s as i}from"./args-DEMOfLz2.js";import{runnerOptions as a}from"./remove-CZmO4BSd.js";import o from"node:process";const s=t({name:`runner add`,globalFlags:{cwd:!1},args:1,help:{usage:`coder runner add <kind> [--name <name>] [--scope <scope>] [--field key=value …] [--server [url]] [--json]`,summary:`Connect a runner. Secret fields read environment variables with key=env:VARIABLE. Adding local prints a pairing command.`,flags:[[`--name <name>`,`runner display name`],[`--scope <scope>`,`personal or workspace`],[`--field key=value`,`repeat for each field, use env:VARIABLE for secrets`],n]},options:{...a,name:i,scope:i,field:r},async run({options:t,args:[n]}){if(!n)throw new e(`invalid-option`,`Missing runner kind.`);let{addRunnerFields:r}=await import(`./runner-c-2w6Eoj.js`).then(e=>e.a);return r(n,t)},print:e=>o.stdout.write(`${`command`in e?e.command:`Added ${e.name} (${e.id}).`}\n`)});export{s as commandRunnerAdd};

package/dist/add-json-GHTfZV_U.js

@@ -1 +0,0 @@
-import{rt as e}from"./dispatch-YW1aqjEg.js";import{i as t}from"./cli-IfrPgeYz.js";import{n,t as r}from"./args-DEMOfLz2.js";import{printAdded as i}from"./add-DrbKvzAF.js";const a=t({name:`mcp add-json`,help:{usage:`coder mcp add-json <name> '<json entry>' [--user]`,summary:`Save an entry pasted from any .mcp.json (command/args/env or url/headers, plus tools).`,flags:[[`--user`,`write ~/.coder config instead of the repo`]]},options:{...r,user:n},args:2,run:({options:t,args:[n,r],cwd:i})=>e(i,n,r,t),print:i});export{a as commandMcpAddJson};

package/dist/agent-CR8UFMa-.js

@@ -1 +0,0 @@
-import{s as e}from"./cli-IfrPgeYz.js";const t=e(`agent`,{tools:async()=>(await import(`./tools-DhlrB8xV.js`)).commandTools,list:async()=>(await import(`./list-DYzczkQZ.js`)).commandAgentList,ls:async()=>(await import(`./list-DYzczkQZ.js`)).commandAgentList,show:async()=>(await import(`./show-aCUICSoc.js`)).commandAgentShow,run:async()=>(await import(`./run-FYA9XIij.js`)).commandAgentRun,init:async()=>(await import(`./init-Bo3RS_va.js`)).commandAgentInit,push:async()=>(await import(`./push-HLTHyhsP.js`)).commandAgentPush,usage:async()=>(await import(`./usage-BlT_poNA.js`)).commandAgentUsage,integrations:async()=>(await import(`./integrations-CstFKLTr.js`)).commandAgentIntegrations},{menu:[{usage:`list`,blurb:`list local or server-owned agents`},{usage:`show <id>`,blurb:`one agent in full: settings, integrations, triggers, tools`},{usage:`init [id]`,blurb:`scaffold an agent folder in .coder/agents`},{usage:`push [id]`,blurb:`upload workspace agents to a Coder server`},{usage:`integrations <list|show>`,blurb:`the integration catalog: coder agent integrations --help`},{usage:`run <agent> <event.json>`,blurb:`run a recorded event through an agent, offline or on a server`},{usage:`usage`,blurb:`aggregate usage by agent, installation, or engine`}],description:[`Define and run agents from the CLI, the dashboard, or on GitHub, Slack and other platforms.`]},{aliases:{ls:`list`},nested:[`integrations`]});export{t as commandAgent};

package/dist/agent-D0pQ_ewc.js

@@ -1,3 +0,0 @@
-import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{St as t}from"./dispatch-YW1aqjEg.js";import{t as n}from"./types-D0q15RJa.js";import{a as r}from"./load-DDZfByUe.js";import{i,n as a}from"./remote-AcWWfKVS.js";import{t as o}from"./integrations-B2CavXR1.js";import{a as s,r as c}from"./exec-DgI3boHa.js";import{c as l,o as u,u as d}from"./task-DhZ5vhyY.js";import{n as f}from"./match-DMI54zg4.js";import p from"node:path";import m from"node:process";import h from"node:fs";import{spawn as g}from"node:child_process";import _ from"node:os";import v from"node:fs/promises";const y=/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[()][A-Z0-9]|\r/g;function b(e,t){if(e===`codex`)return{file:`codex`,args:[`login`,`--device-auth`],env:{CODEX_HOME:t}};let n=`stty cols 4000 rows 50 2>/dev/null; exec claude setup-token`;return{file:`sh`,args:[`-c`,`cat | { ${m.platform===`darwin`?`script -q /dev/null sh -c '${n}'`:`script -qfec '${n}' /dev/null`}; kill 0; }`],env:{CLAUDE_CONFIG_DIR:t,BROWSER:`true`}}}function x(e){try{return JSON.parse(Buffer.from(String(e).split(`.`)[1]??``,`base64url`).toString())}catch{return{}}}function S(e){let t=x(JSON.parse(e).tokens?.id_token),n=t[`https://api.openai.com/auth`];return{...typeof t.email==`string`?{email:t.email}:{},...typeof n?.chatgpt_plan_type==`string`?{plan:n.chatgpt_plan_type}:{}}}function C(e,t){let n=t.replace(y,``),r=/\x1b\]8;[^;]*;(https:\/\/[^\x07\x1b]+)(?:\x07|\x1b\\)/.exec(t)?.[1],i=e===`claude`?r??/https:\/\/\S*(?:oauth|authorize)\S*(?=\s)/.exec(n)?.[0]:/https:\/\/\S+(?=\s)/.exec(n)?.[0],a=e===`codex`?/\b[A-Z0-9]{4,}-[A-Z0-9]{4,}\b/.exec(n)?.[0]:void 0;if(!(!i||e===`codex`&&!a))return{url:i,...a?{code:a}:{}}}async function w(e,t){let{server:n,token:r}=d();delete m.env.CODER_TASK_TOKEN,delete m.env.CODER_LOGIN;let i=new AbortController,a=async(t,a)=>{let o=await fetch(`${n}/logins/${encodeURIComponent(e)}${t}`,{method:a===void 0?`GET`:`POST`,...t?{signal:i.signal}:{},headers:{authorization:`Bearer ${r}`,...a===void 0?{}:{"content-type":`application/json`}},...a===void 0?{}:{body:JSON.stringify(a)}});if(!o.ok)throw Error(`Coder server answered ${o.status}`);return await o.json()},{engine:o}=await a(``),s=await v.mkdtemp(p.join(t,`.login-`)),c=b(o,s),l=g(c.file,c.args,{env:{...m.env,...c.env},stdio:[`pipe`,`pipe`,`pipe`],detached:!0}),u=()=>{try{m.kill(-l.pid,`SIGTERM`)}catch{}},f=``,h=``,_=!1,x=new Promise((e,t)=>{l.once(`error`,t),l.once(`close`,e)}),w=setTimeout(u,6e5),T=async()=>{for(;!i.signal.aborted;){let{code:e}=await a(`/input`);if(e)return void l.stdin.write(`${e}\r`)}},E=e=>{if(f+=e.toString(),h=f.replace(y,``),!_){let e=C(o,f);e&&(_=!0,m.stdout.write(`Sign-in link ready
-`),a(``,e).catch(()=>u()),o===`claude`&&T().catch(()=>{i.signal.aborted||u()}))}o===`claude`&&/sk-ant-oat[\w-]+\s/.test(h)&&u()};l.stdout.on(`data`,E),l.stderr.on(`data`,E);try{let e=await x;i.abort();let t=/sk-ant-oat[A-Za-z0-9_-]+/.exec(h)?.[0];if(o===`claude`&&t){let e=/[\w.+-]+@[\w-]+(?:\.[\w-]+)+/.exec(h)?.[0];await a(``,{result:{env:{CLAUDE_CODE_OAUTH_TOKEN:t},...e?{account:{email:e}}:{}}})}else if(o===`codex`&&e===0){let e=await v.readFile(p.join(s,`auth.json`),`utf8`);await a(``,{result:{env:{CODEX_AUTH_JSON:e},account:S(e)}})}else await a(``,{error:_?`Sign-in did not finish. Start again.`:`${o} sign-in could not start.`}).catch(()=>{});m.stdout.write(`Sign-in finished
-`)}finally{clearTimeout(w),i.abort(),u(),await v.rm(s,{recursive:!0,force:!0})}}var T=e({agentIdError:()=>k,agents:()=>P,regexError:()=>A});const E=e=>e.cwd?p.resolve(e.cwd):m.cwd(),D=e=>(Array.isArray(e)?e:(e??``).split(`,`)).map(e=>e.trim()).filter(Boolean),O=/^[a-z0-9][a-z0-9_-]*$/;function k(e,t){if(!O.test(t))return`Use lowercase letters, digits, - or _, starting with a letter or digit.`;let n=p.join(e,`.coder`,`agents`,t);if(h.existsSync(n)&&h.readdirSync(n).length>0)return`${p.relative(e,n)} is not empty; clear it to start over, or edit what is there.`}function A(e){try{new RegExp(e);return}catch{return`Not a valid regular expression.`}}function j(e,t){let n=o[e]?.sample;return{integration:e,type:t,appId:`${e}:sample`,installationId:`sample`,deliveryId:`sample-1`,actor:{id:`user-1`,login:`someone`,role:`member`},text:`Replace me with the text a real event would carry.`,...n?{chat:{thread:{_type:`chat:Thread`,adapterName:e,channelId:n.slice(0,n.lastIndexOf(`:`)),id:n,isDM:!1}}}:{}}}async function M(e,r={}){let i=E(r);if(!e&&r.askId&&(e=await r.askId(e=>k(i,e))),!e)throw new t(`invalid-option`,`Missing agent id.`,{hint:`Usage: coder agent init <id>`});let a=k(i,e);if(a)throw new t(`invalid-option`,a.includes(`not empty`)?a:`Agent id "${e}": ${a}`);let s=p.join(i,`.coder`,`agents`,e),c=r.askPicks?await r.askPicks(e):{...r.name?{name:r.name}:{},integrations:D(r.integrations).length?D(r.integrations):[Object.keys(o)[0]],events:{},matches:{},tools:r.tools??`comment`};if(!n.includes(c.tools))throw new t(`invalid-option`,`Unknown preset "${c.tools}"; valid: ${n.join(`, `)}`);let l={},u=D(r.triggers),d=e=>Object.keys(o[e]?.events??{});for(let e of c.integrations)if(!o[e])throw new t(`invalid-option`,`Unknown integration "${e}"; valid: ${Object.keys(o).join(`, `)}`);for(let e of u)if(!c.integrations.some(t=>d(t).includes(e)))throw new t(`invalid-option`,`No chosen integration has event "${e}".`,{hint:`Events per integration: coder agent integrations show <id>`});let f=Object.fromEntries(D(r.match).map(e=>{let n=e.indexOf(`=`);if(n<1)throw new t(`invalid-option`,`Bad --match "${e}"; use event=regex.`);let r=e.slice(n+1);if(A(r))throw new t(`invalid-option`,`Bad --match for ${e.slice(0,n)}: ${A(r)}`);return[e.slice(0,n),r]}));for(let e of c.integrations){let n=d(e),r=c.events[e]??(u.length?u.filter(e=>n.includes(e)):[n.includes(`mention`)?`mention`:n[0]]);for(let i of r)if(!n.includes(i))throw new t(`invalid-option`,`${e} has no event "${i}"; valid: ${n.join(`, `)}`);let i={...f,...c.matches[e]??{}},a=r.filter(e=>i[e]);r.length&&(l[e]={triggers:a.length?Object.fromEntries(r.map(e=>[e,!i[e]||{match:i[e]}])):r,tools:c.tools})}let m={...c.name?{name:c.name}:{},...r.description?{description:r.description}:{},permissions:r.permissions??`read-only`,integrations:l};await v.mkdir(s,{recursive:!0}),await v.writeFile(p.join(s,`agent.json`),`${JSON.stringify(m,null,2)}\n`),await v.writeFile(p.join(s,`system.md`),`You are ${c.name??e}.\n`);let h=p.join(_.tmpdir(),`coder-agent-samples`,e),g=[];for(let[e,t]of Object.entries(l)){let n=(Array.isArray(t.triggers)?t.triggers:Object.keys(t.triggers??{}))[0];await v.mkdir(h,{recursive:!0});let r=p.join(h,`sample-${e}-${n}.json`);await v.writeFile(r,`${JSON.stringify(j(e,n),null,2)}\n`),g.push(r)}return{id:e,dir:s,files:[`agent.json`,`system.md`],samples:g,integrations:Object.keys(l)}}function N(e){if(e===void 0||typeof e==`number`)return e;if(/^\d+$/.test(e))return Number(e);let n=/^(\d+)([dh])$/.exec(e);if(!n)throw new t(`invalid-option`,`Invalid --since value.`,{hint:`Use 7d, 24h, or milliseconds since epoch`});return Date.now()-Number(n[1])*(n[2]===`d`?864e5:36e5)}const P={list:(e={})=>e.server===void 0?r(E(e),o):a(e).agents.list(),async show(e,n={}){if(!e)throw new t(`invalid-option`,`Missing agent id.`,{hint:`Usage: coder agent show <id>`});if(n.server===void 0){let i=(await r(E(n),o)).find(t=>t.id===e);if(!i)throw new t(`invalid-option`,`No agent named "${e}".`,{hint:`List agents: coder agent list`});return i}let i=a(n),s=await i.agents.get(e),c=await i.agents.version(e,s.currentVersion);return{...s,definition:c.definition}},init:M,push:(e,t={})=>i(a(t),E(t),e),async run(e,n,i={}){if(i.wait&&i.server===void 0)throw new t(`invalid-option`,`--wait needs --server.`,{hint:`Offline runs print their reply as they finish`});if(!e||!n)throw new t(`invalid-option`,`Missing agent id or event file.`,{hint:`Usage: coder agent run <agent> <event.json>`});let l=E(i),u=typeof n==`string`?JSON.parse(await v.readFile(p.resolve(l,n),`utf8`)):n;if(i.server!==void 0){let t=a(i),n=await t.tasks.create({agent:e,event:u});if(!i.wait||!n.tasks.length)return n;let r=[];for(let e of n.tasks){let n=await t.tasks.wait(e,{onLog:i.onLog});r.push(n),i.onDone?.(n)}return r}let d=await r(l,o),m=d.find(t=>t.id===e);if(!m)throw new t(`invalid-option`,`No agent named "${e}".`);let h=f(u,d).find(t=>t.agent.id===e),g=i.flow??h?.flow;if(!g)throw new t(`invalid-option`,`Agent "${e}" does not match event "${u.type}".`);return c({cwd:l,agent:e,flow:g,task:{...s(m,g,u),tools:{},...h?.permissions?{permissions:h.permissions}:{}},post:!1})},runTask(e,t={}){let n=E(t);return m.env.CODER_LOGIN?w(e,n):m.env.CODER_PREPARE?u(e,n):l(e,n)},async usage(e={}){if(e.by&&![`agent`,`installation`,`engine`].includes(e.by))throw new t(`invalid-option`,`Invalid --by value.`,{hint:`Use agent, installation, or engine`});let n=e.by;if(e.server!==void 0)return a(e).usage({since:N(e.since),by:n});let[{localUsage:r},{usageSummary:i}]=await Promise.all([import(`./store-Cxc2GYyj.js`).then(e=>e.h),import(`./usage-Bw7fQeFC.js`).then(e=>e.a)]);return i(r(E(e)).map(([,e])=>e),N(e.since)??0,n)},integrations:{list:()=>Object.entries(o).map(([e,t])=>({id:e,description:t.description,events:Object.keys(t.events),tools:t.tools.presets.write})),show(e){if(!e)throw new t(`invalid-option`,`Missing integration id.`,{hint:`Usage: coder agent integrations show <id>`});let n=o[e];if(!n)throw new t(`invalid-option`,`Unknown integration "${e}".`,{hint:`List integrations: coder agent integrations list`});return{id:e,events:Object.fromEntries(Object.entries(n.events).map(([e,t])=>[e,t.description])),tools:n.tools.presets}}}};export{P as n,T as t};

package/dist/alias--pfI-nvH.js

@@ -1,2 +0,0 @@
-import{i as e}from"./cli-IfrPgeYz.js";import{p as t}from"./output-BKeyLbvt.js";import{n}from"./models-DGPrMV51.js";import{n as r}from"./add-CKENklTr.js";import i from"node:process";const a=e({name:`model alias`,help:{usage:`coder model alias <name> <spec> [--workspace]`,summary:`Save an alias for an engine spec, e.g. fast -> codex:luna. An alias may reuse a
-built-in name to override it.`,flags:[[`--workspace`,`target <repo>/.coder/config.json instead of the user file`]]},options:r,args:2,run:({options:e,args:[t,r],cwd:i})=>n(i,t,r,e),print:o});function o(e){let n=t,r=`${e.provider} ${e.model}${e.effort?` (${e.effort})`:``}`;i.stdout.write(`aliased ${n.cyan(e.alias)} -> ${e.provider}:${e.model}${e.effort?`:${e.effort}`:``} ${n.dim(`= ${r}`)}  ${n.dim(`(${e.file})`)}\n`)}export{a as commandModelAlias};

package/dist/app-C7sw1ZkI.js

@@ -1 +0,0 @@
-import{s as e}from"./cli-IfrPgeYz.js";const t=e(`server app`,{create:async()=>(await import(`./create-Ik613gJw.js`)).commandServerAppCreate},{menu:[{usage:`create <integration>`,blurb:`create the built-in agent's public app`}],description:[`The built-in agent's apps, one per platform, shared by every workspace on this server.`],exampleCommand:`server app create`});export{t as commandServerApp};

package/dist/approvals-9-G-QxOy.js

@@ -1,2 +0,0 @@
-import{Tt as e}from"./dispatch-YW1aqjEg.js";import{i as t,r as n}from"./cli-IfrPgeYz.js";import{a as r,p as i,s as a}from"./output-BKeyLbvt.js";import{i as o,n as s,s as c,t as l}from"./args-DEMOfLz2.js";import u from"node:process";const d={server:o,workspace:c,yes:s};function f(e,t){let n=i;if(!t.length)return void u.stdout.write(`${n.dim(`No approvals for task ${e}.`)}\n`);for(let e of t){let t=e.answered??`pending`;u.stdout.write(`${n.cyan(e.id)}  ${t.padEnd(8)} ${n.dim(String(e.summary??``))}\n`)}let r=t.filter(e=>!e.answered);if(r.length){let e=r.length===1?r[0].id:`<approval-id>`;u.stdout.write(`\n${a([`Answer: coder task approve ${e} [--deny]`],n)}\n`)}}function p(t){let n=i;if(!t.length)return void u.stdout.write(`${n.dim(`No pending approvals.`)}\n\n${a([`Check tasks: coder task list`],n)}\n`);let o={id:Math.max(11,...t.map(e=>e.id.length)),task:Math.max(7,...t.map(e=>e.taskId.length))};u.stdout.write(n.bold(n.light(`${`approval-id`.padEnd(o.id)}  ${`task-id`.padEnd(o.task)}  age    summary\n`)));for(let i of t){let t=i.createdAt?r(e(i.createdAt)):`-`;u.stdout.write(`${n.cyan(i.id.padEnd(o.id))}  ${n.cyan(i.taskId.padEnd(o.task))}  ${t.padEnd(5)}  ${n.light(i.summary)}\n`)}let s=t.length===1?t[0].id:`<approval-id>`;u.stdout.write(`\n${a([`Answer: coder task approve ${s} [--deny]`],n)}\n`)}const m=t({name:`task approvals`,help:{usage:`coder task approvals [task-id] [--server [url]]`,summary:`Without a task id: pending approvals across all tasks. With one: that task's
-permission escalations and how each was answered.`,flags:[n]},options:{...l,...d},args:1,run:async({options:e,args:[t]})=>{let{tasks:n}=await import(`./task-DEp3GHwH.js`).then(e=>e.t);return n.approvals(t,{...e,organization:e.workspace})},json:(e,{options:t,args:[n]})=>t.server===void 0&&n?e.map(({taskId:e,...t})=>t):t.server===void 0?e.map(({taskId:e,id:t,summary:n,createdAt:r})=>({taskId:e,id:t,summary:n,createdAt:r})):e,print(e,{options:t,args:[n]}){if(t.server===void 0)return n?f(n,e):p(e);if(!e.length)return void u.stdout.write(`${i.dim(`No pending approvals.`)}\n\n${a([`Check tasks: coder task list`],i)}\n`);for(let t of e)u.stdout.write(`${t.taskId}  ${JSON.stringify(t)}\n`)}});export{m as commandApprovals};

package/dist/approve-CAk8qPqG.js

@@ -1,2 +0,0 @@
-import{i as e,r as t}from"./cli-IfrPgeYz.js";import{p as n}from"./output-BKeyLbvt.js";import{i as r,n as i,s as a,t as o}from"./args-DEMOfLz2.js";import s from"node:process";const c={server:r,workspace:a,yes:i},l=e({name:`task approve`,help:{usage:`coder task approve [task-id] <approval-id> [--deny] [--server [url]]`,summary:`Answer an escalated permission request. Accepts by default; --deny rejects it.
-Approval ids are unique, so the task id is optional.`,flags:[[`--deny`,`reject the request instead of accepting`],t]},options:{...o,deny:i,...c},args:2,run:async({options:e,args:[t,n]})=>{let{tasks:r}=await import(`./task-DEp3GHwH.js`).then(e=>e.t);return r.approve(t,n,{...e,organization:e.workspace})},print:(e,{options:t,args:r})=>s.stdout.write(t.server===void 0?`${t.deny?`Denied`:`Approved`} ${n.cyan(e.approvalId)} on task ${n.cyan(e.taskId)}.\n`:`${t.deny?`Denied`:`Approved`} ${n.cyan(r[1])}.\n`)});export{l as commandApprove};

package/dist/apps-CaHoLNE7.js

@@ -1 +0,0 @@
-import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{St as t}from"./dispatch-YW1aqjEg.js";import{i as n,t as r}from"./load-DDZfByUe.js";import{n as i}from"./integrations-B2CavXR1.js";import{o as a}from"./local-B0GiaLV0.js";import{$n as o,Gn as s,t as c}from"./store-Cxc2GYyj.js";import{n as l}from"./env-LsVTi18f.js";import u from"node:process";var d=e({serverAppLink:()=>f});async function f(e,d={}){let f=l(d.env??u.env),p=i(f.integrations);if(!p[e])throw new t(`invalid-option`,`Unknown integration "${e}".`,{hint:`Pick one of ${Object.keys(p).join(`, `)}.`});if(!f.databaseUrl||!f.publicUrl)throw new t(`invalid-option`,`Built-in apps need the server database and address.`,{hint:`Set DATABASE_URL and PUBLIC_URL as the server has them.`});let m={...n()[r].json,...d.name?{name:d.name}:{}},h={agent:r,def:a(m),...d.owner?{owner:d.owner}:{},public:!0},g=await c(f);try{let t=g.defaultOrganizationId,n={config:f,organizationId:t,store:g.store(t)},r=await o(n,`create`,`*`,s(e,h)),i=new URLSearchParams({agent:h.agent,def:h.def,...h.owner?{owner:h.owner}:{},public:`1`,tx:r});return{url:`${f.publicUrl.replace(/\/$/,``)}/create/${e}?${i}`}}finally{await g.close()}}export{f as n,d as t};

package/dist/archive-Ylxh0HIl.js

@@ -1,3 +0,0 @@
-import{i as e}from"./cli-IfrPgeYz.js";import{p as t}from"./output-BKeyLbvt.js";import{n,t as r}from"./args-DEMOfLz2.js";import i from"node:process";const a=e=>e===1?``:`s`,o=e({name:`flow archive`,help:{usage:`coder flow archive <run-id> | coder flow archive --all-stopped`,summary:`Archive a flow run so it drops out of the default list (see it again with
-\`coder flow list --archived [--limit N]\`). Pass --all-stopped to archive every
-finished run. A running run must be stopped first.`,flags:[[`--all-stopped`,`archive every stopped (finished) run`]]},options:{...r,"all-stopped":n},args:1,run:async({options:e,args:[t]})=>{let{archiveRuns:n}=await import(`./executor-HWnIIYUL.js`).then(e=>e.b);return n(t,{allStopped:e[`all-stopped`]})},print(e){if(!(`count`in e))return void i.stdout.write(`Archived run ${t.cyan(e.runId)}.\n`);i.stdout.write(e.count?`Archived ${e.count} stopped run${a(e.count)}.\n`:`${t.dim(`No stopped runs to archive.`)}\n`)}});export{o as commandArchive,a as plural};

package/dist/archive-fs5RjYHc.js

@@ -1,4 +0,0 @@
-import{i as e,r as t}from"./cli-IfrPgeYz.js";import{p as n}from"./output-BKeyLbvt.js";import{i as r,n as i,s as a,t as o}from"./args-DEMOfLz2.js";import s from"node:process";const c={server:r,workspace:a,yes:i},l=e=>e===1?``:`s`,u=e({name:`task archive`,help:{usage:`coder task archive <task-id> | coder task archive --all-stopped [--server [url]]`,summary:`Archive a task session so it drops out of the default list (see it again with
-\`coder task list --archived [--limit N]\`). Pass --all-stopped to archive every
-finished task. A running task keeps running; steering an archived task
-brings it back.`,flags:[[`--all-stopped`,`archive every stopped (finished) task`],t]},options:{...o,"all-stopped":i,...c},args:1,run:async({options:e,args:[t]})=>{let{tasks:n}=await import(`./task-DEp3GHwH.js`).then(e=>e.t);return n.archive(t,{...e,organization:e.workspace,allStopped:e[`all-stopped`]})},print(e,{options:t}){if(e.count===void 0)return void s.stdout.write(`Archived task ${n.cyan(e.taskId)}.\n`);s.stdout.write(t.server===void 0?e.count?`Archived ${e.count} stopped task${l(e.count)}.\n`:`${n.dim(`No stopped tasks to archive.`)}\n`:`Archived ${e.count} server task${l(e.count)}.\n`)}});export{u as commandArchive,l as plural};

package/dist/archive-sweep-BrqWj4kr.js

@@ -1 +0,0 @@
-import{i as e}from"./cli-IfrPgeYz.js";import{n as t,s as n}from"./args-DEMOfLz2.js";const r=e({name:`task archive-sweep`,options:{cwd:n,flows:t},args:1/0,run:async({options:e,args:t,cwd:n})=>{let{archiveFlagged:r}=await import(`./actions-CmfXOVXQ.js`).then(e=>e.t),{archiveFlaggedRuns:i}=await import(`./executor-HWnIIYUL.js`).then(e=>e.b);return e.flows?i(t):r(n,t)}});export{r as commandArchiveSweep};

package/dist/args-DEMOfLz2.js

@@ -1 +0,0 @@
-import{St as e}from"./dispatch-YW1aqjEg.js";import*as t from"zod/mini";const n=t.optional(t.boolean()),r=t.optional(t.string()),i=t.optional(t.array(t.string())),a=t.optional(t.union([t.string(),t.literal(!0)])),o=t._default(a,!0),s={cwd:r,json:n},c=t.optional(t.union([t.literal(`all`),t.coerce.number().check(t.int(),t.positive())],{error:`expected a positive integer or "all"`})),l=t.optional(t.union([t.literal(`all`),t.coerce.number().check(t.int(),t.nonnegative())],{error:`expected a number or "all"`}));function u(e){let t=e.def;for(;t;){if(t.type===`union`)return t.options.some(e=>e.def.type===`literal`);let e=t.innerType??t.in;t=e?e.def:void 0}return!1}function d(e,t){let n=e.def;for(;n;){if(n.type===t)return!0;let e=n.innerType??n.in;n=e?e.def:void 0}return!1}const f=e=>d(e,`boolean`);function p(t,n,r={}){let i=n.shape,a={},o=[],s=!1,c=(e,t,n,r)=>{let o=i[t],s=r?`-`:`--`;if(!o)throw Error(`Unknown option ${s}${e} (use -- to pass literal text starting with -)`);if(f(o))return a[t]=n===void 0||n!==`false`,0;if(u(o)&&(n===void 0||n.startsWith(`-`)))return a[t]=!0,0;if(n===void 0)throw Error(`Missing value for ${s}${e}`);return a[t]=d(o,`array`)?[...a[t]??[],n]:n,1};for(let e=0;e<t.length;e+=1){let n=t[e];if(s){o.push(n);continue}if(n===`--`){s=!0;continue}if(!n.startsWith(`-`)||n===`-`){o.push(n);continue}if(n.startsWith(`--`)){let[r,a]=n.slice(2).split(`=`,2);a===void 0&&i[r]&&!f(i[r])?e+=c(r,r,t[e+1],!1):c(r,r,a,!1);continue}let r=n.slice(1);i[r]&&!f(i[r])?e+=c(r,r,t[e+1],!0):c(r,r,void 0,!0)}let l=n.safeParse(a);if(!l.success){let e=l.error.issues[0],t=String(e.path[0]??``),n=a[t];throw Error(n===void 0?`Missing required --${t}.`:`Invalid --${t} value ${JSON.stringify(n)}: ${e.message}`)}let p=r.positionals??0;if(o.length>p){let t=o.slice(p);throw new e(`invalid-option`,`Unexpected argument${t.length>1?`s`:``}: ${t.join(` `)}`,r.command?{hint:`Help: coder ${r.command} --help`}:{})}return{options:l.data,positionals:o}}export{p as a,i as c,a as i,l,n,o,c as r,r as s,s as t};

package/dist/ask-Dmk0HGtI.js

@@ -1,4 +0,0 @@
-import{i as e,r as t}from"./cli-IfrPgeYz.js";import{p as n}from"./output-BKeyLbvt.js";import{i as r,n as i,s as a,t as o}from"./args-DEMOfLz2.js";import{idAndText as s}from"./steer-BGKYpW4T.js";import c from"node:process";const l={server:r,workspace:a,yes:i},u=e({name:`task ask`,help:{usage:`coder task ask <task-id> "<question>" [--server [url]]`,summary:`Answer a question ABOUT a task without touching it: a read-only sidecar reads
-the task's progress log, result, and workspace and answers; the task never
-sees the question and its thread is not steered. Works whether the task is
-running or stopped. To change what the task does, use \`coder task steer\`.`,flags:[[`--model <alias|slug>`,`sidecar model (default: the task's own)`],[`--effort <low|medium|high>`,`sidecar reasoning effort`],t],examples:[[`coder task ask task-abc "what approach did you take and why?"`,`probe a decision without derailing the task`]]},options:{...o,model:a,effort:a,...l},args:1/0,async run({options:e,args:t}){let{tasks:r}=await import(`./task-DEp3GHwH.js`).then(e=>e.t),{id:i,text:a}=s(t,`Missing task id or question.`,[`Usage: coder task ask <task-id> "<question>"`,`Help: coder task ask --help`]);return r.ask(i,a,{...e,organization:e.workspace,onAsking:t=>e.json||c.stderr.write(`${n.dim(`[coder]`)} asking about task ${n.cyan(t)} (read-only sidecar; the task is not interrupted)...\n`)})},json:({ok:e,...t})=>t,print(e,{options:t,args:[r]}){if(t.server!==void 0)return void c.stdout.write(`Asked server task ${n.cyan(r)}.\n`);let{answer:i,error:a}=e;i?c.stdout.write(`\n${i}\n`):c.stdout.write(`${n.dim(`(no answer)`)}${a?` ${n.red(a)}`:``}\n`)},exit:(e,{options:t})=>t.server===void 0?+!e.ok:void 0});export{u as commandAsk};

package/dist/auth-CS0cH0gq.js

@@ -1 +0,0 @@
-import{i as e,l as t}from"./http-DG54kyx4.js";import{Lt as n,fn as r,pn as i}from"./store-Cxc2GYyj.js";import{c as a}from"./schema-DoNO0dPh.js";import{a as o,i as s,o as c}from"./serve-D_XiZzYd.js";import{createECDH as l,hkdfSync as u}from"node:crypto";import*as d from"openid-client";import{and as f,eq as p}from"drizzle-orm";import{EncryptJWT as m,calculateJwkThumbprint as h,createRemoteJWKSet as g,jwtDecrypt as _,jwtVerify as v}from"jose";const y=(e,t)=>new Uint8Array(u(`sha256`,e,``,t,32));async function b(e){let t=y(e,`coder oidc client key`),n=l(`prime256v1`);n.setPrivateKey(t);let r=n.getPublicKey(),i={kty:`EC`,crv:`P-256`,x:Buffer.from(r.subarray(1,33)).toString(`base64url`),y:Buffer.from(r.subarray(33)).toString(`base64url`)},a=await crypto.subtle.importKey(`jwk`,{...i,d:Buffer.from(t).toString(`base64url`)},{name:`ECDSA`,namedCurve:`P-256`},!1,[`sign`]),o=await h(i);return{key:a,kid:o,jwk:{...i,kid:o,alg:`ES256`,use:`sig`}}}async function x(e){let t=[e.encryptionKey,e.previousEncryptionKey].filter(e=>!!e),n=await Promise.all(t.map(b));return{cookie:t.map(e=>y(e,`coder session cookie`)),client:n[0],jwks:{keys:n.map(e=>e.jwk)}}}const S=`${r}.session`,C=`${r}.oidc`,w=3800,T=2592e3,E=()=>Math.floor(Date.now()/1e3);function D(e){let t=new Map;for(let n of(e.get(`cookie`)??``).split(/;\s*/)){let e=n.indexOf(`=`);e>0&&t.set(n.slice(0,e),n.slice(e+1))}return t}function O(e){let t=[];for(;e.has(`${S}.${t.length}`);)t.push(`${S}.${t.length}`);return t}function k(e){let t=D(e);return t.get(S)??(O(t).map(e=>t.get(e)).join(``)||void 0)}function A(e){return Array.isArray(e)?e.flatMap(e=>typeof e?.id==`string`&&typeof e.role==`string`?[{id:e.id,slug:String(e.slug??e.id),name:String(e.name??e.slug??e.id),role:e.role}]:[]):[]}function j(e,t,n){let r=e.get(`x-coder-organization`),i=r?t.organizations.find(e=>e.slug===r||e.id===r):t.organizations.find(e=>e.id===n)??t.organizations[0];return i?{...t,organizationId:i.id,role:i.role}:r?{...t,organizationDenied:!0}:t}async function M(r,l){let u=l.auth.wular.url,h=l.publicUrl,y=new URL(h).origin,b=h.startsWith(`https:`),M=await x(l),N=`${h}${s}`,P=(e,t,n)=>`${e}=${t}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${n}${b?`; Secure`:``}`,F=(e,t)=>new m(e).setProtectedHeader({alg:`dir`,enc:`A256GCM`}).setIssuedAt().setExpirationTime(`${t}s`).encrypt(M.cookie[0]);async function I(e){if(e)for(let t of M.cookie)try{return(await _(e,t)).payload}catch{}}async function L(e,t){let n=await F(t,T),r=O(D(e));if(n.length<=w)return[P(S,n,T),...r.map(e=>P(e,``,0))];let i=n.match(RegExp(`.{1,${w}}`,`g`));return[P(S,``,0),...i.map((e,t)=>P(`${S}.${t}`,e,T)),...r.slice(i.length).map(e=>P(e,``,0))]}let R=e=>[S,...O(D(e))].map(e=>P(e,``,0)),z,B=()=>z??=d.discovery(new URL(u),`${h}${c}`,void 0,d.PrivateKeyJwt(M.client),new URL(u).protocol===`http:`?{execute:[d.allowInsecureRequests]}:void 0).catch(e=>{throw z=void 0,e}),V,H=async()=>V??=g(new URL((await B()).serverMetadata().jwks_uri));function U(e,t){let n=e.claims();if(!n)throw Error(`Wular Auth returned no ID token`);let r=A(n.organizations),i=e=>r.find(t=>t.id===e)?.id;return{sub:n.sub,name:typeof n.name==`string`?n.name:``,email:typeof n.email==`string`?n.email:``,orgs:r,org:i(t?.org)??i(n.org)??r[0]?.id,exp_at:E()+(e.expires_in??600),at:E(),rt:e.refresh_token??t?.rt,idt:e.id_token??t?.idt}}let W=new Map;function G(e){let t=e.rt;if(!t)return Promise.resolve(void 0);let n=W.get(t);return n||(n=B().then(e=>d.refreshTokenGrant(e,t)).then(t=>U(t,e)).catch(e=>(W.delete(t),e instanceof d.ResponseBodyError&&e.error===`invalid_grant`?!1:void 0)),W.set(t,n),setTimeout(()=>W.delete(t),6e4).unref?.()),n}async function K(e,t,n){let r=(await H().then(t=>v(e,t,{issuer:u,audience:y,typ:`at+jwt`})).catch(()=>void 0))?.payload;if(!r?.sub)return;let i={user:{id:r.sub,name:``,email:``},organizations:A(r.organizations)};return n&&E()-(r.iat??0)>60?{...i,stale:!0}:j(t,i,typeof r.org==`string`?r.org:void 0)}async function q(e){let t=await B().catch(()=>void 0);if(!t)return Response.redirect(`${h}/login?error=unavailable`,302);let n={verifier:d.randomPKCECodeVerifier(),state:d.randomState(),nonce:d.randomNonce(),return:i(e.searchParams.get(`return`),y)},r=d.buildAuthorizationUrl(t,{redirect_uri:N,scope:o,code_challenge:await d.calculatePKCECodeChallenge(n.verifier),code_challenge_method:`S256`,state:n.state,nonce:n.nonce});return new Response(null,{status:302,headers:{location:r.href,"set-cookie":P(C,await F(n,600),600)}})}async function J(e,t){let n=e=>{let t=new Headers({location:`/login?error=${encodeURIComponent(e)}`});return t.append(`set-cookie`,P(C,``,0)),new Response(null,{status:302,headers:t})},r=await I(D(e.headers).get(C));if(!r)return n(`expired`);let i=t.searchParams.get(`error`);if(i)return n(i);let a;try{a=U(await d.authorizationCodeGrant(await B(),new URL(`${N}${t.search}`),{pkceCodeVerifier:r.verifier,expectedState:r.state,expectedNonce:r.nonce,idTokenExpected:!0}))}catch{return n(`sign_in_failed`)}let o=new Headers({location:r.return});o.append(`set-cookie`,P(C,``,0));for(let t of await L(e.headers,a))o.append(`set-cookie`,t);return new Response(null,{status:302,headers:o})}async function Y(t){if(!n(t,h))return e();let r=await I(k(t.headers)),i=await B().catch(()=>void 0),a=`${h}/?signed_out=1`,o=i?.serverMetadata().end_session_endpoint&&r?.idt?d.buildEndSessionUrl(i,{id_token_hint:r.idt,post_logout_redirect_uri:a}).href:a,s=Response.json({url:o});for(let e of R(t.headers))s.headers.append(`set-cookie`,e);return s}return{issuer:u,jwks:M.jwks,handler(e){let n=new URL(e.url);return n.pathname===`/api/auth/sign-in`&&e.method===`GET`?q(n):n.pathname===`/api/auth/callback`&&e.method===`GET`?J(e,n):n.pathname===`/api/auth/sign-out`&&e.method===`POST`?Y(e):Promise.resolve(t())},async session(e,t=!1,n=[]){let r=e.get(`authorization`);if(r?.startsWith(`Bearer `))return K(r.slice(7),e,t);let i=await I(k(e));if(i){if(i.exp_at<=E()||t&&E()-i.at>60){let t=await G(i);if(t===!1&&n.push(...R(e)),!t)return;i=t,n.push(...await L(e,i))}return j(e,{user:{id:i.sub,name:i.name,email:i.email},organizations:i.orgs},i.org)}},async setOrganization(e,t){let n=await I(k(e)),r=n?.orgs.find(e=>e.slug===t);if(!(!n||!r))return{...r,cookies:await L(e,{...n,org:r.id})}},async link(e,t,n,i={}){let o={name:e.name,email:e.email,...i.organizations?{organizations:i.organizations}:{},...i.token?{token:i.token}:{}};await r.insert(a).values({platform:t,platformUserId:n,userId:e.id,...o}).onConflictDoUpdate({target:[a.platform,a.platformUserId],set:o,setWhere:p(a.userId,e.id)});let[s]=await r.select({userId:a.userId}).from(a).where(f(p(a.platform,t),p(a.platformUserId,n)));return s?.userId===e.id?`linked`:`taken`},async linkedUser(e,t){let[n]=await r.select({id:a.userId,name:a.name,email:a.email,organizations:a.organizations,token:a.token}).from(a).where(f(p(a.platform,e),p(a.platformUserId,t)));return n&&{id:n.id,name:n.name,email:n.email,...n.organizations?{organizations:n.organizations}:{},...n.token?{token:n.token}:{}}}}}export{M as createAuth};

package/dist/auth-cZ0FrkBv.js

@@ -1 +0,0 @@
-import{s as e}from"./cli-IfrPgeYz.js";const t=e(`auth`,{login:async()=>(await import(`./login-KHrM3MI3.js`)).commandLogin,logout:async()=>(await import(`./logout-CqUKg0lc.js`)).commandLogout,status:async()=>(await import(`./status-C09SKASS.js`)).commandStatus},{menu:[{usage:`login`,blurb:`sign in through the browser`},{usage:`logout`,blurb:`sign out and forget the saved session`},{usage:`status`,blurb:`show where you are signed in`}],description:[`Sign in to Coder and manage saved server sessions.`],exampleCommand:`auth login`});export{t as commandAuth};

package/dist/chat-3Znsevah.js

@@ -1 +0,0 @@
-import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import t from"node:path";import n from"node:fs";import{randomUUID as r}from"node:crypto";var i=e({LocalChatState:()=>a,appChatState:()=>l}),a=class{file;now;memory=new Map;constructor(e,t=Date.now){this.file=e,this.now=t}change(e){let r=this.now(),i=this.load(r),a=e(i,r);if(this.file){n.mkdirSync(t.dirname(this.file),{recursive:!0});let e=`${this.file}.${process.pid}.tmp`;n.writeFileSync(e,JSON.stringify(Object.fromEntries(i)),{mode:384}),n.renameSync(e,this.file)}return a}load(e){let t=this.memory;if(this.file)try{t=new Map(Object.entries(JSON.parse(n.readFileSync(this.file,`utf8`))))}catch(e){if(e.code!==`ENOENT`)throw e;t=new Map}for(let[n,r]of t)r.expiresAt!==void 0&&r.expiresAt<=e&&t.delete(n);return t}read(e){return this.load(this.now()).get(e)?.value}async connect(){}async disconnect(){}async get(e){return this.read(`k:${e}`)??null}async set(e,t,n){this.change((r,i)=>r.set(`k:${e}`,o(t,i,n)))}async setIfNotExists(e,t,n){return this.change((r,i)=>!r.has(`k:${e}`)&&(r.set(`k:${e}`,o(t,i,n)),!0))}async delete(e){this.change(t=>t.delete(`k:${e}`))}async appendToList(e,t,n={}){this.change((r,i)=>{let a=[...s(r.get(`k:${e}`)?.value),t],c=n.maxLength?a.slice(-n.maxLength):a;r.set(`k:${e}`,o(c,i,n.ttlMs))})}async getList(e){return s(this.read(`k:${e}`))}async acquireLock(e,t){return this.change((n,i)=>{if(n.has(`l:${e}`))return null;let a={threadId:e,token:r(),expiresAt:i+t};return n.set(`l:${e}`,{value:a.token,expiresAt:a.expiresAt}),a})}async extendLock(e,t){return this.change((n,r)=>n.get(`l:${e.threadId}`)?.value===e.token&&(n.set(`l:${e.threadId}`,{value:e.token,expiresAt:r+t}),!0))}async releaseLock(e){this.change(t=>{t.get(`l:${e.threadId}`)?.value===e.token&&t.delete(`l:${e.threadId}`)})}async forceReleaseLock(e){this.change(t=>t.delete(`l:${e}`))}async enqueue(e,t,n){return this.change((r,i)=>{let a=[...c(r.get(`q:${e}`)?.value,i),t].slice(-n);return r.set(`q:${e}`,{value:a,expiresAt:Math.max(...a.map(e=>e.expiresAt))}),a.length})}async dequeue(e){return this.change((t,n)=>{let r=t.get(`q:${e}`),[i,...a]=c(r?.value,n);return a.length?t.set(`q:${e}`,{...r,value:a}):t.delete(`q:${e}`),i??null})}async queueDepth(e){return c(this.read(`q:${e}`),this.now()).length}async subscribe(e){this.change(t=>t.set(`s:${e}`,{value:!0}))}async unsubscribe(e){this.change(t=>t.delete(`s:${e}`))}async isSubscribed(e){return this.read(`s:${e}`)===!0}};const o=(e,t,n)=>n?{value:e,expiresAt:t+n}:{value:e},s=e=>Array.isArray(e)?e:[],c=(e,t)=>s(e).filter(e=>e.expiresAt>t);function l(e,t){let n=`${encodeURIComponent(t)}/`,r=e=>n+e,i=e=>({...e,threadId:r(e.threadId)}),a=e=>e&&{...e,threadId:e.threadId.slice(n.length)};return{connect:()=>e.connect(),disconnect:()=>e.disconnect(),get:t=>e.get(r(t)),set:(t,n,i)=>e.set(r(t),n,i),setIfNotExists:(t,n,i)=>e.setIfNotExists(r(t),n,i),delete:t=>e.delete(r(t)),appendToList:(t,n,i)=>e.appendToList(r(t),n,i),getList:t=>e.getList(r(t)),acquireLock:async(t,n)=>a(await e.acquireLock(r(t),n)),extendLock:(t,n)=>e.extendLock(i(t),n),releaseLock:t=>e.releaseLock(i(t)),forceReleaseLock:t=>e.forceReleaseLock(r(t)),enqueue:(t,n,i)=>e.enqueue(r(t),n,i),dequeue:t=>e.dequeue(r(t)),queueDepth:t=>e.queueDepth(r(t)),subscribe:t=>e.subscribe(r(t)),unsubscribe:t=>e.unsubscribe(r(t)),isSubscribed:t=>e.isSubscribed(r(t))}}export{l as n,i as r,a as t};

package/dist/chat-bridge-18koyS7c.js

@@ -1,2 +0,0 @@
-import{Z as e}from"./dispatch-YW1aqjEg.js";import t from"node:process";import n from"node:crypto";import r from"node:http";function i(e){let t=[];typeof e.instructions==`string`&&e.instructions&&t.push({role:`system`,content:e.instructions});let n=Array.isArray(e.input)?e.input:[];for(let e of n)switch(e?.type){case`message`:{let n=Array.isArray(e.content)?e.content.map(e=>e?.text??``).join(``):String(e.content??``);t.push({role:e.role===`developer`?`system`:e.role,content:n});break}case`function_call`:{let n={id:e.call_id,type:`function`,function:{name:e.name,arguments:e.arguments??`{}`}},r=t.at(-1);r?.role===`assistant`&&r.tool_calls?r.tool_calls.push(n):t.push({role:`assistant`,content:null,tool_calls:[n]});break}case`function_call_output`:{let n=e.output;t.push({role:`tool`,tool_call_id:e.call_id,content:typeof n==`string`?n:JSON.stringify(n??``)});break}}return t}function a(e){let t=(Array.isArray(e.tools)?e.tools:[]).filter(e=>e?.type===`function`).map(e=>({type:`function`,function:{name:e.name,description:e.description??``,parameters:e.parameters??{type:`object`,properties:{}}}})),n=e.text?.format;return{model:e.model,messages:i(e),...t.length?{tools:t,tool_choice:e.tool_choice??`auto`}:{},...typeof e.parallel_tool_calls==`boolean`?{parallel_tool_calls:e.parallel_tool_calls}:{},...n?.type===`json_schema`?{response_format:{type:`json_schema`,json_schema:{name:n.name,schema:n.schema,strict:n.strict??!1}}}:{},stream:!0,stream_options:{include_usage:!0}}}var o=class{send;model;responseId=`resp_bridge_${n.randomUUID()}`;text=``;textOpen=!1;toolCalls=new Map;usage=null;buffer=``;constructor(e,t){this.model=e,this.send=t,this.send({type:`response.created`,response:{id:this.responseId,object:`response`,status:`in_progress`,model:e,output:[]}})}push(e){this.buffer+=e;let t=this.buffer.split(`
-`);this.buffer=t.pop()??``;for(let e of t){let t=e.trim();if(!t.startsWith(`data:`))continue;let n=t.slice(5).trim();if(!n||n===`[DONE]`)continue;let r;try{r=JSON.parse(n)}catch{continue}r.usage&&(this.usage=r.usage);let i=r.choices?.[0]?.delta;if(i){typeof i.content==`string`&&i.content&&(this.textOpen||(this.textOpen=!0,this.send({type:`response.output_item.added`,output_index:0,item:{type:`message`,id:`msg_bridge_0`,status:`in_progress`,role:`assistant`,content:[]}})),this.text+=i.content,this.send({type:`response.output_text.delta`,item_id:`msg_bridge_0`,output_index:0,content_index:0,delta:i.content}));for(let e of i.tool_calls??[]){let t=this.toolCalls.get(e.index)??{id:``,name:``,args:``};e.id&&(t.id=e.id),e.function?.name&&(t.name+=e.function.name),e.function?.arguments&&(t.args+=e.function.arguments),this.toolCalls.set(e.index,t)}}}}finish(){let e=[];if(this.text){let t={type:`message`,id:`msg_bridge_0`,status:`completed`,role:`assistant`,content:[{type:`output_text`,text:this.text,annotations:[]}]};e.push(t),this.send({type:`response.output_item.done`,output_index:0,item:t})}let t=e.length;for(let n of this.toolCalls.values()){let r={type:`function_call`,id:`fc_bridge_${t}`,call_id:n.id||`call_bridge_${t}`,name:n.name,arguments:n.args||`{}`,status:`completed`};e.push(r),this.send({type:`response.output_item.done`,output_index:t,item:r}),t+=1}this.send({type:`response.completed`,response:{id:this.responseId,object:`response`,status:`completed`,model:this.model,output:e,usage:{input_tokens:this.usage?.prompt_tokens??0,input_tokens_details:{cached_tokens:this.usage?.prompt_tokens_details?.cached_tokens??0},output_tokens:this.usage?.completion_tokens??0,output_tokens_details:{reasoning_tokens:this.usage?.completion_tokens_details?.reasoning_tokens??0},total_tokens:this.usage?.total_tokens??0}}})}};async function s(s,c=`chat`){let l=c===`responses`,u=e(s.baseUrl,l?`responses`:`chat/completions`),d=null,f=!0,p=s.envKey?t.env[s.envKey]:void 0;async function m(e){let t=d?[d]:u,n=null;for(let r of t)if(n=await fetch(r,{method:`POST`,headers:{"content-type":`application/json`,...p?{authorization:`Bearer ${p}`}:{}},body:e}),n.status!==404)return d=r,n;return n}async function h(e){let t=e.text?.format,n=l?e:a(e),r=()=>{let r=`Reply with only a single JSON object matching this JSON Schema:\n${JSON.stringify(t.schema)}\nUse no prose or markdown fences.`;if(l){let{format:t,...n}=e.text;return{...e,text:n,input:[...e.input??[],{type:`message`,role:`user`,content:[{type:`input_text`,text:r}]}]}}let{response_format:a,...o}=n;return{...o,messages:[...i(e),{role:`user`,content:r}]}};if(t?.type!==`json_schema`)return m(JSON.stringify(n));if(!f)return m(JSON.stringify(r()));let o=await m(JSON.stringify(n));if(![400,422,501].includes(o.status))return o;let s=await o.clone().text();return/(invalid.{0,30}schema|schema.{0,30}invalid|unsupported.{0,30}(keyword|constraint)|(keyword|constraint).{0,30}unsupported)/i.test(s)||!/(response_format|json_schema|text[.\s]format)/i.test(s)||!/(not supported|unsupported|unknown parameter|unrecognized|not available)/i.test(s)?o:(f=!1,await o.body?.cancel(),m(JSON.stringify(r())))}let g=n.randomBytes(16).toString(`hex`),_=r.createServer((e,t)=>{if(e.method!==`POST`||!e.url?.startsWith(`/${g}/`)||!e.url.replace(/\/+$/,``).endsWith(`/responses`)){t.writeHead(404,{"content-type":`application/json`}),t.end(JSON.stringify({error:{message:`coder chat bridge: only POST /responses is supported`}}));return}let n=``;e.on(`data`,e=>n+=e),e.on(`end`,async()=>{let e;try{e=JSON.parse(n)}catch{t.writeHead(400,{"content-type":`application/json`}),t.end(JSON.stringify({error:{message:`invalid JSON`}}));return}try{if(l){let n=await h(e);if(t.writeHead(n.status,{"content-type":n.headers.get(`content-type`)??`application/json`,"cache-control":`no-store`}),n.body)for await(let e of n.body)t.write(e);t.end();return}let n=await h(e);if(!n.ok||!n.body){let e=await n.text().catch(()=>``);t.writeHead(n.status,{"content-type":`application/json`}),t.end(e||JSON.stringify({error:{message:`upstream HTTP ${n.status}`}}));return}t.writeHead(200,{"content-type":`text/event-stream`,"cache-control":`no-store`});let r=new o(e.model,e=>t.write(`data: ${JSON.stringify(e)}\n\n`)),i=new TextDecoder;for await(let e of n.body)r.push(i.decode(e,{stream:!0}));r.finish(),t.end()}catch(e){let n=e instanceof Error?e.message:String(e);t.writeHead(502,{"content-type":`application/json`}),t.end(JSON.stringify({error:{message:`coder chat bridge: ${n}`}}))}})});await new Promise(e=>_.listen(0,`127.0.0.1`,e));let v=_.address();return{url:`http://127.0.0.1:${typeof v==`object`&&v?v.port:0}/${g}/v1`,close:()=>new Promise(e=>{_.close(()=>e()),_.closeAllConnections?.()})}}export{s as t};