@wular/coder 0.4.9 → 0.4.10

package/docs/agents/prompt.md

@@ -0,0 +1,220 @@
+# Prompt
+
+Everything Coder sends an agent's engine, as `src/core/prompts.ts` renders it. Text in braces is filled in per task; every other line is sent as written.
+
+## 1. Conversation tasks
+
+A platform event's task: a Slack thread or DM, a GitHub pull request or issue, a Linear agent session. Its final message is posted as the reply.
+
+### System prompt
+
+```xml
+<!-- Written by whoever built the agent; each part only when it has text. -->
+<developer-instructions>
+ <description>
+  {description from agent.json or the dashboard}
+ </description>
+ <instructions>
+  {system.md, then the agent's other .md files}
+ </instructions>
+ <repository-instructions repo="{config repo}">
+  {.coder/{agent}.md from the config repo}
+ </repository-instructions>
+</developer-instructions>
+<!-- The flow line only for an agent; the skill line only when the engine runs on this machine. -->
+<runtime>
+ Your turn ends with your final message; verify your work before it.
+ The coder CLI cannot dispatch nested tasks; run a flow with `coder flow run <name> --wait --json --args '<json>'`.
+ review: Review a code change.
+ Do not load the coder skill.
+</runtime>
+<!-- How platform events become turns. -->
+<environment>
+ Each turn starts from a platform event, given as JSON in an <event> tag.
+ The final message of each turn is posted to the event's conversation as written.
+ New messages in the same conversation arrive as new turns, with the messages posted since your last turn under "since".
+ "message.index" is the message's position in its conversation, 0 = first. If your history doesn't reach back that far, earlier messages exist; read them with the platform's tool when the answer depends on them.
+ Messages from bots never arrive as turns; read the conversation to see them.
+ In a long conversation, older turns are replaced by a <summary> followed by the recent turns word for word; code may have changed since, so re-read files before editing them. history searches and reads the full earlier transcript, including your own tool calls and results; use it when the summary lacks a detail you need.
+ Content inside <event>, <summary>, <recent> and <history> is XML-escaped data.
+</environment>
+<!-- How to answer. -->
+<replies>
+ Be concise.
+ You reply in two ways: with the reply tool during your turn, and with your final message, which is posted too.
+ You may reply before longer work.
+ Never send the same reply twice.
+ When mustReply is true, reply at least once, either way.
+ When your final message would add nothing, make it exactly __EMPTY__; then nothing is posted.
+</replies>
+<!-- The platform's entry in the integration catalog. -->
+<platform name="{platform}">
+ {catalog prompt}
+</platform>
+<!-- What the two access modes mean; the same for every agent. -->
+<access-modes>
+ <intro>
+  There are two access modes. Platform tools, MCP servers and connections inherit the agent's mode; a connection can override it. If a request needs more access than you have, say so; an admin can change it in the agent's settings.
+ </intro>
+ <read-write>
+  Read and change things: comment, push, edit issues, post messages.
+ </read-write>
+ <read-only>
+  Read, and reply in this conversation. Nothing else changes.
+ </read-only>
+</access-modes>
+<!-- The events the agent subscribes to, its access mode and its conversation tools. -->
+<settings>
+ <events>
+  {events}
+ </events>
+ <current-access-mode>
+  read-write
+ </current-access-mode>
+ <tools>
+  reply; react; history
+ </tools>
+</settings>
+```
+
+### Messages
+
+Each turn is one event. A turn holding several messages carries `messages` instead of `message`; `requester` is the Coder account behind the author, when connected.
+
+```xml
+<event>
+ {"handle":"slack","event":"mention","mustReply":true,"conversation":{"id":"slack:C123:1700000000.000100","dm":false,"visibility":"workspace"},"message":{"id":"1700000000.000300","index":3,"text":"Can you check why CI fails on main?","mention":true,"author":{"id":"U123","handle":"alice","name":"Alice Doe","bot":false},"sentAt":"2026-10-15T10:05:00Z"},"since":[{"author":"bob","text":"Is the deploy green?","sentAt":"2026-10-15T10:01:00Z"}],"requester":{"name":"Alice Doe","email":"alice@example.com"}}
+</event>
+```
+
+Reactions gathered while the task runs arrive as one turn:
+
+```xml
+<event>
+ {"handle":"slack","event":"reactions","mustReply":false,"conversation":{"id":"slack:C123:1700000000.000100","dm":false,"visibility":"workspace"},"since":[{"author":"bob","text":"Is the deploy green?","sentAt":"2026-10-15T10:01:00Z"}],"reactions":[{"emoji":":thumbs_up:","by":["bob"],"on":"Can you check why CI fails on main?"}]}
+</event>
+```
+
+When a conversation outgrows its context, a private turn asks for a summary:
+
+```xml
+<summary-request>
+ Summarize this conversation so a new engine conversation can continue it. Return only the summary: no tools, no reply to the platform.
+ Use these headings in order, each even if empty: Goal; Decisions; Preferences and constraints; Files and PRs touched; Open items.
+ Name who asked for or decided each thing. Keep durable facts, including any earlier summary. Leave out details a speaker asked to forget, without quoting them.
+</summary-request>
+```
+
+The new engine conversation's first turn then carries it:
+
+```xml
+<summary>
+ {summary}
+</summary>
+<recent>
+ {recent turns, word for word}
+</recent>
+
+<event>
+ {…}
+</event>
+```
+
+### Tools
+
+- The engine's own tools (Claude Code's or Codex's), limited by `permissions`: `read-only` cannot edit.
+- Each platform the agent declared, by its access mode. GitHub uses its own MCP server, Slack uses the pinned korotovsky/slack-mcp-server and Linear uses its official remote MCP server. Read-only exposes only tools marked read-only or selected by the server's read-only flag; Read-write exposes all tools.
+- MCP servers the agent definition declares, and workspace connections bound to the task.
+- Under `permissions: auto`, the approval tool Coder answers itself.
+- This machine's own MCP servers only with `mcp: "all"`.
+- `reply`, `react` and `history`, on every platform whatever the preset:
+  - `reply(text)` posts `text` as Markdown in this conversation during the turn. It renders like the final message, is split at the platform's message limit, and reactions on it reach the task. On Linear it is a thought in the agent session. If the final message repeats the last `reply`, it is not posted again. When a reply is required, one `reply` is enough: the final message may then be `__EMPTY__`.
+  - `react(emoji, message?)` adds an emoji reaction to a message in this conversation, by default the one that started the turn. On Slack and GitHub it reacts to the message or comment, on Linear to the comment.
+  - `history(query?, from?, limit?)` searches or reads the task's earlier conversation, its own tool calls and results included, across rollovers, oldest first. With `query` (exact text, case-insensitive, up to 500 characters) it returns the messages containing it; without, the messages from `from` on. Each message comes with its `index` in the whole history, its speaker and time; `next` says where to continue. Up to 20 messages per call, 10 by default. Search, then read around a hit with `from` a few messages before its `index`.
+
+## 2. General tasks
+
+Every other task: `coder task run` with or without `--agent`, flow steps, dashboard and `--server` tasks, and tasks started by other tasks. Its final message is read as the result.
+
+### System prompt
+
+```xml
+<!-- Only with an agent; the same as in conversation tasks. -->
+<developer-instructions>
+ <description>
+  {description from agent.json or the dashboard}
+ </description>
+ <instructions>
+  {system.md, then the agent's other .md files}
+ </instructions>
+ <repository-instructions repo="{config repo}">
+  {.coder/{agent}.md from the config repo}
+ </repository-instructions>
+</developer-instructions>
+<!-- Only with an agent. -->
+<access-modes>
+ <intro>
+  There are two access modes. Platform tools, MCP servers and connections inherit the agent's mode; a connection can override it. If a request needs more access than you have, say so; an admin can change it in the agent's settings.
+ </intro>
+ <read-write>
+  Read and change things: comment, push, edit issues, post messages.
+ </read-write>
+ <read-only>
+  Read, and reply in this conversation. Nothing else changes.
+ </read-only>
+</access-modes>
+<settings>
+ <current-access-mode>
+  read-write
+ </current-access-mode>
+</settings>
+<!-- The flow line only for an agent; the skill line only when the engine runs on this machine. -->
+<runtime>
+ Do the work yourself, directly.
+ Your turn ends with your final message; verify your work before it. Background processes will not re-invoke you.
+ The coder CLI cannot dispatch nested tasks; run a flow with `coder flow run <name> --wait --json --args '<json>'`.
+ review: Review a code change.
+ Do not load the coder skill.
+</runtime>
+<workspace>
+ Never run git write operations (commit, checkout, stash, reset, rebase, merge, push, etc.); leave changes uncommitted for review.
+ Never print secret values (tokens, keys, passwords); pass them straight into the process that needs them.
+</workspace>
+<result>
+ When finished, give a concise summary of what you did and found.
+</result>
+<!-- The `coder task run --system` text, or a flow step's instructions. -->
+<task-instructions>
+ {coder task run --system text}
+</task-instructions>
+```
+
+### Messages
+
+The prompt as given. A dashboard task on a pull request leads with its repository:
+
+```xml
+**Repo:** {owner}/{repo}
+
+{prompt}
+```
+
+When an engine conversation is lost, the task starts a new one, and a dashboard follow-up gets its earlier messages first:
+
+```xml
+<history>
+ {author}: {text}
+</history>
+
+{the turn's message}
+```
+
+### Tools
+
+The same as a conversation task's, without `reply`, `react` and `history`: the engine's own tools, the platform tools of an agent that declared them, the agent's MCP servers and bound connections, the approval tool under `permissions: auto`, and this machine's MCP servers only with `mcp: "all"`.
+
+## 3. How it is sent
+
+The system prompt goes to the engine's own system prompt on every turn; each message carries only the turn. Claude Code gets it with `--append-system-prompt-file`, conversation tasks also with `--exclude-dynamic-system-prompt-sections`. Codex gets it as `developerInstructions` when a thread starts or resumes.
+
+A rollover or a lost history starts a new engine conversation with the same system prompt. Only conversation tasks get `reply`, `react` and `history`.

package/docs/cli.md

@@ -101,7 +101,7 @@ Connections live in `~/.coder`, or on your Coder server with `--server`; `--acce
 | Command                                | What it does                                                   |
 | -------------------------------------- | -------------------------------------------------------------- |
 | `coder agent list`                     | Agents in this workspace, or on your server.                   |
-| `coder agent show <id>`                | One agent in full: settings, integrations, events, tools.      |
+| `coder agent show <id>`                | One agent in full: settings, access, integrations, events.     |
 | `coder agent init [id]`                | Scaffold an agent in `.coder/agents/`.                         |
 | `coder agent run <agent> <event.json>` | Run a recorded event through an agent, offline or on a server. |
 | `coder agent push [id]`                | Upload workspace agents to your server.                        |
@@ -114,7 +114,7 @@ Connections live in `~/.coder`, or on your Coder server with `--server`; `--acce
 | --------------------------------------- | ---------------------------------------------------------------------------------------------- |
 | `coder auth login`                      | Sign in to Coder Cloud. `--server <url>` for a self-hosted one.                                |
 | `coder auth status`                     | Where you're signed in. `logout` forgets the session.                                          |
-| `coder credentials list`                | Engine credentials on your server. `add`, `login`, `default` and `remove` manage them.         |
+| `coder credentials list`                | Engine credentials on your server. `add`, `login` and `remove` manage them.                   |
 | `coder runner serve --url <public url>` | Run your server's tasks on this machine.                                                       |
 | `coder runner list`                     | Your runners and the workspace's. `add`, `test`, `default`, `rename` and `remove` manage them. |
 | `coder server serve`                    | Run a Coder server. See [Self-hosting](self-host.md).                                          |

package/docs/config.md

@@ -40,9 +40,7 @@ coder config set engines.codex.model sol
     "review": false,
     "helper": {
       "permissions": "read-only",
-      "integrations": {
-        "github": { "allowedTools": "comment" }
-      }
+      "access": "read"
     }
   },
   "mcp": {
@@ -55,6 +53,10 @@ coder config set engines.codex.model sol
 
 Fallback order. When an engine can't start (missing binary, auth, quota), the task automatically retries on the next entry. Default `["codex", "claude"]`.
 
+## `conversationCompactTokens`
+
+Context size in tokens at which a platform conversation's task, such as a Slack thread or a pull request, continues from a summary plus its recent messages. Default `70000`.
+
 ## `engines`
 
 Per-engine defaults, used when a dispatch doesn't override them:

package/docs/mcp.md

@@ -9,7 +9,7 @@ coder connection approve docs                                         # approve
 coder run --mcp docs "why do uploads fail after a rename?"
 ```
 
-For a remote URL, Coder detects OAuth, open access or a required key; OAuth needs `--server`, and a required key is read from stdin or a prompt. `--key` reads a server's key directly; it goes in `--header` (default `Authorization`) or, for a stdio server, `--env`, and `--auth` overrides detection. `--access read` keeps only read-only tools, and a read-only stdio server needs `--tools a,b`.
+For a remote URL, Coder detects OAuth, open access or a required key; OAuth needs `--server`, and a required key is read from stdin or a prompt. `--key` reads a server's key directly; it goes in `--header` (default `Authorization`) or, for a stdio server, `--env`, and `--auth` overrides detection. Access defaults to the agent's; `--access read` keeps read-only tools, `--access write` every tool, and a read-only stdio server needs `--tools a,b`.
 
 ## Config shape
 

package/docs/review.md

@@ -1,6 +1,6 @@
 # Review
 
-`coder review` runs one read-only review task over local changes or a pull request, checks every finding against the repository, and prints the ones that hold. With `--post` it comments inline on the pull request and keeps one sticky summary. A local review covers everything since the merge-base with the origin default branch, committed or not, and never touches the index or working tree.
+`coder review` runs one read-only review task over local changes or a pull request, checks every finding against the repository, and prints the ones that hold. With `--post` it comments inline on the pull request and keeps one sticky summary; a posted finding is never posted again, even after its line moves. A local review covers everything since the merge-base with the origin default branch, committed or not, and never touches the index or working tree.
 
 ```sh
 coder review                         # local changes since the default branch

package/docs/sdk.md

@@ -48,7 +48,7 @@ SDK functions never print and never call `process.exit`; results come back as ty
 | `coder agent integrations list / show <id>`                                            | `agent.integrations.list()` / `agent.integrations.show(id)`                                                                                                                                                                                           |
 | `coder agent run <agent> <event.json> [--server]`                                      | `agent.run(agent, event, { server?, wait?, flow?, cwd? })` - local, tools off; with `server`, a real task                                                                                                                                             |
 | `coder agent run --task <id>`                                                          | `agent.runTask(id, options?)` - the runner form, not for application code                                                                                                                                                                             |
-| `coder credentials list / add / remove / default`                                      | `credentials.list()` / `.add(label, { engine, env, workspace?, default?, noCheck? })` / `.remove(label, { workspace? })` / `.default(label, { workspace? })`, all with `{ server? }`                                                                 |
+| `coder credentials list / add / remove`                                                | `credentials.list()` / `.add({ env, value?, workspace?, noCheck? })` / `.remove(name, { workspace? })`, all with `{ server? }`                                                                                                                       |
 | `coder agent usage [--since] [--by]`                                                   | `agent.usage({ since?, by?, server?, cwd? })`                                                                                                                                                                                                         |
 | `coder server serve / rotate-key`                                                                        | `server.serve(options?)` / `server.rotateKey(options?)`; `server.handler(env)` for serverless hosts, see [Self-hosting](self-host.md#deploy)                                                                                                                                                                                                                 |
 

package/docs/self-host.md

@@ -64,11 +64,11 @@ export const GET = (request: Request) => handler(request, waitUntil);
 export const POST = GET;
 ```
 
-Run `await handler.scheduled()` from an hourly scheduled job to sweep expired state across every workspace, renew platform subscriptions, and start queued tasks. Each call deletes bounded batches; run it more frequently when expiry traffic exceeds 1,000 entries per hour. Call `await handler.close()` when the host shuts down. Other active handlers retain their shared database pool until they close.
+Run `await handler.scheduled()` from a scheduled job to sweep expired state across every workspace, renew platform subscriptions, start queued tasks, and deliver pending messages. Call `await handler.close()` when the host shuts down.
 
 `DATABASE_POOL_MAX` sets the process pool limit, defaulting to 10 connections on a persistent host and 2 on Vercel. `DATABASE_IDLE_TIMEOUT` sets idle expiry in seconds, defaulting to 240 and 30 respectively. Set these before creating a handler; handlers sharing a database share the first pool's settings.
 
-Completed tasks, their logs and usage remain until a task is explicitly deleted. Sandbox snapshots remain until replaced or deleted. Expiring deliveries, notes, engine sign-ins and chat state are cleaned by the sweep.
+Completed tasks, their logs and usage remain until a task is explicitly deleted. Sandbox snapshots remain until replaced or deleted. Expiring deliveries, engine sign-ins and chat state are cleaned by the sweep.
 
 ### Database setup
 
@@ -98,17 +98,15 @@ Each task gets the narrowest platform token: on GitHub an installation token for
 
 ## Credentials
 
-An engine credential names an engine (`claude`, `codex`, or `custom`) and holds one or more encrypted environment variables. A personal credential belongs to one member, who alone sees and uses it. A workspace credential serves every member; only owners and admins add, remove, or change it. Each scope has one default per engine. A task runs on its requester's personal default for the engine, then on the workspace default. Tasks with no known requester, such as events from unlinked platform users, use the workspace default only. Without either, the agent replies with a link to the Credentials page, open at that engine.
+Credentials are subscriptions and API keys. A subscription is a member's own Claude or Codex sign-in, one per engine, offered when `CLAUDE_SUBSCRIPTIONS=1` or `CODEX_SUBSCRIPTIONS=1` is set; it runs the official `claude setup-token` or `codex login --device-auth` on the server's runner, or takes pasted `claude setup-token` output. An API key is saved as its environment variable, one per variable in each scope: personal for any member, workspace-wide for owners and admins.
 
-`CLAUDE_SUBSCRIPTIONS=1` and `CODEX_SUBSCRIPTIONS=1` turn on "Sign in with Claude" and "Sign in with Codex", for personal credentials only; both are off by default. Sign-in runs the official, unmodified `claude setup-token` or `codex login --device-auth` on the server's runner, and the dashboard stores the result. The page shows each credential masked, with the account email and plan where the CLI reports them.
-
-API keys are personal for any member and workspace-wide for owners and admins. Built-in engines are checked with one models request unless `--no-check` is set. Without subscription sign-in, a member may paste their own `claude setup-token` output as a personal credential.
+Each engine uses its subscription, else its key (`ANTHROPIC_API_KEY` for Claude, `OPENAI_API_KEY` for Codex), the requester's own before the workspace's; a custom model uses the variable it names. Tasks with no known requester use the workspace's only, and without a credential the agent replies with a link to the Credentials page.
 
 From a terminal, `coder credentials` adds, lists, removes and signs in credentials; it reads secrets from the environment or stdin and never prints them.
 
 ## Tasks
 
-A task starts from the dashboard, `coder task run --server`, or a platform event. Its credential is the requester's own, then the workspace's; without one it is refused with a link that connects it. The server holds up to `limits.concurrentTasks` runner slots per workspace, including tasks waiting for a reply or approval. Set `MAX_TASKS` for an additional cap across all instances. `TASK_STALL`, `TASK_TIMEOUT` and `TASK_ATTEMPTS` bound each task.
+A task starts from the dashboard, `coder task run --server`, or a platform event. Its credential is the requester's own, then the workspace's; a shared platform conversation, such as a channel thread or a pull request, uses only the workspace's. Without one it is refused with a link that connects it. The server holds up to `limits.concurrentTasks` runner slots per workspace, including tasks waiting for a reply or approval. Set `MAX_TASKS` for an additional cap across all instances. `TASK_STALL`, `TASK_TIMEOUT` and `TASK_ATTEMPTS` bound each task.
 
 A task is a conversation: steer it or ask it a question while it runs, and continue it once it has finished. Its output streams over Server-Sent Events, and a repo task's result includes the diff of its changes. The CLI's task commands take `--server` to do the same as the dashboard. A repo's own `.coder/config.json` can only narrow the workspace's config.
 
@@ -151,11 +149,11 @@ A platform user who addresses an agent must be linked to a member of the workspa
 
 `local-docker` and `github-actions` run in the runner image, which holds the engines and tools. A custom `image` needs `node`, `bun`, `git`, `curl`, `tar`, `claude`, `codex` and `github-mcp-server`.
 
-`local-docker`, `vercel-sandbox` and `github-actions` download this server's version of Coder from npm at start, with nothing to install. `tarballUrl` points them at another package, such as an unpublished build.
+`local-docker`, `vercel-sandbox` and `github-actions` download this server's built runner from its public, immutable `/runner/<hash>.tgz` URL. Repository snapshots are specific to that build.
 
 On `vercel-sandbox` each task uses the universal image's engines without their own sandbox, and its machine stops when the task ends. Repository snapshots hold the checkout and its installed dependencies. The default is 1 CPU and 2 GB memory; `vcpus` selects a larger machine.
 
-Access-token authentication needs a token, team ID and project ID. Settings → Runners accepts the IDs directly, or the adapter app can supply `VERCEL_TEAM_ID` and `VERCEL_PROJECT_ID`. The firewall injects engine API keys into provider requests, and the task sees a placeholder. Below `auto`, a task's machine reaches only this server, npm, its engine, integrations, connections, MCP servers and `allowedNetworkHosts`.
+Access-token authentication needs a token, team ID and project ID. Settings → Runners accepts the IDs directly, or the adapter app can supply `VERCEL_TEAM_ID` and `VERCEL_PROJECT_ID`. The firewall injects engine API keys into provider requests, and the task sees a placeholder. Below `auto`, a task's machine reaches only this server, its engine, integrations, connections, MCP servers and `allowedNetworkHosts`.
 
 For GitHub Actions, save the output of `coder server workflow` as `.github/workflows/coder-agent.yml` on the workflow repository's default branch. Save it again after each Coder upgrade. It accepts `task`, `server`, `token`, `mode` and `tarball`, names each run `Coder agent <task ID>`, and runs the task in the runner image with the callback URL and attempt token in the environment. The workflow token needs repository Actions read and write; a classic token for a private repository needs `repo`. A result returns through the authenticated task callback. No result artifact is required.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wular/coder",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Delegating coding-agent runtime",
   "type": "module",
   "main": "./dist/sdk.js",
@@ -25,6 +25,7 @@
   "scripts": {
     "build": "bun scripts/build.ts",
     "build:dash": "bun scripts/build.ts dash",
+    "deploy:vercel": "bun scripts/deploy-vercel.ts",
     "dev:dash": "pnext dev src/server/dash",
     "dev": "tsdown --watch",
     "typecheck": "tsc -p tsconfig.json --noEmit && pnext typegen src/server/dash && tsc -p src/server/dash/tsconfig.json --noEmit",

package/dist/actions-5TDwmn_z.js

@@ -1,20 +0,0 @@
-import{qi as e}from"./core-DwsAMCnL.js";import{At as t,Ct as n,D as r,Dt as i,Et as a,Ft as o,H as s,J as c,Mt as l,Nt as u,Pt as d,T as f,U as p,Y as m,ct as h,dt as g,et as ee,fn as _,gt as v,ht as y,lt as te,ot as ne,q as b,qt as x,st as S,tt as C,v as w,xn as re,y as ie}from"./config-D2FxHWwi.js";import{A as ae,C as oe,H as se,M as ce,N as le,R as T,S as E,b as D,d as O,j as k,u as A}from"./dispatch-D3Dqxijf.js";import{t as j}from"./chat-bridge-CvspGKBc.js";import M from"node:path";import N from"node:process";import P from"node:fs";import{spawn as F}from"node:child_process";import I from"node:os";function L(){let e=process.env.CLAUDE_CONFIG_DIR||M.join(I.homedir(),`.claude`);return M.join(e,`projects`)}function R(e){if(!e)return!1;let t=L(),n=!1;try{for(let r of P.readdirSync(t)){let i=M.join(t,r,`${e}.jsonl`);P.existsSync(i)&&(P.rmSync(i,{force:!0}),n=!0)}}catch{}return n}var z=e({archiveFlagged:()=>ue,askTask:()=>K,claudeAskOptions:()=>G,collectPending:()=>q,collectTasks:()=>Y,deleteTask:()=>$,recentTasks:()=>J,sidecarPrompt:()=>W,spawnArchiveSweep:()=>Q,steerTask:()=>V,stopTask:()=>Z,streamTask:()=>X});async function B(e,t,n,r,i={}){if(t.status!==`running`)return null;let a=t.engine===`claude`?await(i.claude??oe)(t.steerEndpoint,n,void 0,r):await(i.codex??ce)(e,{endpoint:t.steerEndpoint,threadId:t.threadId,turnId:t.turnId,text:n,command:r});if(a.steered)return b(e,t.id,{kind:`steer`,message:`Steer accepted live:\n${n}`}),{taskId:t.id,steered:`live`};if(!a.retryable)throw b(e,t.id,{kind:`error`,message:`Live steer failed: ${a.detail}`}),Error(`Could not steer running task ${t.id}: ${a.detail}`);let o=h(e,t.id)??t;return u.includes(o.status)?(ee(e,o.id,n),b(e,o.id,{kind:`steer`,message:`Steer queued for the next turn:\n${n}`}),{taskId:o.id,steered:`queued`}):null}async function V(e,n,r,i={},a={}){if(!n.threadId)throw new se(`invalid-option`,`Task ${n.id} has no thread to steer yet (status: ${n.status}).`,{hint:`Wait for it to start: coder task watch ${n.id}`});let o=await B(e,n,r,i.command,a);if(o){let r=h(e,n.id)??n;return r.archived&&t(e,r),o}return await H(e,n,r,i),{taskId:n.id,steered:`resumed`}}async function H(e,n,r,i){if(n.connectionSource===`server`&&!i.resolveConnections)throw Error(`Server connection resolver is required to resume this task`);let a=i.resolveConnections?await i.resolveConnections(n.connections??[]):await _(void 0,n.connections??[]),o=n.mcp?.map(e=>{let t=e.connection??(e.resolved&&n.connections?.includes(e.name)?e.name:void 0);return t?{...e,connection:t,resolved:!1}:e})??[],s=n.mcpBindings??o.filter(e=>e.connection).map(({name:e,connection:t,tools:n})=>({name:e,connection:t,...n?{tools:n}:{}})),c=new Set(s.map(e=>e.connection)),u=A([...s,...o.filter(e=>!c.has(e.connection))],{},{},a.mcp);n.archived&&t(e,n),l(e,n.id,{mcp:u.mcp,mcpBindings:s,status:`queued`,resumedAt:new Date().toISOString(),currentPrompt:r,...i.outputSchema?{outputSchema:i.outputSchema}:{},resumeThreadId:n.threadId,steerEndpoint:null,model:i.model??n.model??null,effort:i.effort??n.effort??null,permissions:i.permissions??n.permissions,error:void 0}),b(e,n.id,{kind:`steer`,message:`Resuming with steer:\n${r}`});for(let t of[...a.warnings,...u.warnings??[]])b(e,n.id,{kind:`status`,message:t});O(n.cwd??e,n.id,a.env)}const U=[`Read`,`Glob`,`Grep`];function W(e,t,n){return`You are a read-only sidecar answering a question ABOUT a coder task.
-You are not the task. Never continue, redo, or fix its work. Only answer the question. The task never sees this question or your answer.
-
-Task metadata:
-${[`id: ${e.id}`,...e.name?[`name: ${e.name}`]:[],`status: ${e.status}`,`engine: ${e.engine}${e.model?`/${e.model}`:``}${e.effort?`/${e.effort}`:``}`,...e.cwd?[`workspace: ${e.cwd}`]:[],...e.createdAt?[`created: ${e.createdAt}`]:[],...e.completedAt?[`finished: ${e.completedAt}`]:[]].join(`
-`)}
-
-Task prompt:
-${e.prompt??`(unknown)`}
-
-Inspect as needed (grep/read selectively; events can be large):
-- progress log (jsonl, one event per line): ${M.join(t,`log.jsonl`)}
-- final result: ${M.join(t,`result.json`)}
-- worker output: ${M.join(t,`worker.log`)}
-${e.cwd?`- the task's workspace (its code and changes): ${e.cwd}`:``}
-
-Question: ${n}
-
-Answer the question directly and concisely.`}function G(e,t,n,r){return{prompt:n,model:r.model??e.model,effort:r.effort,permissions:`read-only`,additionalDirectories:[t],taskRoot:t,readOnlyAllowedTools:U}}async function K(e,t,i,a={}){let o=n(e,t.id),s=W(t,o,i)+(a.command?`\n\nCoder command ${T(a.command)}`:``),c=a.command?e=>{let t=M.join(o,`inbox-control`);P.mkdirSync(t,{recursive:!0}),P.appendFileSync(M.join(t,`${T(a.command)}.transcript.jsonl`),JSON.stringify({command:a.command,result:e.finalMessage??e.error?.message??``})+`
-`)}:void 0,l=a.effort??t.effort??null;if(t.engine===`claude`)return E(t.cwd??e,{...G(t,o,s,{model:a.model,effort:l}),command:a.command,onResult:c});let u=ie(e),d=a.model??t.model,p=d?u.models?.[d]:void 0,m=p&&w(p)?p:void 0;if(m?.envKey&&!N.env[m.envKey])throw Error(`Missing environment variable: \`${m.envKey}\`.`);let h=m?await j(m,m.wireApi??`chat`):null,g=r(u,d,h??void 0);try{return await k(t.cwd??e,{prompt:s,model:g?.model??f(d??null),modelProvider:g?.modelProvider??null,configOverrides:g?.configOverrides??null,effort:l,sandbox:`read-only`,approvalPolicy:`never`,ephemeral:!0,onResult:c})}finally{await h?.close()}}function q(e){return S(e).filter(e=>u.includes(e.status)).flatMap(t=>D(n(e,t.id)).filter(e=>!e.response).map(e=>({taskId:t.id,id:e.id,summary:String(e.summary??``),createdAt:e.createdAt?String(e.createdAt):void 0})))}function J(e){let t=[],n=S(e).filter(n=>!d.includes(n.status)||!c(Date.parse(n.completedAt??n.updatedAt??n.createdAt??``))||(te(e,n,{auto:!0}),t.push(n.id),!1));return Q(e,t),n}function Y(e,t={}){let n=t.limit===`all`?void 0:t.limit,r=e=>d.includes(e.status),i=g(e),o=new Set(i.map(e=>e.id)),c=e=>e.filter(e=>!o.has(e.id)),l=[...c(J(e)),...i.filter(e=>!e.archived)];if(t.archived?l=[...c(ne(e)),...i.filter(e=>e.archived)]:t.running?l=l.filter(e=>u.includes(e.status)):t.stopped&&(l=l.filter(r)),t.dir){let e=a(M.resolve(String(t.dir))),n=new Map;l=l.filter(t=>t.cwd?(n.has(t.cwd)||n.set(t.cwd,a(t.cwd)),n.get(t.cwd)===e):!1)}let f=e=>({rank:p(e.status),createdAt:Date.parse(e.createdAt??``)||0,id:e.id});l=[...l].sort((e,t)=>s(f(e),f(t)));let m=n===void 0?0:Math.max(0,l.length-n);return n!==void 0&&(l=l.slice(0,n)),{tasks:l,clipped:m}}async function*X(e,t,r={}){let a=new Set([`completed`,`failed`,`cancelled`]),o=h(e,t);if(!o)throw Error(`No task found for "${t}".`);let s=r.tail??1,c=re(M.join(n(e,t),`log.jsonl`)),l=!0,u=()=>{let e=c().map(e=>{try{return JSON.parse(e)}catch{return{message:e}}});return l?(l=!1,s===`all`?e:i(e,s)):e};for(yield*u();!a.has(o.status);)await new Promise(e=>setTimeout(e,400)),o=y(e,h(e,t)??o),yield*u();yield*u()}async function Z(e,t,n={}){let r=t.engine===`claude`?{detail:`claude worker terminated`}:await(n.interrupt??ae)(e,{endpoint:t.steerEndpoint,threadId:t.threadId,turnId:t.turnId});if(t.engine!==`claude`&&le(t.steerEndpoint),t.pid&&t.status===`running`)try{N.kill(t.pid,`SIGTERM`)}catch{}return l(e,t.id,{status:`cancelled`,steerEndpoint:null,completedAt:new Date().toISOString()}),{taskId:t.id,status:`cancelled`,interrupt:r.detail}}function Q(e,t,n={}){if(t.length)try{F(N.execPath,[x,`task`,`archive-sweep`,`--cwd`,e,...n.flows?[`--flows`]:[],...t],{detached:!0,stdio:`ignore`}).unref()}catch{}}function $(e,t){return t.threadId&&(t.engine===`claude`?R(t.threadId):o(e,t.threadId)),v(e,t.id)}function ue(e,t){for(let n of t){let t=C(e,n);t&&d.includes(t.status)&&m(e,t,{auto:!0})}}export{$ as a,V as c,Y as i,Z as l,K as n,J as o,q as r,Q as s,z as t,X as u};

package/dist/adapter-sKt1J1Cm.js

@@ -1 +0,0 @@
-import{a as e,c as t,o as n}from"./slack-C_RlVDz7.js";import{l as r}from"./dist-BTornX7Y.js";import{createGitHubAdapter as i}from"./dist-C3wD7GfG.js";function a(a){let o=a.credentials?.webhookSecret,s=a.installationId,c,l=i({userName:a.name,apiUrl:`https://api.github.com`,botUserId:0,installationToken:()=>s?c??=a.token(s,{tools:n.comment}):Promise.reject(Error(`The webhook names no GitHub installation`)),webhookVerifier:(t,n)=>e(n,t.headers.get(`x-hub-signature-256`),o),logger:new r(`error`)});return t(l.octokit,a.fetch),l}export{a as githubAdapter};

package/dist/add-BftLUw05.js

@@ -1 +0,0 @@
-import{i as e,t}from"./cli-ZUdhZnuW.js";import{p as n}from"./output-BKeyLbvt.js";import{c as r,n as i,s as a}from"./args-CxsMr9Un.js";import{credentialOptions as o}from"./remove-5iAM2aTO.js";import s from"node:process";const c=e({name:`credentials add`,globalFlags:{cwd:!1},help:{usage:`coder credentials add [label] --engine <claude|codex|custom> --env <NAME> [--env <NAME> ...] [--value <secret|->] [--workspace] [--no-check] [--default] [--server [url]]`,summary:`Store an API key, encrypted on the server, as your personal credential or with --workspace for every member. The value comes from the named environment variable unless --value says otherwise, and is never printed. Without subscription sign-in on the server, CLAUDE_CODE_OAUTH_TOKEN takes your own claude setup-token output.`,examples:[[`ANTHROPIC_API_KEY=sk-... coder credentials add --engine claude --env ANTHROPIC_API_KEY`,`your own API key, read from the environment`],[`OPENAI_API_KEY=sk-... coder credentials add team --engine codex --env OPENAI_API_KEY --workspace`,`a workspace key every member's tasks can use`],[`pbpaste | coder credentials add router --engine custom --env OPENROUTER_API_KEY --value -`,`any provider, value from stdin`]],flags:[[`--env <NAME>`,`one environment variable name; repeat for more (reads that variable by default)`],[`--engine <name>`,`claude, codex, or custom`],[`--value <secret|->`,`literal values land in shell history and are visible to other processes; use - for stdin or prefer environment variables`],[`--workspace`,`a workspace credential; owners and admins only`],[`--no-check`,`skip the provider credential check`],[`--default`,`make this the default for its engine`],t]},options:{...o,engine:a,env:r,value:a,"no-check":i,default:i},args:1,run:async({options:e,args:[t]})=>{let{addCredential:n}=await import(`./remote-oQs6My_3.js`).then(e=>e.a);return n(t,{...e,env:e.env??[],noCheck:e[`no-check`]})},print:(e,{options:t})=>s.stdout.write(`Added ${t.workspace?`workspace`:`personal`} credential ${n.bold(e.label)}.\n`)});export{c as commandCredentialsAdd};

package/dist/add-CXAGrCnC.js

@@ -1 +0,0 @@
-import{H as e}from"./dispatch-D3Dqxijf.js";import{i as t,t as n}from"./cli-ZUdhZnuW.js";import{c as r,s as i}from"./args-CxsMr9Un.js";import{runnerOptions as a}from"./remove-BZCA-gdU.js";import o from"node:process";const s=t({name:`runner add`,globalFlags:{cwd:!1},args:1,help:{usage:`coder runner add <kind> [--name <name>] [--scope <scope>] [--field key=value …] [--server [url]] [--json]`,summary:`Connect a runner. Secret fields read environment variables with key=env:VARIABLE. Adding local prints a pairing command.`,flags:[[`--name <name>`,`runner display name`],[`--scope <scope>`,`personal or workspace`],[`--field key=value`,`repeat for each field, use env:VARIABLE for secrets`],n]},options:{...a,name:i,scope:i,field:r},async run({options:t,args:[n]}){if(!n)throw new e(`invalid-option`,`Missing runner kind.`);let{addRunnerFields:r}=await import(`./runner-DME7ohjt.js`).then(e=>e.a);return r(n,t)},print:e=>o.stdout.write(`${`command`in e?e.command:`Added ${e.name} (${e.id}).`}\n`)});export{s as commandRunnerAdd};

package/dist/add-Ck_y_nKX.js

@@ -1,2 +0,0 @@
-import{i as e,r as t}from"./cli-ZUdhZnuW.js";import{p as n,r}from"./output-BKeyLbvt.js";import{i,n as a,s as o,t as s}from"./args-CxsMr9Un.js";import c from"node:process";const l={server:i,workspace:o,yes:a};async function u(e){let{openUrl:t}=await import(`./prompt-C--TI1qn.js`).then(e=>e.s);c.stderr.write(`Sign in at ${r.cyan(e)}\n`),t(e)&&c.stderr.write(r.dim(`Opened it in your browser. Waiting...
-`))}async function d(){let{askSecret:e}=await import(`./prompt-C--TI1qn.js`).then(e=>e.s);return e(`Key`)}function f(e){return e.provider===`env`?`API key ${e.env}`:e.provider===`mcp`?`MCP server ${e.url??e.command}`:`${e.provider} account${e.account?` ${e.account}`:``}`}const p=r=>e({name:`connection add`,help:{usage:`coder connection add <name> [--me] [--access read|write] (--env <NAME> | --url <url> [--header <NAME>] | [--env <NAME>] -- <command> [args...]) [--key] [--server [url]]`,summary:"Connect a platform account by its name (OAuth in the browser), an API key that tasks read from --env, or an MCP server at --url or started by the command after `--`. An API key is kept as a credential. A credential already holding the variable is used, else the value comes from that variable here, or from stdin or a prompt. A remote MCP server is checked for OAuth, open access or a key; a needed key is read from stdin or a prompt. With --key, the key goes in --header (default Authorization) or --env. Signing in needs --server.",flags:[[`--env <NAME>`,`the API key variable, or where a stdio server reads its key`],[`--url <url>`,`a remote MCP server (streamable HTTP by default)`],[`--transport <http|sse>`,`remote transport (default: http)`],[`--header <NAME>`,`the header a remote server reads its key from (default: Authorization)`],[`--key`,`read a key from stdin or a prompt, never from a flag value`],[`--auth <oauth|key|none>`,`override MCP authentication (default: detected for --url, none for a command)`],[`--access <read|write>`,`read keeps only read-only tools (default: read; API keys are write)`],[`--tools <a,b>`,`tool allowlist; a read-only stdio server needs one`],[`--credential <id>`,`the credential an API key connection reads`],[`--me`,`your own connection instead of the workspace's`],t],examples:[[`GROQ_API_KEY=gsk_... coder connection add groq --env GROQ_API_KEY`,`an API key from this shell`],[`pbpaste | coder connection add docs --key --env DOCS_TOKEN --access write -- npx -y docs-mcp`,`a stdio server with its key from stdin`],[`coder connection add github --me --server`,`your GitHub account on your Coder server`]]},options:{...s,...l,env:o,url:o,transport:o,header:o,key:a,auth:o,access:o,tools:o,credential:o,me:a},args:1,run:async({options:e,args:[t],cwd:n})=>{let{connection:i}=await import(`./connection-BCRJHTgp.js`).then(e=>e.n);return i.add(t,{...e,cwd:n,command:r,transport:e.transport,auth:e.auth,access:e.access,tools:e.tools?.split(`,`).map(e=>e.trim()).filter(Boolean),key:e.key?await d():void 0,askKey:d,onAuthorize:u})},print:e=>c.stdout.write(`Connected ${n.bold(e.id)}, ${f(e)}.\n`)}),m=Object.assign(e=>{let t=e.indexOf(`--`);return p(t===-1?[]:e.slice(t+1))(t===-1?e:e.slice(0,t))},p([]));export{d as askKey,m as commandConnectionAdd,f as describe,u as openSignIn,l as serverOptions};

package/dist/agent-ChnedLBv.js

@@ -1,8 +0,0 @@
-import{qi as e}from"./core-DwsAMCnL.js";import{H as t}from"./dispatch-D3Dqxijf.js";import{t as n}from"./types-B42Oh0zF.js";import{a as r}from"./load-CRmQB1LD.js";import{i,n as a}from"./remote-oQs6My_3.js";import{t as o}from"./integrations-D3OgJk6Y.js";import{a as s,r as c}from"./exec-BsXFIdTl.js";import{c as l,o as u,u as d}from"./task-DXHKWB_J.js";import{n as f}from"./match-Kt3vFTl1.js";import p from"node:path";import m from"node:process";import h from"node:fs";import{spawn as g}from"node:child_process";import _ from"node:os";import v from"node:fs/promises";const y=[`SIGTERM`,`SIGINT`],b=/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[()][A-Z0-9]|\r/g;function x(e,t){if(e===`codex`)return{file:`codex`,args:[`login`,`--device-auth`],env:{CODEX_HOME:t}};let n=`stty cols 4000 rows 50 2>/dev/null; exec claude setup-token`;return{file:`sh`,args:[`-c`,`cat | { ${m.platform===`darwin`?`script -q /dev/null sh -c '${n}'`:`script -qfec '${n}' /dev/null`}; kill 0; }`],env:{CLAUDE_CONFIG_DIR:t,BROWSER:`true`}}}function S(e){try{return JSON.parse(Buffer.from(String(e).split(`.`)[1]??``,`base64url`).toString())}catch{return{}}}function C(e){let t=S(JSON.parse(e).tokens?.id_token),n=t[`https://api.openai.com/auth`];return{...typeof t.email==`string`?{email:t.email}:{},...typeof n?.chatgpt_plan_type==`string`?{plan:n.chatgpt_plan_type}:{}}}function w(e,t){let n=t.replace(b,``),r=/\x1b\]8;[^;]*;(https:\/\/[^\x07\x1b]+)(?:\x07|\x1b\\)/.exec(t)?.[1],i=e===`claude`?r??/https:\/\/\S*(?:oauth|authorize)\S*(?=\s)/.exec(n)?.[0]:/https:\/\/\S+(?=\s)/.exec(n)?.[0],a=e===`codex`?/\b[A-Z0-9]{4,}-[A-Z0-9]{4,}\b/.exec(n)?.[0]:void 0;if(!(!i||e===`codex`&&!a))return{url:i,...a?{code:a}:{}}}const T=/sk-ant-oat[\w-]+/,E=e=>e.replace(/[\w#.%-]{20,}|\b[A-Z0-9]{4,}-[A-Z0-9]{4,}\b/g,`…`).slice(-600),D=/\x1b(?:\[([0-9;?<>=]*)[ -/]*([@-~])|\][^\x07\x1b]*(?:\x07|\x1b\\)|[()][\s\S]|[^[\]()])/y;var O=class{height;rows=[[]];row=0;col=0;saved=[0,0];rest=``;constructor(e=50){this.height=e}write(e){let t=this.rest+e;this.rest=``;for(let e=0;e<t.length;){if(t[e]===`\x1B`){D.lastIndex=e;let n=D.exec(t);if(!n){this.rest=t.slice(e,e+4096);return}n[2]&&!/^[?<>=]/.test(n[1])?this.csi(n[1].split(`;`),n[2]):n[0]===`\x1B7`?this.saved=[this.row,this.col]:n[0]===`\x1B8`&&([this.row,this.col]=this.saved),e+=n[0].length;continue}let n=t.codePointAt(e),r=String.fromCodePoint(n);e+=r.length,r===`\r`?this.col=0:r===`
-`?this.down():r===`\b`?this.col=Math.max(0,this.col-1):n>=32&&n!==127&&(this.line()[this.col++]=r)}}text(){return this.rows.map(e=>Array.from(e,e=>e??` `).join(``).trimEnd()).join(`
-`)}line(){return this.rows[this.row]??=[]}down(){this.row<this.height-1?this.row++:this.rows.splice(0,this.rows.length-this.height+1)}csi(e,t){let n=(t=0)=>Number(e[t])||1,r=Number(e[0])||0,i=this.height-1;if(t===`A`)this.row=Math.max(0,this.row-n());else if(t===`B`)this.row=Math.min(i,this.row+n());else if(t===`C`)this.col+=n();else if(t===`D`)this.col=Math.max(0,this.col-n());else if(t===`E`||t===`F`)this.row=Math.max(0,Math.min(i,this.row+(t===`E`?n():-n()))),this.col=0;else if(t===`G`)this.col=n()-1;else if(t===`d`)this.row=Math.min(i,n()-1);else if(t===`H`||t===`f`)this.row=Math.min(i,n()-1),this.col=n(1)-1;else if(t===`K`){let e=this.line();r===0?e.length=Math.min(e.length,this.col):r===1?e.fill(` `,0,this.col+1):e.length=0}else t===`J`?r===0?(this.line().length=Math.min(this.line().length,this.col),this.rows.length=Math.min(this.rows.length,this.row+1)):r>=2&&(this.rows=[]):t===`s`?this.saved=[this.row,this.col]:t===`u`&&([this.row,this.col]=this.saved)}};async function k(e,t){let{server:n,token:r}=d();delete m.env.CODER_TASK_TOKEN,delete m.env.CODER_LOGIN;let i=new AbortController,a=async(t,a)=>{let o=t?i.signal:void 0;for(let i=1;;i++){let s=await fetch(`${n}/logins/${encodeURIComponent(e)}${t}`,{method:a===void 0?`GET`:`POST`,...o?{signal:o}:{},headers:{authorization:`Bearer ${r}`,...a===void 0?{}:{"content-type":`application/json`}},...a===void 0?{}:{body:JSON.stringify(a)}}).catch(e=>{if(o?.aborted||t===`/input`||i>=10)throw e;console.error(`coder runner: Coder server did not answer: ${e.message}`)});if(s?.ok)return await s.json();if(s&&(s.status<500||i>=10))throw Error(`Coder server answered ${s.status}`);s&&console.error(`coder runner: Coder server answered ${s.status}`),await new Promise(e=>setTimeout(e,1e3))}},{engine:o}=await a(``),s=await v.mkdtemp(p.join(t,`.login-`)),c=x(o,s),l=g(c.file,c.args,{env:{...m.env,...c.env},stdio:[`pipe`,`pipe`,`pipe`],detached:!0}),u=()=>{try{m.kill(-l.pid,`SIGTERM`)}catch{}},f=``,h=new O,_=!1,S=!1,D=0,k,A,j=new Promise((e,t)=>{l.once(`error`,t),l.once(`close`,e)}),M=setTimeout(u,6e5);for(let e of y)m.once(e,u);let N=async()=>{for(;!i.signal.aborted;){let{code:e}=await a(`/input`);if(e){k=f.length,l.stdin.write(e),await new Promise(e=>setTimeout(e,500)),l.stdin.write(`\r`),m.stdout.write(`Sign-in code typed
-`);let t=k;setTimeout(()=>{k===t&&!_&&console.error(`coder runner: claude has not answered the code: ${JSON.stringify(E(h.text()))}`)},2e4).unref();return}}},P=e=>{if(f+=e,h.write(e),!S){let e=w(o,f.slice(D));e&&(S=!0,clearInterval(A),m.stdout.write(`Sign-in link ready
-`),a(``,e).catch(()=>u()),o===`claude`&&N().catch(()=>{i.signal.aborted||u()}))}o===`claude`&&!_&&T.test(h.text())&&(_=!0,m.stdout.write(`Sign-in token shown
-`),setTimeout(u,2e3)),(k===void 0?``:f.slice(k).replace(b,``).replace(/\s/g,``)).includes(`PressEntertoretry`)&&(m.stdout.write(`Sign-in code rejected; asking claude for a new link
-`),k=void 0,D=f.length,S=!1,A=setInterval(()=>l.stdin.write(`\r`),1e3))};l.stdout.setEncoding(`utf8`).on(`data`,P),l.stderr.setEncoding(`utf8`).on(`data`,P);try{let e=await j;i.abort();let t=h.text(),n=T.exec(t)?.[0];if(o===`claude`&&n){let e=/[\w.+-]+@[\w-]+(?:\.[\w-]+)+/.exec(t)?.[0];await a(``,{result:{env:{CLAUDE_CODE_OAUTH_TOKEN:n},...e?{account:{email:e}}:{}}})}else if(o===`codex`&&e===0){let e=await v.readFile(p.join(s,`auth.json`),`utf8`);await a(``,{result:{env:{CODEX_AUTH_JSON:e},account:C(e)}})}else console.error(`coder runner: ${o} sign-in ended (exit ${e}): ${JSON.stringify(E(t))}`),await a(``,{error:S?`Sign-in did not finish. Start again.`:`${o} sign-in could not start.`}).catch(()=>{});m.stdout.write(`Sign-in finished
-`)}finally{clearTimeout(M),clearInterval(A);for(let e of y)m.off(e,u);i.abort(),u(),await v.rm(s,{recursive:!0,force:!0})}}var A=e({agentIdError:()=>P,agents:()=>z,regexError:()=>F});const j=e=>e.cwd?p.resolve(e.cwd):m.cwd(),M=e=>(Array.isArray(e)?e:(e??``).split(`,`)).map(e=>e.trim()).filter(Boolean),N=/^[a-z0-9][a-z0-9_-]*$/;function P(e,t){if(!N.test(t))return`Use lowercase letters, digits, - or _, starting with a letter or digit.`;let n=p.join(e,`.coder`,`agents`,t);if(h.existsSync(n)&&h.readdirSync(n).length>0)return`${p.relative(e,n)} is not empty; clear it to start over, or edit what is there.`}function F(e){try{new RegExp(e);return}catch{return`Not a valid regular expression.`}}function I(e,t){let n=o[e]?.sample;return{integration:e,type:t,appId:`${e}:sample`,installationId:`sample`,deliveryId:`sample-1`,actor:{id:`user-1`,login:`someone`,role:`member`},text:`Replace me with the text a real event would carry.`,...n?{chat:{thread:{_type:`chat:Thread`,adapterName:e,channelId:n.slice(0,n.lastIndexOf(`:`)),id:n,isDM:!1}}}:{}}}async function L(e,r={}){let i=j(r);if(!e&&r.askId&&(e=await r.askId(e=>P(i,e))),!e)throw new t(`invalid-option`,`Missing agent id.`,{hint:`Usage: coder agent init <id>`});let a=P(i,e);if(a)throw new t(`invalid-option`,a.includes(`not empty`)?a:`Agent id "${e}": ${a}`);let s=p.join(i,`.coder`,`agents`,e),c=r.askPicks?await r.askPicks(e):{...r.name?{name:r.name}:{},integrations:M(r.integrations).length?M(r.integrations):[Object.keys(o)[0]],events:{},matches:{},tools:r.tools??`comment`};if(!n.includes(c.tools))throw new t(`invalid-option`,`Unknown preset "${c.tools}"; valid: ${n.join(`, `)}`);let l={},u=M(r.events),d=e=>Object.keys(o[e]?.events??{});for(let e of c.integrations)if(!o[e])throw new t(`invalid-option`,`Unknown integration "${e}"; valid: ${Object.keys(o).join(`, `)}`);for(let e of u)if(!c.integrations.some(t=>d(t).includes(e)))throw new t(`invalid-option`,`No chosen integration has event "${e}".`,{hint:`Events per integration: coder agent integrations show <id>`});let f=Object.fromEntries(M(r.match).map(e=>{let n=e.indexOf(`=`);if(n<1)throw new t(`invalid-option`,`Bad --match "${e}"; use event=regex.`);let r=e.slice(n+1);if(F(r))throw new t(`invalid-option`,`Bad --match for ${e.slice(0,n)}: ${F(r)}`);return[e.slice(0,n),r]}));for(let e of c.integrations){let n=d(e),r=c.events[e]??(u.length?u.filter(e=>n.includes(e)):[n.includes(`mention`)?`mention`:n[0]]);for(let i of r)if(!n.includes(i))throw new t(`invalid-option`,`${e} has no event "${i}"; valid: ${n.join(`, `)}`);let i={...f,...c.matches[e]??{}},a=r.filter(e=>i[e]);r.length&&(l[e]={events:a.length?Object.fromEntries(r.map(e=>[e,!i[e]||{match:i[e]}])):r,tools:c.tools})}let m={...c.name?{name:c.name}:{},...r.description?{description:r.description}:{},permissions:r.permissions??`read-only`,integrations:l};await v.mkdir(s,{recursive:!0}),await v.writeFile(p.join(s,`agent.json`),`${JSON.stringify(m,null,2)}\n`),await v.writeFile(p.join(s,`system.md`),`You are ${c.name??e}.\n`);let h=p.join(_.tmpdir(),`coder-agent-samples`,e),g=[];for(let[e,t]of Object.entries(l)){let n=(Array.isArray(t.events)?t.events:Object.keys(t.events??{}))[0];await v.mkdir(h,{recursive:!0});let r=p.join(h,`sample-${e}-${n}.json`);await v.writeFile(r,`${JSON.stringify(I(e,n),null,2)}\n`),g.push(r)}return{id:e,dir:s,files:[`agent.json`,`system.md`],samples:g,integrations:Object.keys(l)}}function R(e){if(e===void 0||typeof e==`number`)return e;if(/^\d+$/.test(e))return Number(e);let n=/^(\d+)([dh])$/.exec(e);if(!n)throw new t(`invalid-option`,`Invalid --since value.`,{hint:`Use 7d, 24h, or milliseconds since epoch`});return Date.now()-Number(n[1])*(n[2]===`d`?864e5:36e5)}const z={list:(e={})=>e.server===void 0?r(j(e),o):a(e).agents.list(),async show(e,n={}){if(!e)throw new t(`invalid-option`,`Missing agent id.`,{hint:`Usage: coder agent show <id>`});if(n.server===void 0){let i=(await r(j(n),o)).find(t=>t.id===e);if(!i)throw new t(`invalid-option`,`No agent named "${e}".`,{hint:`List agents: coder agent list`});return i}let i=a(n),s=await i.agents.get(e),c=await i.agents.version(e,s.currentVersion);return{...s,definition:c.definition}},init:L,push:(e,t={})=>i(a(t),j(t),e),async run(e,n,i={}){if(i.wait&&i.server===void 0)throw new t(`invalid-option`,`--wait needs --server.`,{hint:`Offline runs print their reply as they finish`});if(!e||!n)throw new t(`invalid-option`,`Missing agent id or event file.`,{hint:`Usage: coder agent run <agent> <event.json>`});let l=j(i),u=typeof n==`string`?JSON.parse(await v.readFile(p.resolve(l,n),`utf8`)):n;if(i.server!==void 0){let t=a(i),n=await t.tasks.create({agent:e,event:u});if(!i.wait||!n.tasks.length)return n;let r=[];for(let e of n.tasks){let n=await t.tasks.wait(e,{onLog:i.onLog});r.push(n),i.onDone?.(n)}return r}let d=await r(l,o),m=d.find(t=>t.id===e);if(!m)throw new t(`invalid-option`,`No agent named "${e}".`);let h=f(u,d).find(t=>t.agent.id===e),g=i.flow??h?.flow;if(!g)throw new t(`invalid-option`,`Agent "${e}" does not match event "${u.type}".`);return c({cwd:l,agent:e,flow:g,task:{...s(m,g,u),tools:{},...h?.permissions?{permissions:h.permissions}:{}},post:!1})},runTask(e,t={}){let n=j(t);return m.env.CODER_LOGIN?k(e,n):m.env.CODER_PREPARE?u(e,n):l(e,n)},async usage(e={}){if(e.by&&![`agent`,`installation`,`engine`].includes(e.by))throw new t(`invalid-option`,`Invalid --by value.`,{hint:`Use agent, installation, or engine`});let n=e.by;if(e.server!==void 0)return a(e).usage({since:R(e.since),by:n});let[{localUsage:r},{usageSummary:i}]=await Promise.all([import(`./apps-B60OpAHX.js`).then(e=>e.At),import(`./apps-B60OpAHX.js`).then(e=>e.xn)]);return i(r(j(e)).map(([,e])=>e),R(e.since)??0,n)},integrations:{list:()=>Object.entries(o).map(([e,t])=>({id:e,description:t.description,events:Object.keys(t.events),tools:t.tools.presets.write})),show(e){if(!e)throw new t(`invalid-option`,`Missing integration id.`,{hint:`Usage: coder agent integrations show <id>`});let n=o[e];if(!n)throw new t(`invalid-option`,`Unknown integration "${e}".`,{hint:`List integrations: coder agent integrations list`});return{id:e,events:Object.fromEntries(Object.entries(n.events).map(([e,t])=>[e,t.description])),tools:n.tools.presets}}}};export{z as n,A as t};

package/dist/alias-BpgVDY6_.js

@@ -1,2 +0,0 @@
-import{i as e}from"./cli-ZUdhZnuW.js";import{p as t}from"./output-BKeyLbvt.js";import{n}from"./models-CdvmuaLv.js";import{n as r}from"./add-CvBTpxgY.js";import i from"node:process";const a=e({name:`model alias`,help:{usage:`coder model alias <name> <spec> [--workspace]`,summary:`Save an alias for an engine spec, e.g. fast -> codex:luna. An alias may reuse a
-built-in name to override it.`,flags:[[`--workspace`,`target <repo>/.coder/config.json instead of the user file`]]},options:r,args:2,run:({options:e,args:[t,r],cwd:i})=>n(i,t,r,e),print:o});function o(e){let n=t,r=`${e.provider} ${e.model}${e.effort?` (${e.effort})`:``}`;i.stdout.write(`aliased ${n.cyan(e.alias)} -> ${e.provider}:${e.model}${e.effort?`:${e.effort}`:``} ${n.dim(`= ${r}`)}  ${n.dim(`(${e.file})`)}\n`)}export{a as commandModelAlias};

package/dist/approvals-CE8dXZhE.js

@@ -1,2 +0,0 @@
-import{K as e}from"./config-D2FxHWwi.js";import{i as t,r as n}from"./cli-ZUdhZnuW.js";import{a as r,p as i,s as a}from"./output-BKeyLbvt.js";import{i as o,n as s,s as c,t as l}from"./args-CxsMr9Un.js";import u from"node:process";const d={server:o,workspace:c,yes:s};function f(e,t){let n=i;if(!t.length)return void u.stdout.write(`${n.dim(`No approvals for task ${e}.`)}\n`);for(let e of t){let t=e.answered??`pending`;u.stdout.write(`${n.cyan(e.id)}  ${t.padEnd(8)} ${n.dim(String(e.summary??``))}\n`)}let r=t.filter(e=>!e.answered);if(r.length){let e=r.length===1?r[0].id:`<approval-id>`;u.stdout.write(`\n${a([`Answer: coder task approve ${e} [--deny]`],n)}\n`)}}function p(t){let n=i;if(!t.length)return void u.stdout.write(`${n.dim(`No pending approvals.`)}\n\n${a([`Check tasks: coder task list`],n)}\n`);let o={id:Math.max(11,...t.map(e=>e.id.length)),task:Math.max(7,...t.map(e=>e.taskId.length))};u.stdout.write(n.bold(n.light(`${`approval-id`.padEnd(o.id)}  ${`task-id`.padEnd(o.task)}  age    summary\n`)));for(let i of t){let t=i.createdAt?r(e(i.createdAt)):`-`;u.stdout.write(`${n.cyan(i.id.padEnd(o.id))}  ${n.cyan(i.taskId.padEnd(o.task))}  ${t.padEnd(5)}  ${n.light(i.summary)}\n`)}let s=t.length===1?t[0].id:`<approval-id>`;u.stdout.write(`\n${a([`Answer: coder task approve ${s} [--deny]`],n)}\n`)}const m=t({name:`task approvals`,help:{usage:`coder task approvals [task-id] [--server [url]]`,summary:`Without a task id: pending approvals across all tasks. With one: that task's
-permission escalations and how each was answered.`,flags:[n]},options:{...l,...d},args:1,run:async({options:e,args:[t]})=>{let{tasks:n}=await import(`./task-IoBYe7ok.js`).then(e=>e.t);return n.approvals(t,{...e,organization:e.workspace})},json:(e,{options:t,args:[n]})=>t.server===void 0&&n?e.map(({taskId:e,...t})=>t):t.server===void 0?e.map(({taskId:e,id:t,summary:n,createdAt:r})=>({taskId:e,id:t,summary:n,createdAt:r})):e,print(e,{options:t,args:[n]}){if(t.server===void 0)return n?f(n,e):p(e);if(!e.length)return void u.stdout.write(`${i.dim(`No pending approvals.`)}\n\n${a([`Check tasks: coder task list`],i)}\n`);for(let t of e)u.stdout.write(`${t.taskId}  ${JSON.stringify(t)}\n`)}});export{m as commandApprovals};

package/dist/approve-dWW4qt76.js

@@ -1,2 +0,0 @@
-import{i as e,r as t}from"./cli-ZUdhZnuW.js";import{p as n}from"./output-BKeyLbvt.js";import{i as r,n as i,s as a,t as o}from"./args-CxsMr9Un.js";import s from"node:process";const c={server:r,workspace:a,yes:i},l=e({name:`task approve`,help:{usage:`coder task approve [task-id] <approval-id> [--deny] [--server [url]]`,summary:`Answer an escalated permission request. Accepts by default; --deny rejects it.
-Approval ids are unique, so the task id is optional.`,flags:[[`--deny`,`reject the request instead of accepting`],t]},options:{...o,deny:i,...c},args:2,run:async({options:e,args:[t,n]})=>{let{tasks:r}=await import(`./task-IoBYe7ok.js`).then(e=>e.t);return r.approve(t,n,{...e,organization:e.workspace})},print:(e,{options:t,args:r})=>s.stdout.write(t.server===void 0?`${t.deny?`Denied`:`Approved`} ${n.cyan(e.approvalId)} on task ${n.cyan(e.taskId)}.\n`:`${t.deny?`Denied`:`Approved`} ${n.cyan(r[1])}.\n`)});export{l as commandApprove};