@xopcai/xopc 0.0.86 → 0.0.88

package/dist/src/infra/update-check.js

@@ -1,7 +1,7 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
 import { channelToNpmTag } from "./update-channels.js";
-import { dirname, join } from "node:path";
 import { access, readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region src/infra/update-check.ts
 init_package_version();

package/dist/src/infra/update-global.d.ts

@@ -0,0 +1,45 @@
+import { type CommandRunner } from './run-command.js';
+export declare const XOPC_PACKAGE_NAME = "@xopcai/xopc";
+export type GlobalInstallManager = 'npm' | 'pnpm';
+export type ResolvedGlobalInstallCommand = {
+    manager: GlobalInstallManager;
+    command: string;
+};
+export type GlobalInstallRunResult = {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    packageManager: GlobalInstallManager;
+    usedFallback: boolean;
+};
+export declare function joinGlobalPackagePath(globalRoot: string): string;
+export declare function resolveGlobalInstallCommand(manager: GlobalInstallManager, pkgRoot?: string | null): ResolvedGlobalInstallCommand;
+export declare function createGlobalInstallEnv(env?: NodeJS.ProcessEnv): Promise<NodeJS.ProcessEnv | undefined>;
+export declare function resolveGlobalInstallSpec(params: {
+    version: string;
+    env?: NodeJS.ProcessEnv;
+}): string;
+export declare function resolveGlobalRoot(managerOrCommand: GlobalInstallManager | ResolvedGlobalInstallCommand, runCommand: CommandRunner, timeoutMs: number, pkgRoot?: string | null): Promise<string | null>;
+export declare function globalInstallArgs(managerOrCommand: GlobalInstallManager | ResolvedGlobalInstallCommand, spec: string, pkgRoot?: string | null): string[];
+export declare function globalInstallFallbackArgs(managerOrCommand: GlobalInstallManager | ResolvedGlobalInstallCommand, spec: string, pkgRoot?: string | null): string[] | null;
+export declare function detectGlobalInstallManagerForRoot(runCommand: CommandRunner, pkgRoot: string, timeoutMs: number): Promise<GlobalInstallManager | null>;
+export declare function detectGlobalInstallManagerByPresence(runCommand: CommandRunner, timeoutMs: number): Promise<GlobalInstallManager | null>;
+export declare function resolveGlobalManager(params: {
+    root: string | null;
+    timeoutMs?: number;
+}): Promise<GlobalInstallManager>;
+export declare function runGlobalPackageInstall(params: {
+    manager: GlobalInstallManager;
+    spec: string;
+    pkgRoot: string | null;
+    timeoutMs?: number;
+    /** Echo install output to the parent process (CLI interactive). */
+    echoToTerminal?: boolean;
+}): Promise<GlobalInstallRunResult>;
+export declare function formatGlobalInstallFailure(params: {
+    packageManager: GlobalInstallManager;
+    spec: string;
+    exitCode: number;
+    stderr: string;
+    usedFallback: boolean;
+}): string;

package/dist/src/infra/update-global.js

@@ -0,0 +1,224 @@
+import { createDefaultCommandRunner } from "./run-command.js";
+import fs from "node:fs";
+import fs$1 from "node:fs/promises";
+import path from "node:path";
+//#region src/infra/update-global.ts
+const XOPC_PACKAGE_NAME = "@xopcai/xopc";
+const COREPACK_ENABLE_DOWNLOAD_PROMPT_DEFAULT = "0";
+const NPM_GLOBAL_INSTALL_QUIET_FLAGS = [
+	"--no-fund",
+	"--no-audit",
+	"--loglevel=error"
+];
+const NPM_GLOBAL_INSTALL_OMIT_OPTIONAL_FLAGS = ["--omit=optional", ...NPM_GLOBAL_INSTALL_QUIET_FLAGS];
+const GLOBAL_DETECT_TIMEOUT_MS = 15e3;
+const GLOBAL_INSTALL_TIMEOUT_MS = 2700 * 1e3;
+async function pathExists(targetPath) {
+	try {
+		await fs$1.access(targetPath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function tryRealpath(targetPath) {
+	try {
+		return await fs$1.realpath(targetPath);
+	} catch {
+		return path.resolve(targetPath);
+	}
+}
+function joinGlobalPackagePath(globalRoot) {
+	return path.join(globalRoot, XOPC_PACKAGE_NAME);
+}
+function inferNpmPrefixFromPackageRoot(pkgRoot) {
+	const trimmed = pkgRoot?.trim();
+	if (!trimmed) return null;
+	const normalized = path.resolve(trimmed);
+	const nodeModulesDir = path.dirname(normalized);
+	if (path.basename(nodeModulesDir) !== "node_modules") return null;
+	const parentDir = path.dirname(nodeModulesDir);
+	if (path.basename(parentDir) === "lib") return path.dirname(parentDir);
+	if (process.platform === "win32" && path.basename(parentDir).toLowerCase() === "npm") return parentDir;
+	return null;
+}
+function resolvePreferredNpmCommand(pkgRoot) {
+	const prefix = inferNpmPrefixFromPackageRoot(pkgRoot);
+	if (!prefix) return null;
+	const candidate = process.platform === "win32" ? path.join(prefix, "npm.cmd") : path.join(prefix, "bin", "npm");
+	return fs.existsSync(candidate) ? candidate : null;
+}
+function resolvePreferredGlobalManagerCommand(manager, pkgRoot) {
+	if (manager !== "npm") return manager;
+	return resolvePreferredNpmCommand(pkgRoot) ?? manager;
+}
+function resolveGlobalInstallCommand(manager, pkgRoot) {
+	return {
+		manager,
+		command: resolvePreferredGlobalManagerCommand(manager, pkgRoot)
+	};
+}
+function normalizeGlobalInstallCommand(managerOrCommand, pkgRoot) {
+	return typeof managerOrCommand === "string" ? resolveGlobalInstallCommand(managerOrCommand, pkgRoot) : managerOrCommand;
+}
+function applyWindowsPackageInstallEnv(env) {
+	if (process.platform !== "win32") return;
+	env.NPM_CONFIG_UPDATE_NOTIFIER = "false";
+	env.NPM_CONFIG_FUND = "false";
+	env.NPM_CONFIG_AUDIT = "false";
+}
+function applyCorepackDownloadPromptEnv(env) {
+	if (!env.COREPACK_ENABLE_DOWNLOAD_PROMPT?.trim()) env.COREPACK_ENABLE_DOWNLOAD_PROMPT = COREPACK_ENABLE_DOWNLOAD_PROMPT_DEFAULT;
+}
+async function createGlobalInstallEnv(env) {
+	const sourceEnv = env ?? process.env;
+	const hasCorepack = Boolean(sourceEnv.COREPACK_ENABLE_DOWNLOAD_PROMPT?.trim());
+	if (process.platform !== "win32" && hasCorepack) return env;
+	const merged = Object.fromEntries(Object.entries(sourceEnv).filter(([, value]) => value != null).map(([key, value]) => [key, String(value)]));
+	applyWindowsPackageInstallEnv(merged);
+	applyCorepackDownloadPromptEnv(merged);
+	return merged;
+}
+function resolveGlobalInstallSpec(params) {
+	const override = params.env?.XOPC_UPDATE_PACKAGE_SPEC?.trim() || process.env.XOPC_UPDATE_PACKAGE_SPEC?.trim();
+	if (override) return override;
+	return `${XOPC_PACKAGE_NAME}@${params.version}`;
+}
+async function resolveGlobalRoot(managerOrCommand, runCommand, timeoutMs, pkgRoot) {
+	const res = await runCommand([
+		normalizeGlobalInstallCommand(managerOrCommand, pkgRoot).command,
+		"root",
+		"-g"
+	], { timeoutMs }).catch(() => null);
+	if (!res || res.code !== 0) return null;
+	return res.stdout.trim() || null;
+}
+function globalInstallArgs(managerOrCommand, spec, pkgRoot) {
+	const resolved = normalizeGlobalInstallCommand(managerOrCommand, pkgRoot);
+	if (resolved.manager === "pnpm") return [
+		resolved.command,
+		"add",
+		"-g",
+		spec
+	];
+	return [
+		resolved.command,
+		"install",
+		"-g",
+		spec,
+		...NPM_GLOBAL_INSTALL_QUIET_FLAGS
+	];
+}
+function globalInstallFallbackArgs(managerOrCommand, spec, pkgRoot) {
+	const resolved = normalizeGlobalInstallCommand(managerOrCommand, pkgRoot);
+	if (resolved.manager !== "npm") return null;
+	return [
+		resolved.command,
+		"install",
+		"-g",
+		spec,
+		...NPM_GLOBAL_INSTALL_OMIT_OPTIONAL_FLAGS
+	];
+}
+async function detectGlobalInstallManagerForRoot(runCommand, pkgRoot, timeoutMs) {
+	const pkgReal = await tryRealpath(pkgRoot);
+	for (const { manager, argv } of [{
+		manager: "npm",
+		argv: [
+			"npm",
+			"root",
+			"-g"
+		]
+	}, {
+		manager: "pnpm",
+		argv: [
+			"pnpm",
+			"root",
+			"-g"
+		]
+	}]) {
+		const res = await runCommand(argv, { timeoutMs }).catch(() => null);
+		if (!res || res.code !== 0) continue;
+		const globalRoot = res.stdout.trim();
+		if (!globalRoot) continue;
+		const expectedReal = await tryRealpath(joinGlobalPackagePath(await tryRealpath(globalRoot)));
+		if (path.resolve(expectedReal) === path.resolve(pkgReal)) return manager;
+	}
+	if (resolvePreferredNpmCommand(pkgRoot)) return "npm";
+	return null;
+}
+async function detectGlobalInstallManagerByPresence(runCommand, timeoutMs) {
+	for (const manager of ["npm", "pnpm"]) {
+		const root = await resolveGlobalRoot(manager, runCommand, timeoutMs);
+		if (!root) continue;
+		if (await pathExists(joinGlobalPackagePath(root))) return manager;
+	}
+	return null;
+}
+async function resolveGlobalManager(params) {
+	const runCommand = createDefaultCommandRunner();
+	const timeoutMs = params.timeoutMs ?? GLOBAL_DETECT_TIMEOUT_MS;
+	if (params.root) {
+		const detected = await detectGlobalInstallManagerForRoot(runCommand, params.root, timeoutMs);
+		if (detected) return detected;
+	}
+	return await detectGlobalInstallManagerByPresence(runCommand, timeoutMs) ?? "npm";
+}
+function tailOutput(text, max = 4e3) {
+	const t = text.trim();
+	if (t.length <= max) return t;
+	return t.slice(-max);
+}
+async function runGlobalPackageInstall(params) {
+	const timeoutMs = params.timeoutMs ?? GLOBAL_INSTALL_TIMEOUT_MS;
+	const runCommand = createDefaultCommandRunner();
+	const installEnv = await createGlobalInstallEnv();
+	const runStep = async (argv) => {
+		const result = await runCommand(argv, {
+			timeoutMs,
+			env: installEnv
+		});
+		if (params.echoToTerminal) {
+			if (result.stdout) process.stdout.write(result.stdout);
+			if (result.stderr) process.stderr.write(result.stderr);
+		}
+		return result;
+	};
+	const primary = await runStep(globalInstallArgs(params.manager, params.spec, params.pkgRoot));
+	if (primary.code === 0) return {
+		exitCode: 0,
+		stdout: primary.stdout,
+		stderr: primary.stderr,
+		packageManager: params.manager,
+		usedFallback: false
+	};
+	const fallbackArgv = globalInstallFallbackArgs(params.manager, params.spec, params.pkgRoot);
+	if (!fallbackArgv) return {
+		exitCode: primary.code ?? 1,
+		stdout: primary.stdout,
+		stderr: primary.stderr,
+		packageManager: params.manager,
+		usedFallback: false
+	};
+	const fallback = await runStep(fallbackArgv);
+	return {
+		exitCode: fallback.code ?? 1,
+		stdout: [primary.stdout, fallback.stdout].filter(Boolean).join("\n"),
+		stderr: [primary.stderr, fallback.stderr].filter(Boolean).join("\n"),
+		packageManager: params.manager,
+		usedFallback: true
+	};
+}
+function formatGlobalInstallFailure(params) {
+	const tail = tailOutput(params.stderr);
+	return [
+		`Global install via ${params.packageManager} failed (exit ${params.exitCode}).`,
+		params.usedFallback ? "Retried with --omit=optional." : null,
+		`Try manually: ${params.packageManager} install -g ${params.spec}`,
+		tail ? `Install output:\n${tail}` : null
+	].filter(Boolean).join("\n");
+}
+//#endregion
+export { XOPC_PACKAGE_NAME, createGlobalInstallEnv, detectGlobalInstallManagerByPresence, detectGlobalInstallManagerForRoot, formatGlobalInstallFailure, globalInstallArgs, globalInstallFallbackArgs, joinGlobalPackagePath, resolveGlobalInstallCommand, resolveGlobalInstallSpec, resolveGlobalManager, resolveGlobalRoot, runGlobalPackageInstall };
+
+//# sourceMappingURL=update-global.js.map

package/dist/src/infra/update-global.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-global.js","names":["fs","fsSync"],"sources":["../../../src/infra/update-global.ts"],"sourcesContent":["// src/infra/update-global.ts — global npm/pnpm install detection and commands (OpenClaw-aligned)\n\nimport fsSync from 'node:fs';\nimport fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport {\n  createDefaultCommandRunner,\n  type CommandRunner,\n  type CommandRunResult,\n} from './run-command.js';\n\nexport const XOPC_PACKAGE_NAME = '@xopcai/xopc';\n\nexport type GlobalInstallManager = 'npm' | 'pnpm';\n\nexport type ResolvedGlobalInstallCommand = {\n  manager: GlobalInstallManager;\n  command: string;\n};\n\nconst COREPACK_ENABLE_DOWNLOAD_PROMPT_DEFAULT = '0';\nconst NPM_GLOBAL_INSTALL_QUIET_FLAGS = ['--no-fund', '--no-audit', '--loglevel=error'] as const;\nconst NPM_GLOBAL_INSTALL_OMIT_OPTIONAL_FLAGS = [\n  '--omit=optional',\n  ...NPM_GLOBAL_INSTALL_QUIET_FLAGS,\n] as const;\n\nconst GLOBAL_DETECT_TIMEOUT_MS = 15_000;\nconst GLOBAL_INSTALL_TIMEOUT_MS = 45 * 60 * 1000;\n\nexport type GlobalInstallRunResult = {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n  packageManager: GlobalInstallManager;\n  usedFallback: boolean;\n};\n\nasync function pathExists(targetPath: string): Promise<boolean> {\n  try {\n    await fs.access(targetPath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function tryRealpath(targetPath: string): Promise<string> {\n  try {\n    return await fs.realpath(targetPath);\n  } catch {\n    return path.resolve(targetPath);\n  }\n}\n\nexport function joinGlobalPackagePath(globalRoot: string): string {\n  return path.join(globalRoot, XOPC_PACKAGE_NAME);\n}\n\nfunction inferNpmPrefixFromPackageRoot(pkgRoot?: string | null): string | null {\n  const trimmed = pkgRoot?.trim();\n  if (!trimmed) return null;\n  const normalized = path.resolve(trimmed);\n  const nodeModulesDir = path.dirname(normalized);\n  if (path.basename(nodeModulesDir) !== 'node_modules') return null;\n  const parentDir = path.dirname(nodeModulesDir);\n  if (path.basename(parentDir) === 'lib') {\n    return path.dirname(parentDir);\n  }\n  if (process.platform === 'win32' && path.basename(parentDir).toLowerCase() === 'npm') {\n    return parentDir;\n  }\n  return null;\n}\n\nfunction resolvePreferredNpmCommand(pkgRoot?: string | null): string | null {\n  const prefix = inferNpmPrefixFromPackageRoot(pkgRoot);\n  if (!prefix) return null;\n  const candidate =\n    process.platform === 'win32' ? path.join(prefix, 'npm.cmd') : path.join(prefix, 'bin', 'npm');\n  return fsSync.existsSync(candidate) ? candidate : null;\n}\n\nfunction resolvePreferredGlobalManagerCommand(\n  manager: GlobalInstallManager,\n  pkgRoot?: string | null,\n): string {\n  if (manager !== 'npm') return manager;\n  return resolvePreferredNpmCommand(pkgRoot) ?? manager;\n}\n\nexport function resolveGlobalInstallCommand(\n  manager: GlobalInstallManager,\n  pkgRoot?: string | null,\n): ResolvedGlobalInstallCommand {\n  return {\n    manager,\n    command: resolvePreferredGlobalManagerCommand(manager, pkgRoot),\n  };\n}\n\nfunction normalizeGlobalInstallCommand(\n  managerOrCommand: GlobalInstallManager | ResolvedGlobalInstallCommand,\n  pkgRoot?: string | null,\n): ResolvedGlobalInstallCommand {\n  return typeof managerOrCommand === 'string'\n    ? resolveGlobalInstallCommand(managerOrCommand, pkgRoot)\n    : managerOrCommand;\n}\n\nfunction applyWindowsPackageInstallEnv(env: Record<string, string>): void {\n  if (process.platform !== 'win32') return;\n  env.NPM_CONFIG_UPDATE_NOTIFIER = 'false';\n  env.NPM_CONFIG_FUND = 'false';\n  env.NPM_CONFIG_AUDIT = 'false';\n}\n\nfunction applyCorepackDownloadPromptEnv(env: Record<string, string>): void {\n  if (!env.COREPACK_ENABLE_DOWNLOAD_PROMPT?.trim()) {\n    env.COREPACK_ENABLE_DOWNLOAD_PROMPT = COREPACK_ENABLE_DOWNLOAD_PROMPT_DEFAULT;\n  }\n}\n\nexport async function createGlobalInstallEnv(\n  env?: NodeJS.ProcessEnv,\n): Promise<NodeJS.ProcessEnv | undefined> {\n  const sourceEnv = env ?? process.env;\n  const hasCorepack = Boolean(sourceEnv.COREPACK_ENABLE_DOWNLOAD_PROMPT?.trim());\n  if (process.platform !== 'win32' && hasCorepack) {\n    return env;\n  }\n  const merged = Object.fromEntries(\n    Object.entries(sourceEnv)\n      .filter(([, value]) => value != null)\n      .map(([key, value]) => [key, String(value)]),\n  ) as Record<string, string>;\n  applyWindowsPackageInstallEnv(merged);\n  applyCorepackDownloadPromptEnv(merged);\n  return merged;\n}\n\nexport function resolveGlobalInstallSpec(params: {\n  version: string;\n  env?: NodeJS.ProcessEnv;\n}): string {\n  const override =\n    params.env?.XOPC_UPDATE_PACKAGE_SPEC?.trim() || process.env.XOPC_UPDATE_PACKAGE_SPEC?.trim();\n  if (override) return override;\n  return `${XOPC_PACKAGE_NAME}@${params.version}`;\n}\n\nexport async function resolveGlobalRoot(\n  managerOrCommand: GlobalInstallManager | ResolvedGlobalInstallCommand,\n  runCommand: CommandRunner,\n  timeoutMs: number,\n  pkgRoot?: string | null,\n): Promise<string | null> {\n  const resolved = normalizeGlobalInstallCommand(managerOrCommand, pkgRoot);\n  const argv = [resolved.command, 'root', '-g'];\n  const res = await runCommand(argv, { timeoutMs }).catch(() => null);\n  if (!res || res.code !== 0) return null;\n  const root = res.stdout.trim();\n  return root || null;\n}\n\nexport function globalInstallArgs(\n  managerOrCommand: GlobalInstallManager | ResolvedGlobalInstallCommand,\n  spec: string,\n  pkgRoot?: string | null,\n): string[] {\n  const resolved = normalizeGlobalInstallCommand(managerOrCommand, pkgRoot);\n  if (resolved.manager === 'pnpm') {\n    return [resolved.command, 'add', '-g', spec];\n  }\n  return [resolved.command, 'install', '-g', spec, ...NPM_GLOBAL_INSTALL_QUIET_FLAGS];\n}\n\nexport function globalInstallFallbackArgs(\n  managerOrCommand: GlobalInstallManager | ResolvedGlobalInstallCommand,\n  spec: string,\n  pkgRoot?: string | null,\n): string[] | null {\n  const resolved = normalizeGlobalInstallCommand(managerOrCommand, pkgRoot);\n  if (resolved.manager !== 'npm') return null;\n  return [resolved.command, 'install', '-g', spec, ...NPM_GLOBAL_INSTALL_OMIT_OPTIONAL_FLAGS];\n}\n\nexport async function detectGlobalInstallManagerForRoot(\n  runCommand: CommandRunner,\n  pkgRoot: string,\n  timeoutMs: number,\n): Promise<GlobalInstallManager | null> {\n  const pkgReal = await tryRealpath(pkgRoot);\n\n  const candidates: Array<{ manager: GlobalInstallManager; argv: string[] }> = [\n    { manager: 'npm', argv: ['npm', 'root', '-g'] },\n    { manager: 'pnpm', argv: ['pnpm', 'root', '-g'] },\n  ];\n\n  for (const { manager, argv } of candidates) {\n    const res = await runCommand(argv, { timeoutMs }).catch(() => null);\n    if (!res || res.code !== 0) continue;\n    const globalRoot = res.stdout.trim();\n    if (!globalRoot) continue;\n    const globalReal = await tryRealpath(globalRoot);\n    const expected = joinGlobalPackagePath(globalReal);\n    const expectedReal = await tryRealpath(expected);\n    if (path.resolve(expectedReal) === path.resolve(pkgReal)) {\n      return manager;\n    }\n  }\n\n  if (resolvePreferredNpmCommand(pkgRoot)) {\n    return 'npm';\n  }\n\n  return null;\n}\n\nexport async function detectGlobalInstallManagerByPresence(\n  runCommand: CommandRunner,\n  timeoutMs: number,\n): Promise<GlobalInstallManager | null> {\n  for (const manager of ['npm', 'pnpm'] as const) {\n    const root = await resolveGlobalRoot(manager, runCommand, timeoutMs);\n    if (!root) continue;\n    if (await pathExists(joinGlobalPackagePath(root))) {\n      return manager;\n    }\n  }\n  return null;\n}\n\nexport async function resolveGlobalManager(params: {\n  root: string | null;\n  timeoutMs?: number;\n}): Promise<GlobalInstallManager> {\n  const runCommand = createDefaultCommandRunner();\n  const timeoutMs = params.timeoutMs ?? GLOBAL_DETECT_TIMEOUT_MS;\n\n  if (params.root) {\n    const detected = await detectGlobalInstallManagerForRoot(runCommand, params.root, timeoutMs);\n    if (detected) return detected;\n  }\n\n  const byPresence = await detectGlobalInstallManagerByPresence(runCommand, timeoutMs);\n  return byPresence ?? 'npm';\n}\n\nfunction tailOutput(text: string, max = 4000): string {\n  const t = text.trim();\n  if (t.length <= max) return t;\n  return t.slice(-max);\n}\n\nexport async function runGlobalPackageInstall(params: {\n  manager: GlobalInstallManager;\n  spec: string;\n  pkgRoot: string | null;\n  timeoutMs?: number;\n  /** Echo install output to the parent process (CLI interactive). */\n  echoToTerminal?: boolean;\n}): Promise<GlobalInstallRunResult> {\n  const timeoutMs = params.timeoutMs ?? GLOBAL_INSTALL_TIMEOUT_MS;\n  const runCommand = createDefaultCommandRunner();\n  const installEnv = await createGlobalInstallEnv();\n\n  const runStep = async (argv: string[]): Promise<CommandRunResult> => {\n    const result = await runCommand(argv, { timeoutMs, env: installEnv });\n    if (params.echoToTerminal) {\n      if (result.stdout) process.stdout.write(result.stdout);\n      if (result.stderr) process.stderr.write(result.stderr);\n    }\n    return result;\n  };\n\n  const primaryArgv = globalInstallArgs(params.manager, params.spec, params.pkgRoot);\n  const primary = await runStep(primaryArgv);\n  if (primary.code === 0) {\n    return {\n      exitCode: 0,\n      stdout: primary.stdout,\n      stderr: primary.stderr,\n      packageManager: params.manager,\n      usedFallback: false,\n    };\n  }\n\n  const fallbackArgv = globalInstallFallbackArgs(params.manager, params.spec, params.pkgRoot);\n  if (!fallbackArgv) {\n    return {\n      exitCode: primary.code ?? 1,\n      stdout: primary.stdout,\n      stderr: primary.stderr,\n      packageManager: params.manager,\n      usedFallback: false,\n    };\n  }\n\n  const fallback = await runStep(fallbackArgv);\n  return {\n    exitCode: fallback.code ?? 1,\n    stdout: [primary.stdout, fallback.stdout].filter(Boolean).join('\\n'),\n    stderr: [primary.stderr, fallback.stderr].filter(Boolean).join('\\n'),\n    packageManager: params.manager,\n    usedFallback: true,\n  };\n}\n\nexport function formatGlobalInstallFailure(params: {\n  packageManager: GlobalInstallManager;\n  spec: string;\n  exitCode: number;\n  stderr: string;\n  usedFallback: boolean;\n}): string {\n  const tail = tailOutput(params.stderr);\n  const parts = [\n    `Global install via ${params.packageManager} failed (exit ${params.exitCode}).`,\n    params.usedFallback ? 'Retried with --omit=optional.' : null,\n    `Try manually: ${params.packageManager} install -g ${params.spec}`,\n    tail ? `Install output:\\n${tail}` : null,\n  ].filter(Boolean);\n  return parts.join('\\n');\n}\n"],"mappings":";;;;;AAYA,MAAa,oBAAoB;AASjC,MAAM,0CAA0C;AAChD,MAAM,iCAAiC;CAAC;CAAa;CAAc;CAAmB;AACtF,MAAM,yCAAyC,CAC7C,mBACA,GAAG,+BACJ;AAED,MAAM,2BAA2B;AACjC,MAAM,4BAA4B,OAAU;AAU5C,eAAe,WAAW,YAAsC;AAC9D,KAAI;AACF,QAAMA,KAAG,OAAO,WAAW;AAC3B,SAAO;SACD;AACN,SAAO;;;AAIX,eAAe,YAAY,YAAqC;AAC9D,KAAI;AACF,SAAO,MAAMA,KAAG,SAAS,WAAW;SAC9B;AACN,SAAO,KAAK,QAAQ,WAAW;;;AAInC,SAAgB,sBAAsB,YAA4B;AAChE,QAAO,KAAK,KAAK,YAAY,kBAAkB;;AAGjD,SAAS,8BAA8B,SAAwC;CAC7E,MAAM,UAAU,SAAS,MAAM;AAC/B,KAAI,CAAC,QAAS,QAAO;CACrB,MAAM,aAAa,KAAK,QAAQ,QAAQ;CACxC,MAAM,iBAAiB,KAAK,QAAQ,WAAW;AAC/C,KAAI,KAAK,SAAS,eAAe,KAAK,eAAgB,QAAO;CAC7D,MAAM,YAAY,KAAK,QAAQ,eAAe;AAC9C,KAAI,KAAK,SAAS,UAAU,KAAK,MAC/B,QAAO,KAAK,QAAQ,UAAU;AAEhC,KAAI,QAAQ,aAAa,WAAW,KAAK,SAAS,UAAU,CAAC,aAAa,KAAK,MAC7E,QAAO;AAET,QAAO;;AAGT,SAAS,2BAA2B,SAAwC;CAC1E,MAAM,SAAS,8BAA8B,QAAQ;AACrD,KAAI,CAAC,OAAQ,QAAO;CACpB,MAAM,YACJ,QAAQ,aAAa,UAAU,KAAK,KAAK,QAAQ,UAAU,GAAG,KAAK,KAAK,QAAQ,OAAO,MAAM;AAC/F,QAAOC,GAAO,WAAW,UAAU,GAAG,YAAY;;AAGpD,SAAS,qCACP,SACA,SACQ;AACR,KAAI,YAAY,MAAO,QAAO;AAC9B,QAAO,2BAA2B,QAAQ,IAAI;;AAGhD,SAAgB,4BACd,SACA,SAC8B;AAC9B,QAAO;EACL;EACA,SAAS,qCAAqC,SAAS,QAAQ;EAChE;;AAGH,SAAS,8BACP,kBACA,SAC8B;AAC9B,QAAO,OAAO,qBAAqB,WAC/B,4BAA4B,kBAAkB,QAAQ,GACtD;;AAGN,SAAS,8BAA8B,KAAmC;AACxE,KAAI,QAAQ,aAAa,QAAS;AAClC,KAAI,6BAA6B;AACjC,KAAI,kBAAkB;AACtB,KAAI,mBAAmB;;AAGzB,SAAS,+BAA+B,KAAmC;AACzE,KAAI,CAAC,IAAI,iCAAiC,MAAM,CAC9C,KAAI,kCAAkC;;AAI1C,eAAsB,uBACpB,KACwC;CACxC,MAAM,YAAY,OAAO,QAAQ;CACjC,MAAM,cAAc,QAAQ,UAAU,iCAAiC,MAAM,CAAC;AAC9E,KAAI,QAAQ,aAAa,WAAW,YAClC,QAAO;CAET,MAAM,SAAS,OAAO,YACpB,OAAO,QAAQ,UAAU,CACtB,QAAQ,GAAG,WAAW,SAAS,KAAK,CACpC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,OAAO,MAAM,CAAC,CAAC,CAC/C;AACD,+BAA8B,OAAO;AACrC,gCAA+B,OAAO;AACtC,QAAO;;AAGT,SAAgB,yBAAyB,QAG9B;CACT,MAAM,WACJ,OAAO,KAAK,0BAA0B,MAAM,IAAI,QAAQ,IAAI,0BAA0B,MAAM;AAC9F,KAAI,SAAU,QAAO;AACrB,QAAO,GAAG,kBAAkB,GAAG,OAAO;;AAGxC,eAAsB,kBACpB,kBACA,YACA,WACA,SACwB;CAGxB,MAAM,MAAM,MAAM,WAAW;EAFZ,8BAA8B,kBAAkB,QAC3C,CAAC;EAAS;EAAQ;EACP,EAAE,EAAE,WAAW,CAAC,CAAC,YAAY,KAAK;AACnE,KAAI,CAAC,OAAO,IAAI,SAAS,EAAG,QAAO;AAEnC,QADa,IAAI,OAAO,MACb,IAAI;;AAGjB,SAAgB,kBACd,kBACA,MACA,SACU;CACV,MAAM,WAAW,8BAA8B,kBAAkB,QAAQ;AACzE,KAAI,SAAS,YAAY,OACvB,QAAO;EAAC,SAAS;EAAS;EAAO;EAAM;EAAK;AAE9C,QAAO;EAAC,SAAS;EAAS;EAAW;EAAM;EAAM,GAAG;EAA+B;;AAGrF,SAAgB,0BACd,kBACA,MACA,SACiB;CACjB,MAAM,WAAW,8BAA8B,kBAAkB,QAAQ;AACzE,KAAI,SAAS,YAAY,MAAO,QAAO;AACvC,QAAO;EAAC,SAAS;EAAS;EAAW;EAAM;EAAM,GAAG;EAAuC;;AAG7F,eAAsB,kCACpB,YACA,SACA,WACsC;CACtC,MAAM,UAAU,MAAM,YAAY,QAAQ;AAO1C,MAAK,MAAM,EAAE,SAAS,UAAU,CAJ9B;EAAE,SAAS;EAAO,MAAM;GAAC;GAAO;GAAQ;GAAK;EAAE,EAC/C;EAAE,SAAS;EAAQ,MAAM;GAAC;GAAQ;GAAQ;GAAK;EAAE,CAGT,EAAE;EAC1C,MAAM,MAAM,MAAM,WAAW,MAAM,EAAE,WAAW,CAAC,CAAC,YAAY,KAAK;AACnE,MAAI,CAAC,OAAO,IAAI,SAAS,EAAG;EAC5B,MAAM,aAAa,IAAI,OAAO,MAAM;AACpC,MAAI,CAAC,WAAY;EAGjB,MAAM,eAAe,MAAM,YADV,sBAAsB,MADd,YAAY,WAAW,CAED,CAAC;AAChD,MAAI,KAAK,QAAQ,aAAa,KAAK,KAAK,QAAQ,QAAQ,CACtD,QAAO;;AAIX,KAAI,2BAA2B,QAAQ,CACrC,QAAO;AAGT,QAAO;;AAGT,eAAsB,qCACpB,YACA,WACsC;AACtC,MAAK,MAAM,WAAW,CAAC,OAAO,OAAO,EAAW;EAC9C,MAAM,OAAO,MAAM,kBAAkB,SAAS,YAAY,UAAU;AACpE,MAAI,CAAC,KAAM;AACX,MAAI,MAAM,WAAW,sBAAsB,KAAK,CAAC,CAC/C,QAAO;;AAGX,QAAO;;AAGT,eAAsB,qBAAqB,QAGT;CAChC,MAAM,aAAa,4BAA4B;CAC/C,MAAM,YAAY,OAAO,aAAa;AAEtC,KAAI,OAAO,MAAM;EACf,MAAM,WAAW,MAAM,kCAAkC,YAAY,OAAO,MAAM,UAAU;AAC5F,MAAI,SAAU,QAAO;;AAIvB,QAAO,MADkB,qCAAqC,YAAY,UAAU,IAC/D;;AAGvB,SAAS,WAAW,MAAc,MAAM,KAAc;CACpD,MAAM,IAAI,KAAK,MAAM;AACrB,KAAI,EAAE,UAAU,IAAK,QAAO;AAC5B,QAAO,EAAE,MAAM,CAAC,IAAI;;AAGtB,eAAsB,wBAAwB,QAOV;CAClC,MAAM,YAAY,OAAO,aAAa;CACtC,MAAM,aAAa,4BAA4B;CAC/C,MAAM,aAAa,MAAM,wBAAwB;CAEjD,MAAM,UAAU,OAAO,SAA8C;EACnE,MAAM,SAAS,MAAM,WAAW,MAAM;GAAE;GAAW,KAAK;GAAY,CAAC;AACrE,MAAI,OAAO,gBAAgB;AACzB,OAAI,OAAO,OAAQ,SAAQ,OAAO,MAAM,OAAO,OAAO;AACtD,OAAI,OAAO,OAAQ,SAAQ,OAAO,MAAM,OAAO,OAAO;;AAExD,SAAO;;CAIT,MAAM,UAAU,MAAM,QADF,kBAAkB,OAAO,SAAS,OAAO,MAAM,OAAO,QACjC,CAAC;AAC1C,KAAI,QAAQ,SAAS,EACnB,QAAO;EACL,UAAU;EACV,QAAQ,QAAQ;EAChB,QAAQ,QAAQ;EAChB,gBAAgB,OAAO;EACvB,cAAc;EACf;CAGH,MAAM,eAAe,0BAA0B,OAAO,SAAS,OAAO,MAAM,OAAO,QAAQ;AAC3F,KAAI,CAAC,aACH,QAAO;EACL,UAAU,QAAQ,QAAQ;EAC1B,QAAQ,QAAQ;EAChB,QAAQ,QAAQ;EAChB,gBAAgB,OAAO;EACvB,cAAc;EACf;CAGH,MAAM,WAAW,MAAM,QAAQ,aAAa;AAC5C,QAAO;EACL,UAAU,SAAS,QAAQ;EAC3B,QAAQ,CAAC,QAAQ,QAAQ,SAAS,OAAO,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK;EACpE,QAAQ,CAAC,QAAQ,QAAQ,SAAS,OAAO,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK;EACpE,gBAAgB,OAAO;EACvB,cAAc;EACf;;AAGH,SAAgB,2BAA2B,QAMhC;CACT,MAAM,OAAO,WAAW,OAAO,OAAO;AAOtC,QANc;EACZ,sBAAsB,OAAO,eAAe,gBAAgB,OAAO,SAAS;EAC5E,OAAO,eAAe,kCAAkC;EACxD,iBAAiB,OAAO,eAAe,cAAc,OAAO;EAC5D,OAAO,oBAAoB,SAAS;EACrC,CAAC,OAAO,QACG,CAAC,KAAK,KAAK"}

package/dist/src/infra/update-lock.js

@@ -1,9 +1,9 @@
-import { init_paths_state, resolveUpdateLockPath } from "../config/paths-state.js";
+import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
-import { dirname } from "node:path";
+import { init_paths_state, resolveUpdateLockPath } from "../config/paths-state.js";
 import { mkdir, readFile, unlink } from "node:fs/promises";
+import { dirname } from "node:path";
 //#region src/infra/update-lock.ts
 init_write_file_atomic();
 init_paths_state();

package/dist/src/infra/update-runner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { join } from "node:path";
 import { access, readdir, unlink } from "node:fs/promises";
+import { join } from "node:path";
 import { spawn } from "node:child_process";
 //#region src/infra/update-runner.ts
 init_logger();

package/dist/src/infra/update-startup.js

@@ -1,8 +1,8 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
-import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-state.js";
+import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
+import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-state.js";
 import { acquireUpdateLock } from "./update-lock.js";
 import { normalizeUpdateChannel } from "./update-channels.js";
 import { compareSemver, detectInstallKind, resolveNpmChannelTag, resolvePackageRoot } from "./update-check.js";

package/dist/src/infra/write-file-atomic.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import path from "node:path";
-import { chmodSync, closeSync, copyFileSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, copyFileSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { chmod, copyFile, mkdir, open, rename, rm } from "node:fs/promises";
+import path from "node:path";
 //#region src/infra/write-file-atomic.ts
 /**
 * Durable single-file writes: temp file → fsync → rename to target.

package/dist/src/mcp/channel-shared.js

@@ -1,6 +1,7 @@
-import { normalizeOptionalString } from "../utils/string-coerce.js";
+import { init_string_coerce, normalizeOptionalString } from "../utils/string-coerce.js";
 import { z } from "zod";
 //#region src/mcp/channel-shared.ts
+init_string_coerce();
 function normalizeMessageChannel(value) {
 	return value?.trim() || void 0;
 }

package/dist/src/mcp/channel-shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"channel-shared.js","names":["toText"],"sources":["../../../src/mcp/channel-shared.ts"],"sourcesContent":["import { z } from 'zod';\nimport { normalizeOptionalString as toText } from '../utils/string-coerce.js';\n\nfunction normalizeMessageChannel(value: string | undefined): string | undefined {\n  return value?.trim() || undefined;\n}\n\nexport type ClaudeChannelMode = \"off\" | \"on\" | \"auto\";\n\nexport type ConversationDescriptor = {\n  sessionKey: string;\n  channel: string;\n  to: string;\n  accountId?: string;\n  threadId?: string | number;\n  label?: string;\n  displayName?: string;\n  derivedTitle?: string;\n  lastMessagePreview?: string;\n  updatedAt?: number | null;\n};\n\nexport type SessionRow = {\n  key: string;\n  channel?: string;\n  lastChannel?: string;\n  lastTo?: string;\n  lastAccountId?: string;\n  lastThreadId?: string | number;\n  deliveryContext?: {\n    channel?: string;\n    to?: string;\n    accountId?: string;\n    threadId?: string | number;\n  };\n  origin?: {\n    provider?: string;\n    accountId?: string;\n    threadId?: string | number;\n  };\n  label?: string;\n  displayName?: string;\n  derivedTitle?: string;\n  lastMessagePreview?: string;\n  updatedAt?: number | null;\n};\n\nexport type SessionListResult = {\n  sessions?: SessionRow[];\n};\n\nexport type ChatHistoryResult = {\n  messages?: Array<{ id?: string; role?: string; content?: unknown; [key: string]: unknown }>;\n};\n\nexport type SessionMessagePayload = {\n  sessionKey?: string;\n  messageId?: string;\n  messageSeq?: number;\n  message?: { role?: string; content?: unknown; [key: string]: unknown };\n  lastChannel?: string;\n  lastTo?: string;\n  lastAccountId?: string;\n  lastThreadId?: string | number;\n  [key: string]: unknown;\n};\n\nexport type ApprovalKind = \"exec\" | \"plugin\";\nexport type ApprovalDecision = \"allow-once\" | \"allow-always\" | \"deny\";\n\nexport type PendingApproval = {\n  kind: ApprovalKind;\n  id: string;\n  request?: Record<string, unknown>;\n  createdAtMs?: number;\n  expiresAtMs?: number;\n};\n\nexport type QueueEvent =\n  | {\n      cursor: number;\n      type: \"message\";\n      sessionKey: string;\n      conversation?: ConversationDescriptor;\n      messageId?: string;\n      messageSeq?: number;\n      role?: string;\n      text?: string;\n      raw: SessionMessagePayload;\n    }\n  | {\n      cursor: number;\n      type: \"claude_permission_request\";\n      requestId: string;\n      toolName: string;\n      description: string;\n      inputPreview: string;\n    }\n  | {\n      cursor: number;\n      type: \"exec_approval_requested\" | \"exec_approval_resolved\";\n      raw: Record<string, unknown>;\n    }\n  | {\n      cursor: number;\n      type: \"plugin_approval_requested\" | \"plugin_approval_resolved\";\n      raw: Record<string, unknown>;\n    };\n\nexport type ClaudePermissionRequest = {\n  toolName: string;\n  description: string;\n  inputPreview: string;\n};\n\nexport type WaitFilter = {\n  afterCursor: number;\n  sessionKey?: string;\n};\n\nexport const ClaudePermissionRequestSchema = z.object({\n  method: z.literal(\"notifications/claude/channel/permission_request\"),\n  params: z.object({\n    request_id: z.string(),\n    tool_name: z.string(),\n    description: z.string(),\n    input_preview: z.string(),\n  }),\n});\n\nexport { toText };\n\nexport function resolveMessageId(entry: Record<string, unknown>): string | undefined {\n  return (\n    toText(entry.id) ??\n    (entry.__openclaw && typeof entry.__openclaw === \"object\"\n      ? toText((entry.__openclaw as { id?: unknown }).id)\n      : undefined)\n  );\n}\n\nexport function summarizeResult(\n  label: string,\n  count: number,\n): { content: Array<{ type: \"text\"; text: string }> } {\n  return {\n    content: [{ type: \"text\", text: `${label}: ${count}` }],\n  };\n}\n\nexport function resolveConversationChannel(row: SessionRow): string | undefined {\n  return normalizeMessageChannel(\n    toText(row.deliveryContext?.channel) ??\n      toText(row.lastChannel) ??\n      toText(row.channel) ??\n      toText(row.origin?.provider),\n  );\n}\n\nexport function toConversation(row: SessionRow): ConversationDescriptor | null {\n  const channel = resolveConversationChannel(row);\n  const to = toText(row.deliveryContext?.to) ?? toText(row.lastTo);\n  if (!channel || !to) {\n    return null;\n  }\n  return {\n    sessionKey: row.key,\n    channel,\n    to,\n    accountId:\n      toText(row.deliveryContext?.accountId) ??\n      toText(row.lastAccountId) ??\n      toText(row.origin?.accountId),\n    threadId: row.deliveryContext?.threadId ?? row.lastThreadId ?? row.origin?.threadId,\n    label: toText(row.label),\n    displayName: toText(row.displayName),\n    derivedTitle: toText(row.derivedTitle),\n    lastMessagePreview: toText(row.lastMessagePreview),\n    updatedAt: typeof row.updatedAt === \"number\" ? row.updatedAt : null,\n  };\n}\n\nexport function matchEventFilter(event: QueueEvent, filter: WaitFilter): boolean {\n  if (event.cursor <= filter.afterCursor) {\n    return false;\n  }\n  if (!filter.sessionKey) {\n    return true;\n  }\n  return \"sessionKey\" in event && event.sessionKey === filter.sessionKey;\n}\n\nexport function extractAttachmentsFromMessage(message: unknown): unknown[] {\n  if (!message || typeof message !== \"object\") {\n    return [];\n  }\n  const content = (message as { content?: unknown }).content;\n  if (!Array.isArray(content)) {\n    return [];\n  }\n  return content.filter((entry) => {\n    if (!entry || typeof entry !== \"object\") {\n      return false;\n    }\n    return toText((entry as { type?: unknown }).type) !== \"text\";\n  });\n}\n\nexport function normalizeApprovalId(value: unknown): string | undefined {\n  const id = toText(value);\n  return id ? id.trim() : undefined;\n}\n"],"mappings":";;;AAGA,SAAS,wBAAwB,OAA+C;AAC9E,QAAO,OAAO,MAAM,IAAI,KAAA;;AAoH1B,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,kDAAkD;CACpE,QAAQ,EAAE,OAAO;EACf,YAAY,EAAE,QAAQ;EACtB,WAAW,EAAE,QAAQ;EACrB,aAAa,EAAE,QAAQ;EACvB,eAAe,EAAE,QAAQ;EAC1B,CAAC;CACH,CAAC;AAIF,SAAgB,iBAAiB,OAAoD;AACnF,QACEA,wBAAO,MAAM,GAAG,KACf,MAAM,cAAc,OAAO,MAAM,eAAe,WAC7CA,wBAAQ,MAAM,WAAgC,GAAG,GACjD,KAAA;;AAIR,SAAgB,gBACd,OACA,OACoD;AACpD,QAAO,EACL,SAAS,CAAC;EAAE,MAAM;EAAQ,MAAM,GAAG,MAAM,IAAI;EAAS,CAAC,EACxD;;AAGH,SAAgB,2BAA2B,KAAqC;AAC9E,QAAO,wBACLA,wBAAO,IAAI,iBAAiB,QAAQ,IAClCA,wBAAO,IAAI,YAAY,IACvBA,wBAAO,IAAI,QAAQ,IACnBA,wBAAO,IAAI,QAAQ,SAAS,CAC/B;;AAGH,SAAgB,eAAe,KAAgD;CAC7E,MAAM,UAAU,2BAA2B,IAAI;CAC/C,MAAM,KAAKA,wBAAO,IAAI,iBAAiB,GAAG,IAAIA,wBAAO,IAAI,OAAO;AAChE,KAAI,CAAC,WAAW,CAAC,GACf,QAAO;AAET,QAAO;EACL,YAAY,IAAI;EAChB;EACA;EACA,WACEA,wBAAO,IAAI,iBAAiB,UAAU,IACtCA,wBAAO,IAAI,cAAc,IACzBA,wBAAO,IAAI,QAAQ,UAAU;EAC/B,UAAU,IAAI,iBAAiB,YAAY,IAAI,gBAAgB,IAAI,QAAQ;EAC3E,OAAOA,wBAAO,IAAI,MAAM;EACxB,aAAaA,wBAAO,IAAI,YAAY;EACpC,cAAcA,wBAAO,IAAI,aAAa;EACtC,oBAAoBA,wBAAO,IAAI,mBAAmB;EAClD,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;EAChE;;AAGH,SAAgB,iBAAiB,OAAmB,QAA6B;AAC/E,KAAI,MAAM,UAAU,OAAO,YACzB,QAAO;AAET,KAAI,CAAC,OAAO,WACV,QAAO;AAET,QAAO,gBAAgB,SAAS,MAAM,eAAe,OAAO;;AAG9D,SAAgB,8BAA8B,SAA6B;AACzE,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,QAAO,EAAE;CAEX,MAAM,UAAW,QAAkC;AACnD,KAAI,CAAC,MAAM,QAAQ,QAAQ,CACzB,QAAO,EAAE;AAEX,QAAO,QAAQ,QAAQ,UAAU;AAC/B,MAAI,CAAC,SAAS,OAAO,UAAU,SAC7B,QAAO;AAET,SAAOA,wBAAQ,MAA6B,KAAK,KAAK;GACtD;;AAGJ,SAAgB,oBAAoB,OAAoC;CACtE,MAAM,KAAKA,wBAAO,MAAM;AACxB,QAAO,KAAK,GAAG,MAAM,GAAG,KAAA"}
+{"version":3,"file":"channel-shared.js","names":["toText"],"sources":["../../../src/mcp/channel-shared.ts"],"sourcesContent":["import { z } from 'zod';\nimport { normalizeOptionalString as toText } from '../utils/string-coerce.js';\n\nfunction normalizeMessageChannel(value: string | undefined): string | undefined {\n  return value?.trim() || undefined;\n}\n\nexport type ClaudeChannelMode = \"off\" | \"on\" | \"auto\";\n\nexport type ConversationDescriptor = {\n  sessionKey: string;\n  channel: string;\n  to: string;\n  accountId?: string;\n  threadId?: string | number;\n  label?: string;\n  displayName?: string;\n  derivedTitle?: string;\n  lastMessagePreview?: string;\n  updatedAt?: number | null;\n};\n\nexport type SessionRow = {\n  key: string;\n  channel?: string;\n  lastChannel?: string;\n  lastTo?: string;\n  lastAccountId?: string;\n  lastThreadId?: string | number;\n  deliveryContext?: {\n    channel?: string;\n    to?: string;\n    accountId?: string;\n    threadId?: string | number;\n  };\n  origin?: {\n    provider?: string;\n    accountId?: string;\n    threadId?: string | number;\n  };\n  label?: string;\n  displayName?: string;\n  derivedTitle?: string;\n  lastMessagePreview?: string;\n  updatedAt?: number | null;\n};\n\nexport type SessionListResult = {\n  sessions?: SessionRow[];\n};\n\nexport type ChatHistoryResult = {\n  messages?: Array<{ id?: string; role?: string; content?: unknown; [key: string]: unknown }>;\n};\n\nexport type SessionMessagePayload = {\n  sessionKey?: string;\n  messageId?: string;\n  messageSeq?: number;\n  message?: { role?: string; content?: unknown; [key: string]: unknown };\n  lastChannel?: string;\n  lastTo?: string;\n  lastAccountId?: string;\n  lastThreadId?: string | number;\n  [key: string]: unknown;\n};\n\nexport type ApprovalKind = \"exec\" | \"plugin\";\nexport type ApprovalDecision = \"allow-once\" | \"allow-always\" | \"deny\";\n\nexport type PendingApproval = {\n  kind: ApprovalKind;\n  id: string;\n  request?: Record<string, unknown>;\n  createdAtMs?: number;\n  expiresAtMs?: number;\n};\n\nexport type QueueEvent =\n  | {\n      cursor: number;\n      type: \"message\";\n      sessionKey: string;\n      conversation?: ConversationDescriptor;\n      messageId?: string;\n      messageSeq?: number;\n      role?: string;\n      text?: string;\n      raw: SessionMessagePayload;\n    }\n  | {\n      cursor: number;\n      type: \"claude_permission_request\";\n      requestId: string;\n      toolName: string;\n      description: string;\n      inputPreview: string;\n    }\n  | {\n      cursor: number;\n      type: \"exec_approval_requested\" | \"exec_approval_resolved\";\n      raw: Record<string, unknown>;\n    }\n  | {\n      cursor: number;\n      type: \"plugin_approval_requested\" | \"plugin_approval_resolved\";\n      raw: Record<string, unknown>;\n    };\n\nexport type ClaudePermissionRequest = {\n  toolName: string;\n  description: string;\n  inputPreview: string;\n};\n\nexport type WaitFilter = {\n  afterCursor: number;\n  sessionKey?: string;\n};\n\nexport const ClaudePermissionRequestSchema = z.object({\n  method: z.literal(\"notifications/claude/channel/permission_request\"),\n  params: z.object({\n    request_id: z.string(),\n    tool_name: z.string(),\n    description: z.string(),\n    input_preview: z.string(),\n  }),\n});\n\nexport { toText };\n\nexport function resolveMessageId(entry: Record<string, unknown>): string | undefined {\n  return (\n    toText(entry.id) ??\n    (entry.__openclaw && typeof entry.__openclaw === \"object\"\n      ? toText((entry.__openclaw as { id?: unknown }).id)\n      : undefined)\n  );\n}\n\nexport function summarizeResult(\n  label: string,\n  count: number,\n): { content: Array<{ type: \"text\"; text: string }> } {\n  return {\n    content: [{ type: \"text\", text: `${label}: ${count}` }],\n  };\n}\n\nexport function resolveConversationChannel(row: SessionRow): string | undefined {\n  return normalizeMessageChannel(\n    toText(row.deliveryContext?.channel) ??\n      toText(row.lastChannel) ??\n      toText(row.channel) ??\n      toText(row.origin?.provider),\n  );\n}\n\nexport function toConversation(row: SessionRow): ConversationDescriptor | null {\n  const channel = resolveConversationChannel(row);\n  const to = toText(row.deliveryContext?.to) ?? toText(row.lastTo);\n  if (!channel || !to) {\n    return null;\n  }\n  return {\n    sessionKey: row.key,\n    channel,\n    to,\n    accountId:\n      toText(row.deliveryContext?.accountId) ??\n      toText(row.lastAccountId) ??\n      toText(row.origin?.accountId),\n    threadId: row.deliveryContext?.threadId ?? row.lastThreadId ?? row.origin?.threadId,\n    label: toText(row.label),\n    displayName: toText(row.displayName),\n    derivedTitle: toText(row.derivedTitle),\n    lastMessagePreview: toText(row.lastMessagePreview),\n    updatedAt: typeof row.updatedAt === \"number\" ? row.updatedAt : null,\n  };\n}\n\nexport function matchEventFilter(event: QueueEvent, filter: WaitFilter): boolean {\n  if (event.cursor <= filter.afterCursor) {\n    return false;\n  }\n  if (!filter.sessionKey) {\n    return true;\n  }\n  return \"sessionKey\" in event && event.sessionKey === filter.sessionKey;\n}\n\nexport function extractAttachmentsFromMessage(message: unknown): unknown[] {\n  if (!message || typeof message !== \"object\") {\n    return [];\n  }\n  const content = (message as { content?: unknown }).content;\n  if (!Array.isArray(content)) {\n    return [];\n  }\n  return content.filter((entry) => {\n    if (!entry || typeof entry !== \"object\") {\n      return false;\n    }\n    return toText((entry as { type?: unknown }).type) !== \"text\";\n  });\n}\n\nexport function normalizeApprovalId(value: unknown): string | undefined {\n  const id = toText(value);\n  return id ? id.trim() : undefined;\n}\n"],"mappings":";;;oBAC8E;AAE9E,SAAS,wBAAwB,OAA+C;AAC9E,QAAO,OAAO,MAAM,IAAI,KAAA;;AAoH1B,MAAa,gCAAgC,EAAE,OAAO;CACpD,QAAQ,EAAE,QAAQ,kDAAkD;CACpE,QAAQ,EAAE,OAAO;EACf,YAAY,EAAE,QAAQ;EACtB,WAAW,EAAE,QAAQ;EACrB,aAAa,EAAE,QAAQ;EACvB,eAAe,EAAE,QAAQ;EAC1B,CAAC;CACH,CAAC;AAIF,SAAgB,iBAAiB,OAAoD;AACnF,QACEA,wBAAO,MAAM,GAAG,KACf,MAAM,cAAc,OAAO,MAAM,eAAe,WAC7CA,wBAAQ,MAAM,WAAgC,GAAG,GACjD,KAAA;;AAIR,SAAgB,gBACd,OACA,OACoD;AACpD,QAAO,EACL,SAAS,CAAC;EAAE,MAAM;EAAQ,MAAM,GAAG,MAAM,IAAI;EAAS,CAAC,EACxD;;AAGH,SAAgB,2BAA2B,KAAqC;AAC9E,QAAO,wBACLA,wBAAO,IAAI,iBAAiB,QAAQ,IAClCA,wBAAO,IAAI,YAAY,IACvBA,wBAAO,IAAI,QAAQ,IACnBA,wBAAO,IAAI,QAAQ,SAAS,CAC/B;;AAGH,SAAgB,eAAe,KAAgD;CAC7E,MAAM,UAAU,2BAA2B,IAAI;CAC/C,MAAM,KAAKA,wBAAO,IAAI,iBAAiB,GAAG,IAAIA,wBAAO,IAAI,OAAO;AAChE,KAAI,CAAC,WAAW,CAAC,GACf,QAAO;AAET,QAAO;EACL,YAAY,IAAI;EAChB;EACA;EACA,WACEA,wBAAO,IAAI,iBAAiB,UAAU,IACtCA,wBAAO,IAAI,cAAc,IACzBA,wBAAO,IAAI,QAAQ,UAAU;EAC/B,UAAU,IAAI,iBAAiB,YAAY,IAAI,gBAAgB,IAAI,QAAQ;EAC3E,OAAOA,wBAAO,IAAI,MAAM;EACxB,aAAaA,wBAAO,IAAI,YAAY;EACpC,cAAcA,wBAAO,IAAI,aAAa;EACtC,oBAAoBA,wBAAO,IAAI,mBAAmB;EAClD,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;EAChE;;AAGH,SAAgB,iBAAiB,OAAmB,QAA6B;AAC/E,KAAI,MAAM,UAAU,OAAO,YACzB,QAAO;AAET,KAAI,CAAC,OAAO,WACV,QAAO;AAET,QAAO,gBAAgB,SAAS,MAAM,eAAe,OAAO;;AAG9D,SAAgB,8BAA8B,SAA6B;AACzE,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,QAAO,EAAE;CAEX,MAAM,UAAW,QAAkC;AACnD,KAAI,CAAC,MAAM,QAAQ,QAAQ,CACzB,QAAO,EAAE;AAEX,QAAO,QAAQ,QAAQ,UAAU;AAC/B,MAAI,CAAC,SAAS,OAAO,UAAU,SAC7B,QAAO;AAET,SAAOA,wBAAQ,MAA6B,KAAK,KAAK;GACtD;;AAGJ,SAAgB,oBAAoB,OAAoC;CACtE,MAAM,KAAKA,wBAAO,MAAM;AACxB,QAAO,KAAK,GAAG,MAAM,GAAG,KAAA"}

package/dist/src/providers/auth-runtime/auth-profile-store.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 //#region src/providers/auth-runtime/auth-profile-store.ts
 /**
 * {@link AuthProfileStore} implementations.
@@ -206,7 +206,7 @@ function ensureDiskAuthProfileStore(agentDir) {
 * store or the default store.
 */
 function listProfilesForProvider(store, providerId) {
-	return (store ?? getDefaultAuthProfileStore()).list?.(providerId) ?? [];
+	return (store ?? getDefaultAuthProfileStore()).list(providerId);
 }
 //#endregion
 export { DiskAuthProfileStore, NoopAuthProfileStore, ensureDiskAuthProfileStore, getDefaultAuthProfileStore, listProfilesForProvider, setDefaultAuthProfileStore };

package/dist/src/providers/auth-runtime/auth-profile-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-profile-store.js","names":[],"sources":["../../../../src/providers/auth-runtime/auth-profile-store.ts"],"sourcesContent":["/**\n * {@link AuthProfileStore} implementations.\n *\n * - {@link NoopAuthProfileStore}: returns nothing; used by tests and as a safe\n *   fallback when no agent context is available.\n * - {@link DiskAuthProfileStore}: persists per-agent profiles under\n *   `<stateDir>/agents/<agentId>/auth-profiles.json` with a lazy in-memory\n *   cache and atomic writes. Used by the gateway and CLI to host OAuth\n *   tokens (Codex / Anthropic) without leaking them through env vars.\n *\n * Capability providers stay synchronous: `getApiKeySync` / `hasCredentialSync`\n * read the cached snapshot. Async members (`save`, `refresh`) are only used\n * by vendor-specific code that explicitly opts in to OAuth flows.\n */\n\nimport { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\n\nimport { createLogger } from '../../utils/logger.js';\nimport type { AuthProfile, AuthProfileStore } from './types.js';\n\nconst log = createLogger('AuthProfileStore');\n\nconst STORE_FILENAME = 'auth-profiles.json';\n\nexport class NoopAuthProfileStore implements AuthProfileStore {\n  getApiKeySync(): string | undefined {\n    return undefined;\n  }\n  hasCredentialSync(): boolean {\n    return false;\n  }\n  list(): AuthProfile[] {\n    return [];\n  }\n  get(): AuthProfile | undefined {\n    return undefined;\n  }\n  async save(): Promise<void> {\n    /* no-op */\n  }\n  async refresh(profile: AuthProfile): Promise<AuthProfile> {\n    return profile;\n  }\n}\n\ntype DiskFile = {\n  /** Schema version; bumped if we ever change the on-disk shape. */\n  version: 1;\n  profiles: AuthProfile[];\n};\n\nfunction emptyFile(): DiskFile {\n  return { version: 1, profiles: [] };\n}\n\nfunction isDiskFile(v: unknown): v is DiskFile {\n  if (!v || typeof v !== 'object') return false;\n  const o = v as Record<string, unknown>;\n  return o.version === 1 && Array.isArray(o.profiles);\n}\n\n/**\n * Persistent per-agent credential store.\n *\n * File layout (`<stateDir>/agents/<agentId>/auth-profiles.json`):\n *\n * ```json\n * {\n *   \"version\": 1,\n *   \"profiles\": [\n *     { \"provider\": \"openai\", \"profileId\": \"default\", \"mode\": \"api-key\", \"apiKey\": \"sk-...\" },\n *     { \"provider\": \"openai\", \"profileId\": \"codex\",   \"mode\": \"oauth\",\n *       \"oauthAccessToken\": \"...\", \"oauthRefreshToken\": \"...\", \"expiresAt\": 1714000000000 }\n *   ]\n * }\n * ```\n *\n * - Constructor is non-blocking; the first read triggers a sync load.\n * - Writes go through a temp file + `renameSync` so partial writes never\n *   leave the JSON corrupted.\n */\nexport class DiskAuthProfileStore implements AuthProfileStore {\n  private readonly path: string;\n  private cache: DiskFile | undefined;\n  private writeChain: Promise<void> = Promise.resolve();\n\n  constructor(filePath: string) {\n    this.path = filePath;\n  }\n\n  /** Absolute path to the backing JSON file. */\n  get filePath(): string {\n    return this.path;\n  }\n\n  // --- Sync read API ------------------------------------------------------\n\n  getApiKeySync(providerId: string, profile?: string): string | undefined {\n    const p = this.findProfile(providerId, profile);\n    if (!p) return undefined;\n    if (typeof p.apiKey === 'string' && p.apiKey.length > 0) return p.apiKey;\n    if (typeof p.oauthAccessToken === 'string' && p.oauthAccessToken.length > 0) {\n      return p.oauthAccessToken;\n    }\n    return undefined;\n  }\n\n  hasCredentialSync(providerId: string, profile?: string): boolean {\n    return Boolean(this.getApiKeySync(providerId, profile));\n  }\n\n  list(providerId: string): AuthProfile[] {\n    const file = this.ensureLoaded();\n    return file.profiles\n      .filter((p) => p.provider === providerId)\n      .map((p) => ({ ...p }));\n  }\n\n  get(providerId: string, profileId?: string): AuthProfile | undefined {\n    const p = this.findProfile(providerId, profileId);\n    return p ? { ...p } : undefined;\n  }\n\n  // --- Async write API ----------------------------------------------------\n\n  /**\n   * Persist a profile. Uses a serial write chain so concurrent saves cannot\n   * race each other on the JSON document.\n   */\n  save(profile: AuthProfile): Promise<void> {\n    const next = this.writeChain.then(() => {\n      const file = this.ensureLoaded();\n      const idx = file.profiles.findIndex(\n        (p) => p.provider === profile.provider && p.profileId === profile.profileId,\n      );\n      if (idx >= 0) {\n        file.profiles[idx] = { ...profile };\n      } else {\n        file.profiles.push({ ...profile });\n      }\n      // Only one default per provider.\n      if (profile.default) {\n        for (const p of file.profiles) {\n          if (\n            p.provider === profile.provider &&\n            p.profileId !== profile.profileId &&\n            p.default\n          ) {\n            p.default = false;\n          }\n        }\n      }\n      this.persist(file);\n    });\n    // Swallow rejections in the chain so a single bad write doesn't poison\n    // every subsequent save attempt.\n    this.writeChain = next.catch(() => undefined);\n    return next;\n  }\n\n  /**\n   * Default `refresh()` is a no-op. Vendor-specific OAuth refresh logic\n   * (Codex / Anthropic) lives in `src/providers/auth-runtime/oauth.ts` and\n   * calls `save()` here once it has a fresh token.\n   */\n  async refresh(profile: AuthProfile): Promise<AuthProfile> {\n    return profile;\n  }\n\n  // --- Internals ----------------------------------------------------------\n\n  private ensureLoaded(): DiskFile {\n    if (this.cache) return this.cache;\n    if (!existsSync(this.path)) {\n      this.cache = emptyFile();\n      return this.cache;\n    }\n    try {\n      const raw = readFileSync(this.path, 'utf8');\n      const parsed = JSON.parse(raw);\n      if (isDiskFile(parsed)) {\n        this.cache = { version: 1, profiles: parsed.profiles.filter(isAuthProfileLike) };\n      } else {\n        log.warn(\n          { path: this.path, phase: 'load' },\n          'auth-profiles.json has unexpected shape; resetting to empty (file is preserved on disk)',\n        );\n        this.cache = emptyFile();\n      }\n    } catch (err) {\n      log.warn(\n        { err, path: this.path, phase: 'load' },\n        `Failed to read auth-profiles.json: ${err instanceof Error ? err.message : String(err)}`,\n      );\n      this.cache = emptyFile();\n    }\n    return this.cache;\n  }\n\n  private findProfile(providerId: string, profileId?: string): AuthProfile | undefined {\n    const file = this.ensureLoaded();\n    const matches = file.profiles.filter((p) => p.provider === providerId);\n    if (matches.length === 0) return undefined;\n    const wanted = profileId?.trim();\n    if (wanted) {\n      return matches.find((p) => p.profileId === wanted);\n    }\n    return matches.find((p) => p.default) ?? matches.find((p) => p.profileId === 'default') ?? matches[0];\n  }\n\n  private persist(file: DiskFile): void {\n    mkdirSync(dirname(this.path), { recursive: true });\n    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}`;\n    writeFileSync(tmp, JSON.stringify(file, null, 2), { encoding: 'utf8', mode: 0o600 });\n    renameSync(tmp, this.path);\n    this.cache = file;\n  }\n}\n\nfunction isAuthProfileLike(v: unknown): v is AuthProfile {\n  if (!v || typeof v !== 'object') return false;\n  const o = v as Record<string, unknown>;\n  return typeof o.provider === 'string' && typeof o.profileId === 'string' && typeof o.mode === 'string';\n}\n\n// --- Default store registry ------------------------------------------------\n\nlet defaultStore: AuthProfileStore = new NoopAuthProfileStore();\nconst diskStores = new Map<string, DiskAuthProfileStore>();\n\nexport function getDefaultAuthProfileStore(): AuthProfileStore {\n  return defaultStore;\n}\n\n/**\n * Override the default store. Returns a function that restores the previous\n * store; tests typically call it in `afterEach`.\n */\nexport function setDefaultAuthProfileStore(store: AuthProfileStore): () => void {\n  const prev = defaultStore;\n  defaultStore = store;\n  return () => {\n    defaultStore = prev;\n  };\n}\n\n/**\n * Get (or create) a {@link DiskAuthProfileStore} for the given agent\n * directory. Same `agentDir` always returns the same store instance so the\n * in-memory cache stays consistent within one process.\n */\nexport function ensureDiskAuthProfileStore(agentDir: string): DiskAuthProfileStore {\n  const key = agentDir;\n  let store = diskStores.get(key);\n  if (!store) {\n    store = new DiskAuthProfileStore(join(agentDir, STORE_FILENAME));\n    diskStores.set(key, store);\n  }\n  return store;\n}\n\n/**\n * Convenience: list every profile for a provider via either an explicit\n * store or the default store.\n */\nexport function listProfilesForProvider(\n  store: AuthProfileStore | undefined,\n  providerId: string,\n): AuthProfile[] {\n  const s = store ?? getDefaultAuthProfileStore();\n  return s.list?.(providerId) ?? [];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;aAkBqD;AAGrD,MAAM,MAAM,aAAa,mBAAmB;AAE5C,MAAM,iBAAiB;AAEvB,IAAa,uBAAb,MAA8D;CAC5D,gBAAoC;CAGpC,oBAA6B;AAC3B,SAAO;;CAET,OAAsB;AACpB,SAAO,EAAE;;CAEX,MAA+B;CAG/B,MAAM,OAAsB;CAG5B,MAAM,QAAQ,SAA4C;AACxD,SAAO;;;AAUX,SAAS,YAAsB;AAC7B,QAAO;EAAE,SAAS;EAAG,UAAU,EAAE;EAAE;;AAGrC,SAAS,WAAW,GAA2B;AAC7C,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QAAO,EAAE,YAAY,KAAK,MAAM,QAAQ,EAAE,SAAS;;;;;;;;;;;;;;;;;;;;;;AAuBrD,IAAa,uBAAb,MAA8D;CAC5D;CACA;CACA,aAAoC,QAAQ,SAAS;CAErD,YAAY,UAAkB;AAC5B,OAAK,OAAO;;;CAId,IAAI,WAAmB;AACrB,SAAO,KAAK;;CAKd,cAAc,YAAoB,SAAsC;EACtE,MAAM,IAAI,KAAK,YAAY,YAAY,QAAQ;AAC/C,MAAI,CAAC,EAAG,QAAO,KAAA;AACf,MAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,SAAS,EAAG,QAAO,EAAE;AAClE,MAAI,OAAO,EAAE,qBAAqB,YAAY,EAAE,iBAAiB,SAAS,EACxE,QAAO,EAAE;;CAKb,kBAAkB,YAAoB,SAA2B;AAC/D,SAAO,QAAQ,KAAK,cAAc,YAAY,QAAQ,CAAC;;CAGzD,KAAK,YAAmC;AAEtC,SADa,KAAK,cACP,CAAC,SACT,QAAQ,MAAM,EAAE,aAAa,WAAW,CACxC,KAAK,OAAO,EAAE,GAAG,GAAG,EAAE;;CAG3B,IAAI,YAAoB,WAA6C;EACnE,MAAM,IAAI,KAAK,YAAY,YAAY,UAAU;AACjD,SAAO,IAAI,EAAE,GAAG,GAAG,GAAG,KAAA;;;;;;CASxB,KAAK,SAAqC;EACxC,MAAM,OAAO,KAAK,WAAW,WAAW;GACtC,MAAM,OAAO,KAAK,cAAc;GAChC,MAAM,MAAM,KAAK,SAAS,WACvB,MAAM,EAAE,aAAa,QAAQ,YAAY,EAAE,cAAc,QAAQ,UACnE;AACD,OAAI,OAAO,EACT,MAAK,SAAS,OAAO,EAAE,GAAG,SAAS;OAEnC,MAAK,SAAS,KAAK,EAAE,GAAG,SAAS,CAAC;AAGpC,OAAI,QAAQ;SACL,MAAM,KAAK,KAAK,SACnB,KACE,EAAE,aAAa,QAAQ,YACvB,EAAE,cAAc,QAAQ,aACxB,EAAE,QAEF,GAAE,UAAU;;AAIlB,QAAK,QAAQ,KAAK;IAClB;AAGF,OAAK,aAAa,KAAK,YAAY,KAAA,EAAU;AAC7C,SAAO;;;;;;;CAQT,MAAM,QAAQ,SAA4C;AACxD,SAAO;;CAKT,eAAiC;AAC/B,MAAI,KAAK,MAAO,QAAO,KAAK;AAC5B,MAAI,CAAC,WAAW,KAAK,KAAK,EAAE;AAC1B,QAAK,QAAQ,WAAW;AACxB,UAAO,KAAK;;AAEd,MAAI;GACF,MAAM,MAAM,aAAa,KAAK,MAAM,OAAO;GAC3C,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,OAAI,WAAW,OAAO,CACpB,MAAK,QAAQ;IAAE,SAAS;IAAG,UAAU,OAAO,SAAS,OAAO,kBAAkB;IAAE;QAC3E;AACL,QAAI,KACF;KAAE,MAAM,KAAK;KAAM,OAAO;KAAQ,EAClC,0FACD;AACD,SAAK,QAAQ,WAAW;;WAEnB,KAAK;AACZ,OAAI,KACF;IAAE;IAAK,MAAM,KAAK;IAAM,OAAO;IAAQ,EACvC,sCAAsC,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACvF;AACD,QAAK,QAAQ,WAAW;;AAE1B,SAAO,KAAK;;CAGd,YAAoB,YAAoB,WAA6C;EAEnF,MAAM,UADO,KAAK,cACE,CAAC,SAAS,QAAQ,MAAM,EAAE,aAAa,WAAW;AACtE,MAAI,QAAQ,WAAW,EAAG,QAAO,KAAA;EACjC,MAAM,SAAS,WAAW,MAAM;AAChC,MAAI,OACF,QAAO,QAAQ,MAAM,MAAM,EAAE,cAAc,OAAO;AAEpD,SAAO,QAAQ,MAAM,MAAM,EAAE,QAAQ,IAAI,QAAQ,MAAM,MAAM,EAAE,cAAc,UAAU,IAAI,QAAQ;;CAGrG,QAAgB,MAAsB;AACpC,YAAU,QAAQ,KAAK,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;EAClD,MAAM,MAAM,GAAG,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,KAAK;AACzD,gBAAc,KAAK,KAAK,UAAU,MAAM,MAAM,EAAE,EAAE;GAAE,UAAU;GAAQ,MAAM;GAAO,CAAC;AACpF,aAAW,KAAK,KAAK,KAAK;AAC1B,OAAK,QAAQ;;;AAIjB,SAAS,kBAAkB,GAA8B;AACvD,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QAAO,OAAO,EAAE,aAAa,YAAY,OAAO,EAAE,cAAc,YAAY,OAAO,EAAE,SAAS;;AAKhG,IAAI,eAAiC,IAAI,sBAAsB;AAC/D,MAAM,6BAAa,IAAI,KAAmC;AAE1D,SAAgB,6BAA+C;AAC7D,QAAO;;;;;;AAOT,SAAgB,2BAA2B,OAAqC;CAC9E,MAAM,OAAO;AACb,gBAAe;AACf,cAAa;AACX,iBAAe;;;;;;;;AASnB,SAAgB,2BAA2B,UAAwC;CACjF,MAAM,MAAM;CACZ,IAAI,QAAQ,WAAW,IAAI,IAAI;AAC/B,KAAI,CAAC,OAAO;AACV,UAAQ,IAAI,qBAAqB,KAAK,UAAU,eAAe,CAAC;AAChE,aAAW,IAAI,KAAK,MAAM;;AAE5B,QAAO;;;;;;AAOT,SAAgB,wBACd,OACA,YACe;AAEf,SADU,SAAS,4BAA4B,EACtC,OAAO,WAAW,IAAI,EAAE"}
+{"version":3,"file":"auth-profile-store.js","names":[],"sources":["../../../../src/providers/auth-runtime/auth-profile-store.ts"],"sourcesContent":["/**\n * {@link AuthProfileStore} implementations.\n *\n * - {@link NoopAuthProfileStore}: returns nothing; used by tests and as a safe\n *   fallback when no agent context is available.\n * - {@link DiskAuthProfileStore}: persists per-agent profiles under\n *   `<stateDir>/agents/<agentId>/auth-profiles.json` with a lazy in-memory\n *   cache and atomic writes. Used by the gateway and CLI to host OAuth\n *   tokens (Codex / Anthropic) without leaking them through env vars.\n *\n * Capability providers stay synchronous: `getApiKeySync` / `hasCredentialSync`\n * read the cached snapshot. Async members (`save`, `refresh`) are only used\n * by vendor-specific code that explicitly opts in to OAuth flows.\n */\n\nimport { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\n\nimport { createLogger } from '../../utils/logger.js';\nimport type { AuthProfile, AuthProfileStore } from './types.js';\n\nconst log = createLogger('AuthProfileStore');\n\nconst STORE_FILENAME = 'auth-profiles.json';\n\nexport class NoopAuthProfileStore implements AuthProfileStore {\n  getApiKeySync(): string | undefined {\n    return undefined;\n  }\n  hasCredentialSync(): boolean {\n    return false;\n  }\n  list(): AuthProfile[] {\n    return [];\n  }\n  get(): AuthProfile | undefined {\n    return undefined;\n  }\n  async save(): Promise<void> {\n    /* no-op */\n  }\n  async refresh(profile: AuthProfile): Promise<AuthProfile> {\n    return profile;\n  }\n}\n\ntype DiskFile = {\n  /** Schema version; bumped if we ever change the on-disk shape. */\n  version: 1;\n  profiles: AuthProfile[];\n};\n\nfunction emptyFile(): DiskFile {\n  return { version: 1, profiles: [] };\n}\n\nfunction isDiskFile(v: unknown): v is DiskFile {\n  if (!v || typeof v !== 'object') return false;\n  const o = v as Record<string, unknown>;\n  return o.version === 1 && Array.isArray(o.profiles);\n}\n\n/**\n * Persistent per-agent credential store.\n *\n * File layout (`<stateDir>/agents/<agentId>/auth-profiles.json`):\n *\n * ```json\n * {\n *   \"version\": 1,\n *   \"profiles\": [\n *     { \"provider\": \"openai\", \"profileId\": \"default\", \"mode\": \"api-key\", \"apiKey\": \"sk-...\" },\n *     { \"provider\": \"openai\", \"profileId\": \"codex\",   \"mode\": \"oauth\",\n *       \"oauthAccessToken\": \"...\", \"oauthRefreshToken\": \"...\", \"expiresAt\": 1714000000000 }\n *   ]\n * }\n * ```\n *\n * - Constructor is non-blocking; the first read triggers a sync load.\n * - Writes go through a temp file + `renameSync` so partial writes never\n *   leave the JSON corrupted.\n */\nexport class DiskAuthProfileStore implements AuthProfileStore {\n  private readonly path: string;\n  private cache: DiskFile | undefined;\n  private writeChain: Promise<void> = Promise.resolve();\n\n  constructor(filePath: string) {\n    this.path = filePath;\n  }\n\n  /** Absolute path to the backing JSON file. */\n  get filePath(): string {\n    return this.path;\n  }\n\n  // --- Sync read API ------------------------------------------------------\n\n  getApiKeySync(providerId: string, profile?: string): string | undefined {\n    const p = this.findProfile(providerId, profile);\n    if (!p) return undefined;\n    if (typeof p.apiKey === 'string' && p.apiKey.length > 0) return p.apiKey;\n    if (typeof p.oauthAccessToken === 'string' && p.oauthAccessToken.length > 0) {\n      return p.oauthAccessToken;\n    }\n    return undefined;\n  }\n\n  hasCredentialSync(providerId: string, profile?: string): boolean {\n    return Boolean(this.getApiKeySync(providerId, profile));\n  }\n\n  list(providerId: string): AuthProfile[] {\n    const file = this.ensureLoaded();\n    return file.profiles\n      .filter((p) => p.provider === providerId)\n      .map((p) => ({ ...p }));\n  }\n\n  get(providerId: string, profileId?: string): AuthProfile | undefined {\n    const p = this.findProfile(providerId, profileId);\n    return p ? { ...p } : undefined;\n  }\n\n  // --- Async write API ----------------------------------------------------\n\n  /**\n   * Persist a profile. Uses a serial write chain so concurrent saves cannot\n   * race each other on the JSON document.\n   */\n  save(profile: AuthProfile): Promise<void> {\n    const next = this.writeChain.then(() => {\n      const file = this.ensureLoaded();\n      const idx = file.profiles.findIndex(\n        (p) => p.provider === profile.provider && p.profileId === profile.profileId,\n      );\n      if (idx >= 0) {\n        file.profiles[idx] = { ...profile };\n      } else {\n        file.profiles.push({ ...profile });\n      }\n      // Only one default per provider.\n      if (profile.default) {\n        for (const p of file.profiles) {\n          if (\n            p.provider === profile.provider &&\n            p.profileId !== profile.profileId &&\n            p.default\n          ) {\n            p.default = false;\n          }\n        }\n      }\n      this.persist(file);\n    });\n    // Swallow rejections in the chain so a single bad write doesn't poison\n    // every subsequent save attempt.\n    this.writeChain = next.catch(() => undefined);\n    return next;\n  }\n\n  /**\n   * Default `refresh()` is a no-op. Vendor-specific OAuth refresh logic\n   * (Codex / Anthropic) lives in `src/providers/auth-runtime/oauth.ts` and\n   * calls `save()` here once it has a fresh token.\n   */\n  async refresh(profile: AuthProfile): Promise<AuthProfile> {\n    return profile;\n  }\n\n  // --- Internals ----------------------------------------------------------\n\n  private ensureLoaded(): DiskFile {\n    if (this.cache) return this.cache;\n    if (!existsSync(this.path)) {\n      this.cache = emptyFile();\n      return this.cache;\n    }\n    try {\n      const raw = readFileSync(this.path, 'utf8');\n      const parsed = JSON.parse(raw);\n      if (isDiskFile(parsed)) {\n        this.cache = { version: 1, profiles: parsed.profiles.filter(isAuthProfileLike) };\n      } else {\n        log.warn(\n          { path: this.path, phase: 'load' },\n          'auth-profiles.json has unexpected shape; resetting to empty (file is preserved on disk)',\n        );\n        this.cache = emptyFile();\n      }\n    } catch (err) {\n      log.warn(\n        { err, path: this.path, phase: 'load' },\n        `Failed to read auth-profiles.json: ${err instanceof Error ? err.message : String(err)}`,\n      );\n      this.cache = emptyFile();\n    }\n    return this.cache;\n  }\n\n  private findProfile(providerId: string, profileId?: string): AuthProfile | undefined {\n    const file = this.ensureLoaded();\n    const matches = file.profiles.filter((p) => p.provider === providerId);\n    if (matches.length === 0) return undefined;\n    const wanted = profileId?.trim();\n    if (wanted) {\n      return matches.find((p) => p.profileId === wanted);\n    }\n    return matches.find((p) => p.default) ?? matches.find((p) => p.profileId === 'default') ?? matches[0];\n  }\n\n  private persist(file: DiskFile): void {\n    mkdirSync(dirname(this.path), { recursive: true });\n    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}`;\n    writeFileSync(tmp, JSON.stringify(file, null, 2), { encoding: 'utf8', mode: 0o600 });\n    renameSync(tmp, this.path);\n    this.cache = file;\n  }\n}\n\nfunction isAuthProfileLike(v: unknown): v is AuthProfile {\n  if (!v || typeof v !== 'object') return false;\n  const o = v as Record<string, unknown>;\n  return typeof o.provider === 'string' && typeof o.profileId === 'string' && typeof o.mode === 'string';\n}\n\n// --- Default store registry ------------------------------------------------\n\nlet defaultStore: AuthProfileStore = new NoopAuthProfileStore();\nconst diskStores = new Map<string, DiskAuthProfileStore>();\n\nexport function getDefaultAuthProfileStore(): AuthProfileStore {\n  return defaultStore;\n}\n\n/**\n * Override the default store. Returns a function that restores the previous\n * store; tests typically call it in `afterEach`.\n */\nexport function setDefaultAuthProfileStore(store: AuthProfileStore): () => void {\n  const prev = defaultStore;\n  defaultStore = store;\n  return () => {\n    defaultStore = prev;\n  };\n}\n\n/**\n * Get (or create) a {@link DiskAuthProfileStore} for the given agent\n * directory. Same `agentDir` always returns the same store instance so the\n * in-memory cache stays consistent within one process.\n */\nexport function ensureDiskAuthProfileStore(agentDir: string): DiskAuthProfileStore {\n  const key = agentDir;\n  let store = diskStores.get(key);\n  if (!store) {\n    store = new DiskAuthProfileStore(join(agentDir, STORE_FILENAME));\n    diskStores.set(key, store);\n  }\n  return store;\n}\n\n/**\n * Convenience: list every profile for a provider via either an explicit\n * store or the default store.\n */\nexport function listProfilesForProvider(\n  store: AuthProfileStore | undefined,\n  providerId: string,\n): AuthProfile[] {\n  const s = store ?? getDefaultAuthProfileStore();\n  return s.list(providerId);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;aAkBqD;AAGrD,MAAM,MAAM,aAAa,mBAAmB;AAE5C,MAAM,iBAAiB;AAEvB,IAAa,uBAAb,MAA8D;CAC5D,gBAAoC;CAGpC,oBAA6B;AAC3B,SAAO;;CAET,OAAsB;AACpB,SAAO,EAAE;;CAEX,MAA+B;CAG/B,MAAM,OAAsB;CAG5B,MAAM,QAAQ,SAA4C;AACxD,SAAO;;;AAUX,SAAS,YAAsB;AAC7B,QAAO;EAAE,SAAS;EAAG,UAAU,EAAE;EAAE;;AAGrC,SAAS,WAAW,GAA2B;AAC7C,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QAAO,EAAE,YAAY,KAAK,MAAM,QAAQ,EAAE,SAAS;;;;;;;;;;;;;;;;;;;;;;AAuBrD,IAAa,uBAAb,MAA8D;CAC5D;CACA;CACA,aAAoC,QAAQ,SAAS;CAErD,YAAY,UAAkB;AAC5B,OAAK,OAAO;;;CAId,IAAI,WAAmB;AACrB,SAAO,KAAK;;CAKd,cAAc,YAAoB,SAAsC;EACtE,MAAM,IAAI,KAAK,YAAY,YAAY,QAAQ;AAC/C,MAAI,CAAC,EAAG,QAAO,KAAA;AACf,MAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,SAAS,EAAG,QAAO,EAAE;AAClE,MAAI,OAAO,EAAE,qBAAqB,YAAY,EAAE,iBAAiB,SAAS,EACxE,QAAO,EAAE;;CAKb,kBAAkB,YAAoB,SAA2B;AAC/D,SAAO,QAAQ,KAAK,cAAc,YAAY,QAAQ,CAAC;;CAGzD,KAAK,YAAmC;AAEtC,SADa,KAAK,cACP,CAAC,SACT,QAAQ,MAAM,EAAE,aAAa,WAAW,CACxC,KAAK,OAAO,EAAE,GAAG,GAAG,EAAE;;CAG3B,IAAI,YAAoB,WAA6C;EACnE,MAAM,IAAI,KAAK,YAAY,YAAY,UAAU;AACjD,SAAO,IAAI,EAAE,GAAG,GAAG,GAAG,KAAA;;;;;;CASxB,KAAK,SAAqC;EACxC,MAAM,OAAO,KAAK,WAAW,WAAW;GACtC,MAAM,OAAO,KAAK,cAAc;GAChC,MAAM,MAAM,KAAK,SAAS,WACvB,MAAM,EAAE,aAAa,QAAQ,YAAY,EAAE,cAAc,QAAQ,UACnE;AACD,OAAI,OAAO,EACT,MAAK,SAAS,OAAO,EAAE,GAAG,SAAS;OAEnC,MAAK,SAAS,KAAK,EAAE,GAAG,SAAS,CAAC;AAGpC,OAAI,QAAQ;SACL,MAAM,KAAK,KAAK,SACnB,KACE,EAAE,aAAa,QAAQ,YACvB,EAAE,cAAc,QAAQ,aACxB,EAAE,QAEF,GAAE,UAAU;;AAIlB,QAAK,QAAQ,KAAK;IAClB;AAGF,OAAK,aAAa,KAAK,YAAY,KAAA,EAAU;AAC7C,SAAO;;;;;;;CAQT,MAAM,QAAQ,SAA4C;AACxD,SAAO;;CAKT,eAAiC;AAC/B,MAAI,KAAK,MAAO,QAAO,KAAK;AAC5B,MAAI,CAAC,WAAW,KAAK,KAAK,EAAE;AAC1B,QAAK,QAAQ,WAAW;AACxB,UAAO,KAAK;;AAEd,MAAI;GACF,MAAM,MAAM,aAAa,KAAK,MAAM,OAAO;GAC3C,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,OAAI,WAAW,OAAO,CACpB,MAAK,QAAQ;IAAE,SAAS;IAAG,UAAU,OAAO,SAAS,OAAO,kBAAkB;IAAE;QAC3E;AACL,QAAI,KACF;KAAE,MAAM,KAAK;KAAM,OAAO;KAAQ,EAClC,0FACD;AACD,SAAK,QAAQ,WAAW;;WAEnB,KAAK;AACZ,OAAI,KACF;IAAE;IAAK,MAAM,KAAK;IAAM,OAAO;IAAQ,EACvC,sCAAsC,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACvF;AACD,QAAK,QAAQ,WAAW;;AAE1B,SAAO,KAAK;;CAGd,YAAoB,YAAoB,WAA6C;EAEnF,MAAM,UADO,KAAK,cACE,CAAC,SAAS,QAAQ,MAAM,EAAE,aAAa,WAAW;AACtE,MAAI,QAAQ,WAAW,EAAG,QAAO,KAAA;EACjC,MAAM,SAAS,WAAW,MAAM;AAChC,MAAI,OACF,QAAO,QAAQ,MAAM,MAAM,EAAE,cAAc,OAAO;AAEpD,SAAO,QAAQ,MAAM,MAAM,EAAE,QAAQ,IAAI,QAAQ,MAAM,MAAM,EAAE,cAAc,UAAU,IAAI,QAAQ;;CAGrG,QAAgB,MAAsB;AACpC,YAAU,QAAQ,KAAK,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;EAClD,MAAM,MAAM,GAAG,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,KAAK;AACzD,gBAAc,KAAK,KAAK,UAAU,MAAM,MAAM,EAAE,EAAE;GAAE,UAAU;GAAQ,MAAM;GAAO,CAAC;AACpF,aAAW,KAAK,KAAK,KAAK;AAC1B,OAAK,QAAQ;;;AAIjB,SAAS,kBAAkB,GAA8B;AACvD,KAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;CACxC,MAAM,IAAI;AACV,QAAO,OAAO,EAAE,aAAa,YAAY,OAAO,EAAE,cAAc,YAAY,OAAO,EAAE,SAAS;;AAKhG,IAAI,eAAiC,IAAI,sBAAsB;AAC/D,MAAM,6BAAa,IAAI,KAAmC;AAE1D,SAAgB,6BAA+C;AAC7D,QAAO;;;;;;AAOT,SAAgB,2BAA2B,OAAqC;CAC9E,MAAM,OAAO;AACb,gBAAe;AACf,cAAa;AACX,iBAAe;;;;;;;;AASnB,SAAgB,2BAA2B,UAAwC;CACjF,MAAM,MAAM;CACZ,IAAI,QAAQ,WAAW,IAAI,IAAI;AAC/B,KAAI,CAAC,OAAO;AACV,UAAQ,IAAI,qBAAqB,KAAK,UAAU,eAAe,CAAC;AAChE,aAAW,IAAI,KAAK,MAAM;;AAE5B,QAAO;;;;;;AAOT,SAAgB,wBACd,OACA,YACe;AAEf,SADU,SAAS,4BAA4B,EACtC,KAAK,WAAW"}

package/dist/src/providers/auth-runtime/resolve-auth.js

@@ -43,22 +43,11 @@ function resolveAuthProfileForProvider(options) {
 	};
 }
 function pickProfile(store, providerId, profileName) {
-	if (typeof store.get === "function") try {
-		return store.get(providerId, profileName);
-	} catch {}
-	let key;
 	try {
-		key = store.getApiKeySync(providerId, profileName);
+		return store.get(providerId, profileName);
 	} catch {
 		return;
 	}
-	if (!key) return void 0;
-	return {
-		provider: providerId,
-		profileId: profileName ?? "default",
-		mode: "api-key",
-		apiKey: key
-	};
 }
 function readCfgApiKey(cfg, providerId) {
 	const providers = cfg?.providers;

package/dist/src/providers/auth-runtime/resolve-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-auth.js","names":[],"sources":["../../../../src/providers/auth-runtime/resolve-auth.ts"],"sourcesContent":["/**\n * Higher-level auth resolution that returns the *full* profile context, not\n * just the API key. Vendors that support multiple auth modes (e.g. OpenAI\n * api-key + Codex OAuth + Azure api-key) call this to pick the right\n * branch.\n *\n * Resolution order matches `resolveApiKeyForProvider`:\n *   1. AuthProfileStore (per-agent profile — may be OAuth)\n *   2. cfg.providers.<id>.apiKey\n *   3. PROVIDER_ENV_MAP[providerId] env vars\n *\n * Returns:\n *   - `mode: 'oauth' | 'azure-key' | 'api-key'`\n *   - `apiKey` (or OAuth access token) if found\n *   - `profileId` when the credential came from the store\n */\n\nimport { getApiKeyFromEnv } from '../env-keys.js';\nimport { getDefaultAuthProfileStore } from './auth-profile-store.js';\nimport type { AuthProfile, ProviderAuthMode, ResolveApiKeyOptions } from './types.js';\n\nexport interface ProviderAuthResolution {\n  apiKey?: string;\n  mode: ProviderAuthMode;\n  profileId?: string;\n  /** Source bucket: 'store' | 'config' | 'env' | 'none'. */\n  source: 'store' | 'config' | 'env' | 'none';\n  /** Vendor metadata copied from the matched profile (azure resource etc.). */\n  meta?: Record<string, unknown>;\n}\n\nexport function resolveAuthProfileForProvider(\n  options: ResolveApiKeyOptions,\n): ProviderAuthResolution {\n  const { providerId } = options;\n  if (!providerId) {\n    return { apiKey: undefined, mode: 'api-key', source: 'none' };\n  }\n\n  // 1. Profile store\n  const store = options.store ?? getDefaultAuthProfileStore();\n  const profile = pickProfile(store, providerId, options.profileName);\n  if (profile) {\n    const key =\n      (typeof profile.apiKey === 'string' && profile.apiKey.length > 0 ? profile.apiKey : undefined) ??\n      (typeof profile.oauthAccessToken === 'string' && profile.oauthAccessToken.length > 0\n        ? profile.oauthAccessToken\n        : undefined);\n    if (key) {\n      return {\n        apiKey: key,\n        mode: profile.mode,\n        profileId: profile.profileId,\n        source: 'store',\n        meta: profile.meta,\n      };\n    }\n  }\n\n  // 2. cfg.providers.<id>.apiKey\n  const cfgKey = readCfgApiKey(options.cfg, providerId);\n  if (cfgKey) {\n    const azure = readCfgAzureMeta(options.cfg, providerId);\n    return {\n      apiKey: cfgKey,\n      mode: azure ? 'azure-key' : 'api-key',\n      source: 'config',\n      meta: azure,\n    };\n  }\n\n  // 3. env\n  const envKey = options.envReader\n    ? readFromCustomEnv(options.envReader, providerId)\n    : getApiKeyFromEnv(providerId);\n  if (envKey) {\n    return { apiKey: envKey, mode: 'api-key', source: 'env' };\n  }\n\n  return { apiKey: undefined, mode: 'api-key', source: 'none' };\n}\n\nfunction pickProfile(\n  store: { get?(p: string, id?: string): AuthProfile | undefined; getApiKeySync(p: string, id?: string): string | undefined },\n  providerId: string,\n  profileName?: string,\n): AuthProfile | undefined {\n  if (typeof store.get === 'function') {\n    try {\n      return store.get(providerId, profileName);\n    } catch {\n      // fall through to legacy lookup\n    }\n  }\n  // Legacy-only stores that just have getApiKeySync — synthesize a minimal\n  // profile so callers can still branch on `mode === 'api-key'`.\n  let key: string | undefined;\n  try {\n    key = store.getApiKeySync(providerId, profileName);\n  } catch {\n    return undefined;\n  }\n  if (!key) return undefined;\n  return {\n    provider: providerId,\n    profileId: profileName ?? 'default',\n    mode: 'api-key',\n    apiKey: key,\n  };\n}\n\nfunction readCfgApiKey(cfg: ResolveApiKeyOptions['cfg'], providerId: string): string | undefined {\n  const providers = (cfg as unknown as { providers?: Record<string, unknown> } | undefined)?.providers;\n  if (!providers || typeof providers !== 'object') return undefined;\n  const entry = (providers as Record<string, unknown>)[providerId];\n  if (!entry || typeof entry !== 'object') return undefined;\n  const apiKey = (entry as Record<string, unknown>).apiKey;\n  return typeof apiKey === 'string' && apiKey.length > 0 ? apiKey : undefined;\n}\n\nfunction readCfgAzureMeta(\n  cfg: ResolveApiKeyOptions['cfg'],\n  providerId: string,\n): Record<string, unknown> | undefined {\n  const providers = (cfg as unknown as { providers?: Record<string, unknown> } | undefined)?.providers;\n  if (!providers || typeof providers !== 'object') return undefined;\n  const entry = (providers as Record<string, unknown>)[providerId];\n  if (!entry || typeof entry !== 'object') return undefined;\n  const azure = (entry as Record<string, unknown>).azure;\n  return azure && typeof azure === 'object' ? (azure as Record<string, unknown>) : undefined;\n}\n\nfunction readFromCustomEnv(\n  reader: (name: string) => string | undefined,\n  providerId: string,\n): string | undefined {\n  const fallbackName = providerId.toUpperCase().replace(/-/g, '_') + '_API_KEY';\n  const v = reader(fallbackName);\n  return typeof v === 'string' && v.length > 0 ? v : undefined;\n}\n"],"mappings":";;;eAiBkD;AAclD,SAAgB,8BACd,SACwB;CACxB,MAAM,EAAE,eAAe;AACvB,KAAI,CAAC,WACH,QAAO;EAAE,QAAQ,KAAA;EAAW,MAAM;EAAW,QAAQ;EAAQ;CAK/D,MAAM,UAAU,YADF,QAAQ,SAAS,4BAA4B,EACxB,YAAY,QAAQ,YAAY;AACnE,KAAI,SAAS;EACX,MAAM,OACH,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,IAAI,QAAQ,SAAS,KAAA,OACnF,OAAO,QAAQ,qBAAqB,YAAY,QAAQ,iBAAiB,SAAS,IAC/E,QAAQ,mBACR,KAAA;AACN,MAAI,IACF,QAAO;GACL,QAAQ;GACR,MAAM,QAAQ;GACd,WAAW,QAAQ;GACnB,QAAQ;GACR,MAAM,QAAQ;GACf;;CAKL,MAAM,SAAS,cAAc,QAAQ,KAAK,WAAW;AACrD,KAAI,QAAQ;EACV,MAAM,QAAQ,iBAAiB,QAAQ,KAAK,WAAW;AACvD,SAAO;GACL,QAAQ;GACR,MAAM,QAAQ,cAAc;GAC5B,QAAQ;GACR,MAAM;GACP;;CAIH,MAAM,SAAS,QAAQ,YACnB,kBAAkB,QAAQ,WAAW,WAAW,GAChD,iBAAiB,WAAW;AAChC,KAAI,OACF,QAAO;EAAE,QAAQ;EAAQ,MAAM;EAAW,QAAQ;EAAO;AAG3D,QAAO;EAAE,QAAQ,KAAA;EAAW,MAAM;EAAW,QAAQ;EAAQ;;AAG/D,SAAS,YACP,OACA,YACA,aACyB;AACzB,KAAI,OAAO,MAAM,QAAQ,WACvB,KAAI;AACF,SAAO,MAAM,IAAI,YAAY,YAAY;SACnC;CAMV,IAAI;AACJ,KAAI;AACF,QAAM,MAAM,cAAc,YAAY,YAAY;SAC5C;AACN;;AAEF,KAAI,CAAC,IAAK,QAAO,KAAA;AACjB,QAAO;EACL,UAAU;EACV,WAAW,eAAe;EAC1B,MAAM;EACN,QAAQ;EACT;;AAGH,SAAS,cAAc,KAAkC,YAAwC;CAC/F,MAAM,YAAa,KAAwE;AAC3F,KAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO,KAAA;CACxD,MAAM,QAAS,UAAsC;AACrD,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,KAAA;CAChD,MAAM,SAAU,MAAkC;AAClD,QAAO,OAAO,WAAW,YAAY,OAAO,SAAS,IAAI,SAAS,KAAA;;AAGpE,SAAS,iBACP,KACA,YACqC;CACrC,MAAM,YAAa,KAAwE;AAC3F,KAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO,KAAA;CACxD,MAAM,QAAS,UAAsC;AACrD,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,KAAA;CAChD,MAAM,QAAS,MAAkC;AACjD,QAAO,SAAS,OAAO,UAAU,WAAY,QAAoC,KAAA;;AAGnF,SAAS,kBACP,QACA,YACoB;CAEpB,MAAM,IAAI,OADW,WAAW,aAAa,CAAC,QAAQ,MAAM,IAAI,GAAG,WACrC;AAC9B,QAAO,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI,IAAI,KAAA"}
+{"version":3,"file":"resolve-auth.js","names":[],"sources":["../../../../src/providers/auth-runtime/resolve-auth.ts"],"sourcesContent":["/**\n * Higher-level auth resolution that returns the *full* profile context, not\n * just the API key. Vendors that support multiple auth modes (e.g. OpenAI\n * api-key + Codex OAuth + Azure api-key) call this to pick the right\n * branch.\n *\n * Resolution order matches `resolveApiKeyForProvider`:\n *   1. AuthProfileStore (per-agent profile — may be OAuth)\n *   2. cfg.providers.<id>.apiKey\n *   3. PROVIDER_ENV_MAP[providerId] env vars\n *\n * Returns:\n *   - `mode: 'oauth' | 'azure-key' | 'api-key'`\n *   - `apiKey` (or OAuth access token) if found\n *   - `profileId` when the credential came from the store\n */\n\nimport { getApiKeyFromEnv } from '../env-keys.js';\nimport { getDefaultAuthProfileStore } from './auth-profile-store.js';\nimport type { AuthProfile, AuthProfileStore, ProviderAuthMode, ResolveApiKeyOptions } from './types.js';\n\nexport interface ProviderAuthResolution {\n  apiKey?: string;\n  mode: ProviderAuthMode;\n  profileId?: string;\n  /** Source bucket: 'store' | 'config' | 'env' | 'none'. */\n  source: 'store' | 'config' | 'env' | 'none';\n  /** Vendor metadata copied from the matched profile (azure resource etc.). */\n  meta?: Record<string, unknown>;\n}\n\nexport function resolveAuthProfileForProvider(\n  options: ResolveApiKeyOptions,\n): ProviderAuthResolution {\n  const { providerId } = options;\n  if (!providerId) {\n    return { apiKey: undefined, mode: 'api-key', source: 'none' };\n  }\n\n  // 1. Profile store\n  const store = options.store ?? getDefaultAuthProfileStore();\n  const profile = pickProfile(store, providerId, options.profileName);\n  if (profile) {\n    const key =\n      (typeof profile.apiKey === 'string' && profile.apiKey.length > 0 ? profile.apiKey : undefined) ??\n      (typeof profile.oauthAccessToken === 'string' && profile.oauthAccessToken.length > 0\n        ? profile.oauthAccessToken\n        : undefined);\n    if (key) {\n      return {\n        apiKey: key,\n        mode: profile.mode,\n        profileId: profile.profileId,\n        source: 'store',\n        meta: profile.meta,\n      };\n    }\n  }\n\n  // 2. cfg.providers.<id>.apiKey\n  const cfgKey = readCfgApiKey(options.cfg, providerId);\n  if (cfgKey) {\n    const azure = readCfgAzureMeta(options.cfg, providerId);\n    return {\n      apiKey: cfgKey,\n      mode: azure ? 'azure-key' : 'api-key',\n      source: 'config',\n      meta: azure,\n    };\n  }\n\n  // 3. env\n  const envKey = options.envReader\n    ? readFromCustomEnv(options.envReader, providerId)\n    : getApiKeyFromEnv(providerId);\n  if (envKey) {\n    return { apiKey: envKey, mode: 'api-key', source: 'env' };\n  }\n\n  return { apiKey: undefined, mode: 'api-key', source: 'none' };\n}\n\nfunction pickProfile(\n  store: AuthProfileStore,\n  providerId: string,\n  profileName?: string,\n): AuthProfile | undefined {\n  try {\n    return store.get(providerId, profileName);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readCfgApiKey(cfg: ResolveApiKeyOptions['cfg'], providerId: string): string | undefined {\n  const providers = (cfg as unknown as { providers?: Record<string, unknown> } | undefined)?.providers;\n  if (!providers || typeof providers !== 'object') return undefined;\n  const entry = (providers as Record<string, unknown>)[providerId];\n  if (!entry || typeof entry !== 'object') return undefined;\n  const apiKey = (entry as Record<string, unknown>).apiKey;\n  return typeof apiKey === 'string' && apiKey.length > 0 ? apiKey : undefined;\n}\n\nfunction readCfgAzureMeta(\n  cfg: ResolveApiKeyOptions['cfg'],\n  providerId: string,\n): Record<string, unknown> | undefined {\n  const providers = (cfg as unknown as { providers?: Record<string, unknown> } | undefined)?.providers;\n  if (!providers || typeof providers !== 'object') return undefined;\n  const entry = (providers as Record<string, unknown>)[providerId];\n  if (!entry || typeof entry !== 'object') return undefined;\n  const azure = (entry as Record<string, unknown>).azure;\n  return azure && typeof azure === 'object' ? (azure as Record<string, unknown>) : undefined;\n}\n\nfunction readFromCustomEnv(\n  reader: (name: string) => string | undefined,\n  providerId: string,\n): string | undefined {\n  const fallbackName = providerId.toUpperCase().replace(/-/g, '_') + '_API_KEY';\n  const v = reader(fallbackName);\n  return typeof v === 'string' && v.length > 0 ? v : undefined;\n}\n"],"mappings":";;;eAiBkD;AAclD,SAAgB,8BACd,SACwB;CACxB,MAAM,EAAE,eAAe;AACvB,KAAI,CAAC,WACH,QAAO;EAAE,QAAQ,KAAA;EAAW,MAAM;EAAW,QAAQ;EAAQ;CAK/D,MAAM,UAAU,YADF,QAAQ,SAAS,4BAA4B,EACxB,YAAY,QAAQ,YAAY;AACnE,KAAI,SAAS;EACX,MAAM,OACH,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,IAAI,QAAQ,SAAS,KAAA,OACnF,OAAO,QAAQ,qBAAqB,YAAY,QAAQ,iBAAiB,SAAS,IAC/E,QAAQ,mBACR,KAAA;AACN,MAAI,IACF,QAAO;GACL,QAAQ;GACR,MAAM,QAAQ;GACd,WAAW,QAAQ;GACnB,QAAQ;GACR,MAAM,QAAQ;GACf;;CAKL,MAAM,SAAS,cAAc,QAAQ,KAAK,WAAW;AACrD,KAAI,QAAQ;EACV,MAAM,QAAQ,iBAAiB,QAAQ,KAAK,WAAW;AACvD,SAAO;GACL,QAAQ;GACR,MAAM,QAAQ,cAAc;GAC5B,QAAQ;GACR,MAAM;GACP;;CAIH,MAAM,SAAS,QAAQ,YACnB,kBAAkB,QAAQ,WAAW,WAAW,GAChD,iBAAiB,WAAW;AAChC,KAAI,OACF,QAAO;EAAE,QAAQ;EAAQ,MAAM;EAAW,QAAQ;EAAO;AAG3D,QAAO;EAAE,QAAQ,KAAA;EAAW,MAAM;EAAW,QAAQ;EAAQ;;AAG/D,SAAS,YACP,OACA,YACA,aACyB;AACzB,KAAI;AACF,SAAO,MAAM,IAAI,YAAY,YAAY;SACnC;AACN;;;AAIJ,SAAS,cAAc,KAAkC,YAAwC;CAC/F,MAAM,YAAa,KAAwE;AAC3F,KAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO,KAAA;CACxD,MAAM,QAAS,UAAsC;AACrD,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,KAAA;CAChD,MAAM,SAAU,MAAkC;AAClD,QAAO,OAAO,WAAW,YAAY,OAAO,SAAS,IAAI,SAAS,KAAA;;AAGpE,SAAS,iBACP,KACA,YACqC;CACrC,MAAM,YAAa,KAAwE;AAC3F,KAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO,KAAA;CACxD,MAAM,QAAS,UAAsC;AACrD,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,KAAA;CAChD,MAAM,QAAS,MAAkC;AACjD,QAAO,SAAS,OAAO,UAAU,WAAY,QAAoC,KAAA;;AAGnF,SAAS,kBACP,QACA,YACoB;CAEpB,MAAM,IAAI,OADW,WAAW,aAAa,CAAC,QAAQ,MAAM,IAAI,GAAG,WACrC;AAC9B,QAAO,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI,IAAI,KAAA"}

package/dist/src/providers/auth-runtime/types.d.ts

@@ -3,11 +3,6 @@
  * (image / audio / video). Decoupled from the LLM-side
  * `src/auth/credentials.ts` so capability providers do not need to
  * `await` for every isConfigured() call.
- *
- * Step 4 expands {@link AuthProfileStore} from a simple key lookup into a
- * full per-agent profile store that can hold OAuth tokens and refresh them
- * on demand, while keeping every existing sync caller working (legacy
- * methods remain on the interface).
  */
 import type { Config } from '../../config/schema.js';
 export interface ResolveApiKeyOptions {
@@ -58,20 +53,19 @@ export interface AuthProfile {
  *
  * Sync members ({@link getApiKeySync}, {@link hasCredentialSync}) keep
  * `resolveApiKeyForProvider` synchronous so capability providers and tool
- * default-model resolution stay non-blocking. Async members
- * ({@link list}, {@link get}, {@link save}, {@link refresh}) are used by
- * vendor-specific code (Codex / Anthropic OAuth) and the gateway settings
- * UI.
+ * default-model resolution stay non-blocking. {@link get} / {@link list} are
+ * required so OAuth-aware callers can branch on `mode` without falling back
+ * to the sync getters.
  */
 export interface AuthProfileStore {
     /** Synchronous lookup; returns undefined when no profile is loaded. */
     getApiKeySync(providerId: string, profile?: string): string | undefined;
     /** Synchronous "do we have any usable credential" check. */
     hasCredentialSync(providerId: string, profile?: string): boolean;
-    /** All profiles for a provider (Step 4 stores can return multiple). */
-    list?(providerId: string): AuthProfile[];
+    /** All profiles for a provider. */
+    list(providerId: string): AuthProfile[];
     /** Single profile; defaults to `default: true` then "default" id. */
-    get?(providerId: string, profileId?: string): AuthProfile | undefined;
+    get(providerId: string, profileId?: string): AuthProfile | undefined;
     /** Persist a profile; replaces any existing record with the same id. */
     save?(profile: AuthProfile): Promise<void>;
     /** Refresh OAuth access token; idempotent if still fresh. */

package/dist/src/providers/index.js

@@ -1,8 +1,8 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
-import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
-import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
 import { CredentialResolver, hasCredentials, init_credentials, resolveApiKey } from "../auth/credentials.js";
+import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
+import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";
 import { getModel, getModels, getProviders } from "@earendil-works/pi-ai";
 //#region src/providers/index.ts

package/dist/src/providers/model-registry.js

@@ -1,10 +1,10 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { resolveModelsJsonPath } from "../config/paths.js";
 import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { getDefaultModelValues, init_models_json, validateModelsConfig } from "../config/models-json.js";
-import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { existsSync, readFileSync } from "fs";
 import { getModels, getProviders } from "@earendil-works/pi-ai";
 //#region src/providers/model-registry.ts