@yhong91/cpac 0.1.25 → 0.1.26

package/dist/cpac.js

@@ -1,1396 +1,20 @@
 #!/usr/bin/env node
-import { chmodSync, closeSync, copyFileSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { spawn, spawnSync } from "node:child_process";
-import { createHash, randomBytes } from "node:crypto";
-import { createServer, request as httpRequest, } from "node:http";
-import { request as httpsRequest } from "node:https";
-import { homedir, tmpdir } from "node:os";
-import { dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { createInterface } from "node:readline/promises";
-import { Writable } from "node:stream";
-export const PROVIDER = "cpac_cpa";
-const DEFAULT_CPA_URL = "http://124.223.178.52:8317";
-const DEFAULT_CODEX_PROXY_PORT = 10101;
-const MAX_CATALOG_BYTES = 16 * 1024 * 1024;
-const CONFIG_KEYS = new Set([
-    "cpa_url",
-    "api_key_env",
-    "codex_config",
-    "codex_proxy_port",
-    "state_dir",
-    "claude_models",
-    "spawn_models",
-]);
-// Codex advertises only the first 5 picker-visible catalog models as
-// spawn_agent overrides (codex-rs MAX_SPAWN_AGENT_MODEL_OVERRIDES).
-const MAX_SPAWN_MODELS = 5;
-const CLAUDE_SLOT_KEYS = ["opus", "sonnet", "haiku"];
-const REQUIRED_STATE_KEYS = new Set([
-    "config_path",
-    "config_existed",
-    "config_mode",
-]);
-const STATE_KEYS = new Set([
-    ...REQUIRED_STATE_KEYS,
-    "proxy_id",
-    "proxy_fingerprint",
-    "proxy_pid",
-    "proxy_port",
-]);
-const STATE_FILES = ["state.json", "config.toml.backup", "codex-models.json"];
-const MODEL_PROVIDER_KEY = /^\s*(?:model_provider|"model_provider"|'model_provider')\s*=/;
-const MODEL_CATALOG_KEY = /^\s*(?:model_catalog_json|"model_catalog_json"|'model_catalog_json')\s*=/;
-const OPENAI_BASE_URL_KEY = /^\s*(?:openai_base_url|"openai_base_url"|'openai_base_url')\s*=/;
-const ROOT_KEY = new RegExp(`(?:${MODEL_PROVIDER_KEY.source}|${MODEL_CATALOG_KEY.source}|${OPENAI_BASE_URL_KEY.source})`);
-const MANAGED_MARKER = "# CPAC managed; run CPAC 'restore' to restore the original file.";
-let atomicSequence = 0;
-export class CPACError extends Error {
-}
-function objectValue(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function expandUserPath(value) {
-    if (value === "~")
-        return homedir();
-    if (value.startsWith("~/") || value.startsWith("~\\"))
-        return join(homedir(), value.slice(2));
-    return value;
-}
-export function defaultConfigPath() {
-    return resolve(expandUserPath(process.env.CPAC_CONFIG || "~/.config/cpac/config.json"));
-}
-function normalizeCpaUrl(value) {
-    if (typeof value !== "string" || !value.trim()) {
-        throw new CPACError("cpa_url must be a non-empty string");
-    }
-    let parsed;
-    try {
-        parsed = new URL(value);
-    }
-    catch {
-        throw new CPACError("cpa_url must be an absolute http(s) URL");
-    }
-    if (!["http:", "https:"].includes(parsed.protocol) ||
-        !parsed.hostname ||
-        parsed.username ||
-        parsed.password ||
-        parsed.search ||
-        parsed.hash) {
-        throw new CPACError("cpa_url must be an absolute http(s) URL without credentials, query, or fragment");
-    }
-    return value.trim().replace(/\/+$/, "");
-}
-export function loadConfig(path, useDefaultsIfMissing = false) {
-    let value;
-    try {
-        value = JSON.parse(readFileSync(path, "utf8"));
-    }
-    catch (error) {
-        if (error.code === "ENOENT" &&
-            useDefaultsIfMissing) {
-            value = {};
-        }
-        else if (error.code === "ENOENT") {
-            throw new CPACError(`config not found: ${path}`);
-        }
-        else {
-            throw new CPACError(`cannot read config: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    if (!objectValue(value))
-        throw new CPACError("config must be a JSON object");
-    const unknown = Object.keys(value)
-        .filter((key) => !CONFIG_KEYS.has(key))
-        .sort();
-    if (unknown.length)
-        throw new CPACError(`unknown config keys: ${unknown.join(", ")}`);
-    const cpaUrl = normalizeCpaUrl(value.cpa_url ?? process.env.CPA_BASE_URL?.trim() ?? DEFAULT_CPA_URL);
-    const apiKeyEnv = value.api_key_env ?? "CPA_API_KEY";
-    if (typeof apiKeyEnv !== "string" ||
-        !/^[A-Za-z_][A-Za-z0-9_]*$/.test(apiKeyEnv)) {
-        throw new CPACError("api_key_env must be an environment variable name");
-    }
-    if (value.codex_config !== undefined &&
-        (typeof value.codex_config !== "string" || !value.codex_config.trim())) {
-        throw new CPACError("codex_config must be a non-empty string");
-    }
-    if (value.state_dir !== undefined &&
-        (typeof value.state_dir !== "string" || !value.state_dir.trim())) {
-        throw new CPACError("state_dir must be a non-empty string");
-    }
-    const codexProxyPort = value.codex_proxy_port ?? DEFAULT_CODEX_PROXY_PORT;
-    if (!Number.isInteger(codexProxyPort) ||
-        codexProxyPort < 0 ||
-        codexProxyPort > 65535) {
-        throw new CPACError("codex_proxy_port must be an integer from 0 to 65535");
-    }
-    const claudeModelsRaw = value.claude_models;
-    let claudeModels;
-    if (claudeModelsRaw !== undefined) {
-        if (!objectValue(claudeModelsRaw))
-            throw new CPACError("claude_models must be an object");
-        const unknownSlots = Object.keys(claudeModelsRaw)
-            // "classifier" was a shipped slot; its env var turned out unread by
-            // Claude Code, so the key is dropped on load instead of erroring.
-            .filter((key) => key !== "classifier" && !CLAUDE_SLOT_KEYS.includes(key))
-            .sort();
-        if (unknownSlots.length)
-            throw new CPACError(`unknown claude_models slots: ${unknownSlots.join(", ")}`);
-        claudeModels = {};
-        for (const slot of CLAUDE_SLOT_KEYS) {
-            const model = claudeModelsRaw[slot];
-            if (model === undefined)
-                continue;
-            if (typeof model !== "string" || !model.trim())
-                throw new CPACError(`claude_models.${slot} must be a non-empty string`);
-            claudeModels[slot] = model.trim();
-        }
-    }
-    const spawnModelsRaw = value.spawn_models;
-    let spawnModels;
-    if (spawnModelsRaw !== undefined) {
-        if (!Array.isArray(spawnModelsRaw))
-            throw new CPACError("spawn_models must be an array of model slugs");
-        if (spawnModelsRaw.length > MAX_SPAWN_MODELS)
-            throw new CPACError(`spawn_models accepts at most ${MAX_SPAWN_MODELS} models`);
-        spawnModels = spawnModelsRaw.map((model, index) => {
-            if (typeof model !== "string" || !model.trim())
-                throw new CPACError(`spawn_models[${index}] must be a non-empty string`);
-            return model.trim();
-        });
-    }
-    const codexHome = expandUserPath(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"));
-    const codexConfig = resolve(expandUserPath(value.codex_config || join(codexHome, "config.toml")));
-    const stateDir = resolve(expandUserPath(value.state_dir || join(homedir(), ".cpac")));
-    const stateToConfig = relative(stateDir, codexConfig);
-    if ([parse(stateDir).root, resolve(homedir()), resolve(tmpdir())].includes(stateDir) ||
-        stateToConfig === "" ||
-        (!stateToConfig.startsWith("..") && !isAbsolute(stateToConfig))) {
-        throw new CPACError("state_dir must not be a filesystem root, home/temp directory, or contain codex_config");
-    }
-    return {
-        cpa_url: cpaUrl,
-        api_key_env: apiKeyEnv,
-        codex_config: codexConfig,
-        codex_proxy_port: codexProxyPort,
-        state_dir: stateDir,
-        claude_models: claudeModels,
-        spawn_models: spawnModels,
-    };
-}
-export function apiBase(cpaUrl) {
-    try {
-        const url = new URL(cpaUrl);
-        return url.pathname.replace(/\/+$/, "").endsWith("/v1")
-            ? cpaUrl
-            : `${cpaUrl}/v1`;
-    }
-    catch {
-        throw new CPACError("cpa_url must be an absolute http(s) URL");
-    }
-}
-export async function fetchCatalog(cpaUrl, apiKey) {
-    let response;
-    try {
-        response = await fetch(`${apiBase(cpaUrl)}/models?client_version=1`, {
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                Accept: "application/json",
-            },
-            signal: AbortSignal.timeout(20_000),
-        });
-    }
-    catch {
-        throw new CPACError("CPA catalog request failed");
-    }
-    if (!response.ok)
-        throw new CPACError(`CPA catalog request failed: HTTP ${response.status}`);
-    const declaredLength = response.headers.get("content-length");
-    if (declaredLength &&
-        /^\d+$/.test(declaredLength) &&
-        Number(declaredLength) > MAX_CATALOG_BYTES) {
-        await response.body?.cancel();
-        throw new CPACError("CPA catalog exceeds 16 MiB");
-    }
-    const chunks = [];
-    let length = 0;
-    const reader = response.body?.getReader();
-    if (reader) {
-        while (true) {
-            let result;
-            try {
-                result = await reader.read();
-            }
-            catch {
-                throw new CPACError("CPA catalog request failed");
-            }
-            if (result.done)
-                break;
-            length += result.value.byteLength;
-            if (length > MAX_CATALOG_BYTES) {
-                await reader.cancel();
-                throw new CPACError("CPA catalog exceeds 16 MiB");
-            }
-            chunks.push(result.value);
-        }
-    }
-    const body = Buffer.concat(chunks, length);
-    let document;
-    try {
-        document = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body));
-    }
-    catch {
-        throw new CPACError("CPA catalog is not valid JSON");
-    }
-    const models = objectValue(document) ? document.models : undefined;
-    if (!Array.isArray(models) || models.length === 0) {
-        throw new CPACError("CPA rich catalog must contain a non-empty models array");
-    }
-    if (models.some((model) => !objectValue(model) || typeof model.slug !== "string" || !model.slug.trim())) {
-        throw new CPACError("CPA catalog contains a model without a slug");
-    }
-    return {
-        bytes: Buffer.from(`${JSON.stringify(document, null, 2)}\n`),
-        modelCount: models.length,
-    };
-}
-// Codex treats a catalog model's context_window as its input budget, not a
-// display label; upstream keeps it a conservative operating cap while
-// max_context_window holds the real ceiling (gpt-5.6: 272k vs ~921k, measured
-// by opencodex). Opt-in lift: raise context_window to max_context_window and
-// set auto_compact_token_limit at 90% (Codex's own convention), keeping
-// compaction ahead of the hard ceiling.
-export function liftContextWindows(bytes) {
-    let document;
-    try {
-        document = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-    }
-    catch {
-        throw new CPACError("invalid CPA catalog");
-    }
-    for (const model of document.models) {
-        const maxWindow = typeof model.max_context_window === "number" && model.max_context_window > 0
-            ? Math.floor(model.max_context_window)
-            : 0;
-        const window = typeof model.context_window === "number"
-            ? Math.floor(model.context_window)
-            : 0;
-        if (maxWindow <= window)
-            continue;
-        model.context_window = maxWindow;
-        model.auto_compact_token_limit = Math.floor(maxWindow * 0.9);
-    }
-    return Buffer.from(`${JSON.stringify(document, null, 2)}\n`);
-}
-// Move `order` slugs to the front of the rich catalog (stable for the rest),
-// so the Codex client's first-5 spawn_agent advertisement picks them.
-export function reorderCatalog(bytes, order) {
-    let document;
-    try {
-        document = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-    }
-    catch {
-        throw new CPACError("invalid CPA catalog");
-    }
-    const rank = new Map(order.map((slug, index) => [slug, index]));
-    const models = document.models.map((model, index) => ({ model, index }));
-    models.sort((left, right) => {
-        const leftRank = rank.get(String(left.model.slug));
-        const rightRank = rank.get(String(right.model.slug));
-        if (leftRank === undefined && rightRank === undefined)
-            return left.index - right.index;
-        if (leftRank === undefined)
-            return 1;
-        if (rightRank === undefined)
-            return -1;
-        return leftRank - rightRank;
-    });
-    document.models = models.map((entry) => entry.model);
-    return Buffer.from(`${JSON.stringify(document, null, 2)}\n`);
-}
-export function saveSpawnModels(configPath, models) {
-    let document = {};
-    if (existsSync(configPath)) {
-        let parsed;
-        try {
-            parsed = JSON.parse(readFileSync(configPath, "utf8"));
-        }
-        catch {
-            throw new CPACError("config must be a valid JSON object");
-        }
-        if (!objectValue(parsed))
-            throw new CPACError("config must be a JSON object");
-        document = parsed;
-    }
-    document.spawn_models = models;
-    atomicWrite(configPath, Buffer.from(`${JSON.stringify(document, null, 2)}\n`));
-}
-// Arrow-key checkbox picker on raw stdin; resolves with the checked labels in
-// check order (which becomes the spawn advertisement ranking).
-async function checkboxPicker(title, items, max) {
-    if (!process.stdin.isTTY || !process.stderr.isTTY) {
-        throw new CPACError("model selection requires an interactive terminal");
-    }
-    const stdin = process.stdin;
-    const out = process.stderr;
-    const selected = new Set();
-    let cursor = 0;
-    const lines = items.length + 1;
-    const render = () => {
-        out.write(`${title} [space: toggle, up/down: move, enter: confirm, q: cancel, max ${max}]\n`);
-        items.forEach((item, index) => {
-            const box = selected.has(index) ? "[x]" : "[ ]";
-            out.write(`${index === cursor ? ">" : " "} ${box} ${item}\n`);
-        });
-    };
-    const redraw = () => {
-        out.write(`\x1b[${lines}F`);
-        for (let line = 0; line < lines; line += 1)
-            out.write("\x1b[2K\x1b[1E");
-        out.write(`\x1b[${lines}F`);
-        render();
-    };
-    return await new Promise((resolvePromise, rejectPromise) => {
-        const finish = (error) => {
-            stdin.removeListener("data", onData);
-            try {
-                stdin.setRawMode(false);
-            }
-            catch {
-                // Terminal already gone; nothing to restore.
-            }
-            stdin.pause();
-            out.write("\n");
-            if (error)
-                rejectPromise(error);
-            else
-                resolvePromise([...selected].map((index) => items[index]));
-        };
-        const onData = (chunk) => {
-            const key = chunk.toString("utf8");
-            if (key === "\x03" || key === "q" || key === "\x1b") {
-                finish(new CPACError("model selection cancelled"));
-                return;
-            }
-            if (key === "\r" || key === "\n") {
-                if (max === 1 && selected.size === 0) {
-                    selected.add(cursor);
-                }
-                finish();
-                return;
-            }
-            if (key === "\x1b[A")
-                cursor = (cursor + items.length - 1) % items.length;
-            else if (key === "\x1b[B")
-                cursor = (cursor + 1) % items.length;
-            else if (key === " ") {
-                if (max === 1) {
-                    selected.clear();
-                    selected.add(cursor);
-                    finish();
-                    return;
-                }
-                if (selected.has(cursor))
-                    selected.delete(cursor);
-                else if (selected.size < max)
-                    selected.add(cursor);
-            }
-            redraw();
-        };
-        stdin.setRawMode(true);
-        stdin.resume();
-        stdin.on("data", onData);
-        render();
-    });
-}
-export async function pickSpawnModels(config) {
-    const apiKey = process.env[config.api_key_env]?.trim();
-    if (!apiKey)
-        throw new CPACError(`environment variable ${config.api_key_env} is not set`);
-    const catalog = await fetchCatalog(config.cpa_url, apiKey);
-    let document;
-    try {
-        document = JSON.parse(new TextDecoder().decode(catalog.bytes));
-    }
-    catch {
-        throw new CPACError("invalid CPA catalog");
-    }
-    const slugs = document.models.map((model) => model.slug);
-    const picked = await checkboxPicker("Select spawn_agent models", slugs, MAX_SPAWN_MODELS);
-    if (picked.length === 0)
-        throw new CPACError("no models selected");
-    return picked;
-}
-export function tomlString(value) {
-    return JSON.stringify(value);
-}
-function tomlStringArray(values) {
-    return `[ ${values.map(tomlString).join(", ")} ]`;
-}
-export function dominantEol(content) {
-    const crlf = (content.match(/\r\n/g) ?? []).length;
-    if (crlf === 0)
-        return "\n";
-    const bareLf = (content.match(/\n/g) ?? []).length - crlf;
-    return crlf >= bareLf ? "\r\n" : "\n";
-}
-function providerPatterns(provider = PROVIDER) {
-    const escaped = provider.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const modelProviders = `(?:model_providers|"model_providers"|'model_providers')`;
-    const providerToken = `(?:${escaped}|"${escaped}"|'${escaped}')`;
-    return {
-        header: new RegExp(`^\\s*\\[\\s*${modelProviders}\\s*\\.\\s*${providerToken}\\s*\\]\\s*(?:#.*)?$`),
-        arrayHeader: new RegExp(`^\\s*\\[\\[\\s*${modelProviders}\\s*\\.\\s*${providerToken}\\s*\\]\\]\\s*(?:#.*)?$`),
-        parentHeader: new RegExp(`^\\s*\\[\\s*${modelProviders}\\s*\\]\\s*(?:#.*)?$`),
-        inlineKey: new RegExp(`^\\s*${providerToken}\\s*=`),
-        dottedKey: new RegExp(`^\\s*${modelProviders}\\s*\\.\\s*${providerToken}\\s*=`),
-    };
-}
-function providerHeader(provider = PROVIDER) {
-    return providerPatterns(provider).header;
-}
-export function hasProviderTable(content, provider = PROVIDER) {
-    const patterns = providerPatterns(provider);
-    let inRoot = true;
-    let inModelProviders = false;
-    for (const line of content.split(/\r?\n/)) {
-        if (patterns.header.test(line) || patterns.arrayHeader.test(line))
-            return true;
-        if (/^\s*\[/.test(line)) {
-            inRoot = false;
-            inModelProviders = patterns.parentHeader.test(line);
-            continue;
-        }
-        if ((inModelProviders && patterns.inlineKey.test(line)) ||
-            (inRoot && patterns.dottedKey.test(line)))
-            return true;
-    }
-    return false;
-}
-function stripManagedConfig(content) {
-    let text;
-    try {
-        text = new TextDecoder("utf-8", { fatal: true }).decode(content);
-    }
-    catch {
-        throw new CPACError("Codex config must be UTF-8");
-    }
-    const eol = dominantEol(text);
-    const header = providerHeader();
-    const lines = text.replace(/\r\n/g, "\n").split("\n");
-    let inRoot = true;
-    let inProvider = false;
-    let managedRootKeys = 0;
-    const kept = [];
-    for (const line of lines) {
-        if (inProvider && /^\s*\[/.test(line))
-            inProvider = false;
-        if (!inProvider && header.test(line)) {
-            inProvider = true;
-            continue;
-        }
-        if (inProvider)
-            continue;
-        if (/^\s*\[/.test(line))
-            inRoot = false;
-        if (inRoot && line === MANAGED_MARKER) {
-            managedRootKeys = 2;
-            continue;
-        }
-        if (inRoot && managedRootKeys > 0 && ROOT_KEY.test(line)) {
-            managedRootKeys -= 1;
-            continue;
-        }
-        kept.push(line);
-    }
-    const output = kept.join("\n");
-    return Buffer.from(eol === "\n" ? output : output.replace(/\n/g, "\r\n"));
-}
-export function buildCodexConfig(original, proxyPort, catalogPath) {
-    let text;
-    try {
-        text = new TextDecoder("utf-8", { fatal: true }).decode(original);
-    }
-    catch {
-        throw new CPACError("Codex config must be UTF-8");
-    }
-    if (hasProviderTable(text)) {
-        throw new CPACError(`Codex config already contains [model_providers.${PROVIDER}]`);
-    }
-    const normalizedLines = text.replace(/\r\n/g, "\n").split("\n");
-    const firstTable = normalizedLines.findIndex((line) => /^\s*\[/.test(line));
-    const rootLines = normalizedLines.slice(0, firstTable === -1 ? undefined : firstTable);
-    const providerLine = rootLines.find((line) => MODEL_PROVIDER_KEY.test(line));
-    if (providerLine) {
-        const match = /=\s*["']([^"']+)["']/.exec(providerLine);
-        if (!match || match[1] !== "openai") {
-            throw new CPACError("Codex config selects an external model_provider; restore it to openai before injecting CPAC");
-        }
-    }
-    if (rootLines.some((line) => OPENAI_BASE_URL_KEY.test(line))) {
-        throw new CPACError("Codex config already contains openai_base_url; remove that user-owned override before injecting CPAC");
-    }
-    const eol = dominantEol(text);
-    const lines = text.replace(/\r\n/g, "\n").split("\n");
-    let inRoot = true;
-    const kept = lines.filter((line) => {
-        if (/^\s*\[/.test(line))
-            inRoot = false;
-        return !(inRoot && MODEL_CATALOG_KEY.test(line));
-    });
-    let body = kept.join("\n");
-    if (body && !body.endsWith("\n"))
-        body += "\n";
-    const root = [
-        MANAGED_MARKER,
-        `model_catalog_json = ${tomlString(catalogPath)}`,
-        `openai_base_url = ${tomlString(`http://127.0.0.1:${proxyPort}/v1`)}`,
-        "",
-    ].join("\n");
-    const output = root + body;
-    return Buffer.from(eol === "\n" ? output : output.replace(/\n/g, "\r\n"));
-}
-// Codex multi-agent v2 (features.multi_agent_v2). Accepts the same TOML
-// shapes codex-rs does: a [features.multi_agent_v2] table, an inline
-// `multi_agent_v2 = ...` under [features], or dotted root keys.
-const V2_TABLE_HEADER = /^\s*\[\s*(?:features|"features"|'features')\s*\.\s*(?:multi_agent_v2|"multi_agent_v2"|'multi_agent_v2')\s*\]\s*(?:#.*)?$/;
-const FEATURES_TABLE_HEADER = /^\s*\[\s*(?:features|"features"|'features')\s*\]\s*(?:#.*)?$/;
-const V2_KEY = /^\s*(?:multi_agent_v2|"multi_agent_v2"|'multi_agent_v2')\s*=/;
-const V2_DOTTED_KEY = /^\s*(?:features|"features"|'features')\s*\.\s*(?:multi_agent_v2|"multi_agent_v2"|'multi_agent_v2')(?:\s*\.\s*(?:enabled|"enabled"|'enabled'))?\s*=/;
-function v2LineValue(line) {
-    const inline = line.match(/\{[^}]*\benabled\s*=\s*(true|false)/);
-    if (inline)
-        return inline[1] === "true";
-    const plain = line.match(/=\s*(true|false)(?![A-Za-z0-9_])/);
-    if (plain)
-        return plain[1] === "true";
-    return undefined;
-}
-export function multiAgentV2Enabled(content) {
-    let table = "root";
-    for (const line of content.replace(/\r\n/g, "\n").split("\n")) {
-        if (V2_TABLE_HEADER.test(line)) {
-            table = "v2";
-            continue;
-        }
-        if (FEATURES_TABLE_HEADER.test(line)) {
-            table = "features";
-            continue;
-        }
-        if (/^\s*\[/.test(line)) {
-            table = "other";
-            continue;
-        }
-        if (table === "v2" && /^\s*(?:enabled|"enabled"|'enabled')\s*=/.test(line)) {
-            return v2LineValue(line) ?? false;
-        }
-        if (table === "features" && V2_KEY.test(line))
-            return v2LineValue(line) ?? false;
-        if (table === "root" && V2_DOTTED_KEY.test(line))
-            return v2LineValue(line) ?? false;
-    }
-    return false;
-}
-function stripMultiAgentV2(content) {
-    const lines = content.replace(/\r\n/g, "\n").split("\n");
-    const kept = [];
-    let skipTable = false;
-    let table = "root";
-    for (const line of lines) {
-        if (/^\s*\[/.test(line)) {
-            skipTable = V2_TABLE_HEADER.test(line);
-            if (skipTable) {
-                table = "other";
-                continue;
-            }
-            table = FEATURES_TABLE_HEADER.test(line) ? "features" : "other";
-        }
-        if (skipTable)
-            continue;
-        if (table === "features" && V2_KEY.test(line))
-            continue;
-        if (table === "root" && V2_DOTTED_KEY.test(line))
-            continue;
-        kept.push(line);
-    }
-    return kept.join("\n");
-}
-function hasAgentsMaxThreads(content) {
-    let table = "root";
-    for (const line of content.replace(/\r\n/g, "\n").split("\n")) {
-        if (/^\s*\[/.test(line)) {
-            table = /^\s*\[\s*(?:agents|"agents"|'agents')\s*\]\s*(?:#.*)?$/.test(line)
-                ? "agents"
-                : "other";
-            continue;
-        }
-        if (table === "agents" && /^\s*max_threads\s*=/.test(line))
-            return true;
-        if (table === "root" &&
-            /^\s*(?:agents|"agents"|'agents')\s*\.\s*max_threads\s*=/.test(line))
-            return true;
-    }
-    return false;
-}
-export function withMultiAgentV2(content, enabled, eol) {
-    let body = stripMultiAgentV2(content);
-    if (body && !body.endsWith("\n"))
-        body += "\n";
-    const output = body + `\n[features.multi_agent_v2]\nenabled = ${enabled}\n`;
-    return eol === "\n" ? output : output.replace(/\n/g, "\r\n");
-}
-export function atomicWrite(path, data, mode = 0o600) {
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const temporary = `${path}.cpac.${process.pid}.${Date.now()}.${++atomicSequence}.tmp`;
-    let descriptor;
-    try {
-        descriptor = openSync(temporary, "wx", 0o600);
-        writeFileSync(descriptor, data);
-        fsyncSync(descriptor);
-        closeSync(descriptor);
-        descriptor = undefined;
-        chmodSync(temporary, mode);
-        renameSync(temporary, path);
-    }
-    catch (error) {
-        if (descriptor !== undefined) {
-            try {
-                closeSync(descriptor);
-            }
-            catch (closeError) {
-                void closeError;
-            }
-        }
-        try {
-            unlinkSync(temporary);
-        }
-        catch (unlinkError) {
-            void unlinkError;
-        }
-        throw error;
-    }
-}
-const HOP_BY_HOP_HEADERS = new Set([
-    "connection",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "proxy-connection",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-]);
-const CLIENT_CREDENTIAL_HEADERS = new Set([
-    "authorization",
-    "chatgpt-account-id",
-    "cookie",
-    "openai-organization",
-    "openai-project",
-    "x-api-key",
-    "x-opencodex-api-key",
-]);
-function localBrowserOrigin(value) {
-    if (!value)
-        return true;
-    try {
-        const hostname = new URL(value).hostname.toLowerCase();
-        return (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1");
-    }
-    catch {
-        return false;
-    }
-}
-function proxyHeaders(headers, apiKey) {
-    const forwarded = {};
-    for (const [name, value] of Object.entries(headers)) {
-        if (value === undefined ||
-            name === "host" ||
-            CLIENT_CREDENTIAL_HEADERS.has(name) ||
-            HOP_BY_HOP_HEADERS.has(name)) {
-            continue;
-        }
-        forwarded[name] = value;
-    }
-    forwarded.authorization = `Bearer ${apiKey}`;
-    return forwarded;
-}
-function responseHeaders(headers) {
-    const forwarded = {};
-    for (const [name, value] of Object.entries(headers)) {
-        if (value === undefined || HOP_BY_HOP_HEADERS.has(name))
-            continue;
-        forwarded[name] = value;
-    }
-    return forwarded;
-}
-function upstreamUrl(cpaUrl, requestUrl) {
-    try {
-        const incoming = new URL(requestUrl, "http://127.0.0.1");
-        const suffix = incoming.pathname === "/v1"
-            ? ""
-            : incoming.pathname.startsWith("/v1/")
-                ? incoming.pathname.slice(3)
-                : incoming.pathname;
-        return new URL(`${apiBase(cpaUrl)}${suffix}${incoming.search}`);
-    }
-    catch {
-        throw new CPACError(`invalid upstream request URL: ${requestUrl}`);
-    }
-}
-export async function createLoopbackProxy(cpaUrl, apiKey, proxyId, port) {
-    const server = createServer((request, response) => {
-        const requestUrl = request.url ?? "/";
-        if (requestUrl === "/_cpac/health") {
-            if (request.headers["x-cpac-proxy-id"] !== proxyId) {
-                response.writeHead(404).end();
-                return;
-            }
-            response.writeHead(204).end();
-            return;
-        }
-        if (requestUrl === "/_cpac/shutdown" && request.method === "POST") {
-            if (request.headers["x-cpac-proxy-id"] !== proxyId) {
-                response.writeHead(404).end();
-                return;
-            }
-            response.writeHead(204).end();
-            setImmediate(() => {
-                server.closeAllConnections?.();
-                server.close();
-            });
-            return;
-        }
-        if (!localBrowserOrigin(request.headers.origin)) {
-            response.writeHead(403, { "content-type": "application/json" });
-            response.end(JSON.stringify({ error: "non-local origin rejected" }));
-            return;
-        }
-        let target;
-        try {
-            target = upstreamUrl(cpaUrl, requestUrl);
-        }
-        catch {
-            response.writeHead(400).end("invalid request URL");
-            return;
-        }
-        const send = target.protocol === "https:" ? httpsRequest : httpRequest;
-        const upstream = send(target, {
-            method: request.method,
-            headers: proxyHeaders(request.headers, apiKey),
-        }, (upstreamResponse) => {
-            response.writeHead(upstreamResponse.statusCode ?? 502, responseHeaders(upstreamResponse.headers));
-            upstreamResponse.pipe(response);
-        });
-        upstream.once("error", () => {
-            if (!response.headersSent) {
-                response.writeHead(502, { "content-type": "application/json" });
-            }
-            if (!response.writableEnded)
-                response.end(JSON.stringify({ error: "CPA upstream request failed" }));
-        });
-        request.once("aborted", () => upstream.destroy());
-        response.once("close", () => {
-            if (!response.writableEnded)
-                upstream.destroy();
-        });
-        request.pipe(upstream);
-    });
-    server.on("upgrade", (_request, socket) => {
-        socket.end("HTTP/1.1 426 Upgrade Required\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
-    });
-    server.on("clientError", (_error, socket) => socket.destroy());
-    await new Promise((resolveListen, rejectListen) => {
-        server.once("error", rejectListen);
-        server.listen(port, "127.0.0.1", () => {
-            server.off("error", rejectListen);
-            resolveListen();
-        });
-    });
-    const address = server.address();
-    if (!address || typeof address === "string") {
-        server.close();
-        throw new CPACError("cannot determine loopback proxy port");
-    }
-    return { server, port: address.port };
-}
-const CLAUDE_ALIAS_PREFIX = "claude-cpac--";
-// Claude Code accepts CLAUDE_CODE_AUTO_COMPACT_WINDOW in 100K–1M (binary-verified).
-// A single global window cannot be per-model; 350K is opencodex's user-approved
-// default — high enough to mark mid-size models (372K/500K), low enough that
-// marking never outgrows a model's real window.
-const ONE_MILLION = 1_000_000;
-const COMPACT_WINDOW_DEFAULT = 350_000;
-function claudeCompactWindow(maxContext) {
-    return maxContext > 200_000 ? COMPACT_WINDOW_DEFAULT : undefined;
-}
-// [1m] marking predicate (opencodex rule): native claude models manage their own
-// marker; aliases mark when the real window is >= 1M, or when it clears 200K and
-// can host the compact window (marking below it would trip API limits mid-session).
-function shouldMarkOneMillion(id, window, compactWindow) {
-    if (id.startsWith("claude"))
-        return false;
-    if (window >= ONE_MILLION)
-        return true;
-    return (compactWindow !== undefined && window > 200_000 && window >= compactWindow);
-}
-// Auto tier defaults. Within the claude-family pool (whole catalog when no
-// claude model exists), opus matches its family name or stays unset; sonnet
-// and haiku match their family name first, then fall back through
-// gemini → grok → luna → first catalog row.
-function defaultClaudeSlots(models) {
-    if (!models.length)
-        return undefined;
-    const claudeRows = models.filter((model) => model.id.startsWith("claude"));
-    const pool = claudeRows.length ? claudeRows : models;
-    const family = (keyword) => pool.find((model) => model.id.includes(keyword));
-    const fallback = (keyword) => family(keyword) ??
-        models.find((model) => model.id.includes("gemini")) ??
-        models.find((model) => model.id.includes("grok")) ??
-        models.find((model) => model.id.includes("luna")) ??
-        models[0];
-    const slots = {
-        sonnet: fallback("sonnet").id,
-        haiku: fallback("haiku").id,
-    };
-    const opus = family("opus");
-    if (opus)
-        slots.opus = opus.id;
-    return slots;
-}
-// Resolve the tier-model env values: config overrides win over catalog
-// defaults; values are [1m]-marked per the predicate above (Claude Code
-// strips the marker before the request leaves).
-export function claudeTierSlots(override, models, compactWindow) {
-    const defaults = defaultClaudeSlots(models);
-    if (!defaults)
-        return undefined;
-    const windowById = new Map(models.map((model) => [model.id, model.window]));
-    const mark = (id) => !/\[1m\]$/i.test(id) &&
-        shouldMarkOneMillion(id, windowById.get(id) ?? 0, compactWindow)
-        ? `${id}[1m]`
-        : id;
-    const slots = {
-        sonnet: mark(override?.sonnet ?? defaults.sonnet),
-        haiku: mark(override?.haiku ?? defaults.haiku),
-    };
-    const opus = override?.opus ?? defaults.opus;
-    if (opus)
-        slots.opus = mark(opus);
-    return slots;
-}
-function catalogModelRows(document) {
-    if (!objectValue(document))
-        return undefined;
-    const source = Array.isArray(document.models)
-        ? document.models
-        : Array.isArray(document.data)
-            ? document.data
-            : undefined;
-    if (!source)
-        return undefined;
-    return source.filter(objectValue);
-}
-function catalogModelId(model) {
-    if (typeof model.slug === "string" && model.slug.trim())
-        return model.slug.trim();
-    if (typeof model.id === "string" && model.id.trim())
-        return model.id.trim();
-    return undefined;
-}
-async function claudeModelList(cpaUrl, apiKey, response) {
-    let rows;
-    try {
-        const catalog = await fetch(`${apiBase(cpaUrl)}/models?client_version=1`, {
-            headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
-            signal: AbortSignal.timeout(20_000),
-        });
-        if (catalog.ok)
-            rows = catalogModelRows(await catalog.json());
-    }
-    catch {
-        rows = undefined;
-    }
-    if (!rows) {
-        response.writeHead(502, { "content-type": "application/json" });
-        response.end(JSON.stringify({ error: "CPA catalog request failed" }));
-        return;
-    }
-    // Claude Code's /model picker only lists ids starting with claude/anthropic;
-    // expose every other catalog model as claude-cpac--<id>. Append the [1m]
-    // marker when the model can host the auto-compact window — that marker is
-    // the only signal that lifts context accounting above the 200K default
-    // (Claude Code strips it before the request reaches the proxy).
-    const rowsWithWindow = [];
-    let maxContext = 0;
-    for (const model of rows) {
-        const id = catalogModelId(model);
-        if (!id)
-            continue;
-        const window = typeof model.context_window === "number" && model.context_window > 0
-            ? Math.floor(model.context_window)
-            : 0;
-        if (window > maxContext)
-            maxContext = window;
-        rowsWithWindow.push({
-            id,
-            window,
-            alias: id.startsWith("claude") ? id : `${CLAUDE_ALIAS_PREFIX}${id}`,
-            display: typeof model.display_name === "string" && model.display_name.trim()
-                ? model.display_name
-                : id,
-        });
-    }
-    const compactWindow = claudeCompactWindow(maxContext);
-    const data = rowsWithWindow.map((row) => ({
-        type: "model",
-        id: shouldMarkOneMillion(row.id, row.window, compactWindow)
-            ? `${row.alias}[1m]`
-            : row.alias,
-        display_name: row.display,
-    }));
-    response.writeHead(200, { "content-type": "application/json" });
-    response.end(JSON.stringify({
-        data,
-        has_more: false,
-        first_id: data.length > 0 ? data[0].id : null,
-        last_id: data.length > 0 ? data[data.length - 1].id : null,
-    }));
-}
-export async function createClaudeProxy(cpaUrl, apiKey) {
-    const server = createServer((request, response) => {
-        const requestUrl = request.url ?? "/";
-        if (request.method === "GET" && requestUrl.startsWith("/v1/models")) {
-            void claudeModelList(cpaUrl, apiKey, response);
-            return;
-        }
-        let target;
-        try {
-            target = upstreamUrl(cpaUrl, requestUrl);
-        }
-        catch {
-            response.writeHead(400).end("invalid request URL");
-            return;
-        }
-        const chunks = [];
-        request.on("data", (chunk) => chunks.push(chunk));
-        request.once("error", () => response.destroy());
-        request.once("end", () => {
-            let body = Buffer.concat(chunks);
-            if (body.length > 0) {
-                try {
-                    const parsed = JSON.parse(body.toString("utf8"));
-                    if (objectValue(parsed) &&
-                        typeof parsed.model === "string" &&
-                        parsed.model.startsWith(CLAUDE_ALIAS_PREFIX)) {
-                        // Claude Code strips [1m] itself; keep the strip as a guard.
-                        parsed.model = parsed.model
-                            .slice(CLAUDE_ALIAS_PREFIX.length)
-                            .replace(/\[(1|2)m\]$/i, "");
-                        body = Buffer.from(JSON.stringify(parsed));
-                    }
-                }
-                catch {
-                    // not JSON; forward unchanged
-                }
-            }
-            const headers = proxyHeaders(request.headers, apiKey);
-            headers["content-length"] = String(body.length);
-            const send = target.protocol === "https:" ? httpsRequest : httpRequest;
-            const upstream = send(target, { method: request.method, headers }, (upstreamResponse) => {
-                response.writeHead(upstreamResponse.statusCode ?? 502, responseHeaders(upstreamResponse.headers));
-                upstreamResponse.pipe(response);
-            });
-            upstream.once("error", () => {
-                if (!response.headersSent) {
-                    response.writeHead(502, { "content-type": "application/json" });
-                }
-                if (!response.writableEnded)
-                    response.end(JSON.stringify({ error: "CPA upstream request failed" }));
-            });
-            request.once("aborted", () => upstream.destroy());
-            response.once("close", () => {
-                if (!response.writableEnded)
-                    upstream.destroy();
-            });
-            upstream.end(body);
-        });
-    });
-    server.on("clientError", (_error, socket) => socket.destroy());
-    await new Promise((resolveListen, rejectListen) => {
-        server.once("error", rejectListen);
-        server.listen(0, "127.0.0.1", () => {
-            server.off("error", rejectListen);
-            resolveListen();
-        });
-    });
-    const address = server.address();
-    if (!address || typeof address === "string") {
-        server.close();
-        throw new CPACError("cannot determine Claude proxy port");
-    }
-    return { server, port: address.port };
-}
-async function runProxyChild(port) {
-    const cpaUrl = process.env.CPAC_PROXY_UPSTREAM;
-    const apiKey = process.env.CPAC_PROXY_API_KEY;
-    const proxyId = process.env.CPAC_PROXY_ID;
-    if (!cpaUrl || !apiKey || !proxyId)
-        return 1;
-    try {
-        const proxy = await createLoopbackProxy(cpaUrl, apiKey, proxyId, port);
-        process.send?.({ ready: true, port: proxy.port, pid: process.pid });
-        const close = () => {
-            proxy.server.closeAllConnections?.();
-            proxy.server.close();
-        };
-        process.once("SIGINT", close);
-        process.once("SIGTERM", close);
-        await new Promise((resolveClose) => proxy.server.once("close", resolveClose));
-        return 0;
-    }
-    catch (error) {
-        process.send?.({
-            ready: false,
-            error: error instanceof Error ? error.message : String(error),
-        });
-        return 1;
-    }
-}
-async function proxyIsHealthy(proxy) {
-    try {
-        const response = await fetch(`http://127.0.0.1:${proxy.port}/_cpac/health`, {
-            headers: { "x-cpac-proxy-id": proxy.id },
-            signal: AbortSignal.timeout(1_000),
-        });
-        return response.status === 204;
-    }
-    catch {
-        return false;
-    }
-}
-async function startProxyProcess(config, apiKey) {
-    const id = randomBytes(24).toString("hex");
-    const child = spawn(process.execPath, [fileURLToPath(import.meta.url), "_proxy", String(config.codex_proxy_port)], {
-        detached: true,
-        env: {
-            ...process.env,
-            CPAC_PROXY_API_KEY: apiKey,
-            CPAC_PROXY_ID: id,
-            CPAC_PROXY_UPSTREAM: config.cpa_url,
-        },
-        stdio: ["ignore", "ignore", "ignore", "ipc"],
-    });
-    return await new Promise((resolveStart, rejectStart) => {
-        let settled = false;
-        let timeout;
-        const finish = (error, value) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timeout);
-            child.removeAllListeners();
-            if (child.connected)
-                child.disconnect();
-            child.unref();
-            if (error)
-                rejectStart(error);
-            else
-                resolveStart(value);
-        };
-        timeout = setTimeout(() => {
-            child.kill();
-            finish(new CPACError("loopback proxy did not become ready"));
-        }, 5_000);
-        child.once("error", (error) => finish(new CPACError(`cannot start loopback proxy: ${error.message}`)));
-        child.once("exit", (code) => finish(new CPACError(`loopback proxy exited before ready (${code ?? 1})`)));
-        child.once("message", (message) => {
-            if (objectValue(message) &&
-                message.ready === true &&
-                typeof message.pid === "number" &&
-                typeof message.port === "number") {
-                finish(undefined, { id, pid: message.pid, port: message.port });
-                return;
-            }
-            const detail = objectValue(message) && typeof message.error === "string"
-                ? `: ${message.error}`
-                : "";
-            finish(new CPACError(`cannot start loopback proxy${detail}`));
-        });
-    });
-}
-export async function stopProxyProcess(proxy) {
-    if (!(await proxyIsHealthy(proxy)))
-        return;
-    try {
-        await fetch(`http://127.0.0.1:${proxy.port}/_cpac/shutdown`, {
-            method: "POST",
-            headers: { "x-cpac-proxy-id": proxy.id },
-            signal: AbortSignal.timeout(1_000),
-        });
-    }
-    catch {
-        // The server may close the connection while shutting down.
-    }
-}
-export function readState(stateDir) {
-    const path = join(stateDir, "state.json");
-    if (!existsSync(path))
-        return null;
-    let value;
-    try {
-        value = JSON.parse(readFileSync(path, "utf8"));
-    }
-    catch (error) {
-        throw new CPACError(`cannot read state: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    if (!objectValue(value) ||
-        Object.keys(value).some((key) => !STATE_KEYS.has(key)) ||
-        [...REQUIRED_STATE_KEYS].some((key) => !(key in value))) {
-        throw new CPACError("invalid state file");
-    }
-    if (typeof value.config_path !== "string" || !isAbsolute(value.config_path)) {
-        throw new CPACError("invalid config path in state");
-    }
-    if (typeof value.config_existed !== "boolean")
-        throw new CPACError("invalid config_existed value in state");
-    if (!Number.isInteger(value.config_mode) ||
-        value.config_mode < 0 ||
-        value.config_mode > 0o7777) {
-        throw new CPACError("invalid config_mode value in state");
-    }
-    const proxyKeys = ["proxy_id", "proxy_pid", "proxy_port"];
-    const proxyKeyCount = proxyKeys.filter((key) => key in value).length;
-    if (proxyKeyCount !== 0 &&
-        (proxyKeyCount !== proxyKeys.length ||
-            typeof value.proxy_id !== "string" ||
-            !/^[a-f0-9]{48}$/.test(value.proxy_id) ||
-            !Number.isInteger(value.proxy_pid) ||
-            value.proxy_pid <= 0 ||
-            !Number.isInteger(value.proxy_port) ||
-            value.proxy_port <= 0 ||
-            value.proxy_port > 65535)) {
-        throw new CPACError("invalid loopback proxy state");
-    }
-    if (value.proxy_fingerprint !== undefined &&
-        (typeof value.proxy_fingerprint !== "string" ||
-            !/^[a-f0-9]{64}$/.test(value.proxy_fingerprint))) {
-        throw new CPACError("invalid loopback proxy fingerprint");
-    }
-    return value;
-}
-export function stateProxy(state) {
-    return state.proxy_id && state.proxy_pid && state.proxy_port
-        ? { id: state.proxy_id, pid: state.proxy_pid, port: state.proxy_port }
-        : null;
-}
-function stateBytes(config, existed, mode, proxy, proxyFingerprint) {
-    return Buffer.from(`${JSON.stringify({
-        config_path: config.codex_config,
-        config_existed: existed,
-        config_mode: mode,
-        proxy_id: proxy.id,
-        proxy_fingerprint: proxyFingerprint,
-        proxy_pid: proxy.pid,
-        proxy_port: proxy.port,
-    }, null, 2)}\n`);
-}
-function originalBytes(stateDir, state, expectedPath) {
-    if (state.config_path !== expectedPath) {
-        throw new CPACError(`active injection belongs to ${state.config_path}; restore it first`);
-    }
-    if (!state.config_existed)
-        return new Uint8Array();
-    try {
-        return readFileSync(join(stateDir, "config.toml.backup"));
-    }
-    catch (error) {
-        throw new CPACError(`cannot read original config backup: ${error instanceof Error ? error.message : String(error)}`);
-    }
-}
-function cleanupStateFiles(stateDir) {
-    for (const name of STATE_FILES)
-        rmSync(join(stateDir, name), { force: true });
-    try {
-        rmdirSync(stateDir);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code !== "ENOENT" && code !== "ENOTEMPTY" && code !== "EEXIST")
-            throw error;
-    }
-}
-function proxyFingerprint(config, apiKey) {
-    return createHash("sha256")
-        .update(config.cpa_url)
-        .update("\0")
-        .update(apiKey)
-        .digest("hex");
-}
-export async function inject(config, v2Off = false, maxContext = false) {
-    const apiKey = process.env[config.api_key_env]?.trim();
-    if (!apiKey)
-        throw new CPACError(`environment variable ${config.api_key_env} is not set`);
-    const state = readState(config.state_dir);
-    let existed;
-    let original;
-    let originalMode;
-    if (state) {
-        const backup = originalBytes(config.state_dir, state, config.codex_config);
-        try {
-            original = existsSync(config.codex_config)
-                ? stripManagedConfig(readFileSync(config.codex_config))
-                : backup;
-        }
-        catch (error) {
-            if (error instanceof CPACError)
-                throw error;
-            throw new CPACError(`cannot read Codex config: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        existed = state.config_existed;
-        originalMode = state.config_mode;
-    }
-    else {
-        existed = existsSync(config.codex_config);
-        try {
-            original = existed ? readFileSync(config.codex_config) : new Uint8Array();
-            originalMode = existed ? statSync(config.codex_config).mode & 0o7777 : 0o600;
-        }
-        catch (error) {
-            throw new CPACError(`cannot read Codex config: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    const catalog = await fetchCatalog(config.cpa_url, apiKey);
-    if (config.spawn_models?.length)
-        catalog.bytes = reorderCatalog(catalog.bytes, config.spawn_models);
-    if (maxContext)
-        catalog.bytes = liftContextWindows(catalog.bytes);
-    const stateDirExisted = existsSync(config.state_dir);
-    if (!state &&
-        STATE_FILES.some((name) => existsSync(join(config.state_dir, name)))) {
-        throw new CPACError("state_dir contains CPAC files without a valid state; refusing to overwrite them");
-    }
-    const fingerprint = proxyFingerprint(config, apiKey);
-    const previousProxy = state ? stateProxy(state) : null;
-    let proxy;
-    let startedProxy = false;
-    if (previousProxy &&
-        state?.proxy_fingerprint === fingerprint &&
-        (config.codex_proxy_port === 0 ||
-            config.codex_proxy_port === previousProxy.port) &&
-        (await proxyIsHealthy(previousProxy))) {
-        proxy = previousProxy;
-    }
-    else {
-        if (previousProxy)
-            await stopProxyProcess(previousProxy);
-        try {
-            proxy = await startProxyProcess(config, apiKey);
-            startedProxy = true;
-        }
-        catch (error) {
-            throw new CPACError(`${error instanceof Error ? error.message : String(error)}; choose another codex_proxy_port if the port is occupied`);
-        }
-    }
-    const catalogPath = join(config.state_dir, "codex-models.json");
-    let injected;
-    try {
-        injected = buildCodexConfig(original, proxy.port, catalogPath);
-        const injectedText = new TextDecoder("utf-8").decode(injected);
-        injected = Buffer.from(withMultiAgentV2(injectedText, !v2Off, dominantEol(injectedText)));
-        if (!v2Off && hasAgentsMaxThreads(injectedText)) {
-            console.warn("warning: [agents] max_threads is set; codex refuses to start with multi_agent_v2 enabled, remove it");
-        }
-    }
-    catch (error) {
-        if (startedProxy)
-            await stopProxyProcess(proxy);
-        throw error;
-    }
-    mkdirSync(config.state_dir, { recursive: true, mode: 0o700 });
-    if (!stateDirExisted)
-        chmodSync(config.state_dir, 0o700);
-    if (state) {
-        try {
-            atomicWrite(catalogPath, catalog.bytes);
-            atomicWrite(config.codex_config, injected, originalMode);
-            atomicWrite(join(config.state_dir, "state.json"), stateBytes(config, existed, originalMode, proxy, fingerprint));
-        }
-        catch (error) {
-            if (startedProxy)
-                await stopProxyProcess(proxy);
-            throw error;
-        }
-    }
-    else {
-        let configWritten = false;
-        try {
-            if (existed)
-                atomicWrite(join(config.state_dir, "config.toml.backup"), original);
-            atomicWrite(catalogPath, catalog.bytes);
-            atomicWrite(config.codex_config, injected, originalMode);
-            configWritten = true;
-            atomicWrite(join(config.state_dir, "state.json"), stateBytes(config, existed, originalMode, proxy, fingerprint));
-        }
-        catch (error) {
-            if (configWritten) {
-                try {
-                    if (existed)
-                        atomicWrite(config.codex_config, original, originalMode);
-                    else
-                        rmSync(config.codex_config, { force: true });
-                }
-                catch (rollbackError) {
-                    throw new CPACError(`injection failed and config rollback failed; backup retained in ${config.state_dir}: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
-                }
-            }
-            let cleanupError;
-            try {
-                cleanupStateFiles(config.state_dir);
-            }
-            catch (caught) {
-                cleanupError = caught;
-            }
-            if (startedProxy)
-                await stopProxyProcess(proxy);
-            if (cleanupError) {
-                throw new CPACError(`injection failed and state cleanup failed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
-            }
-            throw error;
-        }
-    }
-    try {
-        rmSync(join(dirname(config.codex_config), "models_cache.json"), {
-            force: true,
-        });
-    }
-    catch {
-        console.warn("CPAC could not invalidate Codex models_cache.json; restart Codex App if its model list is stale.");
-    }
-    console.log(`Injected ${catalog.modelCount} CPA models into ${config.codex_config} via http://127.0.0.1:${proxy.port}/v1 (multi-agent v2: ${v2Off ? "off" : "on"})`);
-    console.log("Restart Codex App if its running app-server still shows the old model list.");
-}
-export async function restore(config) {
-    const state = readState(config.state_dir);
-    if (!state)
-        throw new CPACError("no active CPAC injection");
-    const original = originalBytes(config.state_dir, state, config.codex_config);
-    if (state.config_existed)
-        atomicWrite(config.codex_config, original, state.config_mode);
-    else
-        rmSync(config.codex_config, { force: true });
-    const proxy = stateProxy(state);
-    if (proxy)
-        await stopProxyProcess(proxy);
-    try {
-        cleanupStateFiles(config.state_dir);
-    }
-    catch (error) {
-        throw new CPACError(`config restored, but state cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    console.log(`Restored ${config.codex_config}`);
-}
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { CPAC_VERSION, isGrokConfigInstalled, isKimiConfigInstalled, isPiExtensionInstalled, runCodexConfig, runDetect, runInstall, runOpencode, runRestore, runSync, runTargetLauncher, runUpgrade, } from "./agents.js";
+import { runClaude, runClaudeConfig, runClaudeModels } from "./claude.js";
+import { inject, multiAgentV2Enabled } from "./codex.js";
+import { defaultConfigPath, loadConfig, originalBytes, pickSpawnModels, readState, saveSpawnModels, stateProxy, } from "./config.js";
+import { proxyIsHealthy, runProxy, runProxyChild } from "./proxy.js";
+import { CPACError, expandUserPath, promptSecret, saveApiKeyExport, shellProfile, } from "./util.js";
+export { PROVIDER, loadConfig, saveSpawnModels, liftContextWindows, reorderCatalog, readState, stateProxy, } from "./config.js";
+export { saveApiKeyExport } from "./util.js";
+export { stopProxyProcess } from "./proxy.js";
+export { buildCodexConfig, hasProviderTable, inject, multiAgentV2Enabled, restore, withMultiAgentV2, } from "./codex.js";
+export { claudeTierSlots, createClaudeProxy, runClaude } from "./claude.js";
+export { detectClientVersion, detectTargets, installGrokConfig, installKimiConfig, installPiExtension, isGrokConfigInstalled, isKimiConfigInstalled, isPiExtensionInstalled, runInstall, runOpencode, runRestore, runSync, runTargetLauncher, uninstallGrokConfig, uninstallKimiConfig, uninstallPiExtension, } from "./agents.js";
 export async function status(config) {
     const apiKey = process.env[config.api_key_env]?.trim();
     const keyConfigured = !!apiKey;
@@ -1437,60 +61,6 @@ export async function status(config) {
         return 2;
     return 0;
 }
-async function promptSecret(name) {
-    if (!process.stdin.isTTY || !process.stderr.isTTY) {
-        throw new CPACError(`environment variable ${name} is not set; run: export ${name}="..."`);
-    }
-    process.stderr.write(`Enter ${name}: `);
-    const silent = new Writable({
-        write(_chunk, _encoding, callback) {
-            callback();
-        },
-    });
-    const prompt = createInterface({
-        input: process.stdin,
-        output: silent,
-        terminal: true,
-    });
-    try {
-        const value = (await prompt.question("")).trim();
-        process.stderr.write("\n");
-        if (!value)
-            throw new CPACError(`${name} must not be empty`);
-        return value;
-    }
-    finally {
-        prompt.close();
-    }
-}
-async function resolveApiKey(name) {
-    return process.env[name]?.trim() || (await promptSecret(name));
-}
-function shellProfile() {
-    const shell = parse(process.env.SHELL || "").base;
-    if (shell === "zsh")
-        return join(homedir(), ".zshrc");
-    if (shell === "bash")
-        return join(homedir(), process.platform === "darwin" ? ".bash_profile" : ".bashrc");
-    if (["sh", "dash", "ksh"].includes(shell))
-        return join(homedir(), ".profile");
-    throw new CPACError(`unsupported shell ${shell || "unknown"}; run: export CPA_API_KEY="..."`);
-}
-function shellQuote(value) {
-    return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-export function saveApiKeyExport(profile, name, apiKey) {
-    const start = `# >>> CPAC ${name} >>>`;
-    const end = `# <<< CPAC ${name} <<<`;
-    const block = `${start}\nexport ${name}=${shellQuote(apiKey)}\n${end}`;
-    let content = existsSync(profile) ? readFileSync(profile, "utf8") : "";
-    const managed = new RegExp(`${start.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${end.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`);
-    content = managed.test(content)
-        ? content.replace(managed, block)
-        : `${content}${content && !content.endsWith("\n") ? "\n" : ""}${block}\n`;
-    const mode = existsSync(profile) ? statSync(profile).mode & 0o7777 : 0o600;
-    atomicWrite(profile, Buffer.from(content), mode);
-}
 async function guide(config) {
     console.log(`CPA Companion\n\nCPA: ${config.cpa_url}\nCPA_API_KEY: ${process.env[config.api_key_env]?.trim() ? "configured" : "not configured"}\n\nCommands:\n  cpac <agent> [args...] Launch an agent (codex, kimi, grok, pi, claude, opencode) through CPA\n  cpac inject            Inject CPA into Codex and start its loopback proxy\n  cpac proxy             Run the injected loopback proxy in the foreground\n  cpac status            Show agent support status (Codex, Claude, Pi, Kimi, Grok)\n  cpac restore           Restore the original Codex config\n  cpac detect            Show supported targets and install status\n  cpac install           Install CPA integration into detected targets\n  cpac sync              Refresh installed Codex/Pi/Kimi/Grok injections from CPA\n  cpac uninstall         Remove CPA integration from installed targets\n  cpac upgrade           Update cpac from npm and sync installed agents\n  cpac --help            Show command usage`);
     if (process.env[config.api_key_env]?.trim())
@@ -1504,974 +74,6 @@ async function guide(config) {
 }
 // opencode's config schema rejects a limit block with context but no output;
 // the catalog has no output field, so a safe budget stands in, clamped to the
-// context window (same scheme as opencodex's SCHEMA_REQUIRED_OUTPUT_BUDGET).
-const OPENCODE_OUTPUT_BUDGET = 32_000;
-// Ephemeral takeover: inline a CPA provider via OPENCODE_CONFIG_CONTENT so no
-// opencode config file is touched; the session ends with zero residue.
-export async function runOpencode(config, args, executable = "opencode") {
-    const apiKey = process.env[config.api_key_env]?.trim();
-    if (!apiKey)
-        throw new CPACError(`environment variable ${config.api_key_env} is not set`);
-    const catalog = await fetchCatalog(config.cpa_url, apiKey);
-    let document;
-    try {
-        document = JSON.parse(new TextDecoder().decode(catalog.bytes));
-    }
-    catch {
-        throw new CPACError("invalid CPA catalog");
-    }
-    const models = {};
-    for (const row of document.models) {
-        const id = catalogModelId(row);
-        if (!id)
-            continue;
-        const window = typeof row.context_window === "number" && row.context_window > 0
-            ? Math.floor(row.context_window)
-            : 0;
-        models[id] =
-            window > 0
-                ? {
-                    limit: {
-                        context: window,
-                        output: Math.min(OPENCODE_OUTPUT_BUDGET, window),
-                    },
-                }
-                : {};
-    }
-    const content = JSON.stringify({
-        provider: {
-            cpac: {
-                npm: "@ai-sdk/openai-compatible",
-                options: { baseURL: apiBase(config.cpa_url), apiKey },
-                models,
-            },
-        },
-    });
-    const env = {
-        ...process.env,
-        OPENCODE_CONFIG_CONTENT: content,
-    };
-    return await new Promise((resolve, reject) => {
-        const child = spawn(executable, args, { env, stdio: "inherit" });
-        child.once("error", (error) => {
-            reject(new CPACError(error instanceof Error && "code" in error && error.code === "ENOENT"
-                ? `${executable} not found`
-                : `cannot start ${executable}: ${error.message}`));
-        });
-        child.once("close", (code) => resolve(code ?? 1));
-    });
-}
-export async function runCodexConfig(config, configPath, options = {}) {
-    if (options.reset) {
-        let raw = {};
-        try {
-            const file = JSON.parse(readFileSync(configPath, "utf8"));
-            if (!objectValue(file))
-                throw new CPACError("config must be a JSON object");
-            raw = file;
-        }
-        catch (error) {
-            if (error.code !== "ENOENT") {
-                if (error instanceof CPACError)
-                    throw error;
-                throw new CPACError(`cannot read config: ${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-        delete raw.spawn_models;
-        atomicWrite(configPath, Buffer.from(`${JSON.stringify(raw, null, 2)}\n`));
-        await runRestore(config, ["codex"], { all: false, dryRun: false });
-        console.log("Codex configuration reset to default");
-        return 0;
-    }
-    if (options.interactive && (!process.stdin.isTTY || !process.stderr.isTTY)) {
-        console.log(config.spawn_models
-            ? JSON.stringify(config.spawn_models, null, 2)
-            : "spawn_models not set");
-        return 0;
-    }
-    let spawnModels = config.spawn_models;
-    let v2Off = options.v2Off ?? false;
-    let maxContext = options.maxContext ?? false;
-    if (options.interactive || options.v2Models) {
-        const picked = await pickSpawnModels(config);
-        if (picked.length > 0) {
-            spawnModels = picked;
-            saveSpawnModels(configPath, picked);
-            console.log(`spawn_models saved to ${configPath}: ${picked.join(", ")}`);
-        }
-        if (options.interactive) {
-            const [maxCtxChoice] = await checkboxPicker("Codex Context Window Size:", [
-                "Standard (default input budget, e.g. 200K~272K)",
-                "Max Context Window (lift to full upper bound, e.g. 921K~1M, 90% auto-compact limit)",
-            ], 1);
-            maxContext = maxCtxChoice?.startsWith("Max Context") ?? false;
-            const [v2Choice] = await checkboxPicker("Codex Multi-Agent V2 mode:", ["Enabled (Default)", "Disabled (--v2_off)"], 1);
-            v2Off = v2Choice === "Disabled (--v2_off)";
-        }
-    }
-    const updatedConfig = { ...config, spawn_models: spawnModels };
-    await runInstall(updatedConfig, ["codex"], {
-        all: false,
-        dryRun: false,
-        force: true,
-        v2Off,
-        maxContext,
-    });
-    console.log("Codex configuration updated and synced.");
-    return 0;
-}
-export async function runClaudeConfig(config, configPath, options = {}) {
-    if (options.reset) {
-        let raw = {};
-        try {
-            const file = JSON.parse(readFileSync(configPath, "utf8"));
-            if (!objectValue(file))
-                throw new CPACError("config must be a JSON object");
-            raw = file;
-        }
-        catch (error) {
-            if (error.code !== "ENOENT") {
-                if (error instanceof CPACError)
-                    throw error;
-                throw new CPACError(`cannot read config: ${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-        delete raw.claude_models;
-        atomicWrite(configPath, Buffer.from(`${JSON.stringify(raw, null, 2)}\n`));
-        console.log("Claude Code tier models reset to CPA catalog auto-selection");
-        return 0;
-    }
-    if (options.interactive && (!process.stdin.isTTY || !process.stderr.isTTY)) {
-        console.log(config.claude_models
-            ? JSON.stringify(config.claude_models, null, 2)
-            : "claude_models not set; cpac claude auto-picks tier models from the CPA catalog");
-        return 0;
-    }
-    const models = { ...(options.models || {}) };
-    const shouldPick = options.interactive || (options.pick && options.pick.length > 0);
-    if (shouldPick) {
-        const apiKey = await resolveApiKey(config.api_key_env);
-        const catalog = await fetchCatalog(config.cpa_url, apiKey);
-        let document;
-        try {
-            document = JSON.parse(new TextDecoder().decode(catalog.bytes));
-        }
-        catch {
-            throw new CPACError("CPA catalog response is not valid JSON");
-        }
-        const slugs = (document.models ?? [])
-            .map((model) => (typeof model?.slug === "string" ? model.slug : ""))
-            .filter(Boolean);
-        const slotsToPick = options.pick && options.pick.length > 0
-            ? options.pick
-            : ["sonnet", "haiku", "opus"];
-        for (const slot of slotsToPick) {
-            const choices = slot === "sonnet" ? slugs : ["(auto-select from catalog)", ...slugs];
-            const [picked] = await checkboxPicker(`Select Claude Code ${slot.toUpperCase()} tier model:`, choices, 1);
-            if (picked && picked !== "(auto-select from catalog)") {
-                models[slot] = picked;
-            }
-        }
-    }
-    if (!Object.keys(models).length && !shouldPick) {
-        console.log(config.claude_models
-            ? JSON.stringify(config.claude_models, null, 2)
-            : "claude_models not set; cpac claude auto-picks tier models from the CPA catalog");
-        return 0;
-    }
-    let raw = {};
-    try {
-        const file = JSON.parse(readFileSync(configPath, "utf8"));
-        if (!objectValue(file))
-            throw new CPACError("config must be a JSON object");
-        raw = file;
-    }
-    catch (error) {
-        if (error.code !== "ENOENT") {
-            if (error instanceof CPACError)
-                throw error;
-            throw new CPACError(`cannot read config: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    const existing = objectValue(raw.claude_models)
-        ? { ...raw.claude_models }
-        : {};
-    Object.assign(existing, models);
-    raw.claude_models = existing;
-    atomicWrite(configPath, Buffer.from(`${JSON.stringify(raw, null, 2)}\n`));
-    loadConfig(configPath);
-    console.log(`Claude Code tier models updated in ${configPath}:\n${JSON.stringify(raw.claude_models, null, 2)}`);
-    return 0;
-}
-export async function runClaudeModels(parsed) {
-    const config = loadConfig(parsed.configPath, true);
-    return await runClaudeConfig(config, parsed.configPath, {
-        models: parsed.models,
-        pick: parsed.pick,
-        reset: parsed.reset,
-        interactive: false,
-    });
-}
-export async function runClaude(config, args, executable = "claude") {
-    const apiKey = await resolveApiKey(config.api_key_env);
-    const proxy = await createClaudeProxy(config.cpa_url, apiKey);
-    const stopProxy = () => {
-        proxy.server.closeAllConnections?.();
-        proxy.server.close();
-    };
-    // Gateway discovery only carries {id, display_name}; Claude Code accounts
-    // claude-prefixed unknown models at 200K and ignores MAX_CONTEXT_TOKENS for
-    // them. The [1m] marker on the alias (added by the models listing) plus the
-    // auto-compact window is opencodex's working mechanism for bigger windows.
-    let maxContext = 0;
-    const catalogWindows = [];
-    try {
-        const catalog = await fetchCatalog(config.cpa_url, apiKey);
-        const rows = catalogModelRows(JSON.parse(new TextDecoder("utf-8").decode(catalog.bytes))) ?? [];
-        for (const row of rows) {
-            const id = catalogModelId(row);
-            const window = typeof row.context_window === "number" && row.context_window > 0
-                ? Math.floor(row.context_window)
-                : 0;
-            if (id)
-                catalogWindows.push({ id, window });
-            if (window > maxContext)
-                maxContext = window;
-        }
-    }
-    catch {
-        // keep the default window when the catalog is unreachable
-    }
-    const compactWindow = claudeCompactWindow(maxContext);
-    const slots = claudeTierSlots(config.claude_models, catalogWindows, compactWindow);
-    const env = {
-        ...process.env,
-        ANTHROPIC_BASE_URL: `http://127.0.0.1:${proxy.port}`,
-        ANTHROPIC_AUTH_TOKEN: apiKey,
-        CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY: "1",
-        CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST: "1",
-    };
-    if (compactWindow !== undefined &&
-        !(Number(process.env.CLAUDE_CODE_AUTO_COMPACT_WINDOW) > 0)) {
-        env.CLAUDE_CODE_AUTO_COMPACT_WINDOW = String(compactWindow);
-    }
-    const setSlot = (name, value) => {
-        if (process.env[name] === undefined)
-            env[name] = value;
-    };
-    if (slots) {
-        // Route haiku/subagent tier traffic at catalog models instead of the
-        // stock claude-haiku-* ids the gateway does not carry. The opus slot
-        // stays unset when the catalog has no opus-family model.
-        if (slots.opus)
-            setSlot("ANTHROPIC_DEFAULT_OPUS_MODEL", slots.opus);
-        setSlot("ANTHROPIC_DEFAULT_SONNET_MODEL", slots.sonnet);
-        setSlot("ANTHROPIC_DEFAULT_HAIKU_MODEL", slots.haiku);
-        setSlot("ANTHROPIC_SMALL_FAST_MODEL", slots.haiku);
-    }
-    delete env.ANTHROPIC_API_KEY;
-    delete env.CLAUDE_CODE_USE_ANTHROPIC_AWS;
-    delete env.CLAUDE_CODE_USE_BEDROCK;
-    delete env.CLAUDE_CODE_USE_FOUNDRY;
-    delete env.CLAUDE_CODE_USE_VERTEX;
-    return await new Promise((resolve, reject) => {
-        const child = spawn(executable, args, { env, stdio: "inherit" });
-        child.once("error", (error) => {
-            stopProxy();
-            reject(new CPACError(error instanceof Error && "code" in error && error.code === "ENOENT"
-                ? `${executable} not found`
-                : `cannot start ${executable}: ${error.message}`));
-        });
-        child.once("close", (code) => {
-            stopProxy();
-            resolve(code ?? 1);
-        });
-    });
-}
-export async function runTargetLauncher(config, targetId, args, executable = targetId, options = {}) {
-    const target = TARGETS.find((t) => t.id === targetId);
-    if (!target)
-        throw new CPACError(`unknown target: ${targetId}`);
-    if (["kimi", "grok"].includes(targetId)) {
-        const state = readState(config.state_dir);
-        const proxy = state ? stateProxy(state) : null;
-        if (!proxy || !(await proxyIsHealthy(proxy))) {
-            const apiKey = await resolveApiKey(config.api_key_env);
-            const started = await startProxyProcess(config, apiKey);
-            const fingerprint = proxyFingerprint(config, apiKey);
-            const catalog = await fetchCatalog(config.cpa_url, apiKey);
-            const catalogPath = join(config.state_dir, "codex-models.json");
-            mkdirSync(config.state_dir, { recursive: true, mode: 0o700 });
-            atomicWrite(catalogPath, catalog.bytes);
-            const originalMode = existsSync(config.codex_config)
-                ? statSync(config.codex_config).mode & 0o7777
-                : 0o600;
-            atomicWrite(join(config.state_dir, "state.json"), stateBytes(config, state ? state.config_existed : false, state ? state.config_mode : originalMode, started, fingerprint));
-        }
-    }
-    if (target.installed(config)) {
-        try {
-            await runSync(config, [targetId], {
-                all: false,
-                dryRun: false,
-                v2Off: options.v2Off,
-                maxContext: options.maxContext,
-            });
-        }
-        catch (error) {
-            console.warn(`warning: auto-sync failed (${error instanceof Error ? error.message : String(error)}); launching with existing config`);
-        }
-    }
-    else {
-        await target.install(config, false, options.v2Off, options.maxContext);
-    }
-    return await new Promise((resolvePromise, rejectPromise) => {
-        const child = spawn(executable, args, { stdio: "inherit" });
-        child.once("error", (error) => {
-            rejectPromise(new CPACError(error instanceof Error && "code" in error && error.code === "ENOENT"
-                ? `${executable} not found`
-                : `cannot start ${executable}: ${error.message}`));
-        });
-        child.once("close", (code) => resolvePromise(code ?? 1));
-    });
-}
-export async function runProxy(config) {
-    const apiKey = await resolveApiKey(config.api_key_env);
-    const state = readState(config.state_dir);
-    if (!state)
-        throw new CPACError("no active CPAC injection; run cpac inject first");
-    originalBytes(config.state_dir, state, config.codex_config);
-    const recorded = stateProxy(state);
-    if (!recorded) {
-        throw new CPACError("injection has no loopback proxy state; run cpac inject to migrate it");
-    }
-    if (await proxyIsHealthy(recorded)) {
-        throw new CPACError(`loopback proxy is already running on 127.0.0.1:${recorded.port}`);
-    }
-    const proxy = await createLoopbackProxy(config.cpa_url, apiKey, recorded.id, recorded.port);
-    try {
-        atomicWrite(join(config.state_dir, "state.json"), stateBytes(config, state.config_existed, state.config_mode, { id: recorded.id, pid: process.pid, port: proxy.port }, proxyFingerprint(config, apiKey)));
-    }
-    catch (error) {
-        proxy.server.closeAllConnections?.();
-        proxy.server.close();
-        throw error;
-    }
-    console.log(`CPAC loopback proxy listening on http://127.0.0.1:${proxy.port}/v1`);
-    const close = () => {
-        proxy.server.closeAllConnections?.();
-        proxy.server.close();
-    };
-    process.once("SIGINT", close);
-    process.once("SIGTERM", close);
-    await new Promise((resolveClose) => proxy.server.once("close", resolveClose));
-    return 0;
-}
-function piExtensionsDir() {
-    return join(expandUserPath(process.env.PI_CODING_AGENT_DIR?.trim() || join(homedir(), ".pi", "agent")), "extensions");
-}
-export function isPiExtensionInstalled() {
-    return existsSync(join(piExtensionsDir(), "cpac.ts"));
-}
-function piTemplatePath() {
-    return join(dirname(fileURLToPath(import.meta.url)), "pi-extension.template");
-}
-function piExtensionContent(cpaUrl) {
-    return readFileSync(piTemplatePath(), "utf8").replace("__CPA_URL__", cpaUrl);
-}
-export async function installPiExtension(config) {
-    const dir = piExtensionsDir();
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const target = join(dir, "cpac.ts");
-    ensureCpacBackup(target);
-    atomicWrite(target, Buffer.from(piExtensionContent(config.cpa_url)), 0o644);
-    console.log(`Installed Pi extension: ${target}`);
-}
-export async function uninstallPiExtension() {
-    const target = join(piExtensionsDir(), "cpac.ts");
-    if (!existsSync(target))
-        throw new CPACError("Pi extension is not installed");
-    unlinkSync(target);
-    console.log(`Removed Pi extension: ${target}`);
-}
-// Pre-write snapshot kept at <target>.cpac-backup (first version only) so a
-// damaged config can be restored by hand even if uninstall cannot parse it.
-function ensureCpacBackup(target) {
-    if (!existsSync(target))
-        return;
-    const backup = `${target}.cpac-backup`;
-    if (existsSync(backup))
-        return;
-    copyFileSync(target, backup);
-}
-function kimiConfigPath() {
-    const home = process.env.KIMI_CODE_HOME?.trim() || join(homedir(), ".kimi-code");
-    return join(expandUserPath(home), "config.toml");
-}
-const KIMI_BLOCK_START = "# >>> CPAC Kimi >>>";
-const KIMI_BLOCK_END = "# <<< CPAC Kimi <<<";
-const kimiBlockRegex = new RegExp(`${KIMI_BLOCK_START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${KIMI_BLOCK_END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\n?`);
-export function isKimiConfigInstalled() {
-    try {
-        const content = readFileSync(kimiConfigPath(), "utf8");
-        return (kimiBlockRegex.test(content) || /^\s*\[providers\.cpac\]\s*$/m.test(content));
-    }
-    catch {
-        return false;
-    }
-}
-function isCpacTableHeader(line) {
-    const header = line.match(/^\[([^\]]+)\]\s*$/);
-    if (!header)
-        return false;
-    const name = header[1];
-    return (name === "providers.cpac" ||
-        name.startsWith("providers.cpac.") ||
-        /^models\.(?:"cpac\/|'cpac\/)/.test(name));
-}
-// Kimi may rewrite config.toml and drop our comment markers, leaving the
-// [providers.cpac] / [models."cpac/..."] tables behind. A later install would
-// then append a second copy and make the file invalid TOML.
-function stripOrphanCpacTables(content) {
-    const eol = content.includes("\r\n") ? "\r\n" : "\n";
-    const out = [];
-    let skipping = false;
-    for (const line of content.split(/\r?\n/)) {
-        if (/^\[[^\]]+\]\s*$/.test(line))
-            skipping = isCpacTableHeader(line);
-        if (!skipping)
-            out.push(line);
-    }
-    return out.join(eol).replace(/(?:\r?\n){3,}/g, `${eol}${eol}`);
-}
-function writeKimiBlock(path, block) {
-    let content = existsSync(path) ? readFileSync(path, "utf8") : "";
-    content = content.replace(kimiBlockRegex, "");
-    // A truncated managed block (start marker without the end marker) leaves its
-    // tables behind; appending again would duplicate [providers.cpac], make the
-    // file invalid TOML, and block `kimi login`. The block is always appended
-    // last, so dropping from an orphaned start marker to EOF is safe.
-    const orphan = content.indexOf(KIMI_BLOCK_START);
-    if (orphan !== -1)
-        content = content.slice(0, orphan);
-    content = stripOrphanCpacTables(content);
-    if (block) {
-        content = `${content}${content && !content.endsWith("\n") ? "\n" : ""}${block}\n`;
-    }
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const mode = existsSync(path) ? statSync(path).mode & 0o7777 : 0o600;
-    atomicWrite(path, Buffer.from(content), mode);
-}
-const KIMI_REASONING_EFFORTS = new Set([
-    "minimal",
-    "low",
-    "medium",
-    "high",
-    "xhigh",
-    "max",
-    "ultra",
-]);
-function kimiSupportEfforts(row) {
-    const levels = row.supported_reasoning_levels ??
-        row.reasoning_effort_levels ??
-        row.reasoning_levels;
-    if (!Array.isArray(levels))
-        return [];
-    const seen = new Set();
-    const efforts = [];
-    for (const level of levels) {
-        const effort = typeof level === "string"
-            ? level.toLowerCase()
-            : objectValue(level) && typeof level.effort === "string"
-                ? level.effort.toLowerCase()
-                : undefined;
-        if (!effort || !KIMI_REASONING_EFFORTS.has(effort) || seen.has(effort))
-            continue;
-        seen.add(effort);
-        efforts.push(effort);
-    }
-    return efforts;
-}
-function kimiInputHasImage(row) {
-    const modalities = row.input_modalities;
-    if (!Array.isArray(modalities))
-        return true;
-    return modalities.some((value) => value === "image");
-}
-export async function installKimiConfig(config) {
-    const apiKey = await resolveApiKey(config.api_key_env);
-    const catalog = await fetchCatalog(config.cpa_url, apiKey);
-    let document;
-    try {
-        document = JSON.parse(new TextDecoder("utf-8").decode(catalog.bytes));
-    }
-    catch {
-        throw new CPACError("invalid CPA catalog");
-    }
-    const rows = catalogModelRows(document) ?? [];
-    if (rows.length === 0)
-        throw new CPACError("CPA catalog contains no models");
-    const state = readState(config.state_dir);
-    const recorded = state ? stateProxy(state) : null;
-    const port = recorded?.port ?? config.codex_proxy_port;
-    if (!port) {
-        throw new CPACError("loopback proxy port unknown; run cpac inject first");
-    }
-    const lines = [
-        KIMI_BLOCK_START,
-        "[providers.cpac]",
-        'type = "openai"',
-        `base_url = "http://127.0.0.1:${port}/v1"`,
-        '# Placeholder: the CPAC loopback proxy replaces it with the CPA key; run "cpac inject" to start the proxy.',
-        'api_key = "cpac-loopback"',
-    ];
-    for (const row of rows) {
-        const slug = catalogModelId(row);
-        if (!slug)
-            continue;
-        // ponytail: Kimi requires max_context_size; default 200000 when the catalog omits it.
-        const context = typeof row.context_window === "number" && row.context_window > 0
-            ? Math.floor(row.context_window)
-            : 200000;
-        const efforts = kimiSupportEfforts(row);
-        const capabilities = [
-            ...(efforts.length > 0 ? ["thinking"] : []),
-            "tool_use",
-            ...(kimiInputHasImage(row) ? ["image_in"] : []),
-        ];
-        lines.push("", `[models."cpac/${slug}"]`, 'provider = "cpac"', `model = ${tomlString(slug)}`, `max_context_size = ${context}`, `capabilities = ${tomlStringArray(capabilities)}`);
-        if (typeof row.display_name === "string" && row.display_name.trim()) {
-            lines.push(`display_name = ${tomlString(row.display_name)}`);
-        }
-        if (efforts.length > 0) {
-            lines.push(`support_efforts = ${tomlStringArray(efforts)}`);
-            const rawDefaultEffort = (typeof row.default_reasoning_level === "string" &&
-                row.default_reasoning_level) ||
-                (typeof row.default_reasoning_effort === "string" &&
-                    row.default_reasoning_effort) ||
-                (typeof row.default_effort === "string" && row.default_effort);
-            const defaultEffort = rawDefaultEffort && efforts.includes(rawDefaultEffort.toLowerCase())
-                ? rawDefaultEffort.toLowerCase()
-                : undefined;
-            if (defaultEffort)
-                lines.push(`default_effort = ${tomlString(defaultEffort)}`);
-        }
-    }
-    lines.push(KIMI_BLOCK_END);
-    const target = kimiConfigPath();
-    ensureCpacBackup(target);
-    writeKimiBlock(target, lines.join("\n"));
-    console.log(`Installed Kimi Code provider config: ${target}`);
-    if (!recorded || !(await proxyIsHealthy(recorded))) {
-        console.log("Loopback proxy is not running; run: cpac inject");
-    }
-}
-export async function uninstallKimiConfig() {
-    const target = kimiConfigPath();
-    if (!isKimiConfigInstalled())
-        throw new CPACError("Kimi Code config is not installed");
-    writeKimiBlock(target, null);
-    console.log(`Removed Kimi Code provider config: ${target}`);
-}
-function grokHome() {
-    const home = process.env.GROK_HOME?.trim() || join(homedir(), ".grok");
-    return expandUserPath(home);
-}
-function grokConfigPath() {
-    return join(grokHome(), "config.toml");
-}
-const GROK_BLOCK_START = "# >>> CPAC Grok >>>";
-const GROK_BLOCK_END = "# <<< CPAC Grok <<<";
-const grokBlockRegex = new RegExp(`${GROK_BLOCK_START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${GROK_BLOCK_END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\n?`);
-export function isGrokConfigInstalled() {
-    try {
-        const content = readFileSync(grokConfigPath(), "utf8");
-        return (grokBlockRegex.test(content) ||
-            /^\s*\[model\.(?:"cpac\/|'cpac\/|cpac-)/m.test(content));
-    }
-    catch {
-        return false;
-    }
-}
-function isCpacGrokTableHeader(line) {
-    const header = line.match(/^\[([^\]]+)\]\s*$/);
-    if (!header)
-        return false;
-    const name = header[1];
-    return /^model\.(?:"cpac\/|'cpac\/|cpac-)/.test(name);
-}
-function stripOrphanCpacGrokTables(content) {
-    const eol = content.includes("\r\n") ? "\r\n" : "\n";
-    const out = [];
-    let skipping = false;
-    for (const line of content.split(/\r?\n/)) {
-        if (/^\[[^\]]+\]\s*$/.test(line))
-            skipping = isCpacGrokTableHeader(line);
-        if (!skipping)
-            out.push(line);
-    }
-    return out.join(eol).replace(/(?:\r?\n){3,}/g, `${eol}${eol}`);
-}
-function writeGrokBlock(path, block) {
-    let content = existsSync(path) ? readFileSync(path, "utf8") : "";
-    content = content.replace(grokBlockRegex, "");
-    const orphan = content.indexOf(GROK_BLOCK_START);
-    if (orphan !== -1)
-        content = content.slice(0, orphan);
-    content = stripOrphanCpacGrokTables(content);
-    if (block) {
-        content = `${content}${content && !content.endsWith("\n") ? "\n" : ""}${block}\n`;
-    }
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const mode = existsSync(path) ? statSync(path).mode & 0o7777 : 0o600;
-    atomicWrite(path, Buffer.from(content), mode);
-}
-export async function installGrokConfig(config) {
-    const apiKey = await resolveApiKey(config.api_key_env);
-    const catalog = await fetchCatalog(config.cpa_url, apiKey);
-    let document;
-    try {
-        document = JSON.parse(new TextDecoder("utf-8").decode(catalog.bytes));
-    }
-    catch {
-        throw new CPACError("invalid CPA catalog");
-    }
-    const rows = catalogModelRows(document) ?? [];
-    if (rows.length === 0)
-        throw new CPACError("CPA catalog contains no models");
-    const state = readState(config.state_dir);
-    const recorded = state ? stateProxy(state) : null;
-    const port = recorded?.port ?? config.codex_proxy_port;
-    if (!port) {
-        throw new CPACError("loopback proxy port unknown; run cpac inject first");
-    }
-    const lines = [GROK_BLOCK_START];
-    for (const row of rows) {
-        const slug = catalogModelId(row);
-        if (!slug)
-            continue;
-        const context = typeof row.context_window === "number" && row.context_window > 0
-            ? Math.floor(row.context_window)
-            : 200000;
-        const name = typeof row.display_name === "string" && row.display_name.trim()
-            ? `${row.display_name.trim()} (CPAC)`
-            : `CPAC ${slug}`;
-        lines.push(`[model."cpac/${slug}"]`, `model = ${tomlString(slug)}`, `base_url = "http://127.0.0.1:${port}/v1"`, 'api_backend = "responses"', '# Placeholder: the CPAC loopback proxy replaces it with the CPA key; run "cpac inject" to start the proxy.', 'api_key = "cpac-loopback"', `name = ${tomlString(name)}`, `context_window = ${context}`, "");
-    }
-    if (lines[lines.length - 1] === "")
-        lines.pop();
-    lines.push(GROK_BLOCK_END);
-    const target = grokConfigPath();
-    ensureCpacBackup(target);
-    writeGrokBlock(target, lines.join("\n"));
-    console.log(`Installed Grok Build provider config: ${target}`);
-    if (!recorded || !(await proxyIsHealthy(recorded))) {
-        console.log("Loopback proxy is not running; run: cpac inject");
-    }
-}
-export async function uninstallGrokConfig() {
-    const target = grokConfigPath();
-    if (!isGrokConfigInstalled())
-        throw new CPACError("Grok Build config is not installed");
-    writeGrokBlock(target, null);
-    console.log(`Removed Grok Build provider config: ${target}`);
-}
-function readPackageVersion() {
-    try {
-        const raw = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8");
-        const version = JSON.parse(raw).version;
-        return typeof version === "string" ? version : "0.0.0-dev";
-    }
-    catch {
-        return "0.0.0-dev";
-    }
-}
-const CPAC_VERSION = readPackageVersion();
-export function detectClientVersion(binary) {
-    if (!/^[\w.-]+$/.test(binary))
-        return undefined;
-    try {
-        const res = spawnSync(binary, ["--version"], {
-            encoding: "utf8",
-            timeout: 2000,
-            stdio: ["ignore", "pipe", "ignore"],
-        });
-        if (res.status === 0 && typeof res.stdout === "string") {
-            const match = res.stdout.match(/v?(\d+\.\d+\.\d+(?:-[\w.]+)?)/);
-            return match ? match[1] : res.stdout.trim().split(/\s+/)[0] || undefined;
-        }
-    }
-    catch {
-        // ignored
-    }
-    return undefined;
-}
-function binaryOnPath(name) {
-    if (!/^[\w.-]+$/.test(name))
-        return false;
-    try {
-        return (spawnSync(`command -v ${name}`, { stdio: "ignore", shell: true }).status ===
-            0);
-    }
-    catch {
-        return false;
-    }
-}
-const TARGETS = [
-    {
-        id: "codex",
-        home: () => expandUserPath(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex")),
-        detected: function () {
-            return existsSync(this.home());
-        },
-        installed: (config) => {
-            try {
-                return readFileSync(config.codex_config, "utf8").includes(MANAGED_MARKER);
-            }
-            catch {
-                return false;
-            }
-        },
-        version: () => detectClientVersion("codex"),
-        install: async (config, dryRun, v2Off, maxContext) => {
-            if (dryRun) {
-                console.log("would inject CPA catalog and loopback proxy into Codex");
-                return;
-            }
-            await inject(config, v2Off, maxContext);
-        },
-        uninstall: async (config, dryRun) => {
-            if (dryRun) {
-                console.log("would restore the original Codex config");
-                return;
-            }
-            await restore(config);
-        },
-    },
-    {
-        id: "pi",
-        home: () => piExtensionsDir(),
-        detected: () => binaryOnPath("pi") || existsSync(piExtensionsDir()),
-        installed: () => isPiExtensionInstalled(),
-        version: () => detectClientVersion("pi"),
-        install: async (config, dryRun) => {
-            if (dryRun) {
-                console.log(`would write Pi extension: ${join(piExtensionsDir(), "cpac.ts")}`);
-                return;
-            }
-            await installPiExtension(config);
-        },
-        uninstall: async (_config, dryRun) => {
-            if (dryRun) {
-                console.log(`would remove Pi extension: ${join(piExtensionsDir(), "cpac.ts")}`);
-                return;
-            }
-            await uninstallPiExtension();
-        },
-    },
-    {
-        id: "kimi",
-        home: () => dirname(kimiConfigPath()),
-        detected: () => binaryOnPath("kimi") || existsSync(dirname(kimiConfigPath())),
-        installed: () => isKimiConfigInstalled(),
-        version: () => detectClientVersion("kimi"),
-        install: async (config, dryRun) => {
-            if (dryRun) {
-                console.log(`would write CPA provider block: ${kimiConfigPath()}`);
-                return;
-            }
-            await installKimiConfig(config);
-        },
-        uninstall: async (_config, dryRun) => {
-            if (dryRun) {
-                console.log(`would remove CPA provider block: ${kimiConfigPath()}`);
-                return;
-            }
-            await uninstallKimiConfig();
-        },
-    },
-    {
-        id: "grok",
-        home: () => grokHome(),
-        detected: () => binaryOnPath("grok") || existsSync(grokHome()),
-        installed: () => isGrokConfigInstalled(),
-        version: () => detectClientVersion("grok"),
-        install: async (config, dryRun) => {
-            if (dryRun) {
-                console.log(`would write CPA provider block: ${grokConfigPath()}`);
-                return;
-            }
-            await installGrokConfig(config);
-        },
-        uninstall: async (_config, dryRun) => {
-            if (dryRun) {
-                console.log(`would remove CPA provider block: ${grokConfigPath()}`);
-                return;
-            }
-            await uninstallGrokConfig();
-        },
-    },
-];
-export async function detectTargets(config) {
-    return TARGETS.map((target) => ({
-        id: target.id,
-        detected: target.detected(),
-        installed: target.installed(config),
-        path: target.home(),
-        version: target.version?.(),
-    }));
-}
-export async function runDetect(config, asJson) {
-    const targets = await detectTargets(config);
-    if (asJson) {
-        console.log(JSON.stringify({ version: CPAC_VERSION, targets }, null, 2));
-        return 0;
-    }
-    for (const target of targets) {
-        console.log(`${target.id.padEnd(8)} ${(target.detected ? "detected" : "missing").padEnd(9)} ${(target.installed ? "installed" : "not installed").padEnd(14)} ${target.path}`);
-    }
-    return 0;
-}
-function selectTargets(requested, all, eligible) {
-    const unknown = requested.filter((id) => !TARGETS.some((target) => target.id === id));
-    if (unknown.length > 0) {
-        throw new CPACError(`unknown target(s): ${unknown.join(", ")}; use ${TARGETS.map((target) => target.id).join(",")}`);
-    }
-    const ids = requested.length > 0
-        ? requested
-        : all
-            ? TARGETS.map((target) => target.id)
-            : eligible;
-    return TARGETS.filter((target) => ids.includes(target.id));
-}
-export async function runInstall(config, requested, options) {
-    const eligible = TARGETS.filter((target) => target.detected()).map((target) => target.id);
-    const selected = selectTargets(requested, options.all, eligible);
-    if (selected.length === 0) {
-        throw new CPACError(`no supported targets detected; use --target ${TARGETS.map((target) => target.id).join(",")} or --all`);
-    }
-    // Catalog context lifting is Codex-specific; refuse to silently skip it on
-    // other targets so the flag never gains cross-agent meaning.
-    if (options.maxContext && selected.some((target) => target.id !== "codex")) {
-        throw new CPACError("--max_context is only valid with --target codex");
-    }
-    for (const target of selected) {
-        if (target.installed(config) && !options.force) {
-            console.log(`${target.id}: already installed; use --force to reinstall`);
-            continue;
-        }
-        await target.install(config, options.dryRun, options.v2Off, options.maxContext);
-    }
-    return 0;
-}
-export async function runSync(config, requested, options) {
-    const installed = TARGETS.filter((target) => target.installed(config)).map((target) => target.id);
-    if (requested.length === 0 && !options.all) {
-        if (installed.length === 0) {
-            throw new CPACError("no installed CPAC integrations found; run cpac install first");
-        }
-        return runInstall(config, installed, {
-            all: false,
-            dryRun: options.dryRun,
-            force: true,
-            v2Off: options.v2Off,
-            maxContext: options.maxContext,
-        });
-    }
-    return runInstall(config, requested, {
-        all: options.all,
-        dryRun: options.dryRun,
-        force: true,
-        v2Off: options.v2Off,
-        maxContext: options.maxContext,
-    });
-}
-export async function runUninstall(config, requested, options) {
-    const eligible = TARGETS.filter((target) => target.installed(config)).map((target) => target.id);
-    const selected = selectTargets(requested, options.all, eligible);
-    if (selected.length === 0) {
-        throw new CPACError("no installed CPAC integrations found; use --target <id> or --all");
-    }
-    for (const target of selected) {
-        if (!target.installed(config)) {
-            console.log(`${target.id}: not installed`);
-            continue;
-        }
-        await target.uninstall(config, options.dryRun);
-    }
-    return 0;
-}
-export async function runRestore(config, requested, options) {
-    if (requested.length > 0 || options.all) {
-        return runUninstall(config, requested, options);
-    }
-    if (options.dryRun) {
-        console.log("would restore the original Codex config");
-        return 0;
-    }
-    await restore(config);
-    return 0;
-}
-function compareVersions(a, b) {
-    const left = a.split(".").map(Number);
-    const right = b.split(".").map(Number);
-    for (let index = 0; index < Math.max(left.length, right.length); index++) {
-        const l = left[index] ?? 0;
-        const r = right[index] ?? 0;
-        if (l !== r)
-            return l > r ? 1 : -1;
-    }
-    return 0;
-}
-export async function runUpgrade(config, checkOnly) {
-    console.log(`Current version: ${CPAC_VERSION}`);
-    let latest;
-    try {
-        const response = await fetch("https://registry.npmjs.org/@yhong91/cpac/latest", {
-            headers: { Accept: "application/json" },
-            signal: AbortSignal.timeout(10_000),
-        });
-        if (response.ok) {
-            const data = (await response.json());
-            if (typeof data.version === "string")
-                latest = data.version;
-        }
-    }
-    catch {
-        latest = undefined;
-    }
-    if (!latest) {
-        console.error("Could not fetch latest version from npm. Check your network connection.");
-        return 1;
-    }
-    console.log(`Latest version: ${latest}`);
-    const upToDate = compareVersions(CPAC_VERSION, latest) >= 0;
-    if (checkOnly) {
-        if (upToDate)
-            console.log("Already up to date.");
-        else
-            console.log("Update available. Run: cpac upgrade");
-        return 0;
-    }
-    if (upToDate) {
-        console.log("Already up to date.");
-    }
-    else {
-        console.log(`Installing @yhong91/cpac@${latest}`);
-        const result = spawnSync("npm", ["install", "-g", `@yhong91/cpac@${latest}`], { stdio: "inherit" });
-        if (result.status !== 0) {
-            console.error("npm install failed");
-            return result.status ?? 1;
-        }
-    }
-    const installed = TARGETS.filter((target) => target.installed(config)).map((target) => target.id);
-    if (installed.length === 0) {
-        console.log("No installed agents to sync.");
-        return 0;
-    }
-    console.log(`Syncing ${installed.join(", ")}`);
-    return runSync(config, [], { all: false, dryRun: false });
-}
 function usage() {
     return [
         "Usage: cpac",