activeclaw 2026.2.11 → 2026.2.13

package/dist/{tailscale-DU6DgqVy.js → auth-9x3lqfIY.js}

@@ -1,7 +1,27 @@
-import { x as logVerbose } from "./entry.js";
-import { n as runExec } from "./exec-B8JKbXKW.js";
+import { S as logVerbose, b as isVerbose, x as isYes } from "./entry.js";
+import { n as runExec } from "./exec-CACT5OAW.js";
+import { i as isTrustedProxyAddress, l as resolveGatewayClientIp, n as isLoopbackAddress, o as parseForwardedForClientIp } from "./ws-C0k_dhCP.js";
+import { stdin, stdout } from "node:process";
 import { existsSync } from "node:fs";
+import { timingSafeEqual } from "node:crypto";
+import readline from "node:readline/promises";
 
+//#region src/cli/prompt.ts
+async function promptYesNo(question, defaultYes = false) {
+	if (isVerbose() && isYes()) return true;
+	if (isYes()) return true;
+	const rl = readline.createInterface({
+		input: stdin,
+		output: stdout
+	});
+	const suffix = defaultYes ? " [Y/n] " : " [y/N] ";
+	const answer = (await rl.question(`${question}${suffix}`)).trim().toLowerCase();
+	rl.close();
+	if (!answer) return defaultYes;
+	return answer.startsWith("y");
+}
+
+//#endregion
 //#region src/infra/tailscale.ts
 function parsePossiblyNoisyJsonObject(stdout) {
 	const trimmed = stdout.trim();
@@ -222,4 +242,189 @@ async function readTailscaleWhoisIdentity(ip, exec = runExec, opts) {
 }
 
 //#endregion
-export { findTailscaleBinary as a, readTailscaleWhoisIdentity as c, enableTailscaleServe as i, disableTailscaleServe as n, getTailnetHostname as o, enableTailscaleFunnel as r, readTailscaleStatusJson as s, disableTailscaleFunnel as t };
+//#region src/security/secret-equal.ts
+function safeEqualSecret(provided, expected) {
+	if (typeof provided !== "string" || typeof expected !== "string") return false;
+	const providedBuffer = Buffer.from(provided);
+	const expectedBuffer = Buffer.from(expected);
+	if (providedBuffer.length !== expectedBuffer.length) return false;
+	return timingSafeEqual(providedBuffer, expectedBuffer);
+}
+
+//#endregion
+//#region src/gateway/auth.ts
+function normalizeLogin(login) {
+	return login.trim().toLowerCase();
+}
+function getHostName(hostHeader) {
+	const host = (hostHeader ?? "").trim().toLowerCase();
+	if (!host) return "";
+	if (host.startsWith("[")) {
+		const end = host.indexOf("]");
+		if (end !== -1) return host.slice(1, end);
+	}
+	const [name] = host.split(":");
+	return name ?? "";
+}
+function headerValue(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+function resolveTailscaleClientIp(req) {
+	if (!req) return;
+	const forwardedFor = headerValue(req.headers?.["x-forwarded-for"]);
+	return forwardedFor ? parseForwardedForClientIp(forwardedFor) : void 0;
+}
+function resolveRequestClientIp(req, trustedProxies) {
+	if (!req) return;
+	return resolveGatewayClientIp({
+		remoteAddr: req.socket?.remoteAddress ?? "",
+		forwardedFor: headerValue(req.headers?.["x-forwarded-for"]),
+		realIp: headerValue(req.headers?.["x-real-ip"]),
+		trustedProxies
+	});
+}
+function isLocalDirectRequest(req, trustedProxies) {
+	if (!req) return false;
+	if (!isLoopbackAddress(resolveRequestClientIp(req, trustedProxies) ?? "")) return false;
+	const host = getHostName(req.headers?.host);
+	const hostIsLocal = host === "localhost" || host === "127.0.0.1" || host === "::1";
+	const hostIsTailscaleServe = host.endsWith(".ts.net");
+	const hasForwarded = Boolean(req.headers?.["x-forwarded-for"] || req.headers?.["x-real-ip"] || req.headers?.["x-forwarded-host"]);
+	const remoteIsTrustedProxy = isTrustedProxyAddress(req.socket?.remoteAddress, trustedProxies);
+	return (hostIsLocal || hostIsTailscaleServe) && (!hasForwarded || remoteIsTrustedProxy);
+}
+function getTailscaleUser(req) {
+	if (!req) return null;
+	const login = req.headers["tailscale-user-login"];
+	if (typeof login !== "string" || !login.trim()) return null;
+	const nameRaw = req.headers["tailscale-user-name"];
+	const profilePic = req.headers["tailscale-user-profile-pic"];
+	const name = typeof nameRaw === "string" && nameRaw.trim() ? nameRaw.trim() : login.trim();
+	return {
+		login: login.trim(),
+		name,
+		profilePic: typeof profilePic === "string" && profilePic.trim() ? profilePic.trim() : void 0
+	};
+}
+function hasTailscaleProxyHeaders(req) {
+	if (!req) return false;
+	return Boolean(req.headers["x-forwarded-for"] && req.headers["x-forwarded-proto"] && req.headers["x-forwarded-host"]);
+}
+function isTailscaleProxyRequest(req) {
+	if (!req) return false;
+	return isLoopbackAddress(req.socket?.remoteAddress) && hasTailscaleProxyHeaders(req);
+}
+async function resolveVerifiedTailscaleUser(params) {
+	const { req, tailscaleWhois } = params;
+	const tailscaleUser = getTailscaleUser(req);
+	if (!tailscaleUser) return {
+		ok: false,
+		reason: "tailscale_user_missing"
+	};
+	if (!isTailscaleProxyRequest(req)) return {
+		ok: false,
+		reason: "tailscale_proxy_missing"
+	};
+	const clientIp = resolveTailscaleClientIp(req);
+	if (!clientIp) return {
+		ok: false,
+		reason: "tailscale_whois_failed"
+	};
+	const whois = await tailscaleWhois(clientIp);
+	if (!whois?.login) return {
+		ok: false,
+		reason: "tailscale_whois_failed"
+	};
+	if (normalizeLogin(whois.login) !== normalizeLogin(tailscaleUser.login)) return {
+		ok: false,
+		reason: "tailscale_user_mismatch"
+	};
+	return {
+		ok: true,
+		user: {
+			login: whois.login,
+			name: whois.name ?? tailscaleUser.name,
+			profilePic: tailscaleUser.profilePic
+		}
+	};
+}
+function resolveGatewayAuth(params) {
+	const authConfig = params.authConfig ?? {};
+	const env = params.env ?? process.env;
+	const token = authConfig.token ?? env.OPENCLAW_GATEWAY_TOKEN ?? env.CLAWDBOT_GATEWAY_TOKEN ?? void 0;
+	const password = authConfig.password ?? env.OPENCLAW_GATEWAY_PASSWORD ?? env.CLAWDBOT_GATEWAY_PASSWORD ?? void 0;
+	const mode = authConfig.mode ?? (password ? "password" : "token");
+	return {
+		mode,
+		token,
+		password,
+		allowTailscale: authConfig.allowTailscale ?? (params.tailscaleMode === "serve" && mode !== "password")
+	};
+}
+function assertGatewayAuthConfigured(auth) {
+	if (auth.mode === "token" && !auth.token) {
+		if (auth.allowTailscale) return;
+		throw new Error("gateway auth mode is token, but no token was configured (set gateway.auth.token or OPENCLAW_GATEWAY_TOKEN)");
+	}
+	if (auth.mode === "password" && !auth.password) throw new Error("gateway auth mode is password, but no password was configured");
+}
+async function authorizeGatewayConnect(params) {
+	const { auth, connectAuth, req, trustedProxies } = params;
+	const tailscaleWhois = params.tailscaleWhois ?? readTailscaleWhoisIdentity;
+	const localDirect = isLocalDirectRequest(req, trustedProxies);
+	if (auth.allowTailscale && !localDirect) {
+		const tailscaleCheck = await resolveVerifiedTailscaleUser({
+			req,
+			tailscaleWhois
+		});
+		if (tailscaleCheck.ok) return {
+			ok: true,
+			method: "tailscale",
+			user: tailscaleCheck.user.login
+		};
+	}
+	if (auth.mode === "token") {
+		if (!auth.token) return {
+			ok: false,
+			reason: "token_missing_config"
+		};
+		if (!connectAuth?.token) return {
+			ok: false,
+			reason: "token_missing"
+		};
+		if (!safeEqualSecret(connectAuth.token, auth.token)) return {
+			ok: false,
+			reason: "token_mismatch"
+		};
+		return {
+			ok: true,
+			method: "token"
+		};
+	}
+	if (auth.mode === "password") {
+		const password = connectAuth?.password;
+		if (!auth.password) return {
+			ok: false,
+			reason: "password_missing_config"
+		};
+		if (!password) return {
+			ok: false,
+			reason: "password_missing"
+		};
+		if (!safeEqualSecret(password, auth.password)) return {
+			ok: false,
+			reason: "password_mismatch"
+		};
+		return {
+			ok: true,
+			method: "password"
+		};
+	}
+	return {
+		ok: false,
+		reason: "unauthorized"
+	};
+}
+
+//#endregion
+export { safeEqualSecret as a, enableTailscaleFunnel as c, getTailnetHostname as d, readTailscaleStatusJson as f, resolveGatewayAuth as i, enableTailscaleServe as l, authorizeGatewayConnect as n, disableTailscaleFunnel as o, promptYesNo as p, isLocalDirectRequest as r, disableTailscaleServe as s, assertGatewayAuthConfigured as t, findTailscaleBinary as u };

package/dist/{tailscale-Cu-2HNvU.js → auth-CQNl_IaI.js}

@@ -1,7 +1,9 @@
-import { A as logVerbose, O as isVerbose, c as defaultRuntime, k as isYes } from "./subsystem-Bh1Y_6Uv.js";
-import { n as runExec } from "./exec-Cv_Ofd1m.js";
+import { A as logVerbose, O as isVerbose, c as defaultRuntime, k as isYes } from "./subsystem-BoExtIHo.js";
+import { n as runExec } from "./exec-YIosokWE.js";
+import { i as isTrustedProxyAddress, l as resolveGatewayClientIp, n as isLoopbackAddress, o as parseForwardedForClientIp } from "./ws-CHCQHs0F.js";
 import { stdin, stdout } from "node:process";
 import { existsSync } from "node:fs";
+import { timingSafeEqual } from "node:crypto";
 import readline from "node:readline/promises";
 
 //#region src/cli/prompt.ts
@@ -249,4 +251,189 @@ async function readTailscaleWhoisIdentity(ip, exec = runExec, opts) {
 }
 
 //#endregion
-export { findTailscaleBinary as a, readTailscaleWhoisIdentity as c, enableTailscaleServe as i, ensureBinary as l, disableTailscaleServe as n, getTailnetHostname as o, enableTailscaleFunnel as r, readTailscaleStatusJson as s, disableTailscaleFunnel as t, promptYesNo as u };
+//#region src/security/secret-equal.ts
+function safeEqualSecret(provided, expected) {
+	if (typeof provided !== "string" || typeof expected !== "string") return false;
+	const providedBuffer = Buffer.from(provided);
+	const expectedBuffer = Buffer.from(expected);
+	if (providedBuffer.length !== expectedBuffer.length) return false;
+	return timingSafeEqual(providedBuffer, expectedBuffer);
+}
+
+//#endregion
+//#region src/gateway/auth.ts
+function normalizeLogin(login) {
+	return login.trim().toLowerCase();
+}
+function getHostName(hostHeader) {
+	const host = (hostHeader ?? "").trim().toLowerCase();
+	if (!host) return "";
+	if (host.startsWith("[")) {
+		const end = host.indexOf("]");
+		if (end !== -1) return host.slice(1, end);
+	}
+	const [name] = host.split(":");
+	return name ?? "";
+}
+function headerValue(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+function resolveTailscaleClientIp(req) {
+	if (!req) return;
+	const forwardedFor = headerValue(req.headers?.["x-forwarded-for"]);
+	return forwardedFor ? parseForwardedForClientIp(forwardedFor) : void 0;
+}
+function resolveRequestClientIp(req, trustedProxies) {
+	if (!req) return;
+	return resolveGatewayClientIp({
+		remoteAddr: req.socket?.remoteAddress ?? "",
+		forwardedFor: headerValue(req.headers?.["x-forwarded-for"]),
+		realIp: headerValue(req.headers?.["x-real-ip"]),
+		trustedProxies
+	});
+}
+function isLocalDirectRequest(req, trustedProxies) {
+	if (!req) return false;
+	if (!isLoopbackAddress(resolveRequestClientIp(req, trustedProxies) ?? "")) return false;
+	const host = getHostName(req.headers?.host);
+	const hostIsLocal = host === "localhost" || host === "127.0.0.1" || host === "::1";
+	const hostIsTailscaleServe = host.endsWith(".ts.net");
+	const hasForwarded = Boolean(req.headers?.["x-forwarded-for"] || req.headers?.["x-real-ip"] || req.headers?.["x-forwarded-host"]);
+	const remoteIsTrustedProxy = isTrustedProxyAddress(req.socket?.remoteAddress, trustedProxies);
+	return (hostIsLocal || hostIsTailscaleServe) && (!hasForwarded || remoteIsTrustedProxy);
+}
+function getTailscaleUser(req) {
+	if (!req) return null;
+	const login = req.headers["tailscale-user-login"];
+	if (typeof login !== "string" || !login.trim()) return null;
+	const nameRaw = req.headers["tailscale-user-name"];
+	const profilePic = req.headers["tailscale-user-profile-pic"];
+	const name = typeof nameRaw === "string" && nameRaw.trim() ? nameRaw.trim() : login.trim();
+	return {
+		login: login.trim(),
+		name,
+		profilePic: typeof profilePic === "string" && profilePic.trim() ? profilePic.trim() : void 0
+	};
+}
+function hasTailscaleProxyHeaders(req) {
+	if (!req) return false;
+	return Boolean(req.headers["x-forwarded-for"] && req.headers["x-forwarded-proto"] && req.headers["x-forwarded-host"]);
+}
+function isTailscaleProxyRequest(req) {
+	if (!req) return false;
+	return isLoopbackAddress(req.socket?.remoteAddress) && hasTailscaleProxyHeaders(req);
+}
+async function resolveVerifiedTailscaleUser(params) {
+	const { req, tailscaleWhois } = params;
+	const tailscaleUser = getTailscaleUser(req);
+	if (!tailscaleUser) return {
+		ok: false,
+		reason: "tailscale_user_missing"
+	};
+	if (!isTailscaleProxyRequest(req)) return {
+		ok: false,
+		reason: "tailscale_proxy_missing"
+	};
+	const clientIp = resolveTailscaleClientIp(req);
+	if (!clientIp) return {
+		ok: false,
+		reason: "tailscale_whois_failed"
+	};
+	const whois = await tailscaleWhois(clientIp);
+	if (!whois?.login) return {
+		ok: false,
+		reason: "tailscale_whois_failed"
+	};
+	if (normalizeLogin(whois.login) !== normalizeLogin(tailscaleUser.login)) return {
+		ok: false,
+		reason: "tailscale_user_mismatch"
+	};
+	return {
+		ok: true,
+		user: {
+			login: whois.login,
+			name: whois.name ?? tailscaleUser.name,
+			profilePic: tailscaleUser.profilePic
+		}
+	};
+}
+function resolveGatewayAuth(params) {
+	const authConfig = params.authConfig ?? {};
+	const env = params.env ?? process.env;
+	const token = authConfig.token ?? env.OPENCLAW_GATEWAY_TOKEN ?? env.CLAWDBOT_GATEWAY_TOKEN ?? void 0;
+	const password = authConfig.password ?? env.OPENCLAW_GATEWAY_PASSWORD ?? env.CLAWDBOT_GATEWAY_PASSWORD ?? void 0;
+	const mode = authConfig.mode ?? (password ? "password" : "token");
+	return {
+		mode,
+		token,
+		password,
+		allowTailscale: authConfig.allowTailscale ?? (params.tailscaleMode === "serve" && mode !== "password")
+	};
+}
+function assertGatewayAuthConfigured(auth) {
+	if (auth.mode === "token" && !auth.token) {
+		if (auth.allowTailscale) return;
+		throw new Error("gateway auth mode is token, but no token was configured (set gateway.auth.token or OPENCLAW_GATEWAY_TOKEN)");
+	}
+	if (auth.mode === "password" && !auth.password) throw new Error("gateway auth mode is password, but no password was configured");
+}
+async function authorizeGatewayConnect(params) {
+	const { auth, connectAuth, req, trustedProxies } = params;
+	const tailscaleWhois = params.tailscaleWhois ?? readTailscaleWhoisIdentity;
+	const localDirect = isLocalDirectRequest(req, trustedProxies);
+	if (auth.allowTailscale && !localDirect) {
+		const tailscaleCheck = await resolveVerifiedTailscaleUser({
+			req,
+			tailscaleWhois
+		});
+		if (tailscaleCheck.ok) return {
+			ok: true,
+			method: "tailscale",
+			user: tailscaleCheck.user.login
+		};
+	}
+	if (auth.mode === "token") {
+		if (!auth.token) return {
+			ok: false,
+			reason: "token_missing_config"
+		};
+		if (!connectAuth?.token) return {
+			ok: false,
+			reason: "token_missing"
+		};
+		if (!safeEqualSecret(connectAuth.token, auth.token)) return {
+			ok: false,
+			reason: "token_mismatch"
+		};
+		return {
+			ok: true,
+			method: "token"
+		};
+	}
+	if (auth.mode === "password") {
+		const password = connectAuth?.password;
+		if (!auth.password) return {
+			ok: false,
+			reason: "password_missing_config"
+		};
+		if (!password) return {
+			ok: false,
+			reason: "password_missing"
+		};
+		if (!safeEqualSecret(password, auth.password)) return {
+			ok: false,
+			reason: "password_mismatch"
+		};
+		return {
+			ok: true,
+			method: "password"
+		};
+	}
+	return {
+		ok: false,
+		reason: "unauthorized"
+	};
+}
+
+//#endregion
+export { safeEqualSecret as a, enableTailscaleFunnel as c, getTailnetHostname as d, readTailscaleStatusJson as f, resolveGatewayAuth as i, enableTailscaleServe as l, promptYesNo as m, authorizeGatewayConnect as n, disableTailscaleFunnel as o, ensureBinary as p, isLocalDirectRequest as r, disableTailscaleServe as s, assertGatewayAuthConfigured as t, findTailscaleBinary as u };

package/dist/{auth-health-BFKUoCwJ.js → auth-health-C4L4FGBA.js}

@@ -1,4 +1,4 @@
-import { Ct as resolveAuthProfileDisplayLabel } from "./model-selection-BK7DuyH8.js";
+import { Ct as resolveAuthProfileDisplayLabel } from "./model-selection-BLuqsGVB.js";
 
 //#region src/agents/auth-health.ts
 const DEFAULT_OAUTH_WARN_MS = 1440 * 60 * 1e3;

package/dist/{auth-health-d7BMZlWG.js → auth-health-j6epgQbq.js}

@@ -1,4 +1,4 @@
-import { Et as resolveAuthProfileDisplayLabel } from "./auth-profiles-Bv1AEm-Y.js";
+import { Et as resolveAuthProfileDisplayLabel } from "./auth-profiles-ByNs3eEm.js";
 
 //#region src/agents/auth-health.ts
 const DEFAULT_OAUTH_WARN_MS = 1440 * 60 * 1e3;

package/dist/{auth-profiles-Bv1AEm-Y.js → auth-profiles-ByNs3eEm.js}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { X as resolveStateDir, Y as resolveOAuthPath, n as isTruthyEnvValue, o as createSubsystemLogger } from "./entry.js";
-import { t as formatCliCommand } from "./command-format-ayFsmwwz.js";
+import { X as resolveOAuthPath, Z as resolveStateDir, n as isTruthyEnvValue, o as createSubsystemLogger } from "./entry.js";
+import { t as formatCliCommand } from "./command-format-Bxe0mWee.js";
 import { n as DEFAULT_AGENT_ID } from "./session-key-DVvxnFKg.js";
-import { y as resolveUserPath } from "./utils-Dk86IbEs.js";
-import { a as resolveAgentModelPrimary } from "./agent-scope-DQuy3dwI.js";
-import { a as saveJsonFile, i as loadJsonFile, r as resolveCopilotApiToken, t as DEFAULT_COPILOT_API_BASE_URL } from "./github-copilot-token-SLWintYd.js";
+import { y as resolveUserPath } from "./utils-BLJAc3ZV.js";
+import { a as resolveAgentModelPrimary } from "./agent-scope-CsRbLH4l.js";
+import { a as saveJsonFile, i as loadJsonFile, r as resolveCopilotApiToken, t as DEFAULT_COPILOT_API_BASE_URL } from "./github-copilot-token-Cfs0Wxr8.js";
 import { execFileSync, execSync } from "node:child_process";
 import path from "node:path";
 import fs from "node:fs";
@@ -534,6 +534,7 @@ function resolveEnvApiKey(provider) {
 		cerebras: "CEREBRAS_API_KEY",
 		xai: "XAI_API_KEY",
 		openrouter: "OPENROUTER_API_KEY",
+		litellm: "LITELLM_API_KEY",
 		"vercel-ai-gateway": "AI_GATEWAY_API_KEY",
 		"cloudflare-ai-gateway": "CLOUDFLARE_AI_GATEWAY_API_KEY",
 		moonshot: "MOONSHOT_API_KEY",
@@ -1282,10 +1283,23 @@ const QIANFAN_DEFAULT_COST = {
 	cacheRead: 0,
 	cacheWrite: 0
 };
-async function discoverOllamaModels() {
+/**
+* Derive the Ollama native API base URL from a configured base URL.
+*
+* Users typically configure `baseUrl` with a `/v1` suffix (e.g.
+* `http://192.168.20.14:11434/v1`) for the OpenAI-compatible endpoint.
+* The native Ollama API lives at the root (e.g. `/api/tags`), so we
+* strip the `/v1` suffix when present.
+*/
+function resolveOllamaApiBase(configuredBaseUrl) {
+	if (!configuredBaseUrl) return OLLAMA_API_BASE_URL;
+	return configuredBaseUrl.replace(/\/+$/, "").replace(/\/v1$/i, "");
+}
+async function discoverOllamaModels(baseUrl) {
 	if (process.env.VITEST || false) return [];
 	try {
-		const response = await fetch(`${OLLAMA_API_BASE_URL}/api/tags`, { signal: AbortSignal.timeout(5e3) });
+		const apiBase = resolveOllamaApiBase(baseUrl);
+		const response = await fetch(`${apiBase}/api/tags`, { signal: AbortSignal.timeout(5e3) });
 		if (!response.ok) {
 			console.warn(`Failed to discover Ollama models: ${response.status}`);
 			return [];
@@ -1407,23 +1421,53 @@ function buildMinimaxProvider() {
 	return {
 		baseUrl: MINIMAX_API_BASE_URL,
 		api: "openai-completions",
-		models: [{
-			id: MINIMAX_DEFAULT_MODEL_ID,
-			name: "MiniMax M2.1",
-			reasoning: false,
-			input: ["text"],
-			cost: MINIMAX_API_COST,
-			contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
-			maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
-		}, {
-			id: MINIMAX_DEFAULT_VISION_MODEL_ID,
-			name: "MiniMax VL 01",
-			reasoning: false,
-			input: ["text", "image"],
-			cost: MINIMAX_API_COST,
-			contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
-			maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
-		}]
+		models: [
+			{
+				id: MINIMAX_DEFAULT_MODEL_ID,
+				name: "MiniMax M2.1",
+				reasoning: false,
+				input: ["text"],
+				cost: MINIMAX_API_COST,
+				contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
+				maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
+			},
+			{
+				id: "MiniMax-M2.1-lightning",
+				name: "MiniMax M2.1 Lightning",
+				reasoning: false,
+				input: ["text"],
+				cost: MINIMAX_API_COST,
+				contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
+				maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
+			},
+			{
+				id: MINIMAX_DEFAULT_VISION_MODEL_ID,
+				name: "MiniMax VL 01",
+				reasoning: false,
+				input: ["text", "image"],
+				cost: MINIMAX_API_COST,
+				contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
+				maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
+			},
+			{
+				id: "MiniMax-M2.5",
+				name: "MiniMax M2.5",
+				reasoning: true,
+				input: ["text"],
+				cost: MINIMAX_API_COST,
+				contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
+				maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
+			},
+			{
+				id: "MiniMax-M2.5-Lightning",
+				name: "MiniMax M2.5 Lightning",
+				reasoning: true,
+				input: ["text"],
+				cost: MINIMAX_API_COST,
+				contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
+				maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
+			}
+		]
 	};
 }
 function buildMinimaxPortalProvider() {
@@ -1438,6 +1482,14 @@ function buildMinimaxPortalProvider() {
 			cost: MINIMAX_API_COST,
 			contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
 			maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
+		}, {
+			id: "MiniMax-M2.5",
+			name: "MiniMax M2.5",
+			reasoning: true,
+			input: ["text"],
+			cost: MINIMAX_API_COST,
+			contextWindow: MINIMAX_DEFAULT_CONTEXT_WINDOW,
+			maxTokens: MINIMAX_DEFAULT_MAX_TOKENS
 		}]
 	};
 }
@@ -1508,11 +1560,12 @@ async function buildVeniceProvider() {
 		models: await discoverVeniceModels()
 	};
 }
-async function buildOllamaProvider() {
+async function buildOllamaProvider(configuredBaseUrl) {
+	const models = await discoverOllamaModels(configuredBaseUrl);
 	return {
-		baseUrl: OLLAMA_BASE_URL,
+		baseUrl: configuredBaseUrl ?? OLLAMA_BASE_URL,
 		api: "openai-completions",
-		models: await discoverOllamaModels()
+		models
 	};
 }
 function buildTogetherProvider() {
@@ -1622,10 +1675,13 @@ async function resolveImplicitProviders(params) {
 		provider: "ollama",
 		store: authStore
 	});
-	if (ollamaKey) providers.ollama = {
-		...await buildOllamaProvider(),
-		apiKey: ollamaKey
-	};
+	if (ollamaKey) {
+		const ollamaBaseUrl = params.explicitProviders?.ollama?.baseUrl;
+		providers.ollama = {
+			...await buildOllamaProvider(ollamaBaseUrl),
+			apiKey: ollamaKey
+		};
+	}
 	const togetherKey = resolveEnvApiKeyVarName("together") ?? resolveApiKeyFromProfiles({
 		provider: "together",
 		store: authStore

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "2026.2.11",
-  "commit": "28e8457ce87d246921270d6266cf0ed04e14dae7",
-  "builtAt": "2026-02-11T05:17:05.734Z"
+  "version": "2026.2.13",
+  "commit": "a5516aa558835f9a5a093b567b24f6657987810e",
+  "builtAt": "2026-02-13T02:29:14.868Z"
 }