aemeathcli 1.0.0

package/dist/chunk-4IJD72YB.js

@@ -0,0 +1,184 @@
+import { getCredentialsPath, ensureSecureDirectory, getAemeathHome } from './chunk-NBR3GHMT.js';
+import { logger } from './chunk-JAXXTYID.js';
+import { scryptSync, randomBytes, createCipheriv, createDecipheriv } from 'crypto';
+import { existsSync, chmodSync, writeFileSync, readFileSync } from 'fs';
+
+var SERVICE_PREFIX = "com.aemeathcli";
+var ALGORITHM = "aes-256-gcm";
+var KEY_LENGTH = 32;
+var IV_LENGTH = 16;
+var TAG_LENGTH = 16;
+var SALT_LENGTH = 32;
+function getServiceName(provider) {
+  return `${SERVICE_PREFIX}.${provider}`;
+}
+var CredentialStore = class {
+  keytarAvailable;
+  /**
+   * Store a credential for a provider.
+   */
+  async set(provider, credential) {
+    const data = JSON.stringify(credential);
+    const service = getServiceName(provider);
+    if (await this.isKeytarAvailable()) {
+      try {
+        const keytar = await this.getKeytar();
+        await keytar.setPassword(service, provider, data);
+        logger.info({ provider }, "Credential stored in OS keychain");
+        return;
+      } catch (error) {
+        logger.warn({ provider }, "OS keychain store failed, using encrypted fallback");
+      }
+    }
+    this.storeEncrypted(provider, data);
+  }
+  /**
+   * Get a credential for a provider.
+   */
+  async get(provider) {
+    const service = getServiceName(provider);
+    if (await this.isKeytarAvailable()) {
+      try {
+        const keytar = await this.getKeytar();
+        const data = await keytar.getPassword(service, provider);
+        if (data) {
+          return JSON.parse(data);
+        }
+      } catch {
+      }
+    }
+    return this.loadEncrypted(provider);
+  }
+  /**
+   * Delete a credential for a provider.
+   */
+  async delete(provider) {
+    const service = getServiceName(provider);
+    if (await this.isKeytarAvailable()) {
+      try {
+        const keytar = await this.getKeytar();
+        await keytar.deletePassword(service, provider);
+      } catch {
+      }
+    }
+    this.deleteEncrypted(provider);
+  }
+  /**
+   * Check if a credential exists for a provider.
+   */
+  async has(provider) {
+    const credential = await this.get(provider);
+    return credential !== void 0;
+  }
+  // ── Encrypted File Fallback ────────────────────────────────────────────
+  getEncryptionKey(salt) {
+    const machineId = process.env["USER"] ?? process.env["USERNAME"] ?? "aemeathcli";
+    const homedir = process.env["HOME"] ?? process.env["USERPROFILE"] ?? "/";
+    const password = `aemeathcli-${machineId}-${homedir}`;
+    return scryptSync(password, salt, KEY_LENGTH, {
+      N: 32768,
+      r: 8,
+      p: 1,
+      maxmem: 64 * 1024 * 1024
+    });
+  }
+  storeEncrypted(provider, data) {
+    const credPath = getCredentialsPath();
+    ensureSecureDirectory(getAemeathHome());
+    let store = {};
+    if (existsSync(credPath)) {
+      try {
+        const existing = this.decryptFile(credPath);
+        store = JSON.parse(existing);
+      } catch {
+        store = {};
+      }
+    }
+    store[provider] = data;
+    this.encryptFile(credPath, JSON.stringify(store));
+    chmodSync(credPath, 384);
+    logger.info({ provider }, "Credential stored in encrypted fallback");
+  }
+  loadEncrypted(provider) {
+    const credPath = getCredentialsPath();
+    if (!existsSync(credPath)) {
+      return void 0;
+    }
+    try {
+      const content = this.decryptFile(credPath);
+      const store = JSON.parse(content);
+      const data = store[provider];
+      if (data) {
+        return JSON.parse(data);
+      }
+    } catch {
+      return void 0;
+    }
+    return void 0;
+  }
+  deleteEncrypted(provider) {
+    const credPath = getCredentialsPath();
+    if (!existsSync(credPath)) {
+      return;
+    }
+    try {
+      const content = this.decryptFile(credPath);
+      const store = JSON.parse(content);
+      delete store[provider];
+      this.encryptFile(credPath, JSON.stringify(store));
+    } catch {
+    }
+  }
+  encryptFile(filePath, plaintext) {
+    const salt = randomBytes(SALT_LENGTH);
+    const key = this.getEncryptionKey(salt);
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const output = Buffer.concat([salt, iv, tag, encrypted]);
+    writeFileSync(filePath, output);
+  }
+  decryptFile(filePath) {
+    const fileContent = readFileSync(filePath);
+    const hasStoredSalt = fileContent.length > SALT_LENGTH + IV_LENGTH + TAG_LENGTH;
+    let salt;
+    let dataOffset;
+    if (hasStoredSalt) {
+      salt = fileContent.subarray(0, SALT_LENGTH);
+      dataOffset = SALT_LENGTH;
+    } else {
+      const machineId = process.env["USER"] ?? process.env["USERNAME"] ?? "aemeathcli";
+      salt = Buffer.from(`aemeathcli-${machineId}`.padEnd(SALT_LENGTH, "\0").slice(0, SALT_LENGTH));
+      dataOffset = 0;
+    }
+    const key = this.getEncryptionKey(salt);
+    const iv = fileContent.subarray(dataOffset, dataOffset + IV_LENGTH);
+    const tag = fileContent.subarray(dataOffset + IV_LENGTH, dataOffset + IV_LENGTH + TAG_LENGTH);
+    const encrypted = fileContent.subarray(dataOffset + IV_LENGTH + TAG_LENGTH);
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    return decrypted.toString("utf-8");
+  }
+  // ── Keytar Detection ───────────────────────────────────────────────────
+  async isKeytarAvailable() {
+    if (this.keytarAvailable !== void 0) {
+      return this.keytarAvailable;
+    }
+    try {
+      await import('keytar');
+      this.keytarAvailable = true;
+    } catch {
+      this.keytarAvailable = false;
+    }
+    return this.keytarAvailable;
+  }
+  async getKeytar() {
+    return import('keytar');
+  }
+};
+
+export { CredentialStore };
+//# sourceMappingURL=chunk-4IJD72YB.js.map
+//# sourceMappingURL=chunk-4IJD72YB.js.map

package/dist/chunk-4IJD72YB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/credential-store.ts"],"names":[],"mappings":";;;;;AAYA,IAAM,cAAA,GAAiB,gBAAA;AACvB,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,SAAA,GAAY,EAAA;AAClB,IAAM,UAAA,GAAa,EAAA;AACnB,IAAM,WAAA,GAAc,EAAA;AAEpB,SAAS,eAAe,QAAA,EAAgC;AACtD,EAAA,OAAO,CAAA,EAAG,cAAc,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACtC;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACnB,eAAA;AAAA;AAAA;AAAA;AAAA,EAKR,MAAM,GAAA,CAAI,QAAA,EAAwB,UAAA,EAAwC;AACxE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,UAAU,CAAA;AACtC,IAAA,MAAM,OAAA,GAAU,eAAe,QAAQ,CAAA;AAEvC,IAAA,IAAI,MAAM,IAAA,CAAK,iBAAA,EAAkB,EAAG;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,EAAU;AACpC,QAAA,MAAM,MAAA,CAAO,WAAA,CAAY,OAAA,EAAS,QAAA,EAAU,IAAI,CAAA;AAChD,QAAA,MAAA,CAAO,IAAA,CAAK,EAAE,QAAA,EAAS,EAAG,kCAAkC,CAAA;AAC5D,QAAA;AAAA,MACF,SAAS,KAAA,EAAgB;AACvB,QAAA,MAAA,CAAO,IAAA,CAAK,EAAE,QAAA,EAAS,EAAG,oDAAoD,CAAA;AAAA,MAChF;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,cAAA,CAAe,UAAU,IAAI,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,QAAA,EAA0D;AAClE,IAAA,MAAM,OAAA,GAAU,eAAe,QAAQ,CAAA;AAEvC,IAAA,IAAI,MAAM,IAAA,CAAK,iBAAA,EAAkB,EAAG;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,EAAU;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,WAAA,CAAY,SAAS,QAAQ,CAAA;AACvD,QAAA,IAAI,IAAA,EAAM;AACR,UAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QACxB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAGA,IAAA,OAAO,IAAA,CAAK,cAAc,QAAQ,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,QAAA,EAAuC;AAClD,IAAA,MAAM,OAAA,GAAU,eAAe,QAAQ,CAAA;AAEvC,IAAA,IAAI,MAAM,IAAA,CAAK,iBAAA,EAAkB,EAAG;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,EAAU;AACpC,QAAA,MAAM,MAAA,CAAO,cAAA,CAAe,OAAA,EAAS,QAAQ,CAAA;AAAA,MAC/C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAGA,IAAA,IAAA,CAAK,gBAAgB,QAAQ,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,QAAA,EAA0C;AAClD,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,GAAA,CAAI,QAAQ,CAAA;AAC1C,IAAA,OAAO,UAAA,KAAe,MAAA;AAAA,EACxB;AAAA;AAAA,EAIQ,iBAAiB,IAAA,EAAsB;AAE7C,IAAA,MAAM,SAAA,GAAY,QAAQ,GAAA,CAAI,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,IAAK,YAAA;AACpE,IAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA,IAAK,GAAA;AACrE,IAAA,MAAM,QAAA,GAAW,CAAA,WAAA,EAAc,SAAS,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AACnD,IAAA,OAAO,UAAA,CAAW,QAAA,EAAU,IAAA,EAAM,UAAA,EAAY;AAAA,MAC5C,CAAA,EAAG,KAAA;AAAA,MACH,CAAA,EAAG,CAAA;AAAA,MACH,CAAA,EAAG,CAAA;AAAA,MACH,MAAA,EAAQ,KAAK,IAAA,GAAO;AAAA,KACrB,CAAA;AAAA,EACH;AAAA,EAEQ,cAAA,CAAe,UAAwB,IAAA,EAAoB;AACjE,IAAA,MAAM,WAAW,kBAAA,EAAmB;AACpC,IAAA,qBAAA,CAAsB,gBAAgB,CAAA;AAEtC,IAAA,IAAI,QAAgC,EAAC;AACrC,IAAA,IAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACxB,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,QAAQ,CAAA;AAC1C,QAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,QAAQ,CAAA;AAAA,MAC7B,CAAA,CAAA,MAAQ;AACN,QAAA,KAAA,GAAQ,EAAC;AAAA,MACX;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAClB,IAAA,IAAA,CAAK,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAChD,IAAA,SAAA,CAAU,UAAU,GAAK,CAAA;AACzB,IAAA,MAAA,CAAO,IAAA,CAAK,EAAE,QAAA,EAAS,EAAG,yCAAyC,CAAA;AAAA,EACrE;AAAA,EAEQ,cAAc,QAAA,EAAiD;AACrE,IAAA,MAAM,WAAW,kBAAA,EAAmB;AACpC,IAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG;AACzB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,QAAQ,CAAA;AACzC,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAChC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAQ,CAAA;AAC3B,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MACxB;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,gBAAgB,QAAA,EAA8B;AACpD,IAAA,MAAM,WAAW,kBAAA,EAAmB;AACpC,IAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG;AACzB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,QAAQ,CAAA;AACzC,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAChC,MAAA,OAAO,MAAM,QAAQ,CAAA;AACrB,MAAA,IAAA,CAAK,WAAA,CAAY,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,IAClD,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,WAAA,CAAY,UAAkB,SAAA,EAAyB;AAC7D,IAAA,MAAM,IAAA,GAAO,YAAY,WAAW,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,gBAAA,CAAiB,IAAI,CAAA;AACtC,IAAA,MAAM,EAAA,GAAK,YAAY,SAAS,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,SAAA,EAAW,GAAA,EAAK,EAAE,CAAA;AAChD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,OAAO,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACnF,IAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAG9B,IAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO,CAAC,MAAM,EAAA,EAAI,GAAA,EAAK,SAAS,CAAC,CAAA;AACvD,IAAA,aAAA,CAAc,UAAU,MAAM,CAAA;AAAA,EAChC;AAAA,EAEQ,YAAY,QAAA,EAA0B;AAC5C,IAAA,MAAM,WAAA,GAAc,aAAa,QAAQ,CAAA;AAGzC,IAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,MAAA,GAAS,WAAA,GAAc,SAAA,GAAY,UAAA;AACrE,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,UAAA;AAEJ,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IAAA,GAAO,WAAA,CAAY,QAAA,CAAS,CAAA,EAAG,WAAW,CAAA;AAC1C,MAAA,UAAA,GAAa,WAAA;AAAA,IACf,CAAA,MAAO;AAEL,MAAA,MAAM,SAAA,GAAY,QAAQ,GAAA,CAAI,MAAM,KAAK,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,IAAK,YAAA;AACpE,MAAA,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,CAAA,WAAA,EAAc,SAAS,CAAA,CAAA,CAAG,MAAA,CAAO,WAAA,EAAa,IAAI,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,WAAW,CAAC,CAAA;AAC5F,MAAA,UAAA,GAAa,CAAA;AAAA,IACf;AAEA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,gBAAA,CAAiB,IAAI,CAAA;AACtC,IAAA,MAAM,EAAA,GAAK,WAAA,CAAY,QAAA,CAAS,UAAA,EAAY,aAAa,SAAS,CAAA;AAClE,IAAA,MAAM,MAAM,WAAA,CAAY,QAAA,CAAS,aAAa,SAAA,EAAW,UAAA,GAAa,YAAY,UAAU,CAAA;AAC5F,IAAA,MAAM,SAAA,GAAY,WAAA,CAAY,QAAA,CAAS,UAAA,GAAa,YAAY,UAAU,CAAA;AAE1E,IAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,SAAA,EAAW,GAAA,EAAK,EAAE,CAAA;AACpD,IAAA,QAAA,CAAS,WAAW,GAAG,CAAA;AACvB,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAE9E,IAAA,OAAO,SAAA,CAAU,SAAS,OAAO,CAAA;AAAA,EACnC;AAAA;AAAA,EAIA,MAAc,iBAAA,GAAsC;AAClD,IAAA,IAAI,IAAA,CAAK,oBAAoB,MAAA,EAAW;AACtC,MAAA,OAAO,IAAA,CAAK,eAAA;AAAA,IACd;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,QAAQ,CAAA;AACrB,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,IACzB;AAEA,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACd;AAAA,EAEA,MAAc,SAAA,GAA8C;AAC1D,IAAA,OAAO,OAAO,QAAQ,CAAA;AAAA,EACxB;AACF","file":"chunk-4IJD72YB.js","sourcesContent":["/**\n * Credential storage per PRD section 13.6\n * Primary: OS keychain via node-keytar\n * Fallback: AES-256-GCM encrypted file\n */\n\nimport { createCipheriv, createDecipheriv, randomBytes, scryptSync } from \"node:crypto\";\nimport { readFileSync, writeFileSync, existsSync, chmodSync } from \"node:fs\";\nimport type { ProviderName, ICredential } from \"../types/index.js\";\nimport { getCredentialsPath, ensureSecureDirectory, getAemeathHome } from \"../utils/index.js\";\nimport { logger } from \"../utils/index.js\";\n\nconst SERVICE_PREFIX = \"com.aemeathcli\";\nconst ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\nconst IV_LENGTH = 16;\nconst TAG_LENGTH = 16;\nconst SALT_LENGTH = 32;\n\nfunction getServiceName(provider: ProviderName): string {\n  return `${SERVICE_PREFIX}.${provider}`;\n}\n\nexport class CredentialStore {\n  private keytarAvailable: boolean | undefined;\n\n  /**\n   * Store a credential for a provider.\n   */\n  async set(provider: ProviderName, credential: ICredential): Promise<void> {\n    const data = JSON.stringify(credential);\n    const service = getServiceName(provider);\n\n    if (await this.isKeytarAvailable()) {\n      try {\n        const keytar = await this.getKeytar();\n        await keytar.setPassword(service, provider, data);\n        logger.info({ provider }, \"Credential stored in OS keychain\");\n        return;\n      } catch (error: unknown) {\n        logger.warn({ provider }, \"OS keychain store failed, using encrypted fallback\");\n      }\n    }\n\n    // Fallback: encrypted file\n    this.storeEncrypted(provider, data);\n  }\n\n  /**\n   * Get a credential for a provider.\n   */\n  async get(provider: ProviderName): Promise<ICredential | undefined> {\n    const service = getServiceName(provider);\n\n    if (await this.isKeytarAvailable()) {\n      try {\n        const keytar = await this.getKeytar();\n        const data = await keytar.getPassword(service, provider);\n        if (data) {\n          return JSON.parse(data) as ICredential;\n        }\n      } catch {\n        // Try fallback\n      }\n    }\n\n    // Fallback: encrypted file\n    return this.loadEncrypted(provider);\n  }\n\n  /**\n   * Delete a credential for a provider.\n   */\n  async delete(provider: ProviderName): Promise<void> {\n    const service = getServiceName(provider);\n\n    if (await this.isKeytarAvailable()) {\n      try {\n        const keytar = await this.getKeytar();\n        await keytar.deletePassword(service, provider);\n      } catch {\n        // Ignore\n      }\n    }\n\n    // Also clean fallback\n    this.deleteEncrypted(provider);\n  }\n\n  /**\n   * Check if a credential exists for a provider.\n   */\n  async has(provider: ProviderName): Promise<boolean> {\n    const credential = await this.get(provider);\n    return credential !== undefined;\n  }\n\n  // ── Encrypted File Fallback ────────────────────────────────────────────\n\n  private getEncryptionKey(salt: Buffer): Buffer {\n    // Derive key from machine-specific data + random salt using scrypt with high cost\n    const machineId = process.env[\"USER\"] ?? process.env[\"USERNAME\"] ?? \"aemeathcli\";\n    const homedir = process.env[\"HOME\"] ?? process.env[\"USERPROFILE\"] ?? \"/\";\n    const password = `aemeathcli-${machineId}-${homedir}`;\n    return scryptSync(password, salt, KEY_LENGTH, {\n      N: 32768,\n      r: 8,\n      p: 1,\n      maxmem: 64 * 1024 * 1024,\n    });\n  }\n\n  private storeEncrypted(provider: ProviderName, data: string): void {\n    const credPath = getCredentialsPath();\n    ensureSecureDirectory(getAemeathHome());\n\n    let store: Record<string, string> = {};\n    if (existsSync(credPath)) {\n      try {\n        const existing = this.decryptFile(credPath);\n        store = JSON.parse(existing) as Record<string, string>;\n      } catch {\n        store = {};\n      }\n    }\n\n    store[provider] = data;\n    this.encryptFile(credPath, JSON.stringify(store));\n    chmodSync(credPath, 0o600);\n    logger.info({ provider }, \"Credential stored in encrypted fallback\");\n  }\n\n  private loadEncrypted(provider: ProviderName): ICredential | undefined {\n    const credPath = getCredentialsPath();\n    if (!existsSync(credPath)) {\n      return undefined;\n    }\n\n    try {\n      const content = this.decryptFile(credPath);\n      const store = JSON.parse(content) as Record<string, string>;\n      const data = store[provider];\n      if (data) {\n        return JSON.parse(data) as ICredential;\n      }\n    } catch {\n      return undefined;\n    }\n\n    return undefined;\n  }\n\n  private deleteEncrypted(provider: ProviderName): void {\n    const credPath = getCredentialsPath();\n    if (!existsSync(credPath)) {\n      return;\n    }\n\n    try {\n      const content = this.decryptFile(credPath);\n      const store = JSON.parse(content) as Record<string, string>;\n      delete store[provider];\n      this.encryptFile(credPath, JSON.stringify(store));\n    } catch {\n      // Ignore\n    }\n  }\n\n  private encryptFile(filePath: string, plaintext: string): void {\n    const salt = randomBytes(SALT_LENGTH);\n    const key = this.getEncryptionKey(salt);\n    const iv = randomBytes(IV_LENGTH);\n    const cipher = createCipheriv(ALGORITHM, key, iv);\n    const encrypted = Buffer.concat([cipher.update(plaintext, \"utf-8\"), cipher.final()]);\n    const tag = cipher.getAuthTag();\n\n    // Format: salt(32) + iv(16) + tag(16) + encrypted\n    const output = Buffer.concat([salt, iv, tag, encrypted]);\n    writeFileSync(filePath, output);\n  }\n\n  private decryptFile(filePath: string): string {\n    const fileContent = readFileSync(filePath);\n\n    // Handle legacy format without salt (iv(16) + tag(16) + encrypted)\n    const hasStoredSalt = fileContent.length > SALT_LENGTH + IV_LENGTH + TAG_LENGTH;\n    let salt: Buffer;\n    let dataOffset: number;\n\n    if (hasStoredSalt) {\n      salt = fileContent.subarray(0, SALT_LENGTH);\n      dataOffset = SALT_LENGTH;\n    } else {\n      // Legacy fallback: derive salt from username (for backward compatibility)\n      const machineId = process.env[\"USER\"] ?? process.env[\"USERNAME\"] ?? \"aemeathcli\";\n      salt = Buffer.from(`aemeathcli-${machineId}`.padEnd(SALT_LENGTH, \"\\0\").slice(0, SALT_LENGTH));\n      dataOffset = 0;\n    }\n\n    const key = this.getEncryptionKey(salt);\n    const iv = fileContent.subarray(dataOffset, dataOffset + IV_LENGTH);\n    const tag = fileContent.subarray(dataOffset + IV_LENGTH, dataOffset + IV_LENGTH + TAG_LENGTH);\n    const encrypted = fileContent.subarray(dataOffset + IV_LENGTH + TAG_LENGTH);\n\n    const decipher = createDecipheriv(ALGORITHM, key, iv);\n    decipher.setAuthTag(tag);\n    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);\n\n    return decrypted.toString(\"utf-8\");\n  }\n\n  // ── Keytar Detection ───────────────────────────────────────────────────\n\n  private async isKeytarAvailable(): Promise<boolean> {\n    if (this.keytarAvailable !== undefined) {\n      return this.keytarAvailable;\n    }\n\n    try {\n      await import(\"keytar\");\n      this.keytarAvailable = true;\n    } catch {\n      this.keytarAvailable = false;\n    }\n\n    return this.keytarAvailable;\n  }\n\n  private async getKeytar(): Promise<typeof import(\"keytar\")> {\n    return import(\"keytar\");\n  }\n}\n"]}

package/dist/chunk-6PDJ45T4.js

@@ -0,0 +1,325 @@
+import { SUPPORTED_MODELS } from './chunk-HCIHOHLX.js';
+import { ModelNotFoundError, AuthenticationError } from './chunk-ZGOHARPV.js';
+import { logger } from './chunk-JAXXTYID.js';
+import { randomUUID } from 'crypto';
+import { execa } from 'execa';
+
+var CHARS_PER_TOKEN_ESTIMATE = 4;
+function resolveCliTimeoutMs() {
+  const raw = process.env["AEMEATHCLI_NATIVE_CLI_TIMEOUT_MS"];
+  if (raw === void 0) {
+    return 0;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return 0;
+  }
+  return parsed;
+}
+var CLI_TIMEOUT_MS = resolveCliTimeoutMs();
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function asString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function toJsonLines(output) {
+  const lines = output.split(/\r?\n/u).map((line) => line.trim()).filter((line) => line.length > 0 && line.startsWith("{"));
+  const parsed = [];
+  for (const line of lines) {
+    try {
+      parsed.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return parsed;
+}
+function buildPrompt(request) {
+  const latestUser = [...request.messages].reverse().find((message) => message.role === "user");
+  const fallbackLast = request.messages.length > 0 ? request.messages[request.messages.length - 1] : void 0;
+  const latestPrompt = latestUser?.content ?? fallbackLast?.content ?? "";
+  if (request.system !== void 0 && request.system.length > 0) {
+    return `${request.system}
+
+${latestPrompt}`.trim();
+  }
+  return latestPrompt;
+}
+function computeCost(modelInfo, inputTokens, outputTokens) {
+  return inputTokens / 1e6 * modelInfo.inputPricePerMToken + outputTokens / 1e6 * modelInfo.outputPricePerMToken;
+}
+function classifyCliError(provider, error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const lower = message.toLowerCase();
+  if (lower.includes("login") || lower.includes("credential") || lower.includes("authentication") || lower.includes("unauthorized") || lower.includes("forbidden") || lower.includes("api key") || lower.includes("token")) {
+    return new AuthenticationError(provider, message);
+  }
+  return error instanceof Error ? error : new Error(message);
+}
+var BaseNativeCLIAdapter = class {
+  async chat(request) {
+    const modelInfo = this.getModelInfo(request.model);
+    const prompt = buildPrompt(request);
+    try {
+      const result = await this.runCLI(request.model, prompt);
+      const inputTokens = result.inputTokens ?? Math.ceil(prompt.length / CHARS_PER_TOKEN_ESTIMATE);
+      const outputTokens = result.outputTokens ?? Math.ceil(result.text.length / CHARS_PER_TOKEN_ESTIMATE);
+      const usage = {
+        inputTokens,
+        outputTokens,
+        totalTokens: inputTokens + outputTokens,
+        costUsd: computeCost(modelInfo, inputTokens, outputTokens)
+      };
+      const responseMessage = {
+        id: randomUUID(),
+        role: "assistant",
+        content: result.text,
+        model: request.model,
+        provider: this.name,
+        tokenUsage: usage,
+        createdAt: /* @__PURE__ */ new Date()
+      };
+      return {
+        id: randomUUID(),
+        model: request.model,
+        provider: this.name,
+        message: responseMessage,
+        usage,
+        finishReason: result.finishReason ?? "stop"
+      };
+    } catch (error) {
+      throw classifyCliError(this.name, error);
+    }
+  }
+  async *stream(request) {
+    try {
+      const response = await this.chat(request);
+      if (response.message.content.length > 0) {
+        yield { type: "text", content: response.message.content };
+      }
+      yield { type: "usage", usage: response.usage };
+      yield { type: "done" };
+    } catch (error) {
+      const rawMsg = error instanceof Error ? error.message : String(error);
+      const truncated = rawMsg.length > 500 ? rawMsg.slice(0, 500) + "..." : rawMsg;
+      yield { type: "error", error: truncated };
+      yield { type: "done" };
+    }
+  }
+  async countTokens(text, _model) {
+    return Math.ceil(text.length / CHARS_PER_TOKEN_ESTIMATE);
+  }
+  getModelInfo(model) {
+    const info = SUPPORTED_MODELS[model];
+    if (info === void 0 || info.provider !== this.name) {
+      throw new ModelNotFoundError(model);
+    }
+    return info;
+  }
+  async listAvailableModels() {
+    return [...this.supportedModels];
+  }
+};
+var ClaudeNativeCLIAdapter = class extends BaseNativeCLIAdapter {
+  name = "anthropic";
+  supportedModels = [
+    "claude-opus-4-6",
+    "claude-opus-4-6-1m",
+    "claude-sonnet-4-6",
+    "claude-sonnet-4-6-1m",
+    "claude-haiku-4-5"
+  ];
+  async runCLI(model, prompt) {
+    const { stdout } = await execa(
+      "claude",
+      ["-p", "--output-format", "json", "--model", model, prompt],
+      {
+        timeout: CLI_TIMEOUT_MS,
+        stdin: "ignore",
+        env: { ...process.env, NO_COLOR: "1" }
+      }
+    );
+    const lines = toJsonLines(stdout);
+    const lastJson = lines.length > 0 ? lines[lines.length - 1] : void 0;
+    if (!isRecord(lastJson)) {
+      throw new Error("Claude CLI returned no JSON result");
+    }
+    const text = asString(lastJson["result"]) ?? "";
+    const usage = isRecord(lastJson["usage"]) ? lastJson["usage"] : void 0;
+    const inputTokens = usage ? asNumber(usage["input_tokens"]) : void 0;
+    const outputTokens = usage ? asNumber(usage["output_tokens"]) : void 0;
+    return {
+      text,
+      inputTokens,
+      outputTokens,
+      finishReason: "stop"
+    };
+  }
+};
+var CodexNativeCLIAdapter = class extends BaseNativeCLIAdapter {
+  name = "openai";
+  supportedModels = [
+    "gpt-5.3-codex",
+    "gpt-5.3-codex-spark",
+    "gpt-5.2-codex",
+    "gpt-5.1-codex-max",
+    "gpt-5.2",
+    "gpt-5.1-codex-mini"
+  ];
+  async runCLI(model, prompt) {
+    const sandbox = process.env["AEMEATHCLI_CODEX_SANDBOX"] ?? "read-only";
+    const { stdout } = await execa(
+      "codex",
+      [
+        "exec",
+        "--skip-git-repo-check",
+        ...sandbox !== "none" ? ["--sandbox", sandbox] : [],
+        "--json",
+        "--model",
+        model,
+        prompt
+      ],
+      {
+        timeout: CLI_TIMEOUT_MS,
+        stdin: "ignore",
+        env: { ...process.env, NO_COLOR: "1" }
+      }
+    );
+    const lines = toJsonLines(stdout);
+    const textParts = [];
+    let inputTokens;
+    let outputTokens;
+    for (const line of lines) {
+      if (!isRecord(line)) continue;
+      const type = asString(line["type"]);
+      if (type === "item.completed") {
+        const item = isRecord(line["item"]) ? line["item"] : void 0;
+        if (item && asString(item["type"]) === "agent_message") {
+          const text = asString(item["text"]);
+          if (text && text.length > 0) {
+            textParts.push(text);
+          }
+        }
+      }
+      if (type === "turn.completed") {
+        const usage = isRecord(line["usage"]) ? line["usage"] : void 0;
+        if (usage) {
+          inputTokens = asNumber(usage["input_tokens"]) ?? inputTokens;
+          outputTokens = asNumber(usage["output_tokens"]) ?? outputTokens;
+        }
+      }
+    }
+    return {
+      text: textParts.join("\n").trim(),
+      inputTokens,
+      outputTokens,
+      finishReason: "stop"
+    };
+  }
+};
+var GeminiNativeCLIAdapter = class extends BaseNativeCLIAdapter {
+  name = "google";
+  supportedModels = [
+    "gemini-3-pro-preview",
+    "gemini-3-flash-preview",
+    "gemini-2.5-pro",
+    "gemini-2.5-flash",
+    "gemini-2.5-flash-lite"
+  ];
+  async runCLI(model, prompt) {
+    const { stdout } = await execa(
+      "gemini",
+      [
+        "-p",
+        prompt,
+        "--model",
+        model,
+        "--output-format",
+        "stream-json",
+        "--approval-mode",
+        "yolo"
+      ],
+      {
+        timeout: CLI_TIMEOUT_MS,
+        stdin: "ignore",
+        env: { ...process.env, NO_COLOR: "1" }
+      }
+    );
+    const lines = toJsonLines(stdout);
+    let text = "";
+    let inputTokens;
+    let outputTokens;
+    for (const line of lines) {
+      if (!isRecord(line)) continue;
+      const type = asString(line["type"]);
+      if (type === "message" && asString(line["role"]) === "assistant") {
+        const content = asString(line["content"]);
+        if (content !== void 0) {
+          const delta = line["delta"] === true;
+          text = delta ? `${text}${content}` : content;
+        }
+      }
+      if (type === "result") {
+        const stats = isRecord(line["stats"]) ? line["stats"] : void 0;
+        if (stats) {
+          inputTokens = asNumber(stats["input_tokens"]) ?? inputTokens;
+          outputTokens = asNumber(stats["output_tokens"]) ?? outputTokens;
+        }
+      }
+    }
+    return {
+      text: text.trim(),
+      inputTokens,
+      outputTokens,
+      finishReason: "stop"
+    };
+  }
+};
+var KimiNativeCLIAdapter = class extends BaseNativeCLIAdapter {
+  name = "kimi";
+  supportedModels = ["kimi-for-coding"];
+  async runCLI(_model, prompt) {
+    const { stdout } = await execa(
+      "kimi",
+      ["--print", "--output-format", "stream-json", "-p", prompt],
+      {
+        timeout: CLI_TIMEOUT_MS,
+        stdin: "ignore",
+        env: { ...process.env, NO_COLOR: "1" }
+      }
+    );
+    const lines = toJsonLines(stdout);
+    let text = "";
+    for (const line of lines) {
+      if (!isRecord(line)) continue;
+      if (asString(line["role"]) !== "assistant") continue;
+      const content = line["content"];
+      if (!Array.isArray(content)) continue;
+      const textParts = [];
+      for (const part of content) {
+        if (!isRecord(part)) continue;
+        if (asString(part["type"]) === "text") {
+          const piece = asString(part["text"]);
+          if (piece) textParts.push(piece);
+        }
+      }
+      if (textParts.length > 0) {
+        text = textParts.join("");
+      }
+    }
+    return {
+      text: text.trim(),
+      finishReason: "stop"
+    };
+  }
+};
+function logNativeAdapterSelection(provider) {
+  logger.info({ provider }, "Using native CLI adapter");
+}
+
+export { ClaudeNativeCLIAdapter, CodexNativeCLIAdapter, GeminiNativeCLIAdapter, KimiNativeCLIAdapter, logNativeAdapterSelection };
+//# sourceMappingURL=chunk-6PDJ45T4.js.map
+//# sourceMappingURL=chunk-6PDJ45T4.js.map

package/dist/chunk-6PDJ45T4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/providers/native-cli-adapters.ts"],"names":[],"mappings":";;;;;;AA8BA,IAAM,wBAAA,GAA2B,CAAA;AAOjC,SAAS,mBAAA,GAA8B;AACrC,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,kCAAkC,CAAA;AAC1D,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,OAAO,CAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,EAAE,CAAA;AACtC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,UAAU,CAAA,EAAG;AAC3C,IAAA,OAAO,CAAA;AAAA,EACT;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,iBAAiB,mBAAA,EAAoB;AAE3C,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA;AAChD;AAEA,SAAS,SAAS,KAAA,EAAoC;AACpD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,SAAS,KAAA,EAAoC;AACpD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,IAAI,KAAA,GAAQ,MAAA;AACvE;AAEA,SAAS,YAAY,MAAA,EAA2B;AAC9C,EAAA,MAAM,KAAA,GAAQ,OACX,KAAA,CAAM,QAAQ,EACd,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,IAAA,EAAM,CAAA,CACzB,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,GAAG,CAAC,CAAA;AAE3D,EAAA,MAAM,SAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,IAAI,CAAY,CAAA;AAAA,IACzC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,YAAY,OAAA,EAA+B;AAClD,EAAA,MAAM,UAAA,GAAa,CAAC,GAAG,OAAA,CAAQ,QAAQ,CAAA,CACpC,OAAA,EAAQ,CACR,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,SAAS,MAAM,CAAA;AAC5C,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,QAAA,CAAS,MAAA,GAAS,CAAA,GAC3C,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,QAAA,CAAS,MAAA,GAAS,CAAC,CAAA,GAC5C,MAAA;AAEJ,EAAA,MAAM,YAAA,GAAe,UAAA,EAAY,OAAA,IAAW,YAAA,EAAc,OAAA,IAAW,EAAA;AACrE,EAAA,IAAI,QAAQ,MAAA,KAAW,MAAA,IAAa,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AAC7D,IAAA,OAAO,CAAA,EAAG,QAAQ,MAAM;;AAAA,EAAO,YAAY,GAAG,IAAA,EAAK;AAAA,EACrD;AACA,EAAA,OAAO,YAAA;AACT;AAEA,SAAS,WAAA,CAAY,SAAA,EAAuB,WAAA,EAAqB,YAAA,EAA8B;AAC7F,EAAA,OACG,cAAc,GAAA,GAAa,SAAA,CAAU,mBAAA,GACrC,YAAA,GAAe,MAAa,SAAA,CAAU,oBAAA;AAE3C;AAEA,SAAS,gBAAA,CAAiB,UAAwB,KAAA,EAAuB;AACvE,EAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,EAAA,MAAM,KAAA,GAAQ,QAAQ,WAAA,EAAY;AAElC,EAAA,IACE,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,IACnB,KAAA,CAAM,QAAA,CAAS,YAAY,CAAA,IAC3B,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,IAC/B,KAAA,CAAM,QAAA,CAAS,cAAc,CAAA,IAC7B,KAAA,CAAM,QAAA,CAAS,WAAW,CAAA,IAC1B,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA,IACxB,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,EACzB;AACA,IAAA,OAAO,IAAI,mBAAA,CAAoB,QAAA,EAAU,OAAO,CAAA;AAAA,EAClD;AAEA,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,MAAM,OAAO,CAAA;AAC3D;AAEA,IAAe,uBAAf,MAA8D;AAAA,EAM5D,MAAM,KAAK,OAAA,EAA+C;AACxD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAA;AACjD,IAAA,MAAM,MAAA,GAAS,YAAY,OAAO,CAAA;AAElC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,MAAM,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,MAAM,CAAA;AAEtD,MAAA,MAAM,cAAc,MAAA,CAAO,WAAA,IAAe,KAAK,IAAA,CAAK,MAAA,CAAO,SAAS,wBAAwB,CAAA;AAC5F,MAAA,MAAM,YAAA,GAAe,OAAO,YAAA,IAAgB,IAAA,CAAK,KAAK,MAAA,CAAO,IAAA,CAAK,SAAS,wBAAwB,CAAA;AAEnG,MAAA,MAAM,KAAA,GAAqB;AAAA,QACzB,WAAA;AAAA,QACA,YAAA;AAAA,QACA,aAAa,WAAA,GAAc,YAAA;AAAA,QAC3B,OAAA,EAAS,WAAA,CAAY,SAAA,EAAW,WAAA,EAAa,YAAY;AAAA,OAC3D;AAEA,MAAA,MAAM,eAAA,GAAgC;AAAA,QACpC,IAAI,UAAA,EAAW;AAAA,QACf,IAAA,EAAM,WAAA;AAAA,QACN,SAAS,MAAA,CAAO,IAAA;AAAA,QAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,UAAU,IAAA,CAAK,IAAA;AAAA,QACf,UAAA,EAAY,KAAA;AAAA,QACZ,SAAA,sBAAe,IAAA;AAAK,OACtB;AAEA,MAAA,OAAO;AAAA,QACL,IAAI,UAAA,EAAW;AAAA,QACf,OAAO,OAAA,CAAQ,KAAA;AAAA,QACf,UAAU,IAAA,CAAK,IAAA;AAAA,QACf,OAAA,EAAS,eAAA;AAAA,QACT,KAAA;AAAA,QACA,YAAA,EAAc,OAAO,YAAA,IAAgB;AAAA,OACvC;AAAA,IACF,SAAS,KAAA,EAAgB;AACvB,MAAA,MAAM,gBAAA,CAAiB,IAAA,CAAK,IAAA,EAAM,KAAK,CAAA;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,OAAO,OAAO,OAAA,EAAoD;AAChE,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AACxC,MAAA,IAAI,QAAA,CAAS,OAAA,CAAQ,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AACvC,QAAA,MAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,QAAA,CAAS,QAAQ,OAAA,EAAQ;AAAA,MAC1D;AACA,MAAA,MAAM,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,SAAS,KAAA,EAAM;AAC7C,MAAA,MAAM,EAAE,MAAM,MAAA,EAAO;AAAA,IACvB,SAAS,KAAA,EAAgB;AAGvB,MAAA,MAAM,SAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACpE,MAAA,MAAM,SAAA,GAAY,OAAO,MAAA,GAAS,GAAA,GAAM,OAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,GAAI,KAAA,GAAQ,MAAA;AACvE,MAAA,MAAM,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,SAAA,EAAU;AACxC,MAAA,MAAM,EAAE,MAAM,MAAA,EAAO;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAM,WAAA,CAAY,IAAA,EAAc,MAAA,EAAiC;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,MAAA,GAAS,wBAAwB,CAAA;AAAA,EACzD;AAAA,EAEA,aAAa,KAAA,EAA2B;AACtC,IAAA,MAAM,IAAA,GAAO,iBAAiB,KAAK,CAAA;AACnC,IAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,QAAA,KAAa,KAAK,IAAA,EAAM;AACrD,MAAA,MAAM,IAAI,mBAAmB,KAAK,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,mBAAA,GAAkD;AACtD,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,eAAe,CAAA;AAAA,EACjC;AACF,CAAA;AAEO,IAAM,sBAAA,GAAN,cAAqC,oBAAA,CAAqB;AAAA,EACtD,IAAA,GAAqB,WAAA;AAAA,EACrB,eAAA,GAAkB;AAAA,IACzB,iBAAA;AAAA,IACA,oBAAA;AAAA,IACA,mBAAA;AAAA,IACA,sBAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,MAAgB,MAAA,CAAO,KAAA,EAAe,MAAA,EAAqC;AACzE,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,KAAA;AAAA,MACvB,QAAA;AAAA,MACA,CAAC,IAAA,EAAM,iBAAA,EAAmB,MAAA,EAAQ,SAAA,EAAW,OAAO,MAAM,CAAA;AAAA,MAC1D;AAAA,QACE,OAAA,EAAS,cAAA;AAAA,QACT,KAAA,EAAO,QAAA;AAAA,QACP,KAAK,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAK,UAAU,GAAA;AAAI;AACvC,KACF;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAY,MAAM,CAAA;AAChC,IAAA,MAAM,QAAA,GAAW,MAAM,MAAA,GAAS,CAAA,GAAI,MAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,GAAI,MAAA;AAE9D,IAAA,IAAI,CAAC,QAAA,CAAS,QAAQ,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,IACtD;AAEA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,QAAA,CAAS,QAAQ,CAAC,CAAA,IAAK,EAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,SAAS,QAAA,CAAS,OAAO,CAAC,CAAA,GAAI,QAAA,CAAS,OAAO,CAAA,GAAI,MAAA;AAChE,IAAA,MAAM,cAAc,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,cAAc,CAAC,CAAA,GAAI,MAAA;AAC9D,IAAA,MAAM,eAAe,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,eAAe,CAAC,CAAA,GAAI,MAAA;AAEhE,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACF;AAEO,IAAM,qBAAA,GAAN,cAAoC,oBAAA,CAAqB;AAAA,EACrD,IAAA,GAAqB,QAAA;AAAA,EACrB,eAAA,GAAkB;AAAA,IACzB,eAAA;AAAA,IACA,qBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,MAAgB,MAAA,CAAO,KAAA,EAAe,MAAA,EAAqC;AAGzE,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA,IAAK,WAAA;AAC3D,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,KAAA;AAAA,MACvB,OAAA;AAAA,MACA;AAAA,QACE,MAAA;AAAA,QACA,uBAAA;AAAA,QACA,GAAI,OAAA,KAAY,MAAA,GAAS,CAAC,WAAA,EAAa,OAAO,IAAI,EAAC;AAAA,QACnD,QAAA;AAAA,QACA,SAAA;AAAA,QACA,KAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA;AAAA,QACE,OAAA,EAAS,cAAA;AAAA,QACT,KAAA,EAAO,QAAA;AAAA,QACP,KAAK,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAK,UAAU,GAAA;AAAI;AACvC,KACF;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAY,MAAM,CAAA;AAChC,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI,YAAA;AAEJ,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,EAAG;AACrB,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAA,CAAK,MAAM,CAAC,CAAA;AAElC,MAAA,IAAI,SAAS,gBAAA,EAAkB;AAC7B,QAAA,MAAM,IAAA,GAAO,SAAS,IAAA,CAAK,MAAM,CAAC,CAAA,GAAI,IAAA,CAAK,MAAM,CAAA,GAAI,MAAA;AACrD,QAAA,IAAI,QAAQ,QAAA,CAAS,IAAA,CAAK,MAAM,CAAC,MAAM,eAAA,EAAiB;AACtD,UAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAA,CAAK,MAAM,CAAC,CAAA;AAClC,UAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG;AAC3B,YAAA,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAEA,MAAA,IAAI,SAAS,gBAAA,EAAkB;AAC7B,QAAA,MAAM,KAAA,GAAQ,SAAS,IAAA,CAAK,OAAO,CAAC,CAAA,GAAI,IAAA,CAAK,OAAO,CAAA,GAAI,MAAA;AACxD,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,WAAA,GAAc,QAAA,CAAS,KAAA,CAAM,cAAc,CAAC,CAAA,IAAK,WAAA;AACjD,UAAA,YAAA,GAAe,QAAA,CAAS,KAAA,CAAM,eAAe,CAAC,CAAA,IAAK,YAAA;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,SAAA,CAAU,IAAA,CAAK,IAAI,EAAE,IAAA,EAAK;AAAA,MAChC,WAAA;AAAA,MACA,YAAA;AAAA,MACA,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACF;AAEO,IAAM,sBAAA,GAAN,cAAqC,oBAAA,CAAqB;AAAA,EACtD,IAAA,GAAqB,QAAA;AAAA,EACrB,eAAA,GAAkB;AAAA,IACzB,sBAAA;AAAA,IACA,wBAAA;AAAA,IACA,gBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,MAAgB,MAAA,CAAO,KAAA,EAAe,MAAA,EAAqC;AACzE,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,KAAA;AAAA,MACvB,QAAA;AAAA,MACA;AAAA,QACE,IAAA;AAAA,QACA,MAAA;AAAA,QACA,SAAA;AAAA,QACA,KAAA;AAAA,QACA,iBAAA;AAAA,QACA,aAAA;AAAA,QACA,iBAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA;AAAA,QACE,OAAA,EAAS,cAAA;AAAA,QACT,KAAA,EAAO,QAAA;AAAA,QACP,KAAK,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAK,UAAU,GAAA;AAAI;AACvC,KACF;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAY,MAAM,CAAA;AAChC,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI,YAAA;AAEJ,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,EAAG;AACrB,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAA,CAAK,MAAM,CAAC,CAAA;AAElC,MAAA,IAAI,SAAS,SAAA,IAAa,QAAA,CAAS,KAAK,MAAM,CAAC,MAAM,WAAA,EAAa;AAChE,QAAA,MAAM,OAAA,GAAU,QAAA,CAAS,IAAA,CAAK,SAAS,CAAC,CAAA;AACxC,QAAA,IAAI,YAAY,MAAA,EAAW;AACzB,UAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAO,CAAA,KAAM,IAAA;AAChC,UAAA,IAAA,GAAO,KAAA,GAAQ,CAAA,EAAG,IAAI,CAAA,EAAG,OAAO,CAAA,CAAA,GAAK,OAAA;AAAA,QACvC;AAAA,MACF;AAEA,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,MAAM,KAAA,GAAQ,SAAS,IAAA,CAAK,OAAO,CAAC,CAAA,GAAI,IAAA,CAAK,OAAO,CAAA,GAAI,MAAA;AACxD,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,WAAA,GAAc,QAAA,CAAS,KAAA,CAAM,cAAc,CAAC,CAAA,IAAK,WAAA;AACjD,UAAA,YAAA,GAAe,QAAA,CAAS,KAAA,CAAM,eAAe,CAAC,CAAA,IAAK,YAAA;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,WAAA;AAAA,MACA,YAAA;AAAA,MACA,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACF;AAEO,IAAM,oBAAA,GAAN,cAAmC,oBAAA,CAAqB;AAAA,EACpD,IAAA,GAAqB,MAAA;AAAA,EACrB,eAAA,GAAkB,CAAC,iBAAiB,CAAA;AAAA,EAE7C,MAAgB,MAAA,CAAO,MAAA,EAAgB,MAAA,EAAqC;AAC1E,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,KAAA;AAAA,MACvB,MAAA;AAAA,MACA,CAAC,SAAA,EAAW,iBAAA,EAAmB,aAAA,EAAe,MAAM,MAAM,CAAA;AAAA,MAC1D;AAAA,QACE,OAAA,EAAS,cAAA;AAAA,QACT,KAAA,EAAO,QAAA;AAAA,QACP,KAAK,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAK,UAAU,GAAA;AAAI;AACvC,KACF;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAY,MAAM,CAAA;AAChC,IAAA,IAAI,IAAA,GAAO,EAAA;AAEX,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,EAAG;AACrB,MAAA,IAAI,QAAA,CAAS,IAAA,CAAK,MAAM,CAAC,MAAM,WAAA,EAAa;AAE5C,MAAA,MAAM,OAAA,GAAU,KAAK,SAAS,CAAA;AAC9B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAE7B,MAAA,MAAM,YAAsB,EAAC;AAC7B,MAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,QAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,EAAG;AACrB,QAAA,IAAI,QAAA,CAAS,IAAA,CAAK,MAAM,CAAC,MAAM,MAAA,EAAQ;AACrC,UAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,IAAA,CAAK,MAAM,CAAC,CAAA;AACnC,UAAA,IAAI,KAAA,EAAO,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA;AAAA,QACjC;AAAA,MACF;AAEA,MAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,QAAA,IAAA,GAAO,SAAA,CAAU,KAAK,EAAE,CAAA;AAAA,MAC1B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,KAAK,IAAA,EAAK;AAAA,MAChB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,QAAA,EAA8B;AACtE,EAAA,MAAA,CAAO,IAAA,CAAK,EAAE,QAAA,EAAS,EAAG,0BAA0B,CAAA;AACtD","file":"chunk-6PDJ45T4.js","sourcesContent":["/**\n * Native CLI-backed provider adapters.\n * Uses official provider CLIs in non-interactive mode when credentials come from native login.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { execa } from \"execa\";\nimport {\n  AuthenticationError,\n  ModelNotFoundError,\n} from \"../types/errors.js\";\nimport { SUPPORTED_MODELS } from \"../types/model.js\";\nimport { logger } from \"../utils/logger.js\";\nimport type { IModelInfo, ProviderName } from \"../types/model.js\";\nimport type {\n  IChatMessage,\n  IChatRequest,\n  IChatResponse,\n  IStreamChunk,\n  ITokenUsage,\n} from \"../types/message.js\";\nimport type { IModelProvider } from \"./types.js\";\n\ninterface ICLIResult {\n  readonly text: string;\n  readonly inputTokens?: number | undefined;\n  readonly outputTokens?: number | undefined;\n  readonly finishReason?: IChatResponse[\"finishReason\"] | undefined;\n}\n\nconst CHARS_PER_TOKEN_ESTIMATE = 4;\n\n/**\n * Resolve CLI timeout from environment. Default is 0 (no timeout) so that\n * long-running agent tasks are never prematurely killed.\n * Set AEMEATHCLI_NATIVE_CLI_TIMEOUT_MS to a positive integer to enforce a limit.\n */\nfunction resolveCliTimeoutMs(): number {\n  const raw = process.env[\"AEMEATHCLI_NATIVE_CLI_TIMEOUT_MS\"];\n  if (raw === undefined) {\n    return 0;\n  }\n\n  const parsed = Number.parseInt(raw, 10);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    return 0;\n  }\n\n  return parsed;\n}\n\nconst CLI_TIMEOUT_MS = resolveCliTimeoutMs();\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction asString(value: unknown): string | undefined {\n  return typeof value === \"string\" ? value : undefined;\n}\n\nfunction asNumber(value: unknown): number | undefined {\n  return typeof value === \"number\" && Number.isFinite(value) ? value : undefined;\n}\n\nfunction toJsonLines(output: string): unknown[] {\n  const lines = output\n    .split(/\\r?\\n/u)\n    .map((line) => line.trim())\n    .filter((line) => line.length > 0 && line.startsWith(\"{\"));\n\n  const parsed: unknown[] = [];\n  for (const line of lines) {\n    try {\n      parsed.push(JSON.parse(line) as unknown);\n    } catch {\n      // Ignore non-JSON lines\n    }\n  }\n  return parsed;\n}\n\nfunction buildPrompt(request: IChatRequest): string {\n  const latestUser = [...request.messages]\n    .reverse()\n    .find((message) => message.role === \"user\");\n  const fallbackLast = request.messages.length > 0\n    ? request.messages[request.messages.length - 1]\n    : undefined;\n\n  const latestPrompt = latestUser?.content ?? fallbackLast?.content ?? \"\";\n  if (request.system !== undefined && request.system.length > 0) {\n    return `${request.system}\\n\\n${latestPrompt}`.trim();\n  }\n  return latestPrompt;\n}\n\nfunction computeCost(modelInfo: IModelInfo, inputTokens: number, outputTokens: number): number {\n  return (\n    (inputTokens / 1_000_000) * modelInfo.inputPricePerMToken +\n    (outputTokens / 1_000_000) * modelInfo.outputPricePerMToken\n  );\n}\n\nfunction classifyCliError(provider: ProviderName, error: unknown): Error {\n  const message = error instanceof Error ? error.message : String(error);\n  const lower = message.toLowerCase();\n\n  if (\n    lower.includes(\"login\")\n    || lower.includes(\"credential\")\n    || lower.includes(\"authentication\")\n    || lower.includes(\"unauthorized\")\n    || lower.includes(\"forbidden\")\n    || lower.includes(\"api key\")\n    || lower.includes(\"token\")\n  ) {\n    return new AuthenticationError(provider, message);\n  }\n\n  return error instanceof Error ? error : new Error(message);\n}\n\nabstract class BaseNativeCLIAdapter implements IModelProvider {\n  abstract readonly name: ProviderName;\n  abstract readonly supportedModels: readonly string[];\n\n  protected abstract runCLI(model: string, prompt: string): Promise<ICLIResult>;\n\n  async chat(request: IChatRequest): Promise<IChatResponse> {\n    const modelInfo = this.getModelInfo(request.model);\n    const prompt = buildPrompt(request);\n\n    try {\n      const result = await this.runCLI(request.model, prompt);\n\n      const inputTokens = result.inputTokens ?? Math.ceil(prompt.length / CHARS_PER_TOKEN_ESTIMATE);\n      const outputTokens = result.outputTokens ?? Math.ceil(result.text.length / CHARS_PER_TOKEN_ESTIMATE);\n\n      const usage: ITokenUsage = {\n        inputTokens,\n        outputTokens,\n        totalTokens: inputTokens + outputTokens,\n        costUsd: computeCost(modelInfo, inputTokens, outputTokens),\n      };\n\n      const responseMessage: IChatMessage = {\n        id: randomUUID(),\n        role: \"assistant\",\n        content: result.text,\n        model: request.model,\n        provider: this.name,\n        tokenUsage: usage,\n        createdAt: new Date(),\n      };\n\n      return {\n        id: randomUUID(),\n        model: request.model,\n        provider: this.name,\n        message: responseMessage,\n        usage,\n        finishReason: result.finishReason ?? \"stop\",\n      };\n    } catch (error: unknown) {\n      throw classifyCliError(this.name, error);\n    }\n  }\n\n  async *stream(request: IChatRequest): AsyncIterable<IStreamChunk> {\n    try {\n      const response = await this.chat(request);\n      if (response.message.content.length > 0) {\n        yield { type: \"text\", content: response.message.content };\n      }\n      yield { type: \"usage\", usage: response.usage };\n      yield { type: \"done\" };\n    } catch (error: unknown) {\n      // Execa errors can include raw stdout/stderr in the message.\n      // Truncate to prevent raw CLI protocol output from leaking through.\n      const rawMsg = error instanceof Error ? error.message : String(error);\n      const truncated = rawMsg.length > 500 ? rawMsg.slice(0, 500) + \"...\" : rawMsg;\n      yield { type: \"error\", error: truncated };\n      yield { type: \"done\" };\n    }\n  }\n\n  async countTokens(text: string, _model: string): Promise<number> {\n    return Math.ceil(text.length / CHARS_PER_TOKEN_ESTIMATE);\n  }\n\n  getModelInfo(model: string): IModelInfo {\n    const info = SUPPORTED_MODELS[model];\n    if (info === undefined || info.provider !== this.name) {\n      throw new ModelNotFoundError(model);\n    }\n    return info;\n  }\n\n  async listAvailableModels(): Promise<readonly string[]> {\n    return [...this.supportedModels];\n  }\n}\n\nexport class ClaudeNativeCLIAdapter extends BaseNativeCLIAdapter {\n  readonly name: ProviderName = \"anthropic\";\n  readonly supportedModels = [\n    \"claude-opus-4-6\",\n    \"claude-opus-4-6-1m\",\n    \"claude-sonnet-4-6\",\n    \"claude-sonnet-4-6-1m\",\n    \"claude-haiku-4-5\",\n  ] as const;\n\n  protected async runCLI(model: string, prompt: string): Promise<ICLIResult> {\n    const { stdout } = await execa(\n      \"claude\",\n      [\"-p\", \"--output-format\", \"json\", \"--model\", model, prompt],\n      {\n        timeout: CLI_TIMEOUT_MS,\n        stdin: \"ignore\",\n        env: { ...process.env, NO_COLOR: \"1\" },\n      },\n    );\n\n    const lines = toJsonLines(stdout);\n    const lastJson = lines.length > 0 ? lines[lines.length - 1] : undefined;\n\n    if (!isRecord(lastJson)) {\n      throw new Error(\"Claude CLI returned no JSON result\");\n    }\n\n    const text = asString(lastJson[\"result\"]) ?? \"\";\n    const usage = isRecord(lastJson[\"usage\"]) ? lastJson[\"usage\"] : undefined;\n    const inputTokens = usage ? asNumber(usage[\"input_tokens\"]) : undefined;\n    const outputTokens = usage ? asNumber(usage[\"output_tokens\"]) : undefined;\n\n    return {\n      text,\n      inputTokens,\n      outputTokens,\n      finishReason: \"stop\",\n    };\n  }\n}\n\nexport class CodexNativeCLIAdapter extends BaseNativeCLIAdapter {\n  readonly name: ProviderName = \"openai\";\n  readonly supportedModels = [\n    \"gpt-5.3-codex\",\n    \"gpt-5.3-codex-spark\",\n    \"gpt-5.2-codex\",\n    \"gpt-5.1-codex-max\",\n    \"gpt-5.2\",\n    \"gpt-5.1-codex-mini\",\n  ] as const;\n\n  protected async runCLI(model: string, prompt: string): Promise<ICLIResult> {\n    // Allow agent panes to set a writable sandbox so codex can write to the\n    // shared board directory.  Default to \"read-only\" for normal usage.\n    const sandbox = process.env[\"AEMEATHCLI_CODEX_SANDBOX\"] ?? \"read-only\";\n    const { stdout } = await execa(\n      \"codex\",\n      [\n        \"exec\",\n        \"--skip-git-repo-check\",\n        ...(sandbox !== \"none\" ? [\"--sandbox\", sandbox] : []),\n        \"--json\",\n        \"--model\",\n        model,\n        prompt,\n      ],\n      {\n        timeout: CLI_TIMEOUT_MS,\n        stdin: \"ignore\",\n        env: { ...process.env, NO_COLOR: \"1\" },\n      },\n    );\n\n    const lines = toJsonLines(stdout);\n    const textParts: string[] = [];\n    let inputTokens: number | undefined;\n    let outputTokens: number | undefined;\n\n    for (const line of lines) {\n      if (!isRecord(line)) continue;\n      const type = asString(line[\"type\"]);\n\n      if (type === \"item.completed\") {\n        const item = isRecord(line[\"item\"]) ? line[\"item\"] : undefined;\n        if (item && asString(item[\"type\"]) === \"agent_message\") {\n          const text = asString(item[\"text\"]);\n          if (text && text.length > 0) {\n            textParts.push(text);\n          }\n        }\n      }\n\n      if (type === \"turn.completed\") {\n        const usage = isRecord(line[\"usage\"]) ? line[\"usage\"] : undefined;\n        if (usage) {\n          inputTokens = asNumber(usage[\"input_tokens\"]) ?? inputTokens;\n          outputTokens = asNumber(usage[\"output_tokens\"]) ?? outputTokens;\n        }\n      }\n    }\n\n    return {\n      text: textParts.join(\"\\n\").trim(),\n      inputTokens,\n      outputTokens,\n      finishReason: \"stop\",\n    };\n  }\n}\n\nexport class GeminiNativeCLIAdapter extends BaseNativeCLIAdapter {\n  readonly name: ProviderName = \"google\";\n  readonly supportedModels = [\n    \"gemini-3-pro-preview\",\n    \"gemini-3-flash-preview\",\n    \"gemini-2.5-pro\",\n    \"gemini-2.5-flash\",\n    \"gemini-2.5-flash-lite\",\n  ] as const;\n\n  protected async runCLI(model: string, prompt: string): Promise<ICLIResult> {\n    const { stdout } = await execa(\n      \"gemini\",\n      [\n        \"-p\",\n        prompt,\n        \"--model\",\n        model,\n        \"--output-format\",\n        \"stream-json\",\n        \"--approval-mode\",\n        \"yolo\",\n      ],\n      {\n        timeout: CLI_TIMEOUT_MS,\n        stdin: \"ignore\",\n        env: { ...process.env, NO_COLOR: \"1\" },\n      },\n    );\n\n    const lines = toJsonLines(stdout);\n    let text = \"\";\n    let inputTokens: number | undefined;\n    let outputTokens: number | undefined;\n\n    for (const line of lines) {\n      if (!isRecord(line)) continue;\n      const type = asString(line[\"type\"]);\n\n      if (type === \"message\" && asString(line[\"role\"]) === \"assistant\") {\n        const content = asString(line[\"content\"]);\n        if (content !== undefined) {\n          const delta = line[\"delta\"] === true;\n          text = delta ? `${text}${content}` : content;\n        }\n      }\n\n      if (type === \"result\") {\n        const stats = isRecord(line[\"stats\"]) ? line[\"stats\"] : undefined;\n        if (stats) {\n          inputTokens = asNumber(stats[\"input_tokens\"]) ?? inputTokens;\n          outputTokens = asNumber(stats[\"output_tokens\"]) ?? outputTokens;\n        }\n      }\n    }\n\n    return {\n      text: text.trim(),\n      inputTokens,\n      outputTokens,\n      finishReason: \"stop\",\n    };\n  }\n}\n\nexport class KimiNativeCLIAdapter extends BaseNativeCLIAdapter {\n  readonly name: ProviderName = \"kimi\";\n  readonly supportedModels = [\"kimi-for-coding\"] as const;\n\n  protected async runCLI(_model: string, prompt: string): Promise<ICLIResult> {\n    const { stdout } = await execa(\n      \"kimi\",\n      [\"--print\", \"--output-format\", \"stream-json\", \"-p\", prompt],\n      {\n        timeout: CLI_TIMEOUT_MS,\n        stdin: \"ignore\",\n        env: { ...process.env, NO_COLOR: \"1\" },\n      },\n    );\n\n    const lines = toJsonLines(stdout);\n    let text = \"\";\n\n    for (const line of lines) {\n      if (!isRecord(line)) continue;\n      if (asString(line[\"role\"]) !== \"assistant\") continue;\n\n      const content = line[\"content\"];\n      if (!Array.isArray(content)) continue;\n\n      const textParts: string[] = [];\n      for (const part of content) {\n        if (!isRecord(part)) continue;\n        if (asString(part[\"type\"]) === \"text\") {\n          const piece = asString(part[\"text\"]);\n          if (piece) textParts.push(piece);\n        }\n      }\n\n      if (textParts.length > 0) {\n        text = textParts.join(\"\");\n      }\n    }\n\n    return {\n      text: text.trim(),\n      finishReason: \"stop\",\n    };\n  }\n}\n\nexport function logNativeAdapterSelection(provider: ProviderName): void {\n  logger.info({ provider }, \"Using native CLI adapter\");\n}\n"]}