agenticreplay 0.1.0 → 0.1.2

package/node_modules/@agenticreplay/adapters/dist/kilo.js

@@ -0,0 +1,35 @@
+import { detectAgent } from './detect.js';
+/**
+ * Kilo Code's CLI — another OpenCode fork, captured the way the others are.
+ *
+ * Nothing is redirected, for the reason the whole OpenCode family shares: the provider origin
+ * lives in the harness's own config rather than in an environment variable, so `OPENAI_BASE_URL`
+ * leaves the run talking straight past the proxy. `--tls-intercept` terminates the TLS the agent
+ * established itself, and `api.kilo.ai` is in `DEFAULT_TLS_HOSTS` so the built-in `kilo/*` models
+ * need no extra `--tls-hosts`.
+ *
+ * One thing worth knowing before recording it: Kilo checks entitlement locally, before it opens a
+ * connection. A model the account cannot use fails with "You need to sign in to use this model"
+ * and no request is ever sent, so there is nothing to capture — unlike MiMo, which sends the
+ * request and lets the server reject it. `kilo/kilo-auto/free` is reachable without a paid plan
+ * and is what the fixture below was verified against.
+ *
+ * Kilo also posts to `us.i.posthog.com`. That is not a model API and is not in the allowlist, so
+ * it stays tunnelled: agenticreplay records that the connection happened and reads none of it.
+ */
+export const kiloAdapter = {
+    id: 'kilo',
+    aliases: ['kilocode', 'kilo-code'],
+    harnessVersions: '>=7.5.9',
+    // Redirecting nothing is the intent, not a defect. See the `capture` field on `Adapter`.
+    capture: 'transport',
+    async detect(_cwd) {
+        return detectAgent(['kilo', 'kilocode'], ['.config/kilo', '.kilo']);
+    },
+    async prepare(ctx) {
+        // No origin and no credential: both live in the harness's own config and credential store,
+        // and an adapter that injected either would override a choice made there.
+        return { command: 'kilo', args: [...ctx.userArgs], env: {} };
+    },
+};
+//# sourceMappingURL=kilo.js.map

package/node_modules/@agenticreplay/adapters/dist/kilo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kilo.js","sourceRoot":"","sources":["../src/kilo.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAY;IAClC,EAAE,EAAE,MAAM;IACV,OAAO,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;IAClC,eAAe,EAAE,SAAS;IAE1B,yFAAyF;IACzF,OAAO,EAAE,WAAW;IAEpB,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,WAAW,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAkB;QAC9B,2FAA2F;QAC3F,0EAA0E;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC/D,CAAC;CACF,CAAC"}

package/node_modules/@agenticreplay/adapters/dist/mcode.d.ts

@@ -0,0 +1,81 @@
+import type { Adapter } from '@agenticreplay/plugin-api';
+/**
+ * MiniMax Code — MCode, `Mavis` in its own source — captured by relocating its data directory.
+ *
+ * It keeps a provider's origin in `~/.minimax/config.yaml`, not in an environment variable, and
+ * its HTTP client is Node's `fetch`. That rules out both of the routes agenticreplay usually takes: there
+ * is no base-URL variable to redirect, and undici consults neither `HTTP_PROXY` nor `HTTPS_PROXY`,
+ * so `--tls-intercept` sees no traffic at all — a run recorded that way finishes with
+ * `capture.empty` and nothing in the trace.
+ *
+ * What it does honour is `MINIMAX_DATA_DIR`. Pointing that at a directory of agenticreplay's own gives a
+ * config the agent will read and the operator's own file never has to be touched — which matters,
+ * because the obvious alternative is to rewrite `~/.minimax/config.yaml` in place and put it back
+ * afterwards, and a run that is killed never puts it back.
+ *
+ * Relocating rather than rewriting is also the only thing that holds, because MCode writes to its
+ * own config on startup. Measured on a real run: of the config this adapter generated, it put
+ * exactly two lines back — the built-in `minimax_api` provider's `baseURL` and `apiKey`, restored
+ * to its own values over what the file said. An adapter editing `~/.minimax/config.yaml` in place
+ * would be handing the agent its own file to fight over.
+ *
+ * `provider add --use` is not involved: it throws `TEST_REQUIRED` unconditionally before it saves
+ * anything. A `defaultModel` naming the provider activates it on its own, which is what the
+ * operator's config already carries.
+ *
+ * So only custom providers can be captured. The redirect on every one of them survived that same
+ * run; the built-in entries are the two lines MCode took back, and a run on the managed login
+ * records nothing but the end-of-run warning. Every capture in `prompt/MCODE/` was taken through
+ * a custom provider.
+ */
+export declare const mcodeAdapter: Adapter;
+/** True when there is an origin in here this adapter can actually move. */
+export declare function hasOrigin(config: string): boolean;
+/**
+ * Whether the rewrite can be trusted with this config at all.
+ *
+ * A rewrite that cannot prove it did its job does not get written. The proof is the allowlist: a
+ * line that mentions either field must be written the one way this file understands. A key it
+ * cannot see is a key it cannot take out, and an origin it cannot see is a provider that would
+ * keep talking to its real host with nothing in the trace to say so.
+ *
+ * The cost of refusing is an uncaptured run — the same untouched launch a config with no custom
+ * provider gets — which is the side to fail on when the alternative is writing a credential down.
+ */
+export declare function rewriteIsTrustworthy(config: string, proxyUrl: string): boolean;
+/**
+ * The operator's config with every custom origin routed through the proxy and every key taken out.
+ *
+ * Rewritten as text rather than parsed and re-emitted. A YAML round-trip would reformat a file
+ * agenticreplay did not write — comments, quoting, key order — and the two lines that need to change are
+ * recognisable without understanding the rest.
+ *
+ * Each origin goes through `/forward/`, so the request arrives naming the destination it was taken
+ * away from. Replacing it with agenticreplay's own default instead would point a recorded run at a host the
+ * operator never named, which is worse than not capturing it.
+ *
+ * Every custom provider, not the first. With several configured, rewriting one leaves the rest
+ * aimed at their real origins, and a run on one of those is simply missing from the trace.
+ *
+ * Keys come out of every section, built-in included, and `rewriteIsTrustworthy` refuses a config
+ * whose credentials it cannot account for. What that is worth saying precisely: the two nets
+ * catch what they recognise and a short low-entropy value under an unknown name gets past both,
+ * so this is a best effort rather than the guarantee an earlier version of this comment claimed.
+ *
+ * Two things carry the rest of the weight, and neither is detection. `agenticreplay push` ships an
+ * allowlist of four top-level entries, which this directory is not one of, so a pushed run never
+ * carries it. And `capture/<model>/trace/` — where `capture.mjs` moves the run — is documented as
+ * the unscrubbed raw run and is the one thing the prompt vault's CONTRIBUTING forbids committing.
+ * A key that survives the nets stays on the machine it was already on. AgenticReplay
+ * supplies the real one for the origin it forwards to — that is what `agenticreplay setup` configures and
+ * what `upstreamHeaders` injects. Without it the gateway answers 401, and the prompt is captured
+ * anyway: it travels in the request, which agenticreplay records before the origin ever replies.
+ *
+ * What MCode writes back into this file on startup is its own: measured against a config whose
+ * every key had been replaced by a distinct canary, it restored the built-in provider's `apiKey`
+ * as the literal `sk-xxx` from its bundle, and no canary reached the run directory. The
+ * credentials it would have had to read instead live in `<dataDir>/auth/`, which moves with
+ * `MINIMAX_DATA_DIR` — the run's copy holds two lock files and nothing else.
+ */
+export declare function redirected(config: string, proxyUrl: string): string;
+//# sourceMappingURL=mcode.d.ts.map

package/node_modules/@agenticreplay/adapters/dist/mcode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcode.d.ts","sourceRoot":"","sources":["../src/mcode.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAyB,MAAM,2BAA2B,CAAC;AAMhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,YAAY,EAAE,OAuD1B,CAAC;AAgMF,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAoC9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAanE"}

package/node_modules/@agenticreplay/adapters/dist/mcode.js

@@ -0,0 +1,368 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { detectAgent } from './detect.js';
+import { Redactor, withoutInvisible } from '@agenticreplay/core';
+import { decodeForwardPath, forwardBasePath } from '@agenticreplay/proxy';
+import { forwardOrProxyBase, PLACEHOLDER_KEY, readEnv } from './env.js';
+/**
+ * MiniMax Code — MCode, `Mavis` in its own source — captured by relocating its data directory.
+ *
+ * It keeps a provider's origin in `~/.minimax/config.yaml`, not in an environment variable, and
+ * its HTTP client is Node's `fetch`. That rules out both of the routes agenticreplay usually takes: there
+ * is no base-URL variable to redirect, and undici consults neither `HTTP_PROXY` nor `HTTPS_PROXY`,
+ * so `--tls-intercept` sees no traffic at all — a run recorded that way finishes with
+ * `capture.empty` and nothing in the trace.
+ *
+ * What it does honour is `MINIMAX_DATA_DIR`. Pointing that at a directory of agenticreplay's own gives a
+ * config the agent will read and the operator's own file never has to be touched — which matters,
+ * because the obvious alternative is to rewrite `~/.minimax/config.yaml` in place and put it back
+ * afterwards, and a run that is killed never puts it back.
+ *
+ * Relocating rather than rewriting is also the only thing that holds, because MCode writes to its
+ * own config on startup. Measured on a real run: of the config this adapter generated, it put
+ * exactly two lines back — the built-in `minimax_api` provider's `baseURL` and `apiKey`, restored
+ * to its own values over what the file said. An adapter editing `~/.minimax/config.yaml` in place
+ * would be handing the agent its own file to fight over.
+ *
+ * `provider add --use` is not involved: it throws `TEST_REQUIRED` unconditionally before it saves
+ * anything. A `defaultModel` naming the provider activates it on its own, which is what the
+ * operator's config already carries.
+ *
+ * So only custom providers can be captured. The redirect on every one of them survived that same
+ * run; the built-in entries are the two lines MCode took back, and a run on the managed login
+ * records nothing but the end-of-run warning. Every capture in `prompt/MCODE/` was taken through
+ * a custom provider.
+ */
+export const mcodeAdapter = {
+    id: 'mcode',
+    aliases: ['minimax-code', 'minimaxcode'],
+    harnessVersions: '>=0.4.12',
+    // Redirected through a file, not a variable. See the `capture` field on `Adapter`.
+    capture: 'config',
+    async detect(_cwd) {
+        return detectAgent(['mcode'], ['.minimax']);
+    },
+    async prepare(ctx) {
+        const source = configPath(ctx.env);
+        const original = await readFile(source, 'utf8').catch(() => undefined);
+        // The data directory moves whether or not there is anything to put in it.
+        //
+        // Review caught what the earlier fallback cost. `agenticreplay replay` calls this same `prepare`, with
+        // the operator's *current* environment rather than the recorded one — so a config that has
+        // lost its custom provider since the recording made the fallback launch MCode untouched, on
+        // the real `~/.minimax`, against the real gateway with the real credential. Nothing reached
+        // the proxy, `unmatched` stayed at zero, and the replay reported success. An offline replay
+        // had spent money and recorded nothing, quietly.
+        //
+        // An empty directory of agenticreplay's own is what stops that: MCode finds no provider and no
+        // credential there and refuses to start, measured — `Sign in to MiniMax to use Agent
+        // features` — without making a call. The adapter cannot tell a record from a replay, so the
+        // safe launch has to be the one it always produces.
+        //
+        // The operator of a stock install pays for it: `agenticreplay record mcode` now ends in that sign-in
+        // message rather than running uncaptured, and MCode fills the directory with its bundled
+        // skills either way, about 14 MB. Both are worth it against a replay that silently goes live.
+        const dataDir = join(ctx.runDir, 'mcode-data');
+        await mkdir(dataDir, { recursive: true });
+        const launch = {
+            command: 'mcode',
+            args: [...ctx.userArgs],
+            env: isolatedEnv(ctx.env, dataDir),
+        };
+        // Nothing to redirect, or nothing this rewrite can prove it redirected. Either way the config
+        // is not written, and the isolated directory above is what the agent gets.
+        if (original === undefined ||
+            !hasOrigin(original) ||
+            !rewriteIsTrustworthy(original, ctx.proxyUrl)) {
+            return launch;
+        }
+        const config = join(dataDir, 'config.yaml');
+        await writeFile(config, redirected(original, ctx.proxyUrl), 'utf8');
+        return { ...launch, tempFiles: [config] };
+    },
+};
+/**
+ * The vendor's whole environment namespace, blanked, then the data directory put back.
+ *
+ * Review found `MAVIS_DATA_DIR` surviving into the child: `configPath` reads either spelling, but
+ * the launch overrode only one, so an operator who had set the other kept their real data
+ * directory — real config, real origin, real credential — and the isolation above bought nothing.
+ *
+ * Naming the spellings one at a time is how that happened, so this does not. MCode reads about
+ * ninety `MAVIS_*` and `MINIMAX_*` variables, among them three more data directories
+ * (`MAVIS_RUNTIME_DATA_DIR`, `MAVIS_PARENT_DATA_DIR`), four credentials (`MAVIS_ACCESS_TOKEN`,
+ * `MAVIS_PARENT_AUTH_SECRET`, `MINIMAX_API_KEY`, `MINIMAX_CN_API_KEY`) and several origins. Every
+ * one of them is emptied, and the two documented data-dir spellings are then pointed here. A
+ * variable a later version adds is covered by the sweep rather than by remembering to add it.
+ *
+ * The overlay can only set, not unset, so they arrive empty rather than absent. That is the
+ * difference between a run that cannot reach a real origin and one that quietly can.
+ */
+function isolatedEnv(env, dataDir) {
+    const overlay = {};
+    for (const name of Object.keys(env))
+        if (VENDOR_ENV.test(name))
+            overlay[name] = '';
+    for (const name of DATA_DIR_VARS)
+        overlay[name] = dataDir;
+    return overlay;
+}
+/**
+ * One opaque run of token characters, long enough that nothing in a real config is one.
+ *
+ * `/` is deliberately not in the alphabet. A base64 secret can contain one, but so does every
+ * provider-qualified model id — `deepseek/deepseek-v4-flash-free` is thirty-one characters of it —
+ * and refusing every config that names a model would leave nothing working at all.
+ */
+const OPAQUE_TOKEN = /[A-Za-z0-9+_=-]{24,}/;
+/**
+ * What a line says after its field name.
+ *
+ * Nothing is stripped from it. The shape below is searched for inside the text rather than
+ * matched against the whole of it, so a quote, a brace or a comma around the value makes no
+ * difference — which is the property that makes a detector cheaper to get right than a rewriter.
+ *
+ * The name is dropped because names are long: `contextWindowOptionHints` and
+ * `files_api_upload_endpoint` both clear twenty-four characters in a real config, and scanning
+ * whole lines refused it. A line with no colon is a continuation — the indented scalar under
+ * `apiKey:` — and is scanned whole, which is the only way to see a value written there.
+ */
+function valueText(line) {
+    const body = lineBody(line);
+    const colon = body.indexOf(':');
+    return colon === -1 ? body : body.slice(colon + 1);
+}
+/**
+ * A value this file cannot account for, anywhere in the file.
+ *
+ * The second of two nets under `rewriteIsTrustworthy`, and a detector rather than a rewriter — so
+ * it is deliberately not written the way the rewrite is. The rewrite understands one shape and
+ * refuses the rest, which is right for something that has to produce correct output. A detector
+ * built that way has the failure the other way round: every shape it does not parse is a value it
+ * does not look at. Review found three of those in turn — a quoted value, a flow map, a value on
+ * the following line — so this reads the text after the colon and does not care about structure.
+ *
+ * Every section, not just the custom one: the file lands in the run directory whatever section a
+ * value is in. That also covers the configs whose section cannot be tracked at all, a quoted
+ * top-level key or a leading byte-order mark.
+ *
+ * Measured against a real config and against a rewritten one, forward URLs included: nothing in
+ * either matches.
+ */
+function hasUnaccountedToken(config) {
+    return config.split('\n').some((line) => {
+        // The two this file rewrites are accounted for by the checks above.
+        if (/base[_-]?url|api[_-]?key/i.test(lineBody(line).split(':')[0] ?? ''))
+            return false;
+        // As a reader would retype it — an invisible character inside a token split it below 24.
+        return OPAQUE_TOKEN.test(withoutInvisible(valueText(line)));
+    });
+}
+const VENDOR_ENV = /^(MAVIS|MINIMAX)_/;
+const DATA_DIR_VARS = ['MAVIS_DATA_DIR', 'MINIMAX_DATA_DIR'];
+/** Both spellings, because the bundle reads either and the operator may have set the other. */
+function configPath(env) {
+    const dir = readEnv(env, 'MINIMAX_DATA_DIR') ?? readEnv(env, 'MAVIS_DATA_DIR');
+    return dir !== undefined ? join(dir, 'config.yaml') : join(homedir(), '.minimax', 'config.yaml');
+}
+/**
+ * Everything on a line that is not a comment.
+ *
+ * A YAML comment starts at a `#` with whitespace or the line start before it, so a `#` inside a
+ * URL is a fragment and stays. A `#` inside a quoted value is cut as though it were a comment,
+ * which leaves the line unparseable below and refused — the safe way to be wrong about it.
+ */
+function lineBody(line) {
+    const at = line.search(/(^|[ \t])#/);
+    return at === -1 ? line : line.slice(0, at);
+}
+/**
+ * The one shape this rewrite understands, for either field: optional quotes around the name, a
+ * colon, and a value that is a single token, optionally quoted.
+ *
+ * An allowlist, after three rounds of review found shapes a blocklist had not thought of — a flow
+ * map, a list item, a block scalar, a value on the next line, a quoted name, a name whose value is
+ * only a comment. Each was a different way of writing the same field, and each went through a
+ * pattern written to catch the ways already known. Reversing it ends that: a line that mentions
+ * one of these fields and is not written this way is not rewritten, it is refused.
+ */
+const CANONICAL = /^([ \t]*)(['"]?)(base[_-]?url|api[_-]?key)\2([ \t]*:[ \t]*)(?:(['"])([^'"]*)\5|([^\s'"]+))([ \t\r]*)$/i;
+/**
+ * Either field, however it is written. A line naming one has to be understood or refused.
+ *
+ * The colon is what makes it a name rather than a value. Without it, `authMode: api-key` — which
+ * every custom provider in a real config carries — read as a field this rewrite could not parse,
+ * and the whole config was refused: a recording that should have captured six exchanges captured
+ * none. The optional quote is for a name written `"apiKey"`.
+ */
+const KEY_MENTION = /api[_-]?key['"]?[ \t]*:/i;
+const ORIGIN_MENTION = /base[_-]?url['"]?[ \t]*:/i;
+/** `|` and `>` say the value is on the following lines, where no line pattern can reach it. */
+const BLOCK_SCALAR = /^[|>][+-]?[0-9]*$/;
+function fieldOf(line) {
+    const parts = CANONICAL.exec(lineBody(line));
+    if (parts === null)
+        return undefined;
+    const body = parts[0];
+    const name = parts[3];
+    const quote = parts[5] ?? '';
+    const value = parts[6] ?? parts[7] ?? '';
+    // A value is only a value if it is one. `|` and `>` put it on the lines below; so does a
+    // `#` with no space before it, which the comment strip leaves in place — `apiKey:#rotated`
+    // parsed as a field whose value was `#rotated` while the real key sat on the next line.
+    if (BLOCK_SCALAR.test(value) || value.startsWith('#'))
+        return undefined;
+    const head = `${parts[1]}${parts[2]}${name}${parts[2]}${parts[4]}`;
+    // The trailing whitespace and the comment come back from the line as it was written.
+    const tail = `${parts[8]}${line.slice(body.length)}`;
+    return { name, value, rebuild: (replacement) => `${head}${quote}${replacement}${quote}${tail}` };
+}
+const isKey = (name) => /key$/i.test(name);
+/**
+ * Which top-level section of the config a line is in.
+ *
+ * The two that matter are `custom_provider:` and `provider:`. Only the first holds anything worth
+ * redirecting: MCode restores the built-in providers' own `baseURL` over whatever the file says,
+ * measured on a real run, so pointing one at the proxy changes nothing and a run on it records
+ * nothing either way.
+ *
+ * Keys are a separate question and are taken out of *every* section. The generated file lands in
+ * the run directory and `capture.mjs` copies that directory into `capture/<model>/trace/` without
+ * scrubbing it, so whatever this function decides about origins, no key may be left behind.
+ */
+function sectionsOf(config) {
+    let section = '';
+    return config.split('\n').map((line) => {
+        const top = /^([A-Za-z_][\w-]*)[ \t]*:/.exec(line);
+        if (top !== null)
+            section = top[1];
+        return section;
+    });
+}
+const CUSTOM_SECTION = 'custom_provider';
+/**
+ * Whether `/forward/` can carry this origin, asked of the decoder rather than restated here.
+ *
+ * `forwardOrProxyBase` answers an origin the decoder will not take with agenticreplay's own default
+ * upstream, which for the env route is a reasonable last resort and here is not: the request
+ * would leave for a host the operator never named, and this file's own comment calls that worse
+ * than not capturing. Userinfo, a query, a fragment and a non-HTTP scheme are all refused by the
+ * decoder, and a config carrying one of those is a config this adapter leaves alone.
+ */
+function carries(origin) {
+    return decodeForwardPath(forwardBasePath(origin)) !== undefined;
+}
+/** True when there is an origin in here this adapter can actually move. */
+export function hasOrigin(config) {
+    const sections = sectionsOf(config);
+    return config.split('\n').some((line, i) => {
+        if (sections[i] !== CUSTOM_SECTION)
+            return false;
+        const field = fieldOf(line);
+        return field !== undefined && !isKey(field.name) && field.value !== '';
+    });
+}
+/**
+ * Whether the rewrite can be trusted with this config at all.
+ *
+ * A rewrite that cannot prove it did its job does not get written. The proof is the allowlist: a
+ * line that mentions either field must be written the one way this file understands. A key it
+ * cannot see is a key it cannot take out, and an origin it cannot see is a provider that would
+ * keep talking to its real host with nothing in the trace to say so.
+ *
+ * The cost of refusing is an uncaptured run — the same untouched launch a config with no custom
+ * provider gets — which is the side to fail on when the alternative is writing a credential down.
+ */
+export function rewriteIsTrustworthy(config, proxyUrl) {
+    // Last, and about what this file does not know rather than what it does. The allowlist proves
+    // the two fields it understands; a custom provider storing its credential under any other
+    // name — `token:`, `secret:`, `apiToken:` — would pass every check above and be copied out
+    // verbatim.
+    //
+    // Two nets, because one of them has a measured hole. AgenticReplay's own redactor is asked whether
+    // anything in the result still looks like a secret: it changes nothing in a rewritten real
+    // config, forward URLs included, and it catches an `sk-` token, a real JWT, a 40-character
+    // random string and an AWS key id. It does not catch 32 hex characters — that string's maximum
+    // Shannon entropy is exactly the threshold, so a hex key never trips it — which is the commonest
+    // shape a session key or an API key takes.
+    //
+    // So the second net is shape rather than entropy: anywhere in the file, a field this one does
+    // not rewrite whose value is a single opaque token of twenty-four characters or more is
+    // something it cannot account for, and is refused. No value in a real config matches that —
+    // names, kinds, model ids and `api-key` all carry punctuation or are shorter.
+    //
+    // What survives both is a short low-entropy value under an unknown name, `token: hunter2`.
+    // These narrow the hole; they do not close it.
+    const rewritten = redirected(config, proxyUrl);
+    if (new Redactor().redactString(rewritten).value !== rewritten)
+        return false;
+    if (hasUnaccountedToken(config))
+        return false;
+    const sections = sectionsOf(config);
+    return config.split('\n').every((line, i) => {
+        const body = lineBody(line);
+        const mentionsKey = KEY_MENTION.test(body);
+        if (!mentionsKey && !ORIGIN_MENTION.test(body))
+            return true;
+        const field = fieldOf(line);
+        if (field !== undefined && (mentionsKey || carries(field.value)))
+            return true;
+        // Not understood. A key hidden in it would be written down, and a custom origin would be
+        // left pointing at its real host. A built-in origin is MCode's to decide and is not
+        // rewritten either way, so its shape is none of this adapter's business.
+        return !mentionsKey && sections[i] !== CUSTOM_SECTION;
+    });
+}
+/**
+ * The operator's config with every custom origin routed through the proxy and every key taken out.
+ *
+ * Rewritten as text rather than parsed and re-emitted. A YAML round-trip would reformat a file
+ * agenticreplay did not write — comments, quoting, key order — and the two lines that need to change are
+ * recognisable without understanding the rest.
+ *
+ * Each origin goes through `/forward/`, so the request arrives naming the destination it was taken
+ * away from. Replacing it with agenticreplay's own default instead would point a recorded run at a host the
+ * operator never named, which is worse than not capturing it.
+ *
+ * Every custom provider, not the first. With several configured, rewriting one leaves the rest
+ * aimed at their real origins, and a run on one of those is simply missing from the trace.
+ *
+ * Keys come out of every section, built-in included, and `rewriteIsTrustworthy` refuses a config
+ * whose credentials it cannot account for. What that is worth saying precisely: the two nets
+ * catch what they recognise and a short low-entropy value under an unknown name gets past both,
+ * so this is a best effort rather than the guarantee an earlier version of this comment claimed.
+ *
+ * Two things carry the rest of the weight, and neither is detection. `agenticreplay push` ships an
+ * allowlist of four top-level entries, which this directory is not one of, so a pushed run never
+ * carries it. And `capture/<model>/trace/` — where `capture.mjs` moves the run — is documented as
+ * the unscrubbed raw run and is the one thing the prompt vault's CONTRIBUTING forbids committing.
+ * A key that survives the nets stays on the machine it was already on. AgenticReplay
+ * supplies the real one for the origin it forwards to — that is what `agenticreplay setup` configures and
+ * what `upstreamHeaders` injects. Without it the gateway answers 401, and the prompt is captured
+ * anyway: it travels in the request, which agenticreplay records before the origin ever replies.
+ *
+ * What MCode writes back into this file on startup is its own: measured against a config whose
+ * every key had been replaced by a distinct canary, it restored the built-in provider's `apiKey`
+ * as the literal `sk-xxx` from its bundle, and no canary reached the run directory. The
+ * credentials it would have had to read instead live in `<dataDir>/auth/`, which moves with
+ * `MINIMAX_DATA_DIR` — the run's copy holds two lock files and nothing else.
+ */
+export function redirected(config, proxyUrl) {
+    const sections = sectionsOf(config);
+    return config
+        .split('\n')
+        .map((line, i) => {
+        const field = fieldOf(line);
+        if (field === undefined || field.value === '')
+            return line;
+        if (isKey(field.name))
+            return field.rebuild(PLACEHOLDER_KEY);
+        if (sections[i] !== CUSTOM_SECTION)
+            return line;
+        // `v1` when the decoder will not take this origin, matching what the env route falls back to.
+        return field.rebuild(forwardOrProxyBase(proxyUrl, field.value));
+    })
+        .join('\n');
+}
+//# sourceMappingURL=mcode.js.map

package/node_modules/@agenticreplay/adapters/dist/mcode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcode.js","sourceRoot":"","sources":["../src/mcode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,YAAY,GAAY;IACnC,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC;IACxC,eAAe,EAAE,UAAU;IAE3B,mFAAmF;IACnF,OAAO,EAAE,QAAQ;IAEjB,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAkB;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAEvE,0EAA0E;QAC1E,EAAE;QACF,uGAAuG;QACvG,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,4FAA4F;QAC5F,iDAAiD;QACjD,EAAE;QACF,+FAA+F;QAC/F,qFAAqF;QACrF,4FAA4F;QAC5F,oDAAoD;QACpD,EAAE;QACF,qGAAqG;QACrG,yFAAyF;QACzF,8FAA8F;QAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAW;YACrB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;YACvB,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;SACnC,CAAC;QAEF,8FAA8F;QAC9F,2EAA2E;QAC3E,IACE,QAAQ,KAAK,SAAS;YACtB,CAAC,SAAS,CAAC,QAAQ,CAAC;YACpB,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,EAC7C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC5C,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5C,CAAC;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAClB,GAAuC,EACvC,OAAe;IAEf,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACnF,KAAK,MAAM,IAAI,IAAI,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC1D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,oEAAoE;QACpE,IAAI,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,yFAAyF;QACzF,OAAO,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG,mBAAmB,CAAC;AACvC,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;AAE7D,+FAA+F;AAC/F,SAAS,UAAU,CAAC,GAAuC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC/E,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,SAAS,GACb,wGAAwG,CAAC;AAE3G;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD,+FAA+F;AAC/F,MAAM,YAAY,GAAG,mBAAmB,CAAC;AASzC,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,yFAAyF;IACzF,2FAA2F;IAC3F,wFAAwF;IACxF,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;IACvE,qFAAqF;IACrF,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,GAAG,IAAI,EAAE,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC;;;;;;;;GAQG;AACH,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,iBAAiB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACzC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc;YAAE,OAAO,KAAK,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACnE,8FAA8F;IAC9F,0FAA0F;IAC1F,2FAA2F;IAC3F,YAAY;IACZ,EAAE;IACF,mGAAmG;IACnG,2FAA2F;IAC3F,2FAA2F;IAC3F,+FAA+F;IAC/F,iGAAiG;IACjG,2CAA2C;IAC3C,EAAE;IACF,8FAA8F;IAC9F,wFAAwF;IACxF,4FAA4F;IAC5F,8EAA8E;IAC9E,EAAE;IACF,2FAA2F;IAC3F,+CAA+C;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI,QAAQ,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,yFAAyF;QACzF,oFAAoF;QACpF,yEAAyE;QACzE,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,QAAgB;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACf,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;QAChD,8FAA8F;QAC9F,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/node_modules/@agenticreplay/adapters/dist/mcp-config.d.ts

@@ -0,0 +1,17 @@
+/** Result of rewriting an agent's MCP config to launch its stdio servers through the shim. */
+export interface McpRewrite {
+    /** A new config value. The input is never mutated. */
+    config: unknown;
+    /** Server names now launching through the shim. */
+    rewritten: string[];
+    /** Server names deliberately left alone — HTTP/SSE transports, or shapes we do not recognise. */
+    skipped: string[];
+}
+/**
+ * Rewrites `{ mcpServers: { name: { command, args, env } } }` so each stdio server launches under
+ * the JSON-RPC tee. Servers reached over HTTP/SSE are left untouched — they are already captured
+ * by the HTTP proxy — but they are reported rather than silently dropped, because an MCP server
+ * that quietly stops appearing in a trace is indistinguishable from one that was never used.
+ */
+export declare function rewriteMcpConfig(config: unknown, shimCommand: string, shimArgs: string[]): McpRewrite;
+//# sourceMappingURL=mcp-config.d.ts.map

package/node_modules/@agenticreplay/adapters/dist/mcp-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config.d.ts","sourceRoot":"","sources":["../src/mcp-config.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,MAAM,WAAW,UAAU;IACzB,sDAAsD;IACtD,MAAM,EAAE,OAAO,CAAC;IAChB,mDAAmD;IACnD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iGAAiG;IACjG,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAmBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAAE,GACjB,UAAU,CA8CZ"}

package/node_modules/@agenticreplay/adapters/dist/mcp-config.js

@@ -0,0 +1,62 @@
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * A server is already wrapped when it points at *this* shim and carries the `--name ... --`
+ * separator we generate. Matching on the shim command as well as the separator keeps a real
+ * server whose own argv happens to contain `--` from being mistaken for our wrapper.
+ */
+function isWrapped(entry, shimCommand) {
+    if (entry['command'] !== shimCommand)
+        return false;
+    const args = entry['args'];
+    return Array.isArray(args) && args.includes('--name') && args.includes('--');
+}
+/**
+ * Rewrites `{ mcpServers: { name: { command, args, env } } }` so each stdio server launches under
+ * the JSON-RPC tee. Servers reached over HTTP/SSE are left untouched — they are already captured
+ * by the HTTP proxy — but they are reported rather than silently dropped, because an MCP server
+ * that quietly stops appearing in a trace is indistinguishable from one that was never used.
+ */
+export function rewriteMcpConfig(config, shimCommand, shimArgs) {
+    const rewritten = [];
+    const skipped = [];
+    if (!isObject(config) || !isObject(config['mcpServers'])) {
+        return { config, rewritten, skipped };
+    }
+    const { mcpServers: servers, ...rest } = config;
+    const nextServers = {};
+    for (const [name, raw] of Object.entries(servers)) {
+        if (!isObject(raw)) {
+            nextServers[name] = raw;
+            skipped.push(name);
+            continue;
+        }
+        const entry = structuredClone(raw);
+        if (isWrapped(entry, shimCommand)) {
+            nextServers[name] = entry;
+            rewritten.push(name);
+            continue;
+        }
+        if (typeof entry['url'] === 'string') {
+            nextServers[name] = entry;
+            skipped.push(name);
+            continue;
+        }
+        if (typeof entry['command'] !== 'string') {
+            nextServers[name] = entry;
+            skipped.push(name);
+            continue;
+        }
+        const original = entry['command'];
+        const originalArgs = Array.isArray(entry['args']) ? entry['args'] : [];
+        nextServers[name] = {
+            ...entry,
+            command: shimCommand,
+            args: [...shimArgs, '--name', name, '--', original, ...originalArgs],
+        };
+        rewritten.push(name);
+    }
+    return { config: { ...structuredClone(rest), mcpServers: nextServers }, rewritten, skipped };
+}
+//# sourceMappingURL=mcp-config.js.map

package/node_modules/@agenticreplay/adapters/dist/mcp-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config.js","sourceRoot":"","sources":["../src/mcp-config.ts"],"names":[],"mappings":"AAYA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAkB,EAAE,WAAmB;IACxD,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAe,EACf,WAAmB,EACnB,QAAkB;IAElB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAiD,CAAC;IAC3F,MAAM,WAAW,GAA4B,EAAE,CAAC;IAEhD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAgB,CAAC;QAElD,IAAI,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrC,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzC,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,MAAM,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,WAAW,CAAC,IAAI,CAAC,GAAG;YAClB,GAAG,KAAK;YACR,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;SACrE,CAAC;QACF,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/F,CAAC"}

package/node_modules/@agenticreplay/adapters/dist/mimo.d.ts

@@ -0,0 +1,26 @@
+import type { Adapter } from '@agenticreplay/plugin-api';
+/**
+ * MiMo Code, Xiaomi's terminal agent — an OpenCode fork, captured the way OpenCode is.
+ *
+ * Nothing is redirected, and that is inherited rather than chosen: like OpenCode, MiMo keeps its
+ * provider origin in a config file (`~/.config/mimocode/mimocode.jsonc`) rather than in an
+ * environment variable, so `OPENAI_BASE_URL` leaves the run talking straight past the proxy. The
+ * route that works is the one agenticreplay built for an origin that cannot be moved — `--tls-intercept`
+ * terminates the TLS the agent established itself, and the config is left alone.
+ *
+ * Being a fork does *not* mean it inherits an OpenCode installation. The two read parallel
+ * directories, `~/.config/mimocode/` beside `~/.config/opencode/`, so a machine with OpenCode
+ * configured still starts MiMo on Xiaomi's own provider. The config *shape* is shared, which is
+ * what makes a provider block copied from one work in the other.
+ *
+ * `api.xiaomimimo.com` is in `DEFAULT_TLS_HOSTS`, so no extra `--tls-hosts` is needed for the
+ * built-in `xiaomi/*` and `mimo/*` models. A provider of your own pointed at a plain-HTTP gateway
+ * is a different matter: agenticreplay sets `HTTPS_PROXY` and not `HTTP_PROXY`, so that traffic is neither
+ * redirected nor decrypted and the run records nothing.
+ *
+ * A credential is not required to capture the prompt. MiMo sends the request and lets the server
+ * reject it, and the system prompt is in the request — so an invalid key still yields a complete
+ * capture, which is how the fixture below was verified.
+ */
+export declare const mimoAdapter: Adapter;
+//# sourceMappingURL=mimo.d.ts.map

package/node_modules/@agenticreplay/adapters/dist/mimo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mimo.d.ts","sourceRoot":"","sources":["../src/mimo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAyB,MAAM,2BAA2B,CAAC;AAGhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,WAAW,EAAE,OAiBzB,CAAC"}