aicodeman 1.28.1 → 1.29.0

package/dist/custom-model-injection-apply.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @fileoverview The one IO wrapper around `custom-model-injection.ts`'s pure
+ * `ConfigDirInjection` output — deliberately split out so that file, the
+ * discovery routes, and `scripts/test-local-llm-harnesses.ts` (via tsx) can
+ * all share EXACTLY one "write these files, merge this env" implementation.
+ * Before this existed, the route and the standalone script each carried
+ * their own copy of this logic, which is exactly the kind of drift the CLI
+ * registry's "declare once, consume everywhere" design exists to prevent —
+ * see docs/custom-model-endpoints-plan.md and the "dynamic to support
+ * cli-registry changes" requirement it was written against.
+ */
+import type { CliEntry } from './config/cli-registry/types.js';
+import { type ConfigDirInjection, type CustomModelEndpoint } from './custom-model-injection.js';
+/** Where a session's isolated `configDir`-kind files live: never the user's real CLI config path. */
+export declare function customModelConfigDir(sessionId: string): string;
+/**
+ * Writes a `ConfigDirInjection`'s files under `baseDir` and returns the full
+ * envOverrides object a caller should merge into the session/process env
+ * (the dir-redirect var plus any `extraEnv` the config file references by
+ * name). Never touches anything outside `baseDir` — the caller is
+ * responsible for choosing an isolated directory (never the user's real
+ * `~/.codex`, `~/.pi`, etc.).
+ *
+ * pi and omp embed the API key literally in the file, so the tree is written
+ * 0700/0600 like every other secret-bearing file under `~/.codeman`; the chmod
+ * covers a re-apply onto a file that already exists (`mode` only applies at
+ * creation).
+ */
+export declare function applyConfigDirInjection(baseDir: string, injection: ConfigDirInjection): Record<string, string>;
+/** Best-effort recursive removal of a previously-written configDir. Never throws. */
+export declare function removeConfigDir(dir: string | undefined): void;
+/** What applying an endpoint to a session yields, ready for `Session.setCustomModel()`. */
+export interface AppliedCustomModel {
+    envOverrides: Record<string, string>;
+    envKeys: string[];
+    configDir?: string;
+    launchModel?: string;
+}
+/**
+ * Compute (and for the `configDir` kind, write) everything a session needs to run
+ * against `endpoint`/`modelId`. Returns undefined for a CLI with no mechanism.
+ *
+ * Idempotent on purpose: the boot-recovery path calls it again for a session that
+ * was already pointed at an endpoint, so the config files are rewritten in place
+ * (same content) and the env values, which are never persisted because they carry
+ * the API key, are re-derived from the endpoint store instead.
+ */
+export declare function applyCustomModelInjection(entry: Pick<CliEntry, 'capabilities'>, endpoint: CustomModelEndpoint, modelId: string, sessionId: string): AppliedCustomModel | undefined;
+//# sourceMappingURL=custom-model-injection-apply.d.ts.map

package/dist/custom-model-injection-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-model-injection-apply.d.ts","sourceRoot":"","sources":["../src/custom-model-injection-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AAErC,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ9G;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAO7D;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EACrC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,kBAAkB,GAAG,SAAS,CAahC"}

package/dist/custom-model-injection-apply.js

@@ -0,0 +1,77 @@
+/**
+ * @fileoverview The one IO wrapper around `custom-model-injection.ts`'s pure
+ * `ConfigDirInjection` output — deliberately split out so that file, the
+ * discovery routes, and `scripts/test-local-llm-harnesses.ts` (via tsx) can
+ * all share EXACTLY one "write these files, merge this env" implementation.
+ * Before this existed, the route and the standalone script each carried
+ * their own copy of this logic, which is exactly the kind of drift the CLI
+ * registry's "declare once, consume everywhere" design exists to prevent —
+ * see docs/custom-model-endpoints-plan.md and the "dynamic to support
+ * cli-registry changes" requirement it was written against.
+ */
+import { chmodSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { dataPath } from './config/instance.js';
+import { buildCustomModelInjection, } from './custom-model-injection.js';
+/** Where a session's isolated `configDir`-kind files live: never the user's real CLI config path. */
+export function customModelConfigDir(sessionId) {
+    return join(dataPath('custom-model-configs'), sessionId);
+}
+/**
+ * Writes a `ConfigDirInjection`'s files under `baseDir` and returns the full
+ * envOverrides object a caller should merge into the session/process env
+ * (the dir-redirect var plus any `extraEnv` the config file references by
+ * name). Never touches anything outside `baseDir` — the caller is
+ * responsible for choosing an isolated directory (never the user's real
+ * `~/.codex`, `~/.pi`, etc.).
+ *
+ * pi and omp embed the API key literally in the file, so the tree is written
+ * 0700/0600 like every other secret-bearing file under `~/.codeman`; the chmod
+ * covers a re-apply onto a file that already exists (`mode` only applies at
+ * creation).
+ */
+export function applyConfigDirInjection(baseDir, injection) {
+    for (const file of injection.files) {
+        const filePath = join(baseDir, file.relPath);
+        mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+        writeFileSync(filePath, file.content, { encoding: 'utf8', mode: 0o600 });
+        chmodSync(filePath, 0o600);
+    }
+    return { [injection.dirEnvVar]: baseDir, ...injection.extraEnv };
+}
+/** Best-effort recursive removal of a previously-written configDir. Never throws. */
+export function removeConfigDir(dir) {
+    if (!dir)
+        return;
+    try {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        // best-effort cleanup only
+    }
+}
+/**
+ * Compute (and for the `configDir` kind, write) everything a session needs to run
+ * against `endpoint`/`modelId`. Returns undefined for a CLI with no mechanism.
+ *
+ * Idempotent on purpose: the boot-recovery path calls it again for a session that
+ * was already pointed at an endpoint, so the config files are rewritten in place
+ * (same content) and the env values, which are never persisted because they carry
+ * the API key, are re-derived from the endpoint store instead.
+ */
+export function applyCustomModelInjection(entry, endpoint, modelId, sessionId) {
+    const injection = buildCustomModelInjection(entry, endpoint, modelId);
+    if (injection.kind === 'unsupported')
+        return undefined;
+    if (injection.kind === 'env') {
+        return {
+            envOverrides: injection.envOverrides,
+            envKeys: Object.keys(injection.envOverrides),
+            launchModel: injection.launchModel,
+        };
+    }
+    const configDir = customModelConfigDir(sessionId);
+    const envOverrides = applyConfigDirInjection(configDir, injection);
+    return { envOverrides, envKeys: Object.keys(envOverrides), configDir, launchModel: injection.launchModel };
+}
+//# sourceMappingURL=custom-model-injection-apply.js.map

package/dist/custom-model-injection-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-model-injection-apply.js","sourceRoot":"","sources":["../src/custom-model-injection-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EACL,yBAAyB,GAG1B,MAAM,6BAA6B,CAAC;AAErC,qGAAqG;AACrG,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,SAA6B;IACpF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;AACH,CAAC;AAUD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAqC,EACrC,QAA6B,EAC7B,OAAe,EACf,SAAiB;IAEjB,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAC5C,WAAW,EAAE,SAAS,CAAC,WAAW;SACnC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;AAC7G,CAAC"}

package/dist/custom-model-injection.d.ts

@@ -0,0 +1,79 @@
+/**
+ * @fileoverview Pure builder for the Custom Model Endpoint Profiles feature
+ * (docs/custom-model-endpoints-plan.md): turns a CLI registry entry's
+ * `capabilities.customModelInjection` declaration, a configured endpoint,
+ * and a chosen model id into the concrete env vars / config-file content
+ * that would redirect that CLI's session at the endpoint.
+ *
+ * No IO here on purpose (mirrors `session-cli-builder.ts`) — a caller
+ * writes `ConfigDirInjection.files` to disk under an isolated per-session
+ * directory and points `dirEnvVar` at it; this module only computes what
+ * those files/env vars should contain.
+ *
+ * Confidence: `claude` and `opencode` are verified end-to-end against a real
+ * llama-swap server (a real "hello world" reply came back). `codex`'s
+ * config.toml STRUCTURE is now verified (an earlier `[model].default` table
+ * shape was rejected by a real codex binary with "invalid type: map,
+ * expected a string" — caught by `scripts/test-local-llm-harnesses.ts`),
+ * but `wire_api = "responses"` is the only value codex still accepts
+ * (support for `"chat"` was dropped in Feb 2026), and a plain OpenAI
+ * Chat-Completions server (llama.cpp, llama-swap, most local setups) does
+ * NOT implement the Responses API — so codex may still fail at the
+ * PROTOCOL level even with a correctly-shaped config file. That gap is
+ * real and current, not a stale warning; see docs/custom-model-endpoints-plan.md. The rest
+ * (gemini/pi/grok/deepseek/omp) have their ONE-SHOT INVOCATION flags
+ * confirmed against real installed binaries' own `--help` output, but
+ * their custom-endpoint env/config conventions remain web-researched,
+ * unverified.
+ */
+import type { CliEntry } from './config/cli-registry/types.js';
+export interface CustomModelEndpoint {
+    id: string;
+    label: string;
+    /** Root URL, no trailing slash required — e.g. "http://192.168.1.50:8080" or an Azure AI Foundry URL. */
+    baseUrl: string;
+    /** Falls back to a harmless placeholder for endpoints (llama.cpp) that don't check it. */
+    apiKey?: string;
+}
+export interface EnvInjection {
+    kind: 'env';
+    /** Ready to merge into a session's envOverrides. */
+    envOverrides: Record<string, string>;
+    /** See {@link ConfigDirInjection.launchModel}. */
+    launchModel?: string;
+}
+export interface ConfigDirInjection {
+    kind: 'configDir';
+    /** Env var that must be set to the directory the caller writes `files` under. */
+    dirEnvVar: string;
+    files: Array<{
+        relPath: string;
+        content: string;
+    }>;
+    /**
+     * Env vars the written config file REFERENCES by name rather than embedding a
+     * literal value (codex's `env_key = "..."` convention: config.toml never carries
+     * the API key itself, only the name of an env var codex reads it from). Merge
+     * these into the session's envOverrides alongside `dirEnvVar` — never skip them,
+     * or the config points at a credential that was never actually set.
+     */
+    extraEnv?: Record<string, string>;
+    /**
+     * The value the CLI's `model` launch param must carry for it to SELECT the injected
+     * provider (pi/omp: `custom/<modelId>`; grok: the `[model.<name>]` block name). Absent
+     * when the config alone selects the model. Rendered from the registry entry's
+     * `customModelInjection.launchModel` template, never hand-built per CLI.
+     */
+    launchModel?: string;
+}
+export interface UnsupportedInjection {
+    kind: 'unsupported';
+}
+export type CustomModelInjectionResult = EnvInjection | ConfigDirInjection | UnsupportedInjection;
+/** Normalizes a base URL to end in exactly one trailing `/v1`, for CLIs whose config expects the OpenAI-style suffix. */
+export declare function withV1Suffix(baseUrl: string): string;
+export declare function buildCustomModelInjection(entry: Pick<CliEntry, 'capabilities'>, endpoint: CustomModelEndpoint, modelId: string): CustomModelInjectionResult;
+/** The `[model.<name>]` block name grok's config.toml uses for the injected model — also
+ *  what `-m <name>` in the standalone script's ONE_SHOT argv must reference to select it. */
+export declare const GROK_CUSTOM_MODEL_NAME = "codeman-custom";
+//# sourceMappingURL=custom-model-injection.d.ts.map

package/dist/custom-model-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-model-injection.d.ts","sourceRoot":"","sources":["../src/custom-model-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,yGAAyG;IACzG,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,KAAK,CAAC;IACZ,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,MAAM,0BAA0B,GAAG,YAAY,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAIlG,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGpD;AAOD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EACrC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,MAAM,GACd,0BAA0B,CA+B5B;AAmCD;6FAC6F;AAC7F,eAAO,MAAM,sBAAsB,mBAAmB,CAAC"}

package/dist/custom-model-injection.js

@@ -0,0 +1,169 @@
+/**
+ * @fileoverview Pure builder for the Custom Model Endpoint Profiles feature
+ * (docs/custom-model-endpoints-plan.md): turns a CLI registry entry's
+ * `capabilities.customModelInjection` declaration, a configured endpoint,
+ * and a chosen model id into the concrete env vars / config-file content
+ * that would redirect that CLI's session at the endpoint.
+ *
+ * No IO here on purpose (mirrors `session-cli-builder.ts`) — a caller
+ * writes `ConfigDirInjection.files` to disk under an isolated per-session
+ * directory and points `dirEnvVar` at it; this module only computes what
+ * those files/env vars should contain.
+ *
+ * Confidence: `claude` and `opencode` are verified end-to-end against a real
+ * llama-swap server (a real "hello world" reply came back). `codex`'s
+ * config.toml STRUCTURE is now verified (an earlier `[model].default` table
+ * shape was rejected by a real codex binary with "invalid type: map,
+ * expected a string" — caught by `scripts/test-local-llm-harnesses.ts`),
+ * but `wire_api = "responses"` is the only value codex still accepts
+ * (support for `"chat"` was dropped in Feb 2026), and a plain OpenAI
+ * Chat-Completions server (llama.cpp, llama-swap, most local setups) does
+ * NOT implement the Responses API — so codex may still fail at the
+ * PROTOCOL level even with a correctly-shaped config file. That gap is
+ * real and current, not a stale warning; see docs/custom-model-endpoints-plan.md. The rest
+ * (gemini/pi/grok/deepseek/omp) have their ONE-SHOT INVOCATION flags
+ * confirmed against real installed binaries' own `--help` output, but
+ * their custom-endpoint env/config conventions remain web-researched,
+ * unverified.
+ */
+const DEFAULT_API_KEY = 'local-dummy-key';
+/** Normalizes a base URL to end in exactly one trailing `/v1`, for CLIs whose config expects the OpenAI-style suffix. */
+export function withV1Suffix(baseUrl) {
+    const trimmed = baseUrl.replace(/\/+$/, '');
+    return /\/v1$/.test(trimmed) ? trimmed : `${trimmed}/v1`;
+}
+/** JSON-escapes a string for embedding in a TOML/YAML double-quoted scalar — a safe superset of both grammars' basic escapes. */
+function quoted(value) {
+    return JSON.stringify(value);
+}
+export function buildCustomModelInjection(entry, endpoint, modelId) {
+    const cap = entry.capabilities.customModelInjection;
+    const apiKey = endpoint.apiKey?.trim() || DEFAULT_API_KEY;
+    switch (cap.kind) {
+        case 'env': {
+            const envOverrides = {
+                [cap.baseUrlVar]: endpoint.baseUrl,
+                [cap.apiKeyVar]: apiKey,
+            };
+            for (const modelVar of cap.modelVars)
+                envOverrides[modelVar] = modelId;
+            return withLaunchModel({ kind: 'env', envOverrides }, cap.launchModel, modelId);
+        }
+        case 'configContentEnv': {
+            const content = renderConfigContent(cap.template, endpoint, modelId, apiKey);
+            return withLaunchModel({ kind: 'env', envOverrides: { [cap.envVar]: content } }, cap.launchModel, modelId);
+        }
+        case 'configDir': {
+            const { content, extraEnv } = renderConfigFile(cap.template, endpoint, modelId, apiKey);
+            return withLaunchModel({ kind: 'configDir', dirEnvVar: cap.dirEnvVar, files: [{ relPath: cap.fileName, content }], extraEnv }, cap.launchModel, modelId);
+        }
+        case 'unsupported':
+            return { kind: 'unsupported' };
+    }
+}
+/** Render a `launchModel` template (`{modelId}` = the chosen id) onto an injection result. */
+function withLaunchModel(result, template, modelId) {
+    if (!template)
+        return result;
+    return { ...result, launchModel: template.split('{modelId}').join(modelId) };
+}
+function renderConfigContent(template, endpoint, modelId, apiKey) {
+    switch (template) {
+        case 'opencode-json':
+            return JSON.stringify({
+                $schema: 'https://opencode.ai/config.json',
+                provider: {
+                    custom: {
+                        options: { baseURL: withV1Suffix(endpoint.baseUrl), apiKey },
+                        models: { [modelId]: {} },
+                    },
+                },
+                model: `custom/${modelId}`,
+            });
+    }
+}
+const CODEX_API_KEY_ENV_VAR = 'CODEMAN_CUSTOM_MODEL_API_KEY';
+/** The `[model.<name>]` block name grok's config.toml uses for the injected model — also
+ *  what `-m <name>` in the standalone script's ONE_SHOT argv must reference to select it. */
+export const GROK_CUSTOM_MODEL_NAME = 'codeman-custom';
+function renderConfigFile(template, endpoint, modelId, apiKey) {
+    const baseUrl = withV1Suffix(endpoint.baseUrl);
+    switch (template) {
+        case 'codex-toml': {
+            // Verified against real codex (>= Feb 2026): `model` is a top-level STRING, never
+            // a `[model].default` table — codex rejects that with "invalid type: map, expected
+            // a string" (caught by scripts/test-local-llm-harnesses.ts against a real llama-swap
+            // server). The API key is NEVER a literal TOML field: codex's schema only supports
+            // `env_key`, the NAME of an env var it reads the credential from at runtime, so the
+            // actual value must ride along as an extra env var, never embedded in the file.
+            // ⚠️ `wire_api = "responses"` is the only value codex still accepts (it dropped
+            // `"chat"` support in Feb 2026) — a plain OpenAI Chat-Completions server (llama.cpp,
+            // llama-swap, most local setups) does NOT implement the Responses API, so this
+            // recipe may still fail at the PROTOCOL level even though the file now parses
+            // correctly. That is a real, currently-unresolved compatibility gap, not a syntax
+            // bug — track it before calling codex support done.
+            const content = [
+                `model = ${quoted(modelId)}`,
+                `model_provider = "custom"`,
+                '',
+                '[model_providers.custom]',
+                `name = "Custom Endpoint"`,
+                `base_url = ${quoted(baseUrl)}`,
+                `env_key = ${quoted(CODEX_API_KEY_ENV_VAR)}`,
+                `wire_api = "responses"`,
+                '',
+            ].join('\n');
+            return { content, extraEnv: { [CODEX_API_KEY_ENV_VAR]: apiKey } };
+        }
+        case 'pi-models-json':
+            // Verified against pi's OWN bundled docs (models.md): `models` is an ARRAY of
+            // `{id: "..."}` objects, NOT an object keyed by model id — the earlier shape here
+            // silently loaded zero models ("No models available"), confirmed live. `authHeader:
+            // true` is required too: pi does not automatically send `Authorization: Bearer
+            // <apiKey>` just because `apiKey` is set (per the same doc) — without it, a real
+            // (non-llama.cpp) endpoint that actually checks the key would reject every request.
+            return {
+                content: JSON.stringify({
+                    providers: {
+                        custom: {
+                            baseUrl,
+                            apiKey,
+                            api: 'openai-completions',
+                            authHeader: true,
+                            models: [{ id: modelId }],
+                        },
+                    },
+                }, null, 2),
+            };
+        case 'omp-models-yml':
+            // Mirrors the pi-models-json fix above (omp shares pi's config lineage per
+            // CLAUDE.md — it reads several of pi's own env vars): a flat list of bare model
+            // name strings under `models` is UNCONFIRMED against real omp docs (none are
+            // bundled with the binary) — this now matches pi's `{id: "..."}` object-list
+            // shape and adds `authHeader: true` on the same reasoning, but has not itself
+            // been live-tested the way pi's fix was. Verify before raising its confidence.
+            return {
+                content: `providers:\n  custom:\n    baseUrl: ${quoted(baseUrl)}\n    apiKey: ${quoted(apiKey)}\n    api: openai-completions\n    authHeader: true\n    models:\n      - id: ${quoted(modelId)}\n`,
+            };
+        case 'grok-toml': {
+            // Verified against xAI's own docs (docs.x.ai/build/settings/reference): a
+            // `[model.<name>]` block, NOT plain env vars — an earlier `env`-kind recipe for
+            // grok was wrong, not just unverified (see the customModelInjection doc comment
+            // in cli-registry/types.ts). `api_backend = "chat_completions"` is explicitly
+            // supported (unlike codex, which dropped it after Feb 2026), so this one CAN
+            // talk to a plain OpenAI-compatible server directly. `env_key` reuses grok's own
+            // documented fallback var name (XAI_API_KEY) rather than inventing a new one.
+            const content = [
+                `[model.${GROK_CUSTOM_MODEL_NAME}]`,
+                `model = ${quoted(modelId)}`,
+                `base_url = ${quoted(baseUrl)}`,
+                `name = "Custom Endpoint"`,
+                `env_key = "XAI_API_KEY"`,
+                `api_backend = "chat_completions"`,
+                '',
+            ].join('\n');
+            return { content, extraEnv: { XAI_API_KEY: apiKey } };
+        }
+    }
+}
+//# sourceMappingURL=custom-model-injection.js.map

package/dist/custom-model-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-model-injection.js","sourceRoot":"","sources":["../src/custom-model-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAiDH,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,yHAAyH;AACzH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC;AAC3D,CAAC;AAED,iIAAiI;AACjI,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAqC,EACrC,QAA6B,EAC7B,OAAe;IAEf,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,oBAAoB,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC;IAE1D,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,YAAY,GAA2B;gBAC3C,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,OAAO;gBAClC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM;aACxB,CAAC;YACF,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,SAAS;gBAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;YACvE,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7E,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7G,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACxF,OAAO,eAAe,CACpB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EACtG,GAAG,CAAC,WAAW,EACf,OAAO,CACR,CAAC;QACJ,CAAC;QAED,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,eAAe,CACtB,MAAS,EACT,QAA4B,EAC5B,OAAe;IAEf,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC7B,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAyB,EACzB,QAA6B,EAC7B,OAAe,EACf,MAAc;IAEd,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO,EAAE,iCAAiC;gBAC1C,QAAQ,EAAE;oBACR,MAAM,EAAE;wBACN,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE;wBAC5D,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE;qBAC1B;iBACF;gBACD,KAAK,EAAE,UAAU,OAAO,EAAE;aAC3B,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAE7D;6FAC6F;AAC7F,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD,SAAS,gBAAgB,CACvB,QAA0E,EAC1E,QAA6B,EAC7B,OAAe,EACf,MAAc;IAEd,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,kFAAkF;YAClF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,oFAAoF;YACpF,gFAAgF;YAChF,gFAAgF;YAChF,qFAAqF;YACrF,+EAA+E;YAC/E,8EAA8E;YAC9E,kFAAkF;YAClF,oDAAoD;YACpD,MAAM,OAAO,GAAG;gBACd,WAAW,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC5B,2BAA2B;gBAC3B,EAAE;gBACF,0BAA0B;gBAC1B,0BAA0B;gBAC1B,cAAc,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC/B,aAAa,MAAM,CAAC,qBAAqB,CAAC,EAAE;gBAC5C,wBAAwB;gBACxB,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,KAAK,gBAAgB;YACnB,8EAA8E;YAC9E,kFAAkF;YAClF,oFAAoF;YACpF,+EAA+E;YAC/E,iFAAiF;YACjF,oFAAoF;YACpF,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CACrB;oBACE,SAAS,EAAE;wBACT,MAAM,EAAE;4BACN,OAAO;4BACP,MAAM;4BACN,GAAG,EAAE,oBAAoB;4BACzB,UAAU,EAAE,IAAI;4BAChB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;yBAC1B;qBACF;iBACF,EACD,IAAI,EACJ,CAAC,CACF;aACF,CAAC;QACJ,KAAK,gBAAgB;YACnB,2EAA2E;YAC3E,gFAAgF;YAChF,6EAA6E;YAC7E,6EAA6E;YAC7E,8EAA8E;YAC9E,+EAA+E;YAC/E,OAAO;gBACL,OAAO,EAAE,uCAAuC,MAAM,CAAC,OAAO,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,iFAAiF,MAAM,CAAC,OAAO,CAAC,IAAI;aACnM,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,0EAA0E;YAC1E,gFAAgF;YAChF,gFAAgF;YAChF,8EAA8E;YAC9E,6EAA6E;YAC7E,iFAAiF;YACjF,8EAA8E;YAC9E,MAAM,OAAO,GAAG;gBACd,UAAU,sBAAsB,GAAG;gBACnC,WAAW,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC5B,cAAc,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC/B,0BAA0B;gBAC1B,yBAAyB;gBACzB,kCAAkC;gBAClC,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/docker-hosts.d.ts

@@ -100,6 +100,48 @@ export declare function dockerConfigHash(docker: Pick<SessionDocker, 'engine' |
  * computed last over the resolved values.
  */
 export declare function toSessionDocker(host: DockerHost, dockerCase: DockerCase): SessionDocker;
+/**
+ * Which existing case, if any, blocks adopting `container` at `containerWorkdir`.
+ *
+ * One container may back SEVERAL adopted cases, each pointing at a different
+ * directory inside it — that is the whole reason to adopt the same container
+ * twice, and it is safe because the in-container tmux session is named per
+ * SESSION (`dockerTmuxSessionName`, `codeman-dkr-<id8>`) and not per case, so a
+ * session teardown kills exactly one session and its siblings on the shared
+ * in-container tmux server are untouched. Nothing else reaches an adopted
+ * container's lifecycle either: stop/remove throw at the builder, recreate
+ * refuses `owned === false`, and the orphan reaper filters on the
+ * `codeman.managed=1` label that only Codeman-created containers carry.
+ *
+ * So the conflicts that remain are NOT about the tmux server:
+ *  - `owned-case`  the container backs a case Codeman CREATED, whose lifecycle
+ *                  it owns; a recreate or delete there would destroy the
+ *                  adopted case's container out from under it.
+ *  - `other-owner` already adopted by a different user. Adoption hands out a
+ *                  shell inside someone else's container, so it stays scoped.
+ *  - `duplicate`   same container AND same directory: the second case would
+ *                  behave identically to the first, so name the first instead
+ *                  of silently creating a twin. A DIFFERENT directory is the
+ *                  supported case and returns null.
+ */
+export type AdoptContainerConflict = {
+    kind: 'owned-case';
+    caseName: string;
+} | {
+    kind: 'other-owner';
+    caseName: string;
+} | {
+    kind: 'duplicate';
+    caseName: string;
+} | null;
+export declare function classifyAdoptContainerConflict(params: {
+    container: string;
+    /** Directory inside the container this adoption targets (already defaulted). */
+    containerWorkdir: string;
+    existing: ReadonlyArray<Pick<DockerCase, 'name' | 'container' | 'containerWorkdir' | 'hostWorkspacePath' | 'owned' | 'owner'>>;
+    /** Owner visibility test (canAccessOwned bound to the caller). */
+    canAccess: (owner?: string) => boolean;
+}): AdoptContainerConflict;
 /**
  * An ADOPTED container is one the user built and runs themselves. Codeman may
  * only exec into it; it must never create, start, stop, restart or remove it.
@@ -176,7 +218,28 @@ export declare function buildDockerCreateArgs(ctx: DockerCreateContext): string[
  * scripts/build-agent-image.mjs): `build -f <dockerfile> -t <image> [--no-cache]
  * <contextDir>`. Kept pure + unit-testable; the caller prepends the engine binary.
  */
-export declare function agentImageBuildArgs(dockerfile: string, image: string, contextDir: string, noCache?: boolean): string[];
+export declare function agentImageBuildArgs(dockerfile: string, image: string, contextDir: string, noCache?: boolean, buildArgs?: Array<[string, string]>): string[];
+/**
+ * npm packages the agent image installs in its shared layer, from the STOCK catalogue.
+ *
+ * ⚠️ Stock, deliberately, NOT the merged registry. A user's `~/.codeman/clis.json` must not
+ * change what lands inside an image tagged `codeman/agent:base`, or two machines holding that
+ * same tag hold different images and every cache-hit decision downstream is a lie.
+ *
+ * ⚠️ An entry carrying `discovery.install.agentImageLayer` is excluded here — see that field's
+ * doc comment in `types.ts` for why some CLIs need their own hand-written Dockerfile layer
+ * instead of the shared one, and `test/docker-agent-image-coverage.test.ts` for the guard that
+ * an exclusion here still lands in the Dockerfile somewhere.
+ *
+ * ⚠️ This mirrors `agentImageNpmPackages()` in `scripts/lib/cli-catalog.mjs`, which the CLI
+ * build path uses because a `.mjs` cannot import TypeScript. Two producers of one command
+ * line drift; `test/agent-image-build-args-parity.test.ts` is what stops them — including the
+ * SAFE_PACKAGE regex below, which is duplicated (not imported) in that file for the same
+ * reason and must stay byte-identical to it.
+ */
+export declare function agentImageNpmPackages(): string[];
+/** The `--build-arg` pairs the agent image takes. */
+export declare function agentImageBuildArgPairs(): Array<[string, string]>;
 /** Container Claude config dir (created gid-0 writable in the image). */
 export declare const CONTAINER_CLAUDE_DIR = "/home/agent/.claude";
 /** In-container path of the seeded (writable) `~/.claude.json`. */

package/dist/docker-hosts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker-hosts.d.ts","sourceRoot":"","sources":["../src/docker-hosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,UAAU,EAEV,oBAAoB,EACpB,aAAa,EACb,WAAW,EACZ,MAAM,YAAY,CAAC;AAUpB,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AAExD,8FAA8F;AAC9F,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,WAAW,EAAE,CAErD;AAmBD,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,EAAE,oBAKtC,CAAC;AAIF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD;AAiBD,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE9E;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE9E;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAMf;AAID,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,UAAQ,GAAG,MAAM,CAQzF;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,kBAAkB,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtG,MAAM,CAGR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAW/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CACV,aAAa,EACX,QAAQ,GACR,OAAO,GACP,kBAAkB,GAClB,SAAS,GACT,aAAa,GACb,WAAW,GACX,MAAM,GACN,kBAAkB,GAClB,iBAAiB,CACpB,GACA,MAAM,CAaR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,aAAa,CA8BvF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,OAAO,CAEhF;AAID;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAID,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAO/G;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oFAAoF;IACpF,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAChC,+DAA+D;IAC/D,WAAW,EAAE,WAAW,EAAE,CAAC;IAC3B,sHAAsH;IACtH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,+GAA+G;IAC/G,cAAc,EAAE,OAAO,CAAC;IACxB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,GAAG,MAAM,EAAE,CAK9G;AA4BD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAmExE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,MAAM,EAAE,CAEpH;AAID,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,wBAA8B,CAAC;AAChE,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,6BAAmC,CAAC;AACjE,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,0CAAgD,CAAC;AAQ9E;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,aAAa,EAAE,MAAM,EACrB,KAAK,SAAS,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB;AAYD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,GAAE,MAAkB,EACxB,aAAa,CAAC,EAAE,MAAM,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,WAAW,GAAG,IAAI,CAgBpB;AAED;wCACwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,+FAA+F;IAC/F,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB,qBAAqB,CAkCvB;AAmFD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,GAAE,MAAkB,GAAG,qBAAqB,CAgChG;AAiBD,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,YAAY,GAAG,OAAO,CAAC,GAC1G,OAAO,CAAC,iBAAiB,CAAC,CA0B5B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,OAAO,CAAC,GAC3F,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,sFAAsF;IACtF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAqCD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyB7F;AAED;uFACuF;AACvF,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,EAChE,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,EAChE,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACpE,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AA+CD,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC,GACzE,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAED,kFAAkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,GAC/D,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAyBhC;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,CAAC,EAClF,KAAK,GAAE,WAAW,EAAO,EACzB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAgHhC;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,CAAC,EAClF,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,GAAE,YAAuB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcvG;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,YAAuB,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CAkDnB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,eAAe,GAAG,SAAS,GAAG,YAAY,CAAC,EAClF,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuB7B"}
+{"version":3,"file":"docker-hosts.d.ts","sourceRoot":"","sources":["../src/docker-hosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAaH,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,UAAU,EAEV,oBAAoB,EACpB,aAAa,EACb,WAAW,EACZ,MAAM,YAAY,CAAC;AAUpB,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AAExD,8FAA8F;AAC9F,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,WAAW,EAAE,CAErD;AAmBD,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,EAAE,oBAKtC,CAAC;AAIF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD;AAiBD,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE9E;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE9E;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAMf;AAID,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,UAAQ,GAAG,MAAM,CAQzF;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,kBAAkB,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtG,MAAM,CAGR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAW/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CACV,aAAa,EACX,QAAQ,GACR,OAAO,GACP,kBAAkB,GAClB,SAAS,GACT,aAAa,GACb,WAAW,GACX,MAAM,GACN,kBAAkB,GAClB,iBAAiB,CACpB,GACA,MAAM,CAaR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,aAAa,CA8BvF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvC,IAAI,CAAC;AAET,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,aAAa,CACrB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,OAAO,GAAG,OAAO,CAAC,CACtG,CAAC;IACF,kEAAkE;IAClE,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;CACxC,GAAG,sBAAsB,CAiBzB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,OAAO,CAEhF;AAID;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAID,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAO/G;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oFAAoF;IACpF,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAChC,+DAA+D;IAC/D,WAAW,EAAE,WAAW,EAAE,CAAC;IAC3B,sHAAsH;IACtH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,+GAA+G;IAC/G,cAAc,EAAE,OAAO,CAAC;IACxB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,GAAG,MAAM,EAAE,CAK9G;AA4BD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAmExE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,UAAQ,EACf,SAAS,GAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,GACtC,MAAM,EAAE,CAWV;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAiBhD;AAED,qDAAqD;AACrD,wBAAgB,uBAAuB,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEjE;AAID,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,wBAA8B,CAAC;AAChE,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,6BAAmC,CAAC;AACjE,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,0CAAgD,CAAC;AAQ9E;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,aAAa,EAAE,MAAM,EACrB,KAAK,SAAS,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB;AAYD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,GAAE,MAAkB,EACxB,aAAa,CAAC,EAAE,MAAM,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,WAAW,GAAG,IAAI,CAgBpB;AAED;wCACwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,+FAA+F;IAC/F,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB,qBAAqB,CAkCvB;AAmFD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,GAAE,MAAkB,GAAG,qBAAqB,CAgChG;AAiBD,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,YAAY,GAAG,OAAO,CAAC,GAC1G,OAAO,CAAC,iBAAiB,CAAC,CA0B5B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,OAAO,CAAC,GAC3F,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,sFAAsF;IACtF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAqCD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyB7F;AAED;uFACuF;AACvF,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,EAChE,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,EAChE,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACpE,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AA+CD,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC,GACzE,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAED,kFAAkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,GAC/D,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAyBhC;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,CAAC,EAClF,KAAK,GAAE,WAAW,EAAO,EACzB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAgHhC;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,CAAC,EAClF,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,GAAE,YAAuB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcvG;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,YAAuB,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CAkDnB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,eAAe,GAAG,SAAS,GAAG,YAAY,CAAC,EAClF,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuB7B"}

package/dist/docker-hosts.js

@@ -24,6 +24,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { enabledCliIds, getCli } from './config/cli-registry/registry.js';
+import { STOCK_CLIS } from './config/cli-registry/stock.js';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { createHash } from 'node:crypto';
@@ -243,6 +244,24 @@ export function toSessionDocker(host, dockerCase) {
         session.owned = false;
     return session;
 }
+export function classifyAdoptContainerConflict(params) {
+    const { container, containerWorkdir, existing, canAccess } = params;
+    const sharing = existing.filter((item) => (item.container ?? dockerContainerName(item.name)) === container);
+    if (sharing.length === 0)
+        return null;
+    // `owned` is optional and an ABSENT flag means owned (legacy cases predate the
+    // field), so this must test `!== false` rather than truthiness.
+    const owned = sharing.find((item) => item.owned !== false);
+    if (owned)
+        return { kind: 'owned-case', caseName: owned.name };
+    const foreign = sharing.find((item) => !canAccess(item.owner));
+    if (foreign)
+        return { kind: 'other-owner', caseName: foreign.name };
+    const twin = sharing.find((item) => (item.containerWorkdir ?? item.hostWorkspacePath) === containerWorkdir);
+    if (twin)
+        return { kind: 'duplicate', caseName: twin.name };
+    return null;
+}
 /**
  * An ADOPTED container is one the user built and runs themselves. Codeman may
  * only exec into it; it must never create, start, stop, restart or remove it.
@@ -381,8 +400,61 @@ export function buildDockerCreateArgs(ctx) {
  * scripts/build-agent-image.mjs): `build -f <dockerfile> -t <image> [--no-cache]
  * <contextDir>`. Kept pure + unit-testable; the caller prepends the engine binary.
  */
-export function agentImageBuildArgs(dockerfile, image, contextDir, noCache = false) {
-    return ['build', '-f', dockerfile, '-t', image, ...(noCache ? ['--no-cache'] : []), contextDir];
+export function agentImageBuildArgs(dockerfile, image, contextDir, noCache = false, buildArgs = []) {
+    return [
+        'build',
+        '-f',
+        dockerfile,
+        '-t',
+        image,
+        ...(noCache ? ['--no-cache'] : []),
+        ...buildArgs.flatMap(([name, value]) => ['--build-arg', `${name}=${value}`]),
+        contextDir,
+    ];
+}
+/** Tokens allowed in an npm package name reaching a Dockerfile build arg unquoted. */
+const SAFE_PACKAGE = /^[@A-Za-z0-9][@A-Za-z0-9/._-]*$/;
+/**
+ * npm packages the agent image installs in its shared layer, from the STOCK catalogue.
+ *
+ * ⚠️ Stock, deliberately, NOT the merged registry. A user's `~/.codeman/clis.json` must not
+ * change what lands inside an image tagged `codeman/agent:base`, or two machines holding that
+ * same tag hold different images and every cache-hit decision downstream is a lie.
+ *
+ * ⚠️ An entry carrying `discovery.install.agentImageLayer` is excluded here — see that field's
+ * doc comment in `types.ts` for why some CLIs need their own hand-written Dockerfile layer
+ * instead of the shared one, and `test/docker-agent-image-coverage.test.ts` for the guard that
+ * an exclusion here still lands in the Dockerfile somewhere.
+ *
+ * ⚠️ This mirrors `agentImageNpmPackages()` in `scripts/lib/cli-catalog.mjs`, which the CLI
+ * build path uses because a `.mjs` cannot import TypeScript. Two producers of one command
+ * line drift; `test/agent-image-build-args-parity.test.ts` is what stops them — including the
+ * SAFE_PACKAGE regex below, which is duplicated (not imported) in that file for the same
+ * reason and must stay byte-identical to it.
+ */
+export function agentImageNpmPackages() {
+    const packages = [];
+    for (const entry of STOCK_CLIS) {
+        if (!entry.enabled || entry.discovery.install.agentImageLayer)
+            continue;
+        const pkg = entry.discovery.install.npmPackage;
+        if (!pkg)
+            continue;
+        // The value is interpolated into a Dockerfile ARG expanded UNQUOTED (word splitting is
+        // how the list becomes several arguments), so a token with whitespace or shell
+        // metacharacters would change what the RUN line means. The source is `stock.ts`, so the
+        // practical risk is nil, but this is the in-app auto-build path and the only one of the
+        // two producers where that had gone unchecked.
+        if (!SAFE_PACKAGE.test(pkg)) {
+            throw new Error(`Refusing unsafe npm package name for "${String(entry.id)}": ${JSON.stringify(pkg)}`);
+        }
+        packages.push(pkg);
+    }
+    return packages;
+}
+/** The `--build-arg` pairs the agent image takes. */
+export function agentImageBuildArgPairs() {
+    return [['CLI_NPM_PACKAGES', agentImageNpmPackages().join(' ')]];
 }
 // ========== Credential mount resolution (IO) ==========
 /** Container Claude config dir (created gid-0 writable in the image). */
@@ -802,7 +874,7 @@ function buildAgentImage(docker, image, opts) {
     const argv = dockerEngineArgv(docker);
     const args = [
         ...argv.slice(1),
-        ...agentImageBuildArgs(resolved.dockerfile, image, resolved.contextDir, opts.noCache),
+        ...agentImageBuildArgs(resolved.dockerfile, image, resolved.contextDir, opts.noCache, agentImageBuildArgPairs()),
     ];
     return new Promise((resolve) => {
         // async spawn (NEVER spawnSync) so a multi-minute build never wedges the event loop.