anypick 1.0.0 → 1.1.0

package/dist/clients/isolation.d.ts

@@ -1,28 +0,0 @@
-/**
- * Isolated temporary client runtime helpers (spec §9.7.1).
- *
- * Rules:
- * - owner-only temp directory (0o700)
- * - copy only explicit allowlist entries from listIsolatablePaths
- * - reject path traversal, destinations outside temp root, unsafe symlinks
- * - never recursively copy a full home directory
- */
-import type { IsolatablePath, IsolatedClientRuntime } from '../types.js';
-export { syntheticProxyProfile } from '../core/profile-synth.js';
-export declare function createTempRuntimeRoot(prefix?: string): Promise<string>;
-/**
- * Validate destinationPath stays inside runtimeRoot (no `..` escape).
- */
-export declare function resolveSafeDestination(runtimeRoot: string, destinationPath: string): string;
-/**
- * Reject symlinks that would escape the allowlist source policy.
- * Policy: do not follow symlinks when copying; fail if source is a symlink.
- */
-export declare function assertSafeSource(sourcePath: string): Promise<void>;
-/**
- * Copy allowlisted isolatable paths into runtimeRoot.
- * Missing optional paths are skipped; missing required paths fail.
- */
-export declare function materializeIsolatablePaths(runtimeRoot: string, paths: readonly IsolatablePath[]): Promise<string[]>;
-export declare function makeIsolatedRuntime(directory: string, environment: Record<string, string>): IsolatedClientRuntime;
-//# sourceMappingURL=isolation.d.ts.map

package/dist/clients/isolation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"isolation.d.ts","sourceRoot":"","sources":["../../src/clients/isolation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAKtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,wBAAsB,qBAAqB,CAAC,MAAM,SAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAoC3F;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,cAAc,EAAE,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CAuDnB;AAgCD,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,qBAAqB,CAiBvB"}

package/dist/clients/isolation.js

@@ -1,131 +0,0 @@
-import { ExitCode, anypickError } from "../utils/errors.js";
-import { pathExists } from "../utils/fs.js";
-import { syntheticProxyProfile } from "../core/profile-synth.js";
-import { dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
-import { chmod, cp, lstat, mkdir, mkdtemp, readdir, rm, stat } from "node:fs/promises";
-import { tmpdir } from "node:os";
-//#region src/clients/isolation.ts
-/**
-* Isolated temporary client runtime helpers (spec §9.7.1).
-*
-* Rules:
-* - owner-only temp directory (0o700)
-* - copy only explicit allowlist entries from listIsolatablePaths
-* - reject path traversal, destinations outside temp root, unsafe symlinks
-* - never recursively copy a full home directory
-*/
-async function createTempRuntimeRoot(prefix = "anypick-client-") {
-	const root = await mkdtemp(join(tmpdir(), prefix));
-	try {
-		await chmod(root, 448);
-	} catch {}
-	return root;
-}
-/**
-* Validate destinationPath stays inside runtimeRoot (no `..` escape).
-*/
-function resolveSafeDestination(runtimeRoot, destinationPath) {
-	if (!destinationPath || destinationPath.includes("\0")) throw anypickError(`Invalid isolation destination: ${destinationPath}`, "INVALID_USAGE", { exitCode: ExitCode.INVALID_USAGE });
-	if (isAbsolute(destinationPath)) throw anypickError(`Isolation destination must be relative: ${destinationPath}`, "INVALID_USAGE", { exitCode: ExitCode.INVALID_USAGE });
-	const normalized = normalize(destinationPath);
-	if (normalized === ".." || normalized.startsWith(`..${sep}`) || normalized.includes(`${sep}..${sep}`) || normalized.endsWith(`${sep}..`)) throw anypickError(`Isolation destination escapes runtime root: ${destinationPath}`, "INVALID_USAGE", { exitCode: ExitCode.INVALID_USAGE });
-	const abs = resolve(runtimeRoot, normalized);
-	const rel = relative(resolve(runtimeRoot), abs);
-	if (rel.startsWith("..") || isAbsolute(rel)) throw anypickError(`Isolation destination escapes runtime root: ${destinationPath}`, "INVALID_USAGE", { exitCode: ExitCode.INVALID_USAGE });
-	return abs;
-}
-/**
-* Reject symlinks that would escape the allowlist source policy.
-* Policy: do not follow symlinks when copying; fail if source is a symlink.
-*/
-async function assertSafeSource(sourcePath) {
-	try {
-		if ((await lstat(sourcePath)).isSymbolicLink()) throw anypickError(`Isolation refuses to copy symlink: ${sourcePath}`, "INVALID_USAGE", { exitCode: ExitCode.INVALID_USAGE });
-	} catch (err) {
-		if (err && typeof err === "object" && "code" in err) throw err;
-		throw err;
-	}
-}
-/**
-* Copy allowlisted isolatable paths into runtimeRoot.
-* Missing optional paths are skipped; missing required paths fail.
-*/
-async function materializeIsolatablePaths(runtimeRoot, paths) {
-	const copied = [];
-	for (const entry of paths) {
-		const dest = resolveSafeDestination(runtimeRoot, entry.destinationPath);
-		if (!await pathExists(entry.sourcePath)) {
-			if (entry.required) throw anypickError(`Required client path missing for isolation: ${entry.sourcePath}`, "MISSING_DEPENDENCY", { exitCode: ExitCode.MISSING_DEPENDENCY });
-			continue;
-		}
-		await assertSafeSource(entry.sourcePath);
-		await mkdir(dirname(dest), {
-			recursive: true,
-			mode: 448
-		});
-		if (entry.kind === "directory") {
-			await cp(entry.sourcePath, dest, {
-				recursive: true,
-				verbatimSymlinks: true,
-				filter: async (src) => {
-					try {
-						if ((await lstat(src)).isSymbolicLink()) return false;
-						return true;
-					} catch {
-						return false;
-					}
-				}
-			});
-			await clampModeRecursively(dest);
-		} else {
-			const { copyFile, chmod: chmodFile } = await import("node:fs/promises");
-			await copyFile(entry.sourcePath, dest);
-			try {
-				await chmodFile(dest, (await stat(entry.sourcePath)).mode & 384 || 384);
-			} catch {}
-		}
-		copied.push(dest);
-	}
-	return copied;
-}
-/**
-* Walk a copied subtree and clamp every entry to owner-only permissions.
-* Files cap at 0o600 (drop all group/other bits); directories at 0o700.
-* Used after `cp` since it preserves the source tree's modes verbatim and
-* would otherwise carry world/group-readable secrets into the isolated home.
-*/
-async function clampModeRecursively(root) {
-	const entries = await readdir(root, { withFileTypes: true });
-	for (const entry of entries) {
-		const full = join(root, entry.name);
-		if (entry.isDirectory()) {
-			await clampModeRecursively(full);
-			try {
-				await chmod(full, 448);
-			} catch {}
-		} else if (entry.isFile()) try {
-			await chmod(full, (await stat(full)).mode & 384 || 384);
-		} catch {}
-	}
-}
-function makeIsolatedRuntime(directory, environment) {
-	let cleaned = false;
-	return {
-		directory,
-		environment,
-		async cleanup() {
-			if (cleaned) return;
-			cleaned = true;
-			try {
-				await rm(directory, {
-					recursive: true,
-					force: true
-				});
-			} catch {}
-		}
-	};
-}
-//#endregion
-export { assertSafeSource, createTempRuntimeRoot, makeIsolatedRuntime, materializeIsolatablePaths, resolveSafeDestination, syntheticProxyProfile };
-
-//# sourceMappingURL=isolation.js.map

package/dist/clients/isolation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"isolation.js","names":[],"sources":["../../src/clients/isolation.ts"],"sourcesContent":["/**\n * Isolated temporary client runtime helpers (spec §9.7.1).\n *\n * Rules:\n * - owner-only temp directory (0o700)\n * - copy only explicit allowlist entries from listIsolatablePaths\n * - reject path traversal, destinations outside temp root, unsafe symlinks\n * - never recursively copy a full home directory\n */\n\nimport { chmod, cp, lstat, mkdir, mkdtemp, readdir, rm, stat } from 'node:fs/promises';\nimport { tmpdir } from 'node:os';\nimport { dirname, isAbsolute, join, normalize, relative, resolve, sep } from 'node:path';\nimport type { IsolatablePath, IsolatedClientRuntime } from '../types';\nimport { anypickError, ExitCode } from '../utils/errors';\nimport { pathExists } from '../utils/fs';\n\n// Moved to core so core does not take value imports from the clients package.\nexport { syntheticProxyProfile } from '../core/profile-synth';\n\nexport async function createTempRuntimeRoot(prefix = 'anypick-client-'): Promise<string> {\n  const root = await mkdtemp(join(tmpdir(), prefix));\n  try {\n    await chmod(root, 0o700);\n  } catch {\n    // best-effort on platforms without chmod\n  }\n  return root;\n}\n\n/**\n * Validate destinationPath stays inside runtimeRoot (no `..` escape).\n */\nexport function resolveSafeDestination(runtimeRoot: string, destinationPath: string): string {\n  if (!destinationPath || destinationPath.includes('\\0')) {\n    throw anypickError(`Invalid isolation destination: ${destinationPath}`, 'INVALID_USAGE', {\n      exitCode: ExitCode.INVALID_USAGE,\n    });\n  }\n  if (isAbsolute(destinationPath)) {\n    throw anypickError(\n      `Isolation destination must be relative: ${destinationPath}`,\n      'INVALID_USAGE',\n      { exitCode: ExitCode.INVALID_USAGE },\n    );\n  }\n  const normalized = normalize(destinationPath);\n  if (\n    normalized === '..' ||\n    normalized.startsWith(`..${sep}`) ||\n    normalized.includes(`${sep}..${sep}`) ||\n    normalized.endsWith(`${sep}..`)\n  ) {\n    throw anypickError(\n      `Isolation destination escapes runtime root: ${destinationPath}`,\n      'INVALID_USAGE',\n      { exitCode: ExitCode.INVALID_USAGE },\n    );\n  }\n  const abs = resolve(runtimeRoot, normalized);\n  const rel = relative(resolve(runtimeRoot), abs);\n  if (rel.startsWith('..') || isAbsolute(rel)) {\n    throw anypickError(\n      `Isolation destination escapes runtime root: ${destinationPath}`,\n      'INVALID_USAGE',\n      { exitCode: ExitCode.INVALID_USAGE },\n    );\n  }\n  return abs;\n}\n\n/**\n * Reject symlinks that would escape the allowlist source policy.\n * Policy: do not follow symlinks when copying; fail if source is a symlink.\n */\nexport async function assertSafeSource(sourcePath: string): Promise<void> {\n  try {\n    const st = await lstat(sourcePath);\n    if (st.isSymbolicLink()) {\n      throw anypickError(`Isolation refuses to copy symlink: ${sourcePath}`, 'INVALID_USAGE', {\n        exitCode: ExitCode.INVALID_USAGE,\n      });\n    }\n  } catch (err) {\n    if (err && typeof err === 'object' && 'code' in err) {\n      // ENOENT handled by caller via required flag\n      throw err;\n    }\n    throw err;\n  }\n}\n\n/**\n * Copy allowlisted isolatable paths into runtimeRoot.\n * Missing optional paths are skipped; missing required paths fail.\n */\nexport async function materializeIsolatablePaths(\n  runtimeRoot: string,\n  paths: readonly IsolatablePath[],\n): Promise<string[]> {\n  const copied: string[] = [];\n  for (const entry of paths) {\n    const dest = resolveSafeDestination(runtimeRoot, entry.destinationPath);\n    const exists = await pathExists(entry.sourcePath);\n    if (!exists) {\n      if (entry.required) {\n        throw anypickError(\n          `Required client path missing for isolation: ${entry.sourcePath}`,\n          'MISSING_DEPENDENCY',\n          { exitCode: ExitCode.MISSING_DEPENDENCY },\n        );\n      }\n      continue;\n    }\n    await assertSafeSource(entry.sourcePath);\n    await mkdir(dirname(dest), { recursive: true, mode: 0o700 });\n\n    if (entry.kind === 'directory') {\n      await cp(entry.sourcePath, dest, {\n        recursive: true,\n        // do not follow symlinks\n        verbatimSymlinks: true,\n        filter: async (src) => {\n          try {\n            const st = await lstat(src);\n            if (st.isSymbolicLink()) {\n              return false;\n            }\n            return true;\n          } catch {\n            return false;\n          }\n        },\n      });\n      // cp preserves the source tree's modes verbatim for directory contents,\n      // so clamp every copied file/dir to owner-only (0o600 / 0o700) after the\n      // copy. Symlinks are already excluded by the filter above.\n      await clampModeRecursively(dest);\n    } else {\n      const { copyFile, chmod: chmodFile } = await import('node:fs/promises');\n      await copyFile(entry.sourcePath, dest);\n      try {\n        // never more permissive than 0o600 for files\n        const srcStat = await stat(entry.sourcePath);\n        const mode = srcStat.mode & 0o777;\n        const restrictive = mode & 0o600; // drop group/other write/exec at least\n        await chmodFile(dest, restrictive || 0o600);\n      } catch {\n        // ignore\n      }\n    }\n    copied.push(dest);\n  }\n  return copied;\n}\n\n/**\n * Walk a copied subtree and clamp every entry to owner-only permissions.\n * Files cap at 0o600 (drop all group/other bits); directories at 0o700.\n * Used after `cp` since it preserves the source tree's modes verbatim and\n * would otherwise carry world/group-readable secrets into the isolated home.\n */\nasync function clampModeRecursively(root: string): Promise<void> {\n  const entries = await readdir(root, { withFileTypes: true });\n  for (const entry of entries) {\n    const full = join(root, entry.name);\n    if (entry.isDirectory()) {\n      await clampModeRecursively(full);\n      try {\n        await chmod(full, 0o700);\n      } catch {\n        // ignore best-effort\n      }\n    } else if (entry.isFile()) {\n      try {\n        const st = await stat(full);\n        const mode = st.mode & 0o777;\n        await chmod(full, mode & 0o600 || 0o600);\n      } catch {\n        // ignore best-effort\n      }\n    }\n    // symlinks are skipped (excluded by the copy filter)\n  }\n}\n\nexport function makeIsolatedRuntime(\n  directory: string,\n  environment: Record<string, string>,\n): IsolatedClientRuntime {\n  let cleaned = false;\n  return {\n    directory,\n    environment,\n    async cleanup() {\n      if (cleaned) {\n        return;\n      }\n      cleaned = true;\n      try {\n        await rm(directory, { recursive: true, force: true });\n      } catch {\n        // best-effort\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsB,sBAAsB,SAAS,mBAAoC;CACvF,MAAM,OAAO,MAAM,QAAQ,KAAK,OAAO,GAAG,MAAM,CAAC;CACjD,IAAI;EACF,MAAM,MAAM,MAAM,GAAK;CACzB,QAAQ,CAER;CACA,OAAO;AACT;;;;AAKA,SAAgB,uBAAuB,aAAqB,iBAAiC;CAC3F,IAAI,CAAC,mBAAmB,gBAAgB,SAAS,IAAI,GACnD,MAAM,aAAa,kCAAkC,mBAAmB,iBAAiB,EACvF,UAAU,SAAS,cACrB,CAAC;CAEH,IAAI,WAAW,eAAe,GAC5B,MAAM,aACJ,2CAA2C,mBAC3C,iBACA,EAAE,UAAU,SAAS,cAAc,CACrC;CAEF,MAAM,aAAa,UAAU,eAAe;CAC5C,IACE,eAAe,QACf,WAAW,WAAW,KAAK,KAAK,KAChC,WAAW,SAAS,GAAG,IAAI,IAAI,KAAK,KACpC,WAAW,SAAS,GAAG,IAAI,GAAG,GAE9B,MAAM,aACJ,+CAA+C,mBAC/C,iBACA,EAAE,UAAU,SAAS,cAAc,CACrC;CAEF,MAAM,MAAM,QAAQ,aAAa,UAAU;CAC3C,MAAM,MAAM,SAAS,QAAQ,WAAW,GAAG,GAAG;CAC9C,IAAI,IAAI,WAAW,IAAI,KAAK,WAAW,GAAG,GACxC,MAAM,aACJ,+CAA+C,mBAC/C,iBACA,EAAE,UAAU,SAAS,cAAc,CACrC;CAEF,OAAO;AACT;;;;;AAMA,eAAsB,iBAAiB,YAAmC;CACxE,IAAI;EAEF,KAAI,MADa,MAAM,UAAU,EAAA,CAC1B,eAAe,GACpB,MAAM,aAAa,sCAAsC,cAAc,iBAAiB,EACtF,UAAU,SAAS,cACrB,CAAC;CAEL,SAAS,KAAK;EACZ,IAAI,OAAO,OAAO,QAAQ,YAAY,UAAU,KAE9C,MAAM;EAER,MAAM;CACR;AACF;;;;;AAMA,eAAsB,2BACpB,aACA,OACmB;CACnB,MAAM,SAAmB,CAAC;CAC1B,KAAK,MAAM,SAAS,OAAO;EACzB,MAAM,OAAO,uBAAuB,aAAa,MAAM,eAAe;EAEtE,IAAI,CAAC,MADgB,WAAW,MAAM,UAAU,GACnC;GACX,IAAI,MAAM,UACR,MAAM,aACJ,+CAA+C,MAAM,cACrD,sBACA,EAAE,UAAU,SAAS,mBAAmB,CAC1C;GAEF;EACF;EACA,MAAM,iBAAiB,MAAM,UAAU;EACvC,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAE3D,IAAI,MAAM,SAAS,aAAa;GAC9B,MAAM,GAAG,MAAM,YAAY,MAAM;IAC/B,WAAW;IAEX,kBAAkB;IAClB,QAAQ,OAAO,QAAQ;KACrB,IAAI;MAEF,KAAI,MADa,MAAM,GAAG,EAAA,CACnB,eAAe,GACpB,OAAO;MAET,OAAO;KACT,QAAQ;MACN,OAAO;KACT;IACF;GACF,CAAC;GAID,MAAM,qBAAqB,IAAI;EACjC,OAAO;GACL,MAAM,EAAE,UAAU,OAAO,cAAc,MAAM,OAAO;GACpD,MAAM,SAAS,MAAM,YAAY,IAAI;GACrC,IAAI;IAKF,MAAM,UAAU,OAFH,MADS,KAAK,MAAM,UAAU,EAAA,CACtB,OAAA,OAEgB,GAAK;GAC5C,QAAQ,CAER;EACF;EACA,OAAO,KAAK,IAAI;CAClB;CACA,OAAO;AACT;;;;;;;AAQA,eAAe,qBAAqB,MAA6B;CAC/D,MAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,eAAe,KAAK,CAAC;CAC3D,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,OAAO,KAAK,MAAM,MAAM,IAAI;EAClC,IAAI,MAAM,YAAY,GAAG;GACvB,MAAM,qBAAqB,IAAI;GAC/B,IAAI;IACF,MAAM,MAAM,MAAM,GAAK;GACzB,QAAQ,CAER;EACF,OAAO,IAAI,MAAM,OAAO,GACtB,IAAI;GAGF,MAAM,MAAM,OADC,MADI,KAAK,IAAI,EAAA,CACV,OAAA,OACkB,GAAK;EACzC,QAAQ,CAER;CAGJ;AACF;AAEA,SAAgB,oBACd,WACA,aACuB;CACvB,IAAI,UAAU;CACd,OAAO;EACL;EACA;EACA,MAAM,UAAU;GACd,IAAI,SACF;GAEF,UAAU;GACV,IAAI;IACF,MAAM,GAAG,WAAW;KAAE,WAAW;KAAM,OAAO;IAAK,CAAC;GACtD,QAAQ,CAER;EACF;CACF;AACF"}

package/dist/clients/kiro.d.ts

@@ -1,10 +0,0 @@
-import type { ClientAdapter } from '../types.js';
-/**
- * Kiro client adapter — primarily env-file based.
- * Native Kiro auth remains under account backup/restore (SSO cache files).
- *
- * Ephemeral run uses an isolated temporary HOME so live config is untouched.
- */
-export declare function createKiroClient(home?: string): ClientAdapter;
-export declare const kiroClient: ClientAdapter;
-//# sourceMappingURL=kiro.d.ts.map

package/dist/clients/kiro.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kiro.d.ts","sourceRoot":"","sources":["../../src/clients/kiro.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,aAAa,EAOd,MAAM,UAAU,CAAC;AAiElB;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,SAAgC,GAAG,aAAa,CAoJpF;AAYD,eAAO,MAAM,UAAU,eAAqB,CAAC"}

package/dist/clients/kiro.js

@@ -1,168 +0,0 @@
-import { ensureDir, writeTextFile } from "../utils/fs.js";
-import { resolveFromContext } from "./resolve.js";
-import { syntheticProxyProfile } from "../core/profile-synth.js";
-import { removeClientEnvFiles, writeClientEnvFiles } from "./env-files.js";
-import { createTempRuntimeRoot, makeIsolatedRuntime, materializeIsolatablePaths } from "./isolation.js";
-import { DEFAULT_MODEL_ROLE } from "./model-roles.js";
-import { join } from "node:path";
-import { homedir } from "node:os";
-//#region src/clients/kiro.ts
-async function applyKiroContext(ctx) {
-	const r = resolveFromContext(ctx);
-	const env = { OPENAI_API_KEY: r.apiKey };
-	if (r.endpoint) env.OPENAI_BASE_URL = r.endpoint;
-	if (r.defaultModel) env.OPENAI_MODEL = r.defaultModel;
-	if (r.endpoint) {
-		env.ANTHROPIC_BASE_URL = r.endpoint;
-		env.ANTHROPIC_AUTH_TOKEN = r.apiKey;
-	}
-	if (ctx.dryRun) return {
-		managedPaths: [join(ctx.anypickRoot, "clients", "kiro", "env.sh"), join(ctx.anypickRoot, "clients", "kiro", "env.ps1")],
-		managedEnvKeys: Object.keys(env)
-	};
-	if (ctx.isolatedHome) {
-		const envPaths = await writeClientEnvFiles(join(ctx.isolatedHome, ".anypick"), "kiro", env);
-		const dotenv = join(ctx.isolatedHome, ".kiro-anypick.env");
-		await writeTextFile(dotenv, Object.entries(env).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join("\n") + "\n", 384);
-		return {
-			managedPaths: [...envPaths, dotenv],
-			managedEnvKeys: Object.keys(env)
-		};
-	}
-	return {
-		managedPaths: await writeClientEnvFiles(ctx.anypickRoot, "kiro", env),
-		managedEnvKeys: Object.keys(env)
-	};
-}
-/**
-* Kiro client adapter — primarily env-file based.
-* Native Kiro auth remains under account backup/restore (SSO cache files).
-*
-* Ephemeral run uses an isolated temporary HOME so live config is untouched.
-*/
-function createKiroClient(home = process.env.HOME ?? homedir()) {
-	return {
-		id: "kiro",
-		name: "Kiro",
-		shortName: "Kiro",
-		binaryName: "kiro",
-		binaryEnvVar: "KIRO_BINARY",
-		description: "Amazon Kiro (runtime env overlay)",
-		supportedApiStyles: [
-			"openai",
-			"anthropic",
-			"custom"
-		],
-		nativeInstallations: [{
-			sourceId: "kiro",
-			executables: ["kiro-cli", "kiro"],
-			macApplications: ["Kiro.app", "Kiro CLI.app"]
-		}],
-		capabilities: {
-			id: "kiro",
-			acceptedProtocols: ["openai", "anthropic"],
-			supportsEnvironmentOverlay: false,
-			supportsIsolatedHome: true,
-			supportsPersistentConfig: true,
-			protocolPreference: "anthropic"
-		},
-		modelRoles: () => DEFAULT_MODEL_ROLE,
-		async validate(_ctx) {},
-		async apply(ctx) {
-			return applyKiroContext(ctx);
-		},
-		async listIsolatablePaths(_liveState) {
-			return [];
-		},
-		async createIsolatedRuntime(plan, paths) {
-			const runtimeRoot = await createTempRuntimeRoot("anypick-kiro-");
-			const isoHome = join(runtimeRoot, "home");
-			await ensureDir(isoHome);
-			await materializeIsolatablePaths(isoHome, paths);
-			const profile = plan.profile ?? syntheticProxyProfile({
-				name: `ephemeral-${plan.source.display}`,
-				endpoint: plan.transport.endpoint ?? "",
-				apiKey: "anypick-proxy",
-				defaultModel: plan.model.mode === "explicit" ? plan.model.id : void 0
-			});
-			const endpoint = plan.transport.endpoint ?? (plan.transport.managedProxy ? `http://127.0.0.1:${plan.transport.managedProxy.port}` : profile.meta.endpoint ?? "");
-			const ctx = {
-				profile: {
-					...profile,
-					meta: {
-						...profile.meta,
-						endpoint
-					},
-					secrets: {
-						...profile.secrets,
-						apiKey: profile.secrets.apiKey ?? "anypick-proxy"
-					}
-				},
-				clientId: "kiro",
-				dryRun: plan.dryRun,
-				verbose: plan.verbose,
-				proxyEndpoint: endpoint || void 0,
-				anypickRoot: plan.anypickRoot,
-				isolatedHome: isoHome
-			};
-			let env;
-			if (!plan.dryRun) {
-				await applyKiroContext(ctx);
-				env = {
-					HOME: isoHome,
-					OPENAI_API_KEY: ctx.profile.secrets.apiKey ?? "anypick-proxy",
-					...endpoint ? {
-						OPENAI_BASE_URL: endpoint,
-						ANTHROPIC_BASE_URL: endpoint,
-						ANTHROPIC_AUTH_TOKEN: ctx.profile.secrets.apiKey ?? "anypick-proxy"
-					} : {}
-				};
-			} else env = { HOME: isoHome };
-			return makeIsolatedRuntime(runtimeRoot, env);
-		},
-		async applyPersistent(plan) {
-			const profile = plan.profile ?? syntheticProxyProfile({
-				name: `proxy-${plan.source.display}`,
-				endpoint: plan.transport.endpoint ?? "",
-				apiKey: "anypick-proxy",
-				defaultModel: plan.model.mode === "explicit" ? plan.model.id : void 0
-			});
-			const endpoint = plan.transport.endpoint ?? (plan.transport.managedProxy ? `http://127.0.0.1:${plan.transport.managedProxy.port}` : profile.meta.endpoint ?? "");
-			return applyKiroContext({
-				profile: {
-					...profile,
-					meta: {
-						...profile.meta,
-						endpoint
-					}
-				},
-				clientId: "kiro",
-				dryRun: plan.dryRun,
-				verbose: plan.verbose,
-				proxyEndpoint: endpoint || void 0,
-				anypickRoot: plan.anypickRoot
-			});
-		},
-		async reset(state) {
-			await removeClientEnvFiles(inferAnyPickRoot(state) ?? process.env.ANYPICK_HOME ?? join(homedir(), ".anypick"), "kiro");
-		},
-		async inspect() {
-			return {
-				present: true,
-				configPaths: [],
-				summary: "Kiro runtime uses anypick env files (account auth separate)"
-			};
-		}
-	};
-}
-function inferAnyPickRoot(state) {
-	for (const p of state.managedPaths) {
-		const idx = p.replace(/\\/g, "/").indexOf("/clients/kiro/");
-		if (idx > 0) return p.slice(0, idx);
-	}
-}
-var kiroClient = createKiroClient();
-//#endregion
-export { createKiroClient, kiroClient };
-
-//# sourceMappingURL=kiro.js.map

package/dist/clients/kiro.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kiro.js","names":[],"sources":["../../src/clients/kiro.ts"],"sourcesContent":["import { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport type {\n  ApplyContext,\n  ClientAdapter,\n  ClientInspectResult,\n  ClientLiveState,\n  ClientState,\n  IsolatablePath,\n  IsolatedClientRuntime,\n  ResolvedClientPlan,\n} from '../types';\nimport { resolveFromContext } from './resolve';\nimport { removeClientEnvFiles, writeClientEnvFiles } from './env-files';\nimport { ensureDir, pathExists, writeTextFile } from '../utils/fs';\nimport {\n  createTempRuntimeRoot,\n  makeIsolatedRuntime,\n  materializeIsolatablePaths,\n  syntheticProxyProfile,\n} from './isolation';\nimport { DEFAULT_MODEL_ROLE } from './model-roles';\n\nasync function applyKiroContext(ctx: ApplyContext) {\n  const r = resolveFromContext(ctx);\n  const env: Record<string, string> = {\n    OPENAI_API_KEY: r.apiKey,\n  };\n  if (r.endpoint) {\n    env.OPENAI_BASE_URL = r.endpoint;\n  }\n  if (r.defaultModel) {\n    env.OPENAI_MODEL = r.defaultModel;\n  }\n  // Anthropic-compatible consumers of Kiro proxy\n  if (r.endpoint) {\n    env.ANTHROPIC_BASE_URL = r.endpoint;\n    env.ANTHROPIC_AUTH_TOKEN = r.apiKey;\n  }\n\n  if (ctx.dryRun) {\n    return {\n      managedPaths: [\n        join(ctx.anypickRoot, 'clients', 'kiro', 'env.sh'),\n        join(ctx.anypickRoot, 'clients', 'kiro', 'env.ps1'),\n      ],\n      managedEnvKeys: Object.keys(env),\n    };\n  }\n\n  if (ctx.isolatedHome) {\n    // Write env into isolated tree only — never touch live anypick root env files\n    const isoAnyPick = join(ctx.isolatedHome, '.anypick');\n    const envPaths = await writeClientEnvFiles(isoAnyPick, 'kiro', env);\n    // Also drop a small dotenv for launchers that source it\n    const dotenv = join(ctx.isolatedHome, '.kiro-anypick.env');\n    await writeTextFile(\n      dotenv,\n      Object.entries(env)\n        .map(([k, v]) => `${k}=${JSON.stringify(v)}`)\n        .join('\\n') + '\\n',\n      0o600,\n    );\n    return {\n      managedPaths: [...envPaths, dotenv],\n      managedEnvKeys: Object.keys(env),\n    };\n  }\n\n  const envPaths = await writeClientEnvFiles(ctx.anypickRoot, 'kiro', env);\n  return {\n    managedPaths: envPaths,\n    managedEnvKeys: Object.keys(env),\n  };\n}\n\n/**\n * Kiro client adapter — primarily env-file based.\n * Native Kiro auth remains under account backup/restore (SSO cache files).\n *\n * Ephemeral run uses an isolated temporary HOME so live config is untouched.\n */\nexport function createKiroClient(home = process.env.HOME ?? homedir()): ClientAdapter {\n  const adapter: ClientAdapter = {\n    id: 'kiro',\n    name: 'Kiro',\n    shortName: 'Kiro',\n    binaryName: 'kiro',\n    binaryEnvVar: 'KIRO_BINARY',\n    description: 'Amazon Kiro (runtime env overlay)',\n    supportedApiStyles: ['openai', 'anthropic', 'custom'],\n    nativeInstallations: [\n      {\n        sourceId: 'kiro',\n        executables: ['kiro-cli', 'kiro'],\n        macApplications: ['Kiro.app', 'Kiro CLI.app'],\n      },\n    ],\n    capabilities: {\n      id: 'kiro',\n      acceptedProtocols: ['openai', 'anthropic'],\n      supportsEnvironmentOverlay: false,\n      supportsIsolatedHome: true,\n      supportsPersistentConfig: true,\n      protocolPreference: 'anthropic',\n    },\n    modelRoles: () => DEFAULT_MODEL_ROLE,\n\n    async validate(_ctx: ApplyContext): Promise<void> {\n      // No key format/presence checks — local proxies use arbitrary tokens.\n    },\n\n    async apply(ctx: ApplyContext) {\n      return applyKiroContext(ctx);\n    },\n\n    async listIsolatablePaths(_liveState: ClientLiveState): Promise<readonly IsolatablePath[]> {\n      // Kiro runtime is env-driven; no live config files required.\n      // Keep allowlist empty (still implements isolation via env in temp home).\n      return [];\n    },\n\n    async createIsolatedRuntime(\n      plan: ResolvedClientPlan,\n      paths: readonly IsolatablePath[],\n    ): Promise<IsolatedClientRuntime> {\n      const runtimeRoot = await createTempRuntimeRoot('anypick-kiro-');\n      const isoHome = join(runtimeRoot, 'home');\n      await ensureDir(isoHome);\n      await materializeIsolatablePaths(isoHome, paths);\n\n      const profile =\n        plan.profile ??\n        syntheticProxyProfile({\n          name: `ephemeral-${plan.source.display}`,\n          endpoint: plan.transport.endpoint ?? '',\n          apiKey: 'anypick-proxy',\n          defaultModel: plan.model.mode === 'explicit' ? plan.model.id : undefined,\n        });\n\n      const endpoint =\n        plan.transport.endpoint ??\n        (plan.transport.managedProxy\n          ? `http://127.0.0.1:${plan.transport.managedProxy.port}`\n          : (profile.meta.endpoint ?? ''));\n\n      const ctx: ApplyContext = {\n        profile: {\n          ...profile,\n          meta: { ...profile.meta, endpoint },\n          secrets: {\n            ...profile.secrets,\n            apiKey: profile.secrets.apiKey ?? 'anypick-proxy',\n          },\n        },\n        clientId: 'kiro',\n        dryRun: plan.dryRun,\n        verbose: plan.verbose,\n        proxyEndpoint: endpoint || undefined,\n        anypickRoot: plan.anypickRoot,\n        isolatedHome: isoHome,\n      };\n\n      let env: Record<string, string>;\n      if (!plan.dryRun) {\n        await applyKiroContext(ctx);\n        env = {\n          HOME: isoHome,\n          OPENAI_API_KEY: ctx.profile.secrets.apiKey ?? 'anypick-proxy',\n          ...(endpoint\n            ? {\n                OPENAI_BASE_URL: endpoint,\n                ANTHROPIC_BASE_URL: endpoint,\n                ANTHROPIC_AUTH_TOKEN: ctx.profile.secrets.apiKey ?? 'anypick-proxy',\n              }\n            : {}),\n        };\n      } else {\n        env = { HOME: isoHome };\n      }\n\n      return makeIsolatedRuntime(runtimeRoot, env);\n    },\n\n    async applyPersistent(plan: ResolvedClientPlan) {\n      const profile =\n        plan.profile ??\n        syntheticProxyProfile({\n          name: `proxy-${plan.source.display}`,\n          endpoint: plan.transport.endpoint ?? '',\n          apiKey: 'anypick-proxy',\n          defaultModel: plan.model.mode === 'explicit' ? plan.model.id : undefined,\n        });\n      const endpoint =\n        plan.transport.endpoint ??\n        (plan.transport.managedProxy\n          ? `http://127.0.0.1:${plan.transport.managedProxy.port}`\n          : (profile.meta.endpoint ?? ''));\n      const ctx: ApplyContext = {\n        profile: {\n          ...profile,\n          meta: { ...profile.meta, endpoint },\n        },\n        clientId: 'kiro',\n        dryRun: plan.dryRun,\n        verbose: plan.verbose,\n        proxyEndpoint: endpoint || undefined,\n        anypickRoot: plan.anypickRoot,\n      };\n      return applyKiroContext(ctx);\n    },\n\n    async reset(state: ClientState): Promise<void> {\n      const anypickRoot =\n        inferAnyPickRoot(state) ?? process.env.ANYPICK_HOME ?? join(homedir(), '.anypick');\n      await removeClientEnvFiles(anypickRoot, 'kiro');\n    },\n\n    async inspect(): Promise<ClientInspectResult> {\n      void home;\n      void pathExists;\n      return {\n        present: true,\n        configPaths: [],\n        summary: 'Kiro runtime uses anypick env files (account auth separate)',\n      };\n    },\n  };\n\n  return adapter;\n}\n\nfunction inferAnyPickRoot(state: ClientState): string | undefined {\n  for (const p of state.managedPaths) {\n    const idx = p.replace(/\\\\/g, '/').indexOf('/clients/kiro/');\n    if (idx > 0) {\n      return p.slice(0, idx);\n    }\n  }\n  return undefined;\n}\n\nexport const kiroClient = createKiroClient();\n"],"mappings":";;;;;;;;;AAuBA,eAAe,iBAAiB,KAAmB;CACjD,MAAM,IAAI,mBAAmB,GAAG;CAChC,MAAM,MAA8B,EAClC,gBAAgB,EAAE,OACpB;CACA,IAAI,EAAE,UACJ,IAAI,kBAAkB,EAAE;CAE1B,IAAI,EAAE,cACJ,IAAI,eAAe,EAAE;CAGvB,IAAI,EAAE,UAAU;EACd,IAAI,qBAAqB,EAAE;EAC3B,IAAI,uBAAuB,EAAE;CAC/B;CAEA,IAAI,IAAI,QACN,OAAO;EACL,cAAc,CACZ,KAAK,IAAI,aAAa,WAAW,QAAQ,QAAQ,GACjD,KAAK,IAAI,aAAa,WAAW,QAAQ,SAAS,CACpD;EACA,gBAAgB,OAAO,KAAK,GAAG;CACjC;CAGF,IAAI,IAAI,cAAc;EAGpB,MAAM,WAAW,MAAM,oBADJ,KAAK,IAAI,cAAc,UACC,GAAY,QAAQ,GAAG;EAElE,MAAM,SAAS,KAAK,IAAI,cAAc,mBAAmB;EACzD,MAAM,cACJ,QACA,OAAO,QAAQ,GAAG,CAAC,CAChB,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC,CAC5C,KAAK,IAAI,IAAI,MAChB,GACF;EACA,OAAO;GACL,cAAc,CAAC,GAAG,UAAU,MAAM;GAClC,gBAAgB,OAAO,KAAK,GAAG;EACjC;CACF;CAGA,OAAO;EACL,cAAc,MAFO,oBAAoB,IAAI,aAAa,QAAQ,GAAG;EAGrE,gBAAgB,OAAO,KAAK,GAAG;CACjC;AACF;;;;;;;AAQA,SAAgB,iBAAiB,OAAO,QAAQ,IAAI,QAAQ,QAAQ,GAAkB;CAmJpF,OAAO;EAjJL,IAAI;EACJ,MAAM;EACN,WAAW;EACX,YAAY;EACZ,cAAc;EACd,aAAa;EACb,oBAAoB;GAAC;GAAU;GAAa;EAAQ;EACpD,qBAAqB,CACnB;GACE,UAAU;GACV,aAAa,CAAC,YAAY,MAAM;GAChC,iBAAiB,CAAC,YAAY,cAAc;EAC9C,CACF;EACA,cAAc;GACZ,IAAI;GACJ,mBAAmB,CAAC,UAAU,WAAW;GACzC,4BAA4B;GAC5B,sBAAsB;GACtB,0BAA0B;GAC1B,oBAAoB;EACtB;EACA,kBAAkB;EAElB,MAAM,SAAS,MAAmC,CAElD;EAEA,MAAM,MAAM,KAAmB;GAC7B,OAAO,iBAAiB,GAAG;EAC7B;EAEA,MAAM,oBAAoB,YAAiE;GAGzF,OAAO,CAAC;EACV;EAEA,MAAM,sBACJ,MACA,OACgC;GAChC,MAAM,cAAc,MAAM,sBAAsB,eAAe;GAC/D,MAAM,UAAU,KAAK,aAAa,MAAM;GACxC,MAAM,UAAU,OAAO;GACvB,MAAM,2BAA2B,SAAS,KAAK;GAE/C,MAAM,UACJ,KAAK,WACL,sBAAsB;IACpB,MAAM,aAAa,KAAK,OAAO;IAC/B,UAAU,KAAK,UAAU,YAAY;IACrC,QAAQ;IACR,cAAc,KAAK,MAAM,SAAS,aAAa,KAAK,MAAM,KAAK,KAAA;GACjE,CAAC;GAEH,MAAM,WACJ,KAAK,UAAU,aACd,KAAK,UAAU,eACZ,oBAAoB,KAAK,UAAU,aAAa,SAC/C,QAAQ,KAAK,YAAY;GAEhC,MAAM,MAAoB;IACxB,SAAS;KACP,GAAG;KACH,MAAM;MAAE,GAAG,QAAQ;MAAM;KAAS;KAClC,SAAS;MACP,GAAG,QAAQ;MACX,QAAQ,QAAQ,QAAQ,UAAU;KACpC;IACF;IACA,UAAU;IACV,QAAQ,KAAK;IACb,SAAS,KAAK;IACd,eAAe,YAAY,KAAA;IAC3B,aAAa,KAAK;IAClB,cAAc;GAChB;GAEA,IAAI;GACJ,IAAI,CAAC,KAAK,QAAQ;IAChB,MAAM,iBAAiB,GAAG;IAC1B,MAAM;KACJ,MAAM;KACN,gBAAgB,IAAI,QAAQ,QAAQ,UAAU;KAC9C,GAAI,WACA;MACE,iBAAiB;MACjB,oBAAoB;MACpB,sBAAsB,IAAI,QAAQ,QAAQ,UAAU;KACtD,IACA,CAAC;IACP;GACF,OACE,MAAM,EAAE,MAAM,QAAQ;GAGxB,OAAO,oBAAoB,aAAa,GAAG;EAC7C;EAEA,MAAM,gBAAgB,MAA0B;GAC9C,MAAM,UACJ,KAAK,WACL,sBAAsB;IACpB,MAAM,SAAS,KAAK,OAAO;IAC3B,UAAU,KAAK,UAAU,YAAY;IACrC,QAAQ;IACR,cAAc,KAAK,MAAM,SAAS,aAAa,KAAK,MAAM,KAAK,KAAA;GACjE,CAAC;GACH,MAAM,WACJ,KAAK,UAAU,aACd,KAAK,UAAU,eACZ,oBAAoB,KAAK,UAAU,aAAa,SAC/C,QAAQ,KAAK,YAAY;GAYhC,OAAO,iBAAiB;IAVtB,SAAS;KACP,GAAG;KACH,MAAM;MAAE,GAAG,QAAQ;MAAM;KAAS;IACpC;IACA,UAAU;IACV,QAAQ,KAAK;IACb,SAAS,KAAK;IACd,eAAe,YAAY,KAAA;IAC3B,aAAa,KAAK;GAEI,CAAG;EAC7B;EAEA,MAAM,MAAM,OAAmC;GAG7C,MAAM,qBADJ,iBAAiB,KAAK,KAAK,QAAQ,IAAI,gBAAgB,KAAK,QAAQ,GAAG,UAAU,GAC3C,MAAM;EAChD;EAEA,MAAM,UAAwC;GAG5C,OAAO;IACL,SAAS;IACT,aAAa,CAAC;IACd,SAAS;GACX;EACF;CAGK;AACT;AAEA,SAAS,iBAAiB,OAAwC;CAChE,KAAK,MAAM,KAAK,MAAM,cAAc;EAClC,MAAM,MAAM,EAAE,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,gBAAgB;EAC1D,IAAI,MAAM,GACR,OAAO,EAAE,MAAM,GAAG,GAAG;CAEzB;AAEF;AAEA,IAAa,aAAa,iBAAiB"}

package/dist/clients/model-roles.d.ts

@@ -1,58 +0,0 @@
-/**
- * Client-shaped model roles + provider default maps for proxy → app apply.
- *
- * Model *policy* (which model fills which role, what to suggest, what to fall
- * back to) belongs to the provider, not to this module. Callers pass a
- * `ModelPolicy` resolved from the provider or catalog registry; when none is
- * supplied these functions return generic, vendor-neutral answers rather than
- * guessing a specific vendor's model ids.
- */
-import type { ClientAdapter, ClientModelRole, ModelPolicy } from '../types.js';
-/** Resolves a provider/catalog id to its model policy, if it has one. */
-export type ModelPolicyLookup = (providerId: string) => ModelPolicy | undefined;
-export declare const CLAUDE_MODEL_ROLES: readonly ClientModelRole[];
-/**
- * Codex Desktop only surfaces ~5 allowlisted GPT picker slots. AnyPick maps
- * Hub models onto those slots (see `codex-desktop-catalog.ts`). Configure Models
- * exposes one required Default plus four optional models — same multi-picker
- * shape as Claude's Default/Sonnet/Opus/Haiku, but for the Desktop list rather
- * than Claude Code env roles. Stable ids stay `list2`…`list5` (binding storage).
- */
-export declare const CODEX_DESKTOP_MODEL_ROLES: readonly ClientModelRole[];
-export declare const DEFAULT_MODEL_ROLE: readonly ClientModelRole[];
-/**
- * Roles an app can map when applying a proxy/profile.
- *
- * Prefer passing a `ClientAdapter` (or anything with `modelRoles()`). The string
- * overload is only a fallback for call sites that have not resolved the
- * adapter yet — it returns the neutral single-role default so third-party
- * clients never inherit Anthropic's multi-role labels by id coincidence.
- */
-export declare function modelRolesForClient(client: Pick<ClientAdapter, 'id' | 'modelRoles'> | string): readonly ClientModelRole[];
-/**
- * Default role → model id when pointing a client at a proxy for this provider.
- * Values are bare ids suitable for Claude Code / Codex env injection.
- *
- * Pass a ClientAdapter (or anything with modelRoles) as the second argument so
- * multi-role clients keep their slots. A bare client id falls back to the
- * neutral single-role default.
- */
-export declare function defaultModelRolesForProxy(providerId: string, client: Pick<ClientAdapter, 'id' | 'modelRoles'> | string, lookup?: ModelPolicyLookup): Record<string, string>;
-/**
- * Reconcile provider templates with the models the proxy actually exposes.
- * Existing user-selected roles are merged later and therefore are preserved.
- *
- * Only applies to providers that declare `roleModelHints()` — i.e. those whose
- * roles are filled from live discovery. Without hints the declared defaults are
- * already authoritative and must not be second-guessed against a live list.
- */
-export declare function modelDefaultsForSuggestions(providerId: string, defaults: Record<string, string>, suggestions: string[], lookup?: ModelPolicyLookup): Record<string, string>;
-/** Autocomplete candidates for a proxy provider (unique bare ids + aliases). */
-export declare function suggestModelsForProxyProvider(providerId: string, lookup?: ModelPolicyLookup): string[];
-/**
- * Merge user roles over defaults. Empty strings are dropped.
- * Ensures `default` is set when any role is present (from default role or first value).
- */
-export declare function normalizeModelRoles(roles: Record<string, string> | undefined, defaults: Record<string, string>): Record<string, string>;
-export { modelRolesFromClientOptions } from '../core/model-roles.js';
-//# sourceMappingURL=model-roles.d.ts.map

package/dist/clients/model-roles.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"model-roles.d.ts","sourceRoot":"","sources":["../../src/clients/model-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5E,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;AAEhF,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAK/C,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,eAAe,EAMtD,CAAC;AAEX,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAE/C,CAAC;AAEX;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,YAAY,CAAC,GAAG,MAAM,GACxD,SAAS,eAAe,EAAE,CAQ5B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,YAAY,CAAC,GAAG,MAAM,EACzD,MAAM,CAAC,EAAE,iBAAiB,GACzB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,WAAW,EAAE,MAAM,EAAE,EACrB,MAAM,CAAC,EAAE,iBAAiB,GACzB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwBxB;AAED,gFAAgF;AAChF,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,iBAAiB,GACzB,MAAM,EAAE,CAoBV;AAsBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACzC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxB;AAGD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/clients/model-roles.js

@@ -1,139 +0,0 @@
-import { modelRolesFromClientOptions } from "../core/model-roles.js";
-import "../catalog/providers.js";
-//#region src/clients/model-roles.ts
-var CLAUDE_MODEL_ROLES = [
-	{
-		id: "default",
-		label: "Default"
-	},
-	{
-		id: "sonnet",
-		label: "Sonnet"
-	},
-	{
-		id: "opus",
-		label: "Opus"
-	},
-	{
-		id: "haiku",
-		label: "Haiku"
-	}
-];
-/**
-* Codex Desktop only surfaces ~5 allowlisted GPT picker slots. AnyPick maps
-* Hub models onto those slots (see `codex-desktop-catalog.ts`). Configure Models
-* exposes one required Default plus four optional models — same multi-picker
-* shape as Claude's Default/Sonnet/Opus/Haiku, but for the Desktop list rather
-* than Claude Code env roles. Stable ids stay `list2`…`list5` (binding storage).
-*/
-var CODEX_DESKTOP_MODEL_ROLES = [
-	{
-		id: "default",
-		label: "Default"
-	},
-	{
-		id: "list2",
-		label: "Model 2"
-	},
-	{
-		id: "list3",
-		label: "Model 3"
-	},
-	{
-		id: "list4",
-		label: "Model 4"
-	},
-	{
-		id: "list5",
-		label: "Model 5"
-	}
-];
-var DEFAULT_MODEL_ROLE = [{
-	id: "default",
-	label: "Default"
-}];
-/**
-* Roles an app can map when applying a proxy/profile.
-*
-* Prefer passing a `ClientAdapter` (or anything with `modelRoles()`). The string
-* overload is only a fallback for call sites that have not resolved the
-* adapter yet — it returns the neutral single-role default so third-party
-* clients never inherit Anthropic's multi-role labels by id coincidence.
-*/
-function modelRolesForClient(client) {
-	if (typeof client === "string") return DEFAULT_MODEL_ROLE;
-	if (typeof client.modelRoles === "function") return client.modelRoles();
-	return DEFAULT_MODEL_ROLE;
-}
-/**
-* Default role → model id when pointing a client at a proxy for this provider.
-* Values are bare ids suitable for Claude Code / Codex env injection.
-*
-* Pass a ClientAdapter (or anything with modelRoles) as the second argument so
-* multi-role clients keep their slots. A bare client id falls back to the
-* neutral single-role default.
-*/
-function defaultModelRolesForProxy(providerId, client, lookup) {
-	const roles = modelRolesForClient(client);
-	const template = providerModelTemplate(providerId, lookup);
-	const out = {};
-	for (const role of roles) {
-		const v = template[role.id] ?? template.default;
-		if (v) out[role.id] = v;
-	}
-	return out;
-}
-/**
-* Reconcile provider templates with the models the proxy actually exposes.
-* Existing user-selected roles are merged later and therefore are preserved.
-*
-* Only applies to providers that declare `roleModelHints()` — i.e. those whose
-* roles are filled from live discovery. Without hints the declared defaults are
-* already authoritative and must not be second-guessed against a live list.
-*/
-function modelDefaultsForSuggestions(providerId, defaults, suggestions, lookup) {
-	const hints = lookup?.(providerId)?.roleModelHints?.();
-	if (!suggestions.length || !hints) return defaults;
-	const ids = new Set(suggestions);
-	const lower = suggestions.map((id) => [id, id.toLowerCase()]);
-	const pick = (role, current) => {
-		if (current && ids.has(current)) return current;
-		for (const token of hints[role] ?? []) {
-			const match = lower.find(([, id]) => id.includes(token));
-			if (match) return match[0];
-		}
-		return suggestions[0];
-	};
-	const out = { ...defaults };
-	for (const role of Object.keys(out)) out[role] = pick(role, out[role]) ?? out[role];
-	return out;
-}
-/**
-* Merge user roles over defaults. Empty strings are dropped.
-* Ensures `default` is set when any role is present (from default role or first value).
-*/
-function normalizeModelRoles(roles, defaults) {
-	const merged = { ...defaults };
-	if (roles) for (const [k, v] of Object.entries(roles)) {
-		const t = typeof v === "string" ? v.trim() : "";
-		if (t) merged[k] = t;
-	}
-	for (const k of Object.keys(merged)) if (!merged[k]?.trim()) delete merged[k];
-	return merged;
-}
-/**
-* Role → model template for a provider.
-*
-* A provider that declares `roleDefaults()` owns the answer. Otherwise we fall
-* back to a single generic `default` role: inventing Claude/GPT ids for an
-* unknown provider produces model names its API will reject.
-*/
-function providerModelTemplate(providerId, lookup) {
-	const declared = lookup?.(providerId)?.roleDefaults?.();
-	if (declared) return declared;
-	return { default: "default" };
-}
-//#endregion
-export { CLAUDE_MODEL_ROLES, CODEX_DESKTOP_MODEL_ROLES, DEFAULT_MODEL_ROLE, defaultModelRolesForProxy, modelDefaultsForSuggestions, modelRolesForClient, modelRolesFromClientOptions, normalizeModelRoles };
-
-//# sourceMappingURL=model-roles.js.map

package/dist/clients/model-roles.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"model-roles.js","names":[],"sources":["../../src/clients/model-roles.ts"],"sourcesContent":["/**\n * Client-shaped model roles + provider default maps for proxy → app apply.\n *\n * Model *policy* (which model fills which role, what to suggest, what to fall\n * back to) belongs to the provider, not to this module. Callers pass a\n * `ModelPolicy` resolved from the provider or catalog registry; when none is\n * supplied these functions return generic, vendor-neutral answers rather than\n * guessing a specific vendor's model ids.\n */\n\nimport type { ClientAdapter, ClientModelRole, ModelPolicy } from '../types';\nimport { OPENAI_MODELS, ANTHROPIC_MODELS } from '../catalog/providers';\n\n/** Resolves a provider/catalog id to its model policy, if it has one. */\nexport type ModelPolicyLookup = (providerId: string) => ModelPolicy | undefined;\n\nexport const CLAUDE_MODEL_ROLES: readonly ClientModelRole[] = [\n  { id: 'default', label: 'Default' },\n  { id: 'sonnet', label: 'Sonnet' },\n  { id: 'opus', label: 'Opus' },\n  { id: 'haiku', label: 'Haiku' },\n] as const;\n\n/**\n * Codex Desktop only surfaces ~5 allowlisted GPT picker slots. AnyPick maps\n * Hub models onto those slots (see `codex-desktop-catalog.ts`). Configure Models\n * exposes one required Default plus four optional models — same multi-picker\n * shape as Claude's Default/Sonnet/Opus/Haiku, but for the Desktop list rather\n * than Claude Code env roles. Stable ids stay `list2`…`list5` (binding storage).\n */\nexport const CODEX_DESKTOP_MODEL_ROLES: readonly ClientModelRole[] = [\n  { id: 'default', label: 'Default' },\n  { id: 'list2', label: 'Model 2' },\n  { id: 'list3', label: 'Model 3' },\n  { id: 'list4', label: 'Model 4' },\n  { id: 'list5', label: 'Model 5' },\n] as const;\n\nexport const DEFAULT_MODEL_ROLE: readonly ClientModelRole[] = [\n  { id: 'default', label: 'Default' },\n] as const;\n\n/**\n * Roles an app can map when applying a proxy/profile.\n *\n * Prefer passing a `ClientAdapter` (or anything with `modelRoles()`). The string\n * overload is only a fallback for call sites that have not resolved the\n * adapter yet — it returns the neutral single-role default so third-party\n * clients never inherit Anthropic's multi-role labels by id coincidence.\n */\nexport function modelRolesForClient(\n  client: Pick<ClientAdapter, 'id' | 'modelRoles'> | string,\n): readonly ClientModelRole[] {\n  if (typeof client === 'string') {\n    return DEFAULT_MODEL_ROLE;\n  }\n  if (typeof client.modelRoles === 'function') {\n    return client.modelRoles();\n  }\n  return DEFAULT_MODEL_ROLE;\n}\n\n/**\n * Default role → model id when pointing a client at a proxy for this provider.\n * Values are bare ids suitable for Claude Code / Codex env injection.\n *\n * Pass a ClientAdapter (or anything with modelRoles) as the second argument so\n * multi-role clients keep their slots. A bare client id falls back to the\n * neutral single-role default.\n */\nexport function defaultModelRolesForProxy(\n  providerId: string,\n  client: Pick<ClientAdapter, 'id' | 'modelRoles'> | string,\n  lookup?: ModelPolicyLookup,\n): Record<string, string> {\n  const roles = modelRolesForClient(client);\n  const template = providerModelTemplate(providerId, lookup);\n  const out: Record<string, string> = {};\n  for (const role of roles) {\n    const v = template[role.id] ?? template.default;\n    if (v) {\n      out[role.id] = v;\n    }\n  }\n  return out;\n}\n\n/**\n * Reconcile provider templates with the models the proxy actually exposes.\n * Existing user-selected roles are merged later and therefore are preserved.\n *\n * Only applies to providers that declare `roleModelHints()` — i.e. those whose\n * roles are filled from live discovery. Without hints the declared defaults are\n * already authoritative and must not be second-guessed against a live list.\n */\nexport function modelDefaultsForSuggestions(\n  providerId: string,\n  defaults: Record<string, string>,\n  suggestions: string[],\n  lookup?: ModelPolicyLookup,\n): Record<string, string> {\n  const hints = lookup?.(providerId)?.roleModelHints?.();\n  if (!suggestions.length || !hints) {\n    return defaults;\n  }\n  const ids = new Set(suggestions);\n  const lower = suggestions.map((id) => [id, id.toLowerCase()] as const);\n  const pick = (role: string, current: string | undefined): string | undefined => {\n    if (current && ids.has(current)) {\n      return current;\n    }\n    for (const token of hints[role] ?? []) {\n      const match = lower.find(([, id]) => id.includes(token));\n      if (match) {\n        return match[0];\n      }\n    }\n    return suggestions[0];\n  };\n  const out = { ...defaults };\n  for (const role of Object.keys(out)) {\n    out[role] = pick(role, out[role]) ?? out[role];\n  }\n  return out;\n}\n\n/** Autocomplete candidates for a proxy provider (unique bare ids + aliases). */\nexport function suggestModelsForProxyProvider(\n  providerId: string,\n  lookup?: ModelPolicyLookup,\n): string[] {\n  const map = providerSuggestMap(providerId, lookup);\n  const seen = new Set<string>();\n  const out: string[] = [];\n  const push = (v: string) => {\n    if (!v || seen.has(v)) {\n      return;\n    }\n    seen.add(v);\n    out.push(v);\n  };\n  for (const [alias, id] of Object.entries(map)) {\n    push(id);\n    push(alias);\n  }\n  // Role-friendly short names first-class for Claude Code\n  for (const extra of roleFriendlyExtras(providerId, lookup)) {\n    push(extra);\n  }\n  return out;\n}\n\n/**\n * Provider-declared friendly ids, or a generic multi-vendor list for an unknown\n * provider. A provider that declares a policy but no friendly models gets an\n * empty list — that is an answer, not a gap.\n */\nfunction roleFriendlyExtras(providerId: string, lookup?: ModelPolicyLookup): readonly string[] {\n  const policy = lookup?.(providerId);\n  if (policy) {\n    return policy.roleFriendlyModels?.() ?? [];\n  }\n  return [\n    'claude-sonnet-5',\n    'claude-opus-5',\n    'claude-haiku-4-5',\n    'gpt-5.6-sol',\n    'gemini-3.1-pro-preview',\n    'gemini-3.6-flash',\n  ];\n}\n\n/**\n * Merge user roles over defaults. Empty strings are dropped.\n * Ensures `default` is set when any role is present (from default role or first value).\n */\nexport function normalizeModelRoles(\n  roles: Record<string, string> | undefined,\n  defaults: Record<string, string>,\n): Record<string, string> {\n  const merged: Record<string, string> = { ...defaults };\n  if (roles) {\n    for (const [k, v] of Object.entries(roles)) {\n      const t = typeof v === 'string' ? v.trim() : '';\n      if (t) {\n        merged[k] = t;\n      }\n    }\n  }\n  // Drop empty\n  for (const k of Object.keys(merged)) {\n    if (!merged[k]?.trim()) {\n      delete merged[k];\n    }\n  }\n  return merged;\n}\n\n// Moved to core so core does not take value imports from the clients package.\nexport { modelRolesFromClientOptions } from '../core/model-roles';\n\n/**\n * Role → model template for a provider.\n *\n * A provider that declares `roleDefaults()` owns the answer. Otherwise we fall\n * back to a single generic `default` role: inventing Claude/GPT ids for an\n * unknown provider produces model names its API will reject.\n */\nfunction providerModelTemplate(\n  providerId: string,\n  lookup?: ModelPolicyLookup,\n): Record<string, string> {\n  const declared = lookup?.(providerId)?.roleDefaults?.();\n  if (declared) {\n    return declared;\n  }\n  return { default: 'default' };\n}\n\n/**\n * Alias → id suggestion map for a provider.\n *\n * A provider that declares a policy owns its own map (possibly empty, when its\n * catalog is only knowable from a live `/v1/models` call). Only an unknown\n * provider falls back to the built-in Anthropic+OpenAI aliases.\n */\nfunction providerSuggestMap(\n  providerId: string,\n  lookup?: ModelPolicyLookup,\n): Record<string, string> {\n  const policy = lookup?.(providerId);\n  if (policy) {\n    return policy.suggestModels?.() ?? {};\n  }\n  return {\n    ...ANTHROPIC_MODELS,\n    ...OPENAI_MODELS,\n  };\n}\n"],"mappings":";;;AAgBA,IAAa,qBAAiD;CAC5D;EAAE,IAAI;EAAW,OAAO;CAAU;CAClC;EAAE,IAAI;EAAU,OAAO;CAAS;CAChC;EAAE,IAAI;EAAQ,OAAO;CAAO;CAC5B;EAAE,IAAI;EAAS,OAAO;CAAQ;AAChC;;;;;;;;AASA,IAAa,4BAAwD;CACnE;EAAE,IAAI;EAAW,OAAO;CAAU;CAClC;EAAE,IAAI;EAAS,OAAO;CAAU;CAChC;EAAE,IAAI;EAAS,OAAO;CAAU;CAChC;EAAE,IAAI;EAAS,OAAO;CAAU;CAChC;EAAE,IAAI;EAAS,OAAO;CAAU;AAClC;AAEA,IAAa,qBAAiD,CAC5D;CAAE,IAAI;CAAW,OAAO;AAAU,CACpC;;;;;;;;;AAUA,SAAgB,oBACd,QAC4B;CAC5B,IAAI,OAAO,WAAW,UACpB,OAAO;CAET,IAAI,OAAO,OAAO,eAAe,YAC/B,OAAO,OAAO,WAAW;CAE3B,OAAO;AACT;;;;;;;;;AAUA,SAAgB,0BACd,YACA,QACA,QACwB;CACxB,MAAM,QAAQ,oBAAoB,MAAM;CACxC,MAAM,WAAW,sBAAsB,YAAY,MAAM;CACzD,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,IAAI,SAAS,KAAK,OAAO,SAAS;EACxC,IAAI,GACF,IAAI,KAAK,MAAM;CAEnB;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,4BACd,YACA,UACA,aACA,QACwB;CACxB,MAAM,QAAQ,SAAS,UAAU,CAAC,EAAE,iBAAiB;CACrD,IAAI,CAAC,YAAY,UAAU,CAAC,OAC1B,OAAO;CAET,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,MAAM,QAAQ,YAAY,KAAK,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAAU;CACrE,MAAM,QAAQ,MAAc,YAAoD;EAC9E,IAAI,WAAW,IAAI,IAAI,OAAO,GAC5B,OAAO;EAET,KAAK,MAAM,SAAS,MAAM,SAAS,CAAC,GAAG;GACrC,MAAM,QAAQ,MAAM,MAAM,GAAG,QAAQ,GAAG,SAAS,KAAK,CAAC;GACvD,IAAI,OACF,OAAO,MAAM;EAEjB;EACA,OAAO,YAAY;CACrB;CACA,MAAM,MAAM,EAAE,GAAG,SAAS;CAC1B,KAAK,MAAM,QAAQ,OAAO,KAAK,GAAG,GAChC,IAAI,QAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI;CAE3C,OAAO;AACT;;;;;AAoDA,SAAgB,oBACd,OACA,UACwB;CACxB,MAAM,SAAiC,EAAE,GAAG,SAAS;CACrD,IAAI,OACF,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG;EAC1C,MAAM,IAAI,OAAO,MAAM,WAAW,EAAE,KAAK,IAAI;EAC7C,IAAI,GACF,OAAO,KAAK;CAEhB;CAGF,KAAK,MAAM,KAAK,OAAO,KAAK,MAAM,GAChC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,GACnB,OAAO,OAAO;CAGlB,OAAO;AACT;;;;;;;;AAYA,SAAS,sBACP,YACA,QACwB;CACxB,MAAM,WAAW,SAAS,UAAU,CAAC,EAAE,eAAe;CACtD,IAAI,UACF,OAAO;CAET,OAAO,EAAE,SAAS,UAAU;AAC9B"}

package/dist/clients/registry.d.ts

@@ -1,7 +0,0 @@
-import type { ClientAdapter } from '../types.js';
-import { Registry } from '../core/registry.js';
-export declare class ClientRegistry extends Registry<ClientAdapter> {
-    constructor();
-}
-export declare const clientRegistry: ClientRegistry;
-//# sourceMappingURL=registry.d.ts.map

package/dist/clients/registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/clients/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,qBAAa,cAAe,SAAQ,QAAQ,CAAC,aAAa,CAAC;IACzD,cAMC;CACF;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC"}

package/dist/clients/registry.js

@@ -1,16 +0,0 @@
-import { Registry } from "../core/registry.js";
-//#region src/clients/registry.ts
-var ClientRegistry = class extends Registry {
-	constructor() {
-		super({
-			kind: "Client",
-			duplicateCode: "DUPLICATE_CLIENT",
-			unknownCode: "UNKNOWN_CLIENT"
-		});
-	}
-};
-new ClientRegistry();
-//#endregion
-export { ClientRegistry };
-
-//# sourceMappingURL=registry.js.map

package/dist/clients/registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry.js","names":[],"sources":["../../src/clients/registry.ts"],"sourcesContent":["import type { ClientAdapter } from '../types';\nimport { Registry } from '../core/registry';\n\nexport class ClientRegistry extends Registry<ClientAdapter> {\n  constructor() {\n    super({\n      kind: 'Client',\n      duplicateCode: 'DUPLICATE_CLIENT',\n      unknownCode: 'UNKNOWN_CLIENT',\n    });\n  }\n}\n\nexport const clientRegistry = new ClientRegistry();\n"],"mappings":";;AAGA,IAAa,iBAAb,cAAoC,SAAwB;CAC1D,cAAc;EACZ,MAAM;GACJ,MAAM;GACN,eAAe;GACf,aAAa;EACf,CAAC;CACH;AACF;AAE8B,IAAI,eAAe"}