codeply-cli 0.5.1 → 0.5.2

package/lib/mcp.js

@@ -1,258 +1,258 @@
-/**
- * A small Model Context Protocol client: enough to connect to MCP servers,
- * list their tools and call them. No SDK dependency; MCP is JSON-RPC 2.0
- * over either a child process's stdio (one JSON message per line) or HTTP
- * ("streamable HTTP": POST a request, get JSON or an SSE stream back).
- *
- * Servers are configured in the same shape Claude Desktop / Cursor use, so an
- * existing config can be pasted in:
- *
- *   ~/.codeply/mcp.json            (every project)
- *   <project>/.codeply/mcp.json    (this project; same name wins)
- *
- *   { "mcpServers": {
- *       "github":  { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"], "env": { "GITHUB_TOKEN": "..." } },
- *       "docs":    { "url": "https://example.com/mcp", "headers": { "Authorization": "Bearer ..." } },
- *       "old":     { "command": "...", "disabled": true } } }
- *
- * Connections are kept for the life of the process and reused across turns.
- */
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawn } = require('child_process');
-const plugins = require('./plugins.js');
-
-const PROTOCOL_VERSION = '2025-06-18';
-const CONNECT_TIMEOUT_MS = 20000;
-const CALL_TIMEOUT_MS = 120000;
-const CLIENT_INFO = { name: 'codeply', version: '1.0' };
-
-function readConfig(file) {
-  try {
-    const j = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return j.mcpServers || j.servers || {};
-  } catch { return {}; }
-}
-
-/** Merged server config for a project: project entries override global ones. */
-function loadServers(cwd) {
-  const merged = { ...plugins.mcpServers(cwd), ...readConfig(path.join(os.homedir(), '.codeply', 'mcp.json')) };
-  if (cwd) Object.assign(merged, readConfig(path.join(cwd, '.codeply', 'mcp.json')));
-  return Object.fromEntries(Object.entries(merged).filter(([, s]) => s && !s.disabled && (s.command || s.url)));
-}
-
-// ─── Transports ─────────────────────────────────────────────────────────────
-
-class StdioConnection {
-  constructor(name, spec, cwd) {
-    this.name = name;
-    this.pending = new Map();
-    this.nextId = 1;
-    this.stderr = '';
-    // npx/npm/uvx are .cmd shims on Windows and only start through a shell.
-    // A full path to a program (which may contain spaces) is started
-    // directly. Through the shell, arguments are quoted here, since Node
-    // just joins them with spaces.
-    const cmd = String(spec.command);
-    const args = (spec.args || []).map(String);
-    const viaShell = process.platform === 'win32' && !/[\\/]/.test(cmd) && !/\.exe$/i.test(cmd);
-    const quote = (a) => (/[\s"&|<>^()]/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a);
-    this.proc = spawn(viaShell ? [cmd, ...args].map(quote).join(' ') : cmd, viaShell ? [] : args, {
-      cwd: spec.cwd || cwd || process.cwd(),
-      env: { ...process.env, ...(spec.env || {}) },
-      stdio: ['pipe', 'pipe', 'pipe'],
-      windowsHide: true,
-      shell: viaShell,
-    });
-    let buf = '';
-    this.proc.stdout.on('data', (d) => {
-      buf += d.toString('utf8');
-      let nl;
-      while ((nl = buf.indexOf('\n')) !== -1) {
-        const line = buf.slice(0, nl).trim();
-        buf = buf.slice(nl + 1);
-        if (!line) continue;
-        let msg;
-        try { msg = JSON.parse(line); } catch { continue; } // servers sometimes log to stdout
-        this.onMessage(msg);
-      }
-    });
-    this.proc.stderr.on('data', (d) => { this.stderr = (this.stderr + d.toString('utf8')).slice(-4000); });
-    this.proc.on('error', (e) => this.failAll(`could not start: ${e.message}`));
-    this.proc.on('exit', (code) => { this.closed = true; this.failAll(`exited (code ${code})${this.stderr ? `: ${this.stderr.trim().split('\n').slice(-3).join(' ')}` : ''}`); });
-  }
-
-  onMessage(msg) {
-    if (msg.id !== undefined && this.pending.has(msg.id)) {
-      const p = this.pending.get(msg.id);
-      this.pending.delete(msg.id);
-      if (msg.error) p.reject(new Error(msg.error.message || JSON.stringify(msg.error)));
-      else p.resolve(msg.result);
-    } else if (msg.method && msg.id !== undefined) {
-      // A request from the server (sampling, roots...): we offer none of those.
-      this.write({ jsonrpc: '2.0', id: msg.id, error: { code: -32601, message: 'Not supported by this client' } });
-    }
-  }
-
-  write(obj) {
-    if (!this.closed) this.proc.stdin.write(JSON.stringify(obj) + '\n');
-  }
-
-  request(method, params, timeoutMs) {
-    return new Promise((resolve, reject) => {
-      if (this.closed) return reject(new Error(`${this.name} is not running`));
-      const id = this.nextId++;
-      const timer = setTimeout(() => { this.pending.delete(id); reject(new Error(`${method} timed out after ${timeoutMs / 1000}s`)); }, timeoutMs);
-      this.pending.set(id, { resolve: (v) => { clearTimeout(timer); resolve(v); }, reject: (e) => { clearTimeout(timer); reject(e); } });
-      this.write({ jsonrpc: '2.0', id, method, params });
-    });
-  }
-
-  notify(method, params) { this.write({ jsonrpc: '2.0', method, ...(params ? { params } : {}) }); }
-
-  failAll(why) {
-    for (const [, p] of this.pending) p.reject(new Error(`${this.name} ${why}`));
-    this.pending.clear();
-  }
-
-  close() { try { this.proc.kill(); } catch {} }
-}
-
-class HttpConnection {
-  constructor(name, spec) {
-    this.name = name;
-    this.url = spec.url;
-    this.headers = spec.headers || {};
-    this.sessionId = null;
-    this.nextId = 1;
-  }
-
-  async post(body, timeoutMs) {
-    const res = await fetch(this.url, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Accept: 'application/json, text/event-stream',
-        'MCP-Protocol-Version': PROTOCOL_VERSION,
-        ...(this.sessionId ? { 'Mcp-Session-Id': this.sessionId } : {}),
-        ...this.headers,
-      },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    const sid = res.headers.get('mcp-session-id');
-    if (sid) this.sessionId = sid;
-    return res;
-  }
-
-  async request(method, params, timeoutMs) {
-    const id = this.nextId++;
-    const res = await this.post({ jsonrpc: '2.0', id, method, params }, timeoutMs);
-    if (!res.ok) throw new Error(`${method}: HTTP ${res.status}${res.status === 401 ? ' (needs authorization - add a token under "headers")' : ''}`);
-    const type = res.headers.get('content-type') || '';
-    let msg = null;
-    if (type.includes('text/event-stream')) {
-      // Read events until the one answering our id.
-      const text = await res.text();
-      for (const block of text.split(/\r?\n\r?\n/)) {
-        const data = block.split(/\r?\n/).filter((l) => l.startsWith('data:')).map((l) => l.slice(5).trim()).join('\n');
-        if (!data) continue;
-        try { const m = JSON.parse(data); if (m.id === id) { msg = m; break; } } catch {}
-      }
-    } else {
-      msg = await res.json().catch(() => null);
-    }
-    if (!msg) throw new Error(`${method}: no response`);
-    if (msg.error) throw new Error(msg.error.message || JSON.stringify(msg.error));
-    return msg.result;
-  }
-
-  async notify(method, params) {
-    try { await this.post({ jsonrpc: '2.0', method, ...(params ? { params } : {}) }, 10000); } catch {}
-  }
-
-  close() {}
-}
-
-// ─── Servers ────────────────────────────────────────────────────────────────
-
-const servers = new Map(); // key -> { name, conn, tools, error, specKey }
-
-function specKey(spec) { return JSON.stringify(spec); }
-
-async function connect(name, spec, cwd) {
-  const conn = spec.url ? new HttpConnection(name, spec) : new StdioConnection(name, spec, cwd);
-  try {
-    const init = await conn.request('initialize', { protocolVersion: PROTOCOL_VERSION, capabilities: {}, clientInfo: CLIENT_INFO }, CONNECT_TIMEOUT_MS);
-    await conn.notify('notifications/initialized');
-    const tools = [];
-    let cursor;
-    do {
-      const page = await conn.request('tools/list', cursor ? { cursor } : {}, CONNECT_TIMEOUT_MS);
-      tools.push(...(page.tools || []));
-      cursor = page.nextCursor;
-    } while (cursor && tools.length < 500);
-    return { name, conn, tools, instructions: init?.instructions || '', error: null };
-  } catch (e) {
-    conn.close();
-    return { name, conn: null, tools: [], instructions: '', error: e.message };
-  }
-}
-
-/**
- * Connect to every configured server for this project (reusing live
- * connections) and return what they offer. Never throws.
- * @returns {Promise<Array<{name, tools, error, instructions}>>}
- */
-async function listServers(cwd) {
-  const wanted = loadServers(cwd);
-  const out = [];
-  await Promise.all(Object.entries(wanted).map(async ([name, spec]) => {
-    const key = `${cwd}::${name}`;
-    let s = servers.get(key);
-    const stale = s && (s.specKey !== specKey(spec) || (s.conn && s.conn.closed) || s.error);
-    if (!s || stale) {
-      if (s?.conn) s.conn.close();
-      s = { ...(await connect(name, spec, cwd)), specKey: specKey(spec) };
-      servers.set(key, s);
-    }
-    out.push({ name, tools: s.tools, error: s.error, instructions: s.instructions });
-  }));
-  return out.sort((a, b) => a.name.localeCompare(b.name));
-}
-
-/** Tool results as plain text for the model, images kept aside as data URLs. */
-function flattenResult(result) {
-  const parts = Array.isArray(result?.content) ? result.content : [];
-  const text = [];
-  const images = [];
-  for (const p of parts) {
-    if (p.type === 'text') text.push(p.text);
-    else if (p.type === 'image' && p.data) images.push(`data:${p.mimeType || 'image/png'};base64,${p.data}`);
-    else if (p.type === 'resource') text.push(p.resource?.text || `[resource ${p.resource?.uri || ''}]`);
-    else text.push(`[${p.type} content]`);
-  }
-  if (!parts.length && result?.structuredContent) text.push(JSON.stringify(result.structuredContent, null, 1));
-  return { text: text.join('\n') || '(empty result)', images, isError: !!result?.isError };
-}
-
-async function callTool(cwd, serverName, toolName, args) {
-  const s = servers.get(`${cwd}::${serverName}`);
-  if (!s || !s.conn) throw new Error(`MCP server "${serverName}" is not connected${s?.error ? ` (${s.error})` : ''}.`);
-  const result = await s.conn.request('tools/call', { name: toolName, arguments: args || {} }, CALL_TIMEOUT_MS);
-  return flattenResult(result);
-}
-
-function findTool(cwd, serverName, toolName) {
-  const s = servers.get(`${cwd}::${serverName}`);
-  return s ? s.tools.find((t) => t.name === toolName) || null : null;
-}
-
-function closeAll() {
-  for (const [, s] of servers) if (s.conn) s.conn.close();
-  servers.clear();
-}
-process.on('exit', closeAll);
-
-module.exports = { listServers, callTool, findTool, loadServers, closeAll, flattenResult };
+/**
+ * A small Model Context Protocol client: enough to connect to MCP servers,
+ * list their tools and call them. No SDK dependency; MCP is JSON-RPC 2.0
+ * over either a child process's stdio (one JSON message per line) or HTTP
+ * ("streamable HTTP": POST a request, get JSON or an SSE stream back).
+ *
+ * Servers are configured in the same shape Claude Desktop / Cursor use, so an
+ * existing config can be pasted in:
+ *
+ *   ~/.codeply/mcp.json            (every project)
+ *   <project>/.codeply/mcp.json    (this project; same name wins)
+ *
+ *   { "mcpServers": {
+ *       "github":  { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"], "env": { "GITHUB_TOKEN": "..." } },
+ *       "docs":    { "url": "https://example.com/mcp", "headers": { "Authorization": "Bearer ..." } },
+ *       "old":     { "command": "...", "disabled": true } } }
+ *
+ * Connections are kept for the life of the process and reused across turns.
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
+const plugins = require('./plugins.js');
+
+const PROTOCOL_VERSION = '2025-06-18';
+const CONNECT_TIMEOUT_MS = 20000;
+const CALL_TIMEOUT_MS = 120000;
+const CLIENT_INFO = { name: 'codeply', version: '1.0' };
+
+function readConfig(file) {
+  try {
+    const j = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return j.mcpServers || j.servers || {};
+  } catch { return {}; }
+}
+
+/** Merged server config for a project: project entries override global ones. */
+function loadServers(cwd) {
+  const merged = { ...plugins.mcpServers(cwd), ...readConfig(path.join(os.homedir(), '.codeply', 'mcp.json')) };
+  if (cwd) Object.assign(merged, readConfig(path.join(cwd, '.codeply', 'mcp.json')));
+  return Object.fromEntries(Object.entries(merged).filter(([, s]) => s && !s.disabled && (s.command || s.url)));
+}
+
+// ─── Transports ─────────────────────────────────────────────────────────────
+
+class StdioConnection {
+  constructor(name, spec, cwd) {
+    this.name = name;
+    this.pending = new Map();
+    this.nextId = 1;
+    this.stderr = '';
+    // npx/npm/uvx are .cmd shims on Windows and only start through a shell.
+    // A full path to a program (which may contain spaces) is started
+    // directly. Through the shell, arguments are quoted here, since Node
+    // just joins them with spaces.
+    const cmd = String(spec.command);
+    const args = (spec.args || []).map(String);
+    const viaShell = process.platform === 'win32' && !/[\\/]/.test(cmd) && !/\.exe$/i.test(cmd);
+    const quote = (a) => (/[\s"&|<>^()]/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a);
+    this.proc = spawn(viaShell ? [cmd, ...args].map(quote).join(' ') : cmd, viaShell ? [] : args, {
+      cwd: spec.cwd || cwd || process.cwd(),
+      env: { ...process.env, ...(spec.env || {}) },
+      stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
+      shell: viaShell,
+    });
+    let buf = '';
+    this.proc.stdout.on('data', (d) => {
+      buf += d.toString('utf8');
+      let nl;
+      while ((nl = buf.indexOf('\n')) !== -1) {
+        const line = buf.slice(0, nl).trim();
+        buf = buf.slice(nl + 1);
+        if (!line) continue;
+        let msg;
+        try { msg = JSON.parse(line); } catch { continue; } // servers sometimes log to stdout
+        this.onMessage(msg);
+      }
+    });
+    this.proc.stderr.on('data', (d) => { this.stderr = (this.stderr + d.toString('utf8')).slice(-4000); });
+    this.proc.on('error', (e) => this.failAll(`could not start: ${e.message}`));
+    this.proc.on('exit', (code) => { this.closed = true; this.failAll(`exited (code ${code})${this.stderr ? `: ${this.stderr.trim().split('\n').slice(-3).join(' ')}` : ''}`); });
+  }
+
+  onMessage(msg) {
+    if (msg.id !== undefined && this.pending.has(msg.id)) {
+      const p = this.pending.get(msg.id);
+      this.pending.delete(msg.id);
+      if (msg.error) p.reject(new Error(msg.error.message || JSON.stringify(msg.error)));
+      else p.resolve(msg.result);
+    } else if (msg.method && msg.id !== undefined) {
+      // A request from the server (sampling, roots...): we offer none of those.
+      this.write({ jsonrpc: '2.0', id: msg.id, error: { code: -32601, message: 'Not supported by this client' } });
+    }
+  }
+
+  write(obj) {
+    if (!this.closed) this.proc.stdin.write(JSON.stringify(obj) + '\n');
+  }
+
+  request(method, params, timeoutMs) {
+    return new Promise((resolve, reject) => {
+      if (this.closed) return reject(new Error(`${this.name} is not running`));
+      const id = this.nextId++;
+      const timer = setTimeout(() => { this.pending.delete(id); reject(new Error(`${method} timed out after ${timeoutMs / 1000}s`)); }, timeoutMs);
+      this.pending.set(id, { resolve: (v) => { clearTimeout(timer); resolve(v); }, reject: (e) => { clearTimeout(timer); reject(e); } });
+      this.write({ jsonrpc: '2.0', id, method, params });
+    });
+  }
+
+  notify(method, params) { this.write({ jsonrpc: '2.0', method, ...(params ? { params } : {}) }); }
+
+  failAll(why) {
+    for (const [, p] of this.pending) p.reject(new Error(`${this.name} ${why}`));
+    this.pending.clear();
+  }
+
+  close() { try { this.proc.kill(); } catch {} }
+}
+
+class HttpConnection {
+  constructor(name, spec) {
+    this.name = name;
+    this.url = spec.url;
+    this.headers = spec.headers || {};
+    this.sessionId = null;
+    this.nextId = 1;
+  }
+
+  async post(body, timeoutMs) {
+    const res = await fetch(this.url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        'MCP-Protocol-Version': PROTOCOL_VERSION,
+        ...(this.sessionId ? { 'Mcp-Session-Id': this.sessionId } : {}),
+        ...this.headers,
+      },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const sid = res.headers.get('mcp-session-id');
+    if (sid) this.sessionId = sid;
+    return res;
+  }
+
+  async request(method, params, timeoutMs) {
+    const id = this.nextId++;
+    const res = await this.post({ jsonrpc: '2.0', id, method, params }, timeoutMs);
+    if (!res.ok) throw new Error(`${method}: HTTP ${res.status}${res.status === 401 ? ' (needs authorization - add a token under "headers")' : ''}`);
+    const type = res.headers.get('content-type') || '';
+    let msg = null;
+    if (type.includes('text/event-stream')) {
+      // Read events until the one answering our id.
+      const text = await res.text();
+      for (const block of text.split(/\r?\n\r?\n/)) {
+        const data = block.split(/\r?\n/).filter((l) => l.startsWith('data:')).map((l) => l.slice(5).trim()).join('\n');
+        if (!data) continue;
+        try { const m = JSON.parse(data); if (m.id === id) { msg = m; break; } } catch {}
+      }
+    } else {
+      msg = await res.json().catch(() => null);
+    }
+    if (!msg) throw new Error(`${method}: no response`);
+    if (msg.error) throw new Error(msg.error.message || JSON.stringify(msg.error));
+    return msg.result;
+  }
+
+  async notify(method, params) {
+    try { await this.post({ jsonrpc: '2.0', method, ...(params ? { params } : {}) }, 10000); } catch {}
+  }
+
+  close() {}
+}
+
+// ─── Servers ────────────────────────────────────────────────────────────────
+
+const servers = new Map(); // key -> { name, conn, tools, error, specKey }
+
+function specKey(spec) { return JSON.stringify(spec); }
+
+async function connect(name, spec, cwd) {
+  const conn = spec.url ? new HttpConnection(name, spec) : new StdioConnection(name, spec, cwd);
+  try {
+    const init = await conn.request('initialize', { protocolVersion: PROTOCOL_VERSION, capabilities: {}, clientInfo: CLIENT_INFO }, CONNECT_TIMEOUT_MS);
+    await conn.notify('notifications/initialized');
+    const tools = [];
+    let cursor;
+    do {
+      const page = await conn.request('tools/list', cursor ? { cursor } : {}, CONNECT_TIMEOUT_MS);
+      tools.push(...(page.tools || []));
+      cursor = page.nextCursor;
+    } while (cursor && tools.length < 500);
+    return { name, conn, tools, instructions: init?.instructions || '', error: null };
+  } catch (e) {
+    conn.close();
+    return { name, conn: null, tools: [], instructions: '', error: e.message };
+  }
+}
+
+/**
+ * Connect to every configured server for this project (reusing live
+ * connections) and return what they offer. Never throws.
+ * @returns {Promise<Array<{name, tools, error, instructions}>>}
+ */
+async function listServers(cwd) {
+  const wanted = loadServers(cwd);
+  const out = [];
+  await Promise.all(Object.entries(wanted).map(async ([name, spec]) => {
+    const key = `${cwd}::${name}`;
+    let s = servers.get(key);
+    const stale = s && (s.specKey !== specKey(spec) || (s.conn && s.conn.closed) || s.error);
+    if (!s || stale) {
+      if (s?.conn) s.conn.close();
+      s = { ...(await connect(name, spec, cwd)), specKey: specKey(spec) };
+      servers.set(key, s);
+    }
+    out.push({ name, tools: s.tools, error: s.error, instructions: s.instructions });
+  }));
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** Tool results as plain text for the model, images kept aside as data URLs. */
+function flattenResult(result) {
+  const parts = Array.isArray(result?.content) ? result.content : [];
+  const text = [];
+  const images = [];
+  for (const p of parts) {
+    if (p.type === 'text') text.push(p.text);
+    else if (p.type === 'image' && p.data) images.push(`data:${p.mimeType || 'image/png'};base64,${p.data}`);
+    else if (p.type === 'resource') text.push(p.resource?.text || `[resource ${p.resource?.uri || ''}]`);
+    else text.push(`[${p.type} content]`);
+  }
+  if (!parts.length && result?.structuredContent) text.push(JSON.stringify(result.structuredContent, null, 1));
+  return { text: text.join('\n') || '(empty result)', images, isError: !!result?.isError };
+}
+
+async function callTool(cwd, serverName, toolName, args) {
+  const s = servers.get(`${cwd}::${serverName}`);
+  if (!s || !s.conn) throw new Error(`MCP server "${serverName}" is not connected${s?.error ? ` (${s.error})` : ''}.`);
+  const result = await s.conn.request('tools/call', { name: toolName, arguments: args || {} }, CALL_TIMEOUT_MS);
+  return flattenResult(result);
+}
+
+function findTool(cwd, serverName, toolName) {
+  const s = servers.get(`${cwd}::${serverName}`);
+  return s ? s.tools.find((t) => t.name === toolName) || null : null;
+}
+
+function closeAll() {
+  for (const [, s] of servers) if (s.conn) s.conn.close();
+  servers.clear();
+}
+process.on('exit', closeAll);
+
+module.exports = { listServers, callTool, findTool, loadServers, closeAll, flattenResult };

package/lib/model-sync.js

@@ -0,0 +1,114 @@
+/**
+ * Codeply - "Use on my phone": syncs a model the user added (with their own
+ * API key) to their Codeply account, so the phone app can use it while this
+ * PC is off.
+ *
+ * The key goes to the `user-models` edge function once, over TLS with the
+ * user's sign-in token. The function seals it (envelope encryption, see
+ * Codeply-App/supabase/functions/_shared/model-keys.ts) and never sends it
+ * back: listing returns only "****abcd". The phone then chats through the
+ * `byok-proxy` function, which decrypts it there for each request.
+ *
+ * Not synced, by design:
+ *   chatgpt  the ChatGPT sign-in stays on this PC (chatgpt.js).
+ *   ollama   Ollama runs on this PC (or a host only it can reach).
+ *   no key / plain http / a private address: the cloud cannot use those.
+ *
+ * Pure logic with an injectable fetch and token source, so it is tested
+ * against a fake server in scripts/engine-test.mjs.
+ */
+
+const DEFAULT_URL = 'https://zswkhfkfseclgadhvobg.supabase.co/functions/v1/user-models';
+
+const PRIVATE_HOST = /^(localhost|.*\.localhost|.*\.local|.*\.internal|.*\.lan|.*\.home\.arpa|0\.0\.0\.0|127\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|169\.254\.\d+\.\d+|100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.\d+\.\d+|\[.*\])$/i;
+
+/** Why a model cannot be used on the phone without this PC, or null when it can. */
+function phoneBlocker(m) {
+  if (!m) return 'Unknown model.';
+  if (m.kind === 'chatgpt') return 'ChatGPT plan models stay on this PC: your ChatGPT sign-in is never uploaded. The phone can still use them while this PC is on.';
+  if (m.kind === 'ollama') return 'Ollama runs on this PC, so the phone uses it through this PC while it is on.';
+  if (!m.apiKey) return 'Only models with an API key can be used on the phone without this PC.';
+  let u;
+  try { u = new URL(m.baseUrl); } catch { return 'The base URL is not a valid address.'; }
+  if (u.protocol !== 'https:') return 'The phone can only use https addresses. This one keeps working through this PC.';
+  if (u.username || u.password) return 'Remove the user name or password from the base URL first.';
+  if (u.port && u.port !== '443') return 'The phone can only use the standard https port. This one keeps working through this PC.';
+  const host = u.hostname.replace(/\.$/, '');
+  if (PRIVATE_HOST.test(host) || (!host.includes('.') && !host.includes(':'))) {
+    return 'That address is on your own network, so it only works through this PC.';
+  }
+  return null;
+}
+
+/** What the phone toggle should show for a model, given who is signed in now. */
+function phoneStatus(m, userId) {
+  const blocker = phoneBlocker(m);
+  if (blocker) return { eligible: false, on: false, synced: false, reason: blocker };
+  const on = m.phone === true;
+  const synced = on && !!m.phoneSyncedAt && !m.phoneError && !!userId && m.phoneUser === userId;
+  return { eligible: true, on, synced, reason: on && m.phoneError ? m.phoneError : '' };
+}
+
+/**
+ * opts.getAccessToken: async () => token or null (signed out)
+ * opts.fetch: fetch implementation (defaults to the global one)
+ * opts.url / opts.anonKey: the function endpoint and the project's public anon key
+ */
+function createModelSync({ getAccessToken, fetch: fetchImpl = globalThis.fetch, url = DEFAULT_URL, anonKey = '', timeoutMs = 20000 } = {}) {
+  async function call(action, payload) {
+    let token = null;
+    try { token = await getAccessToken(); } catch {}
+    if (!token) return { ok: false, signedOut: true, error: 'Sign in to Codeply to use this model on your phone.' };
+    let res;
+    try {
+      res = await fetchImpl(url, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, ...(anonKey ? { apikey: anonKey } : {}), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ action, ...payload }),
+        signal: AbortSignal.timeout(timeoutMs),
+      });
+    } catch (e) {
+      return { ok: false, offline: true, error: e && e.name === 'TimeoutError' ? 'Codeply took too long to answer.' : "Can't reach Codeply. Check your internet connection." };
+    }
+    const data = await res.json().catch(() => ({}));
+    if (res.ok && data.success) return { ok: true, ...data };
+    return {
+      ok: false,
+      status: res.status,
+      retry: !!data.retry,
+      needsKey: /send the api key/i.test(data.error || ''),
+      error: data.error || `Codeply could not save it (${res.status}).`,
+    };
+  }
+
+  /** Metadata of every synced model, keys masked. */
+  async function list() {
+    return call('list', {});
+  }
+
+  /**
+   * Sends a model. withKey also sends its API key (first sync, a new key, a
+   * new address); otherwise only the name and model id are updated. When the
+   * server turns out not to have the key (removed elsewhere), it retries once
+   * with the key, and once more on a save conflict.
+   */
+  async function push(m, { withKey = false } = {}) {
+    const blocker = phoneBlocker(m);
+    if (blocker) return { ok: false, blocked: true, error: blocker };
+    const send = (k) => call('upsert', {
+      model: { clientId: m.id, name: m.name, kind: 'openai', baseUrl: m.baseUrl, model: m.model, ...(k ? { apiKey: m.apiKey } : {}) },
+    });
+    let r = await send(withKey);
+    if (!r.ok && r.needsKey && !withKey) r = await send(true);
+    if (!r.ok && r.retry) r = await send(withKey || r.needsKey);
+    return r;
+  }
+
+  async function remove(clientId) {
+    return call('delete', { clientId });
+  }
+
+  return { list, push, remove };
+}
+
+module.exports = { phoneBlocker, phoneStatus, createModelSync, DEFAULT_URL };