flavor-code 1.2.1

package/dist/chunk-MVIMQEQT.js

@@ -0,0 +1,692 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module"; const require = createRequire(import.meta.url);
+
+// src/config/load.ts
+import { mkdir as mkdir3, readFile as readFile3, writeFile } from "fs/promises";
+import { join as join2 } from "path";
+import { parse } from "dotenv";
+
+// src/config/schema.ts
+import { z } from "zod";
+var PERMISSION_MODES = [
+  "default",
+  "acceptEdits",
+  "plan",
+  "bypassPermissions",
+  "auto",
+  "bubble"
+];
+function normalizePermissionMode(value) {
+  if (value === "safe" || value === "workspace") return "default";
+  if (value === "full") return "bypassPermissions";
+  return value;
+}
+var PermissionModeSchema = z.preprocess(
+  normalizePermissionMode,
+  z.enum(PERMISSION_MODES).default("default")
+);
+var ProviderConfigSchema = z.object({
+  type: z.string(),
+  baseURL: z.string().url().optional(),
+  apiKey: z.string().optional(),
+  defaultModel: z.string().min(1).optional(),
+  cheapModel: z.string().min(1).optional(),
+  models: z.array(z.string().min(1)).max(100).optional(),
+  maxOutputTokens: z.number().int().positive().optional(),
+  // OAuth PKCE fields
+  apiType: z.enum(["openai", "anthropic"]).optional(),
+  authorizationUrl: z.string().url().optional(),
+  tokenUrl: z.string().url().optional(),
+  clientId: z.string().min(1).optional(),
+  scope: z.string().optional()
+});
+var McpServerCommonShape = {
+  disabled: z.boolean().default(false),
+  timeoutMs: z.number().int().min(100).max(30 * 6e4).default(6e4)
+};
+var McpStdioServerConfigSchema = z.object({
+  command: z.string().min(1),
+  args: z.array(z.string()).default([]),
+  env: z.record(z.string(), z.string()).default({}),
+  cwd: z.string().min(1).optional(),
+  ...McpServerCommonShape
+}).strict();
+var McpHttpServerConfigSchema = z.object({
+  url: z.string().url().refine((value) => {
+    const protocol = new URL(value).protocol;
+    return protocol === "http:" || protocol === "https:";
+  }, "MCP HTTP URLs must use http or https"),
+  headers: z.record(z.string(), z.string()).default({}),
+  ...McpServerCommonShape
+}).strict();
+var McpServerConfigSchema = z.union([
+  McpStdioServerConfigSchema,
+  McpHttpServerConfigSchema
+]);
+var McpServerNameSchema = z.string().min(1).max(32).regex(/^[A-Za-z0-9_-]+$/, "MCP server names may contain only letters, digits, underscores, and hyphens");
+var SkillNameSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Skill names must use lowercase letters, digits, and single hyphens");
+var FlavorConfigSchema = z.object({
+  sleep: z.boolean().default(false),
+  providers: z.record(z.string(), ProviderConfigSchema).default({}),
+  mcpServers: z.record(McpServerNameSchema, McpServerConfigSchema).default({}),
+  skills: z.object({
+    disabled: z.array(SkillNameSchema).max(1e3).default([])
+  }).prefault({}),
+  agents: z.object({
+    main: z.object({ model: z.string() }).optional(),
+    subagent: z.object({ model: z.string() }).optional()
+  }).optional(),
+  maxSubagents: z.number().int().min(1).max(16).default(3),
+  maxSessions: z.number().int().min(1).max(1e3).default(50),
+  memory: z.object({
+    enabled: z.boolean().default(true),
+    autoExtract: z.boolean().default(true),
+    autoExtractMinChars: z.number().int().min(200).max(1e5).default(200),
+    scoreThreshold: z.number().int().min(0).max(12).default(9),
+    autoStoreThreshold: z.number().int().min(0).max(12).default(11),
+    ignoreStreakLimit: z.number().int().min(2).max(100).default(5),
+    reviewAutoDismissSeconds: z.number().int().min(0).max(300).default(5),
+    maxCandidatesPerTask: z.number().int().min(1).max(10).default(1),
+    retrievalTopK: z.number().int().min(1).max(20).default(5),
+    maxEntries: z.number().int().min(1).max(1e4).default(200),
+    maxEntryChars: z.number().int().min(32).max(2e4).default(1e3),
+    maxPromptChars: z.number().int().min(256).max(2e5).default(12e3)
+  }).prefault({}),
+  permissionMode: PermissionModeSchema,
+  execution: z.object({
+    mode: z.enum(["local", "docker"]).default("local"),
+    image: z.string().trim().min(1).default("node:24-bookworm-slim"),
+    network: z.boolean().default(false),
+    memory: z.string().regex(/^[1-9][0-9]*(?:[kKmMgG])?$/).default("2g"),
+    cpus: z.number().positive().max(64).default(2)
+  }).prefault({}),
+  language: z.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/, "language must be a BCP47 tag like zh-CN or en-US").optional(),
+  hallucination: z.object({
+    showWarnings: z.boolean().default(false),
+    evaluationTimeoutMs: z.number().int().min(100).max(3e4).default(2e3)
+  }).prefault({}),
+  maxIterations: z.object({
+    main: z.number().int().min(10).max(500).default(80),
+    subagent: z.number().int().min(10).max(200).default(40),
+    softLimitFactor: z.number().min(0.5).max(1).default(0.8),
+    extendBy: z.number().int().min(5).max(100).default(20)
+  }).prefault({}),
+  loop: z.object({
+    maxCycles: z.number().int().positive().max(1e4).default(20),
+    maxTokens: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).default(5e5),
+    isolation: z.literal("auto").default("auto")
+  }).prefault({}),
+  context: z.object({
+    windowTokens: z.number().int().positive().default(2e5),
+    reservedOutputTokens: z.number().int().nonnegative().default(2e4),
+    autoCompactBufferTokens: z.number().int().nonnegative().default(13e3),
+    warningBufferTokens: z.number().int().nonnegative().default(2e4),
+    blockingBufferTokens: z.number().int().nonnegative().default(3e3),
+    microcompactKeepRecentToolResults: z.number().int().nonnegative().default(5),
+    recentTokens: z.number().int().nonnegative().default(1e4),
+    recentTextMessages: z.number().int().nonnegative().default(5),
+    maxRecentTokens: z.number().int().nonnegative().default(4e4),
+    /** @deprecated Character threshold retained for configuration compatibility. */
+    compactAtChars: z.number().int().positive().optional(),
+    toolOutputChars: z.number().int().positive().default(3e4)
+  }).superRefine((context, issue) => {
+    if (context.reservedOutputTokens >= context.windowTokens) issue.addIssue({
+      code: "custom",
+      path: ["reservedOutputTokens"],
+      message: "reservedOutputTokens must be below windowTokens"
+    });
+    if (context.maxRecentTokens < context.recentTokens) issue.addIssue({
+      code: "custom",
+      path: ["maxRecentTokens"],
+      message: "maxRecentTokens must be at least recentTokens"
+    });
+  }).prefault({}),
+  incidents: z.object({
+    enabled: z.boolean().default(false),
+    webhookUrl: z.string().url().optional()
+  }).prefault({})
+});
+
+// src/config/protected-file.ts
+import { randomUUID } from "crypto";
+import { mkdir, open, readFile, rename, rm, stat } from "fs/promises";
+import { dirname } from "path";
+var LOCK_WAIT_MS = 20;
+var LOCK_TIMEOUT_MS = 2e3;
+var STALE_LOCK_MS = 3e4;
+async function readRecoverableFile(path, decode) {
+  let primaryError;
+  try {
+    return { value: await decode(await readFile(path, "utf8")), source: path };
+  } catch (error) {
+    if (isCode(error, "ENOENT")) primaryError = error;
+    else primaryError = error;
+  }
+  const backup = `${path}.bak`;
+  try {
+    return { value: await decode(await readFile(backup, "utf8")), source: backup };
+  } catch (backupError) {
+    if (isCode(primaryError, "ENOENT") && isCode(backupError, "ENOENT")) return void 0;
+    if (isCode(backupError, "ENOENT")) throw primaryError;
+    const reason = backupError instanceof Error ? backupError.message : String(backupError);
+    const primary = primaryError instanceof Error ? primaryError.message : String(primaryError);
+    throw new Error(`Primary and backup files are invalid for ${path}: ${primary}; backup: ${reason}`);
+  }
+}
+async function updateProtectedFile(options) {
+  await mkdir(dirname(options.path), { recursive: true, mode: 448 });
+  return withFileLock(options.path, async () => {
+    const current = await readRecoverableFile(options.path, options.decode);
+    const next = await options.update(current?.value);
+    if (current !== void 0) {
+      const backup = options.backupEncode === void 0 ? await options.encode(current.value) : await options.backupEncode(current.value);
+      await writeAtomic(`${options.path}.bak`, backup);
+    }
+    await writeAtomic(options.path, await options.encode(next));
+    return next;
+  }, options.lockTimeoutMs ?? LOCK_TIMEOUT_MS, options.staleLockMs ?? STALE_LOCK_MS);
+}
+async function withFileLock(path, operation, lockTimeoutMs, staleLockMs) {
+  const lockPath = `${path}.lock`;
+  const token = JSON.stringify({ pid: process.pid, nonce: randomUUID() });
+  const deadline = Date.now() + lockTimeoutMs;
+  let handle;
+  while (handle === void 0) {
+    try {
+      handle = await open(lockPath, "wx", 384);
+      await handle.writeFile(token, "utf8");
+      await handle.sync();
+    } catch (error) {
+      await handle?.close().catch(() => void 0);
+      handle = void 0;
+      if (!isCode(error, "EEXIST")) throw error;
+      await removeStaleLock(lockPath, staleLockMs);
+      if (Date.now() >= deadline) throw new Error(`Timed out waiting for configuration lock ${lockPath}`);
+      await delay(LOCK_WAIT_MS);
+    }
+  }
+  await handle.close();
+  try {
+    return await operation();
+  } finally {
+    try {
+      if (await readFile(lockPath, "utf8") === token) await rm(lockPath, { force: true });
+    } catch (error) {
+      if (!isCode(error, "ENOENT")) throw error;
+    }
+  }
+}
+async function removeStaleLock(path, staleLockMs) {
+  try {
+    const token = await readFile(path, "utf8");
+    const metadata = await stat(path);
+    if (Date.now() - metadata.mtimeMs <= staleLockMs) return;
+    const owner = parseLockOwner(token);
+    if (owner !== void 0 && isProcessAlive(owner)) return;
+    if (await readFile(path, "utf8") !== token) return;
+    const stale = `${path}.stale-${process.pid}-${randomUUID()}`;
+    try {
+      await rename(path, stale);
+      await rm(stale, { force: true });
+    } catch (error) {
+      if (!isCode(error, "ENOENT")) return;
+    }
+  } catch (error) {
+    if (!isCode(error, "ENOENT")) throw error;
+  }
+}
+function parseLockOwner(token) {
+  try {
+    const parsed = JSON.parse(token);
+    if (typeof parsed !== "object" || parsed === null || !("pid" in parsed)) return void 0;
+    const pid = parsed.pid;
+    return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
+  } catch {
+    const legacy = token.match(/^(\d+):/);
+    if (legacy?.[1] === void 0) return void 0;
+    const pid = Number(legacy[1]);
+    return Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
+  }
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return isCode(error, "EPERM");
+  }
+}
+async function writeAtomic(path, content) {
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  let handle;
+  try {
+    handle = await open(temporary, "wx", 384);
+    await handle.writeFile(content, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await rename(temporary, path);
+  } finally {
+    await handle?.close().catch(() => void 0);
+    await rm(temporary, { force: true }).catch(() => void 0);
+  }
+}
+function delay(ms) {
+  return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+}
+function isCode(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+// src/config/secret-envelope.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import { mkdir as mkdir2, open as open2, readFile as readFile2 } from "fs/promises";
+import { dirname as dirname2, join } from "path";
+var FIELD_PREFIX = "flavor:v1:";
+var FILE_PREFIX = "flavor-file:v1:";
+var KEY_BYTES = 32;
+function isSecretField(key) {
+  const normalized = key.replace(/[-_.]/g, "").toLowerCase();
+  return ["apikey", "authorization", "token", "password", "secret"].some((suffix) => normalized.endsWith(suffix));
+}
+function hasPlainSecretFields(value) {
+  if (Array.isArray(value)) return value.some(hasPlainSecretFields);
+  if (!isObject(value)) return false;
+  return Object.entries(value).some(
+    ([key, item]) => isSecretField(key) && typeof item === "string" && !item.startsWith(FIELD_PREFIX) || hasPlainSecretFields(item)
+  );
+}
+function encryptSecretFields(value, key) {
+  if (Array.isArray(value)) return value.map((item) => encryptSecretFields(item, key));
+  if (!isObject(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([name, item]) => [
+    name,
+    isSecretField(name) && typeof item === "string" ? item.startsWith(FIELD_PREFIX) ? item : `${FIELD_PREFIX}${seal(item, key)}` : encryptSecretFields(item, key)
+  ]));
+}
+function decryptSecretFields(value, key) {
+  if (Array.isArray(value)) return value.map((item) => decryptSecretFields(item, key));
+  if (!isObject(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([name, item]) => [
+    name,
+    isSecretField(name) && typeof item === "string" && item.startsWith(FIELD_PREFIX) ? openEnvelope(item.slice(FIELD_PREFIX.length), key) : decryptSecretFields(item, key)
+  ]));
+}
+function encryptDocument(value, key) {
+  return JSON.stringify(`${FILE_PREFIX}${seal(JSON.stringify(value), key)}`);
+}
+function decryptDocument(raw, key) {
+  const parsed = JSON.parse(raw);
+  if (typeof parsed === "string" && parsed.startsWith(FILE_PREFIX)) {
+    return JSON.parse(openEnvelope(parsed.slice(FILE_PREFIX.length), key));
+  }
+  return parsed;
+}
+async function loadOrCreateConfigKey(directory) {
+  const path = join(directory, ".config.key");
+  try {
+    return parseKey(await readFile2(path, "utf8"));
+  } catch (error) {
+    if (!isCode2(error, "ENOENT")) throw error;
+  }
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  const key = randomBytes(KEY_BYTES);
+  let handle;
+  try {
+    handle = await open2(path, "wx", 384);
+    await handle.writeFile(`${key.toString("base64")}
+`, "utf8");
+    await handle.sync();
+    return key;
+  } catch (error) {
+    if (!isCode2(error, "EEXIST")) throw error;
+    return parseKey(await readFile2(path, "utf8"));
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+function seal(plaintext, key) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return [iv, cipher.getAuthTag(), ciphertext].map((part) => part.toString("base64")).join(":");
+}
+function openEnvelope(envelope, key) {
+  const parts = envelope.split(":");
+  if (parts.length !== 3) throw new Error("Invalid encrypted value envelope");
+  const [ivText, tagText, ciphertextText] = parts;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivText, "base64"));
+    decipher.setAuthTag(Buffer.from(tagText, "base64"));
+    return Buffer.concat([
+      decipher.update(Buffer.from(ciphertextText, "base64")),
+      decipher.final()
+    ]).toString("utf8");
+  } catch (error) {
+    throw new Error(`Encrypted value failed authentication: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function parseKey(raw) {
+  const key = Buffer.from(raw.trim(), "base64");
+  if (key.length !== KEY_BYTES) throw new Error("Invalid Flavor configuration key");
+  return key;
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isCode2(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+// src/config/load.ts
+function parseConfigObject(path, raw) {
+  const parsed = JSON.parse(raw);
+  if (!isPlainObject(parsed)) {
+    throw new Error(`Configuration file ${path} must contain a JSON object`);
+  }
+  return parsed;
+}
+async function readJsonIfPresent(path) {
+  const result = await readRecoverableFile(path, (raw) => parseConfigObject(path, raw));
+  return result === void 0 ? void 0 : { value: result.value, source: result.source };
+}
+async function readTextIfPresent(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      return void 0;
+    }
+    throw error;
+  }
+}
+function isMissingFileError(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeConfig(base, override) {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    if (value === void 0) {
+      continue;
+    }
+    const current = result[key];
+    result[key] = isPlainObject(current) && isPlainObject(value) ? mergeConfig(current, value) : value;
+  }
+  return result;
+}
+function interpolate(value, environment) {
+  if (typeof value === "string") {
+    const result = value.replace(
+      /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,
+      (match, name) => environment[name] === void 0 ? match : environment[name]
+    );
+    if (/^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(value) && result === value) {
+      return void 0;
+    }
+    return result;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => interpolate(item, environment));
+  }
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, interpolate(item, environment)])
+    );
+  }
+  return value;
+}
+var FLAVOR_ENV_VARS = [
+  "ANTHROPIC_BASE_URL",
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+  "OAUTH_AUTHORIZATION_URL",
+  "OAUTH_TOKEN_URL",
+  "OAUTH_CALLBACK_HOST",
+  "OAUTH_CLIENT_ID",
+  "OAUTH_SCOPE"
+];
+async function seedGlobalEnv(globalEnvPath) {
+  try {
+    await readFile3(globalEnvPath, "utf8");
+    return;
+  } catch (error) {
+    if (!isMissingFileError(error)) return;
+  }
+  const lines = [];
+  for (const key of FLAVOR_ENV_VARS) {
+    const value = process.env[key];
+    if (value !== void 0 && value !== "") {
+      lines.push(`${key}=${value}`);
+    }
+  }
+  if (lines.length === 0) return;
+  try {
+    await mkdir3(join2(globalEnvPath, ".."), { recursive: true });
+    await writeFile(globalEnvPath, `${lines.join("\n")}
+`, "utf8");
+  } catch {
+  }
+}
+async function loadConfig(options) {
+  const globalPath = join2(options.home, ".flavor-code", "flavor.json");
+  const globalEnvPath = join2(options.home, ".flavor-code", ".env");
+  const envPath = join2(options.cwd, ".env");
+  const projectPath = join2(options.cwd, ".flavor", "flavor.json");
+  const sources = [];
+  const keyDirectory = join2(options.home, ".flavor-code");
+  let keyPromise;
+  const getKey = () => keyPromise ??= loadOrCreateConfigKey(keyDirectory);
+  const decodeGlobal = async (raw) => {
+    const stored = parseConfigObject(globalPath, raw);
+    const hasPlainSecrets = hasPlainSecretFields(stored);
+    const config = decryptSecretFields(stored, await getKey());
+    return { config, hasPlainSecrets };
+  };
+  const globalRead = await readRecoverableFile(globalPath, decodeGlobal);
+  let globalConfig = globalRead?.value.config;
+  if (globalRead?.value.hasPlainSecrets) {
+    const key = await getKey();
+    const protectedConfig = await updateProtectedFile({
+      path: globalPath,
+      decode: decodeGlobal,
+      encode: (value) => `${JSON.stringify(encryptSecretFields(value.config, key), null, 2)}
+`,
+      backupEncode: (value) => `${JSON.stringify(encryptSecretFields(value.config, key), null, 2)}
+`,
+      update: (current) => current ?? { config: {}, hasPlainSecrets: false }
+    });
+    globalConfig = protectedConfig.config;
+  }
+  if (globalRead) sources.push(globalRead.source);
+  const globalEnvText = await readTextIfPresent(globalEnvPath);
+  const projectEnvText = await readTextIfPresent(envPath);
+  const projectEnvironment = {
+    ...globalEnvText === void 0 ? {} : parse(globalEnvText),
+    ...projectEnvText === void 0 ? {} : parse(projectEnvText)
+  };
+  if (globalEnvText !== void 0) sources.push(globalEnvPath);
+  if (projectEnvText !== void 0) sources.push(envPath);
+  for (const [key, value] of Object.entries(projectEnvironment)) {
+    if (value !== void 0 && process.env[key] === void 0) {
+      process.env[key] = value;
+    }
+  }
+  await seedGlobalEnv(globalEnvPath);
+  const projectRead = await readJsonIfPresent(projectPath);
+  const projectConfig = projectRead?.value;
+  if (projectRead) sources.push(projectRead.source);
+  const merged = mergeConfig(
+    mergeConfig(globalConfig ?? {}, projectConfig ?? {}),
+    options.cli ?? {}
+  );
+  const interpolated = interpolate(merged, {
+    ...options.environment ?? process.env,
+    ...projectEnvironment
+  });
+  return {
+    config: FlavorConfigSchema.parse(interpolated),
+    sources
+  };
+}
+async function setProjectMcpServerDisabled(cwd, serverName, disabled) {
+  const directory = join2(cwd, ".flavor");
+  const path = join2(directory, "flavor.json");
+  await updateProtectedFile({
+    path,
+    decode: (raw) => parseConfigObject(path, raw),
+    encode: (value) => `${JSON.stringify(value, null, 2)}
+`,
+    update: (current) => {
+      const projectConfig = { ...current ?? {} };
+      const currentServers = projectConfig["mcpServers"];
+      if (currentServers !== void 0 && !isPlainObject(currentServers)) {
+        throw new Error(`Configuration field mcpServers in ${path} must be an object`);
+      }
+      const servers = { ...currentServers ?? {} };
+      const currentServer = servers[serverName];
+      if (currentServer !== void 0 && !isPlainObject(currentServer)) {
+        throw new Error(`MCP server ${serverName} in ${path} must be an object`);
+      }
+      servers[serverName] = { ...currentServer ?? {}, disabled };
+      projectConfig["mcpServers"] = servers;
+      return projectConfig;
+    }
+  });
+  return path;
+}
+async function setProjectSkillDisabled(cwd, skillName, disabled, inheritedDisabled = []) {
+  const directory = join2(cwd, ".flavor");
+  const path = join2(directory, "flavor.json");
+  await updateProtectedFile({
+    path,
+    decode: (raw) => parseConfigObject(path, raw),
+    encode: (value) => `${JSON.stringify(value, null, 2)}
+`,
+    update: (current) => {
+      const projectConfig = { ...current ?? {} };
+      const currentSkills = projectConfig["skills"];
+      if (currentSkills !== void 0 && !isPlainObject(currentSkills)) {
+        throw new Error(`Configuration field skills in ${path} must be an object`);
+      }
+      const skills = { ...currentSkills ?? {} };
+      const currentDisabled = skills["disabled"];
+      if (currentDisabled !== void 0 && (!Array.isArray(currentDisabled) || currentDisabled.some((name) => typeof name !== "string"))) {
+        throw new Error(`Configuration field skills.disabled in ${path} must be a string array`);
+      }
+      const names = new Set(currentDisabled ?? inheritedDisabled);
+      if (disabled) names.add(skillName);
+      else names.delete(skillName);
+      skills["disabled"] = [...names].sort();
+      projectConfig["skills"] = skills;
+      return projectConfig;
+    }
+  });
+  return path;
+}
+async function setGlobalProviderConfig(home, providerName, provider) {
+  const directory = join2(home, ".flavor-code");
+  const path = join2(directory, "flavor.json");
+  const key = await loadOrCreateConfigKey(directory);
+  const validatedProvider = ProviderConfigSchema.parse(provider);
+  await updateProtectedFile({
+    path,
+    decode: (raw) => decryptSecretFields(parseConfigObject(path, raw), key),
+    encode: (value) => `${JSON.stringify(encryptSecretFields(value, key), null, 2)}
+`,
+    update: (current) => {
+      const globalConfig = { ...current ?? {} };
+      const currentProviders = globalConfig["providers"];
+      if (currentProviders !== void 0 && !isPlainObject(currentProviders)) {
+        throw new Error(`Configuration field providers in ${path} must be an object`);
+      }
+      const providers = { ...currentProviders ?? {} };
+      const existing = providers[providerName];
+      if (existing !== void 0 && !isPlainObject(existing)) {
+        throw new Error(`Provider ${providerName} in ${path} must be an object`);
+      }
+      const existingModels = isPlainObject(existing) && Array.isArray(existing["models"]) ? existing["models"].filter((model) => typeof model === "string") : [];
+      providers[providerName] = {
+        ...existing ?? {},
+        ...validatedProvider,
+        ...validatedProvider.models === void 0 ? {} : { models: [.../* @__PURE__ */ new Set([...existingModels, ...validatedProvider.models])] }
+      };
+      globalConfig["providers"] = providers;
+      return globalConfig;
+    }
+  });
+  return path;
+}
+async function setProjectProviderConfig(cwd, providerName, provider) {
+  const directory = join2(cwd, ".flavor");
+  const path = join2(directory, "flavor.json");
+  const validatedProvider = ProviderConfigSchema.parse(provider);
+  const projectProvider = { ...validatedProvider };
+  delete projectProvider.apiKey;
+  await updateProtectedFile({
+    path,
+    decode: (raw) => parseConfigObject(path, raw),
+    encode: (value) => `${JSON.stringify(value, null, 2)}
+`,
+    update: (current) => {
+      const projectConfig = { ...current ?? {} };
+      const currentProviders = projectConfig["providers"];
+      if (currentProviders !== void 0 && !isPlainObject(currentProviders)) {
+        throw new Error(`Configuration field providers in ${path} must be an object`);
+      }
+      const providers = { ...currentProviders ?? {} };
+      const existing = providers[providerName];
+      if (existing !== void 0 && !isPlainObject(existing)) {
+        throw new Error(`Provider ${providerName} in ${path} must be an object`);
+      }
+      const existingModels = isPlainObject(existing) && Array.isArray(existing["models"]) ? existing["models"].filter((model) => typeof model === "string") : [];
+      const nextProvider = {
+        ...existing ?? {},
+        ...projectProvider,
+        ...projectProvider.models === void 0 ? {} : { models: [.../* @__PURE__ */ new Set([...existingModels, ...projectProvider.models])] }
+      };
+      delete nextProvider["apiKey"];
+      providers[providerName] = nextProvider;
+      projectConfig["providers"] = providers;
+      return projectConfig;
+    }
+  });
+  return path;
+}
+function redactConfig(config) {
+  if (Array.isArray(config)) {
+    return config.map((item) => redactConfig(item));
+  }
+  if (!isPlainObject(config)) {
+    return config;
+  }
+  return Object.fromEntries(
+    Object.entries(config).map(([key, value]) => [
+      key,
+      isSecretField(key) ? "[redacted]" : redactConfig(value)
+    ])
+  );
+}
+
+export {
+  PERMISSION_MODES,
+  normalizePermissionMode,
+  PermissionModeSchema,
+  McpServerConfigSchema,
+  McpServerNameSchema,
+  SkillNameSchema,
+  readRecoverableFile,
+  updateProtectedFile,
+  encryptDocument,
+  decryptDocument,
+  loadOrCreateConfigKey,
+  loadConfig,
+  setProjectMcpServerDisabled,
+  setProjectSkillDisabled,
+  setGlobalProviderConfig,
+  setProjectProviderConfig,
+  redactConfig
+};
+//# sourceMappingURL=chunk-MVIMQEQT.js.map