flavor-code 1.4.2 → 1.4.3

package/dist/chunk-4TMLXZVZ.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+import { createRequire as createFlavorRequire } from "node:module"; const require = createFlavorRequire(import.meta.url);
+import {
+  redactErrorText,
+  redactSecrets
+} from "./chunk-WLZUAVVU.js";
+import {
+  external_exports
+} from "./chunk-EWD7FWTH.js";
+
+// src/trace/recorder.ts
+import { mkdir, open } from "fs/promises";
+import { dirname, resolve } from "path";
+
+// src/trace/schema.ts
+var TraceKindSchema = external_exports.enum(["command", "response", "output", "queue", "history", "verification"]);
+var TraceRecordSchema = external_exports.object({
+  version: external_exports.literal(1),
+  sequence: external_exports.number().int().positive(),
+  timestamp: external_exports.string().datetime(),
+  sessionId: external_exports.string().min(1),
+  kind: TraceKindSchema,
+  payload: external_exports.unknown()
+}).strict();
+
+// src/trace/recorder.ts
+var TraceRecorder = class {
+  path;
+  #sessionId;
+  #secrets;
+  #now;
+  #sequence = 0;
+  #handle;
+  #tail = Promise.resolve();
+  constructor(options) {
+    this.path = resolve(options.path);
+    this.#sessionId = options.sessionId;
+    this.#secrets = options.secrets ?? [];
+    this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  record(kind, payload) {
+    const sequence = ++this.#sequence;
+    this.#tail = this.#tail.then(async () => {
+      const handle = await this.#file();
+      const serialized = redactErrorText(redactSecrets(JSON.stringify(payload) ?? "null", this.#secrets));
+      const record = TraceRecordSchema.parse({
+        version: 1,
+        sequence,
+        timestamp: this.#now().toISOString(),
+        sessionId: this.#sessionId,
+        kind,
+        payload: JSON.parse(serialized)
+      });
+      await handle.appendFile(`${JSON.stringify(record)}
+`, "utf8");
+    });
+    return this.#tail;
+  }
+  async close() {
+    await this.#tail;
+    await this.#handle?.close();
+    this.#handle = void 0;
+  }
+  async #file() {
+    if (this.#handle !== void 0) return this.#handle;
+    await mkdir(dirname(this.path), { recursive: true });
+    this.#handle = await open(this.path, "a", 384);
+    return this.#handle;
+  }
+};
+
+export {
+  TraceRecordSchema,
+  TraceRecorder
+};

package/dist/{chunk-7YFHRORG.js → chunk-5BDKRA6U.js}

@@ -1,172 +1,340 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module"; const require = createRequire(import.meta.url);
+import { createRequire as createFlavorRequire } from "node:module"; const require = createFlavorRequire(import.meta.url);
+import {
+  FlavorConfigSchema,
+  ProviderConfigSchema,
+  configPathSegments
+} from "./chunk-ONRY3C2L.js";
+import {
+  __commonJS,
+  __require,
+  __toESM
+} from "./chunk-ZKKVSR37.js";
+
+// node_modules/dotenv/lib/main.js
+var require_main = __commonJS({
+  "node_modules/dotenv/lib/main.js"(exports, module) {
+    "use strict";
+    var fs = __require("fs");
+    var path = __require("path");
+    var os = __require("os");
+    var crypto = __require("crypto");
+    var TIPS = [
+      "\u25C8 encrypted .env [www.dotenvx.com]",
+      "\u25C8 secrets for agents [www.dotenvx.com]",
+      "\u2301 auth for agents [www.vestauth.com]",
+      "\u2318 custom filepath { path: '/custom/path/.env' }",
+      "\u2318 enable debugging { debug: true }",
+      "\u2318 override existing { override: true }",
+      "\u2318 suppress logs { quiet: true }",
+      "\u2318 multiple files { path: ['.env.local', '.env'] }"
+    ];
+    function _getRandomTip() {
+      return TIPS[Math.floor(Math.random() * TIPS.length)];
+    }
+    function parseBoolean(value) {
+      if (typeof value === "string") {
+        return !["false", "0", "no", "off", ""].includes(value.toLowerCase());
+      }
+      return Boolean(value);
+    }
+    function supportsAnsi() {
+      return process.stdout.isTTY;
+    }
+    function dim(text) {
+      return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;
+    }
+    var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
+    function parse2(src) {
+      const obj = {};
+      let lines = src.toString();
+      lines = lines.replace(/\r\n?/mg, "\n");
+      let match;
+      while ((match = LINE.exec(lines)) != null) {
+        const key = match[1];
+        let value = match[2] || "";
+        value = value.trim();
+        const maybeQuote = value[0];
+        value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");
+        if (maybeQuote === '"') {
+          value = value.replace(/\\n/g, "\n");
+          value = value.replace(/\\r/g, "\r");
+        }
+        obj[key] = value;
+      }
+      return obj;
+    }
+    function _parseVault(options) {
+      options = options || {};
+      const vaultPath = _vaultPath(options);
+      options.path = vaultPath;
+      const result = DotenvModule.configDotenv(options);
+      if (!result.parsed) {
+        const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
+        err.code = "MISSING_DATA";
+        throw err;
+      }
+      const keys = _dotenvKey(options).split(",");
+      const length = keys.length;
+      let decrypted;
+      for (let i = 0; i < length; i++) {
+        try {
+          const key = keys[i].trim();
+          const attrs = _instructions(result, key);
+          decrypted = DotenvModule.decrypt(attrs.ciphertext, attrs.key);
+          break;
+        } catch (error) {
+          if (i + 1 >= length) {
+            throw error;
+          }
+        }
+      }
+      return DotenvModule.parse(decrypted);
+    }
+    function _warn(message) {
+      console.error(`\u26A0 ${message}`);
+    }
+    function _debug(message) {
+      console.log(`\u2506 ${message}`);
+    }
+    function _log(message) {
+      console.log(`\u25C7 ${message}`);
+    }
+    function _dotenvKey(options) {
+      if (options && options.DOTENV_KEY && options.DOTENV_KEY.length > 0) {
+        return options.DOTENV_KEY;
+      }
+      if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) {
+        return process.env.DOTENV_KEY;
+      }
+      return "";
+    }
+    function _instructions(result, dotenvKey) {
+      let uri;
+      try {
+        uri = new URL(dotenvKey);
+      } catch (error) {
+        if (error.code === "ERR_INVALID_URL") {
+          const err = new Error("INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development");
+          err.code = "INVALID_DOTENV_KEY";
+          throw err;
+        }
+        throw error;
+      }
+      const key = uri.password;
+      if (!key) {
+        const err = new Error("INVALID_DOTENV_KEY: Missing key part");
+        err.code = "INVALID_DOTENV_KEY";
+        throw err;
+      }
+      const environment = uri.searchParams.get("environment");
+      if (!environment) {
+        const err = new Error("INVALID_DOTENV_KEY: Missing environment part");
+        err.code = "INVALID_DOTENV_KEY";
+        throw err;
+      }
+      const environmentKey = `DOTENV_VAULT_${environment.toUpperCase()}`;
+      const ciphertext = result.parsed[environmentKey];
+      if (!ciphertext) {
+        const err = new Error(`NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate environment ${environmentKey} in your .env.vault file.`);
+        err.code = "NOT_FOUND_DOTENV_ENVIRONMENT";
+        throw err;
+      }
+      return { ciphertext, key };
+    }
+    function _vaultPath(options) {
+      let possibleVaultPath = null;
+      if (options && options.path && options.path.length > 0) {
+        if (Array.isArray(options.path)) {
+          for (const filepath of options.path) {
+            if (fs.existsSync(filepath)) {
+              possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
+            }
+          }
+        } else {
+          possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
+        }
+      } else {
+        possibleVaultPath = path.resolve(process.cwd(), ".env.vault");
+      }
+      if (fs.existsSync(possibleVaultPath)) {
+        return possibleVaultPath;
+      }
+      return null;
+    }
+    function _resolveHome(envPath) {
+      return envPath[0] === "~" ? path.join(os.homedir(), envPath.slice(1)) : envPath;
+    }
+    function _configVault(options) {
+      const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || options && options.debug);
+      const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || options && options.quiet);
+      if (debug || !quiet) {
+        _log("loading env from encrypted .env.vault");
+      }
+      const parsed = DotenvModule._parseVault(options);
+      let processEnv = process.env;
+      if (options && options.processEnv != null) {
+        processEnv = options.processEnv;
+      }
+      DotenvModule.populate(processEnv, parsed, options);
+      return { parsed };
+    }
+    function configDotenv(options) {
+      const dotenvPath = path.resolve(process.cwd(), ".env");
+      let encoding = "utf8";
+      let processEnv = process.env;
+      if (options && options.processEnv != null) {
+        processEnv = options.processEnv;
+      }
+      let debug = parseBoolean(processEnv.DOTENV_CONFIG_DEBUG || options && options.debug);
+      let quiet = parseBoolean(processEnv.DOTENV_CONFIG_QUIET || options && options.quiet);
+      if (options && options.encoding) {
+        encoding = options.encoding;
+      } else {
+        if (debug) {
+          _debug("no encoding is specified (UTF-8 is used by default)");
+        }
+      }
+      let optionPaths = [dotenvPath];
+      if (options && options.path) {
+        if (!Array.isArray(options.path)) {
+          optionPaths = [_resolveHome(options.path)];
+        } else {
+          optionPaths = [];
+          for (const filepath of options.path) {
+            optionPaths.push(_resolveHome(filepath));
+          }
+        }
+      }
+      let lastError;
+      const parsedAll = {};
+      for (const path2 of optionPaths) {
+        try {
+          const parsed = DotenvModule.parse(fs.readFileSync(path2, { encoding }));
+          DotenvModule.populate(parsedAll, parsed, options);
+        } catch (e) {
+          if (debug) {
+            _debug(`failed to load ${path2} ${e.message}`);
+          }
+          lastError = e;
+        }
+      }
+      const populated = DotenvModule.populate(processEnv, parsedAll, options);
+      debug = parseBoolean(processEnv.DOTENV_CONFIG_DEBUG || debug);
+      quiet = parseBoolean(processEnv.DOTENV_CONFIG_QUIET || quiet);
+      if (debug || !quiet) {
+        const keysCount = Object.keys(populated).length;
+        const shortPaths = [];
+        for (const filePath of optionPaths) {
+          try {
+            const relative = path.relative(process.cwd(), filePath);
+            shortPaths.push(relative);
+          } catch (e) {
+            if (debug) {
+              _debug(`failed to load ${filePath} ${e.message}`);
+            }
+            lastError = e;
+          }
+        }
+        _log(`injected env (${keysCount}) from ${shortPaths.join(",")} ${dim(`// tip: ${_getRandomTip()}`)}`);
+      }
+      if (lastError) {
+        return { parsed: parsedAll, error: lastError };
+      } else {
+        return { parsed: parsedAll };
+      }
+    }
+    function config(options) {
+      if (_dotenvKey(options).length === 0) {
+        return DotenvModule.configDotenv(options);
+      }
+      const vaultPath = _vaultPath(options);
+      if (!vaultPath) {
+        _warn(`you set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}`);
+        return DotenvModule.configDotenv(options);
+      }
+      return DotenvModule._configVault(options);
+    }
+    function decrypt(encrypted, keyStr) {
+      const key = Buffer.from(keyStr.slice(-64), "hex");
+      let ciphertext = Buffer.from(encrypted, "base64");
+      const nonce = ciphertext.subarray(0, 12);
+      const authTag = ciphertext.subarray(-16);
+      ciphertext = ciphertext.subarray(12, -16);
+      try {
+        const aesgcm = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+        aesgcm.setAuthTag(authTag);
+        return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
+      } catch (error) {
+        const isRange = error instanceof RangeError;
+        const invalidKeyLength = error.message === "Invalid key length";
+        const decryptionFailed = error.message === "Unsupported state or unable to authenticate data";
+        if (isRange || invalidKeyLength) {
+          const err = new Error("INVALID_DOTENV_KEY: It must be 64 characters long (or more)");
+          err.code = "INVALID_DOTENV_KEY";
+          throw err;
+        } else if (decryptionFailed) {
+          const err = new Error("DECRYPTION_FAILED: Please check your DOTENV_KEY");
+          err.code = "DECRYPTION_FAILED";
+          throw err;
+        } else {
+          throw error;
+        }
+      }
+    }
+    function populate(processEnv, parsed, options = {}) {
+      const debug = Boolean(options && options.debug);
+      const override = Boolean(options && options.override);
+      const populated = {};
+      if (typeof parsed !== "object") {
+        const err = new Error("OBJECT_REQUIRED: Please check the processEnv argument being passed to populate");
+        err.code = "OBJECT_REQUIRED";
+        throw err;
+      }
+      for (const key of Object.keys(parsed)) {
+        if (Object.prototype.hasOwnProperty.call(processEnv, key)) {
+          if (override === true) {
+            processEnv[key] = parsed[key];
+            populated[key] = parsed[key];
+          }
+          if (debug) {
+            if (override === true) {
+              _debug(`"${key}" is already defined and WAS overwritten`);
+            } else {
+              _debug(`"${key}" is already defined and was NOT overwritten`);
+            }
+          }
+        } else {
+          processEnv[key] = parsed[key];
+          populated[key] = parsed[key];
+        }
+      }
+      return populated;
+    }
+    var DotenvModule = {
+      configDotenv,
+      _configVault,
+      _parseVault,
+      config,
+      decrypt,
+      parse: parse2,
+      populate
+    };
+    module.exports.configDotenv = DotenvModule.configDotenv;
+    module.exports._configVault = DotenvModule._configVault;
+    module.exports._parseVault = DotenvModule._parseVault;
+    module.exports.config = DotenvModule.config;
+    module.exports.decrypt = DotenvModule.decrypt;
+    module.exports.parse = DotenvModule.parse;
+    module.exports.populate = DotenvModule.populate;
+    module.exports = DotenvModule;
+  }
+});
 
 // src/config/load.ts
+var import_dotenv = __toESM(require_main(), 1);
 import { mkdir as mkdir3, readFile as readFile3, writeFile } from "fs/promises";
 import { join as join2 } from "path";
-import { parse } from "dotenv";
-
-// src/config/schema.ts
-import { z } from "zod";
-var PERMISSION_MODES = [
-  "default",
-  "acceptEdits",
-  "plan",
-  "bypassPermissions",
-  "auto",
-  "bubble"
-];
-function normalizePermissionMode(value) {
-  if (value === "safe" || value === "workspace") return "default";
-  if (value === "full") return "bypassPermissions";
-  return value;
-}
-var PermissionModeSchema = z.preprocess(
-  normalizePermissionMode,
-  z.enum(PERMISSION_MODES).default("default")
-);
-var ProviderConfigSchema = z.object({
-  type: z.string(),
-  baseURL: z.string().url().optional(),
-  apiKey: z.string().optional(),
-  defaultModel: z.string().min(1).optional(),
-  cheapModel: z.string().min(1).optional(),
-  models: z.array(z.string().min(1)).max(100).optional(),
-  maxOutputTokens: z.number().int().positive().optional(),
-  // Extended-thinking budget in output tokens for the Anthropic protocol.
-  // Defaults to DEFAULT_THINKING_BUDGET; set to 0 to disable the request
-  // parameter. Provider thinking deltas are forwarded whenever they arrive.
-  thinkingBudget: z.number().int().min(0).optional(),
-  // Reasoning effort requested from the OpenAI Responses protocol (sent as
-  // reasoning.effort). The adapter defaults an omitted value to high.
-  thinkingEffort: z.enum(["minimal", "low", "medium", "high", "xhigh", "ultra"]).optional(),
-  // Send the Claude Code client fingerprint (User-Agent/x-app) with Anthropic requests,
-  // for gateways that restrict the Anthropic protocol to Claude clients.
-  claudeClient: z.boolean().optional(),
-  // OAuth PKCE fields
-  apiType: z.enum(["openai", "anthropic"]).optional(),
-  authorizationUrl: z.string().url().optional(),
-  tokenUrl: z.string().url().optional(),
-  clientId: z.string().min(1).optional(),
-  scope: z.string().optional()
-});
-var McpServerCommonShape = {
-  disabled: z.boolean().default(false),
-  timeoutMs: z.number().int().min(100).max(30 * 6e4).default(6e4)
-};
-var McpStdioServerConfigSchema = z.object({
-  command: z.string().min(1),
-  args: z.array(z.string()).default([]),
-  env: z.record(z.string(), z.string()).default({}),
-  cwd: z.string().min(1).optional(),
-  ...McpServerCommonShape
-}).strict();
-var McpHttpServerConfigSchema = z.object({
-  url: z.string().url().refine((value) => {
-    const protocol = new URL(value).protocol;
-    return protocol === "http:" || protocol === "https:";
-  }, "MCP HTTP URLs must use http or https"),
-  headers: z.record(z.string(), z.string()).default({}),
-  ...McpServerCommonShape
-}).strict();
-var McpServerConfigSchema = z.union([
-  McpStdioServerConfigSchema,
-  McpHttpServerConfigSchema
-]);
-var McpServerNameSchema = z.string().min(1).max(32).regex(/^[A-Za-z0-9_-]+$/, "MCP server names may contain only letters, digits, underscores, and hyphens");
-var SkillNameSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Skill names must use lowercase letters, digits, and single hyphens");
-var FlavorConfigSchema = z.object({
-  sleep: z.boolean().default(false),
-  providers: z.record(z.string(), ProviderConfigSchema).default({}),
-  mcpServers: z.record(McpServerNameSchema, McpServerConfigSchema).default({}),
-  skills: z.object({
-    disabled: z.array(SkillNameSchema).max(1e3).default([])
-  }).prefault({}),
-  agents: z.object({
-    main: z.object({ model: z.string() }).optional(),
-    subagent: z.object({ model: z.string() }).optional()
-  }).optional(),
-  maxSubagents: z.number().int().min(1).max(16).default(3),
-  maxSessions: z.number().int().min(1).max(1e3).default(50),
-  memory: z.object({
-    enabled: z.boolean().default(true),
-    autoExtract: z.boolean().default(true),
-    autoExtractMinChars: z.number().int().min(200).max(1e5).default(200),
-    scoreThreshold: z.number().int().min(0).max(12).default(9),
-    autoStoreThreshold: z.number().int().min(0).max(12).default(11),
-    ignoreStreakLimit: z.number().int().min(2).max(100).default(5),
-    reviewAutoDismissSeconds: z.number().int().min(0).max(300).default(5),
-    // One candidate per task is a deliberate memory-quality boundary, not a tunable range.
-    maxCandidatesPerTask: z.literal(1).default(1),
-    retrievalTopK: z.number().int().min(1).max(20).default(5),
-    maxEntries: z.number().int().min(1).max(1e4).default(200),
-    maxEntryChars: z.number().int().min(32).max(2e4).default(1e3),
-    maxPromptChars: z.number().int().min(256).max(2e5).default(12e3)
-  }).prefault({}),
-  permissionMode: PermissionModeSchema,
-  execution: z.object({
-    mode: z.enum(["local", "docker"]).default("local"),
-    image: z.string().trim().min(1).default("node:24-bookworm-slim"),
-    network: z.boolean().default(false),
-    memory: z.string().regex(/^[1-9][0-9]*(?:[kKmMgG])?$/).default("2g"),
-    cpus: z.number().positive().max(64).default(2)
-  }).prefault({}),
-  language: z.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/, "language must be a BCP47 tag like zh-CN or en-US").optional(),
-  hallucination: z.object({
-    showWarnings: z.boolean().default(false),
-    evaluationTimeoutMs: z.number().int().min(100).max(3e4).default(2e3)
-  }).prefault({}),
-  maxIterations: z.object({
-    main: z.number().int().min(10).max(500).default(300),
-    subagent: z.number().int().min(10).max(200).default(100),
-    softLimitFactor: z.number().min(0.5).max(1).default(0.8),
-    extendBy: z.number().int().min(5).max(100).default(50)
-  }).prefault({}),
-  loop: z.object({
-    maxCycles: z.number().int().positive().max(1e4).default(100),
-    maxTokens: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).default(5e5),
-    isolation: z.literal("auto").default("auto")
-  }).prefault({}),
-  goal: z.object({
-    maxRounds: z.number().int().positive().max(1e4).default(100),
-    maxStallStreak: z.number().int().positive().max(100).default(3)
-  }).prefault({}),
-  context: z.object({
-    windowTokens: z.number().int().positive().default(2e5),
-    reservedOutputTokens: z.number().int().nonnegative().default(2e4),
-    autoCompactBufferTokens: z.number().int().nonnegative().default(27e3),
-    warningBufferTokens: z.number().int().nonnegative().default(2e4),
-    blockingBufferTokens: z.number().int().nonnegative().default(3e3),
-    microcompactKeepRecentToolResults: z.number().int().nonnegative().default(5),
-    recentTokens: z.number().int().nonnegative().default(1e4),
-    recentTextMessages: z.number().int().nonnegative().default(5),
-    maxRecentTokens: z.number().int().nonnegative().default(4e4),
-    /** @deprecated Character threshold retained for configuration compatibility. */
-    compactAtChars: z.number().int().positive().optional(),
-    toolOutputChars: z.number().int().positive().default(3e4)
-  }).superRefine((context, issue) => {
-    if (context.reservedOutputTokens >= context.windowTokens) issue.addIssue({
-      code: "custom",
-      path: ["reservedOutputTokens"],
-      message: "reservedOutputTokens must be below windowTokens"
-    });
-    if (context.maxRecentTokens < context.recentTokens) issue.addIssue({
-      code: "custom",
-      path: ["maxRecentTokens"],
-      message: "maxRecentTokens must be at least recentTokens"
-    });
-  }).prefault({}),
-  incidents: z.object({
-    enabled: z.boolean().default(false),
-    webhookUrl: z.string().url().optional()
-  }).prefault({}),
-  evolve: z.object({
-    promptTop: z.number().int().min(1).max(10).default(3),
-    minRepeats: z.number().int().min(2).max(100).default(2),
-    testCommand: z.string().trim().min(1).default("npm test"),
-    testTimeoutMs: z.number().int().min(1e3).max(6e5).default(12e4)
-  }).prefault({})
-});
 
 // src/config/protected-file.ts
 import { randomUUID } from "crypto";
@@ -208,6 +376,34 @@ async function updateProtectedFile(options) {
     return next;
   }, options.lockTimeoutMs ?? LOCK_TIMEOUT_MS, options.staleLockMs ?? STALE_LOCK_MS);
 }
+async function updatePlainTextFile(path, update, maxBytes) {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  return withFileLock(path, async () => {
+    const current = await readOptionalPlainText(path, maxBytes);
+    const next = await update(current);
+    if (next === void 0 || next === current) return current;
+    if (await readOptionalPlainText(path, maxBytes) !== current) {
+      throw new Error(`Text file changed while the update was prepared: ${path}`);
+    }
+    await writeAtomic(path, next, defaultFileOperations);
+    return next;
+  }, LOCK_TIMEOUT_MS, STALE_LOCK_MS);
+}
+async function readOptionalPlainText(path, maxBytes) {
+  try {
+    if (maxBytes !== void 0 && (await stat(path)).size > maxBytes) {
+      throw new Error(`Text file exceeds ${maxBytes} bytes: ${path}`);
+    }
+    const bytes = await readFile(path);
+    if (maxBytes !== void 0 && bytes.length > maxBytes) {
+      throw new Error(`Text file exceeds ${maxBytes} bytes: ${path}`);
+    }
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+  } catch (error) {
+    if (isCode(error, "ENOENT")) return void 0;
+    throw error;
+  }
+}
 async function withFileLock(path, operation, lockTimeoutMs, staleLockMs) {
   const lockPath = `${path}.lock`;
   const token = JSON.stringify({ pid: process.pid, nonce: randomUUID() });
@@ -535,8 +731,8 @@ async function loadConfig(options) {
   const globalEnvText = await readTextIfPresent(globalEnvPath);
   const projectEnvText = await readTextIfPresent(envPath);
   const projectEnvironment = {
-    ...globalEnvText === void 0 ? {} : parse(globalEnvText),
-    ...projectEnvText === void 0 ? {} : parse(projectEnvText)
+    ...globalEnvText === void 0 ? {} : (0, import_dotenv.parse)(globalEnvText),
+    ...projectEnvText === void 0 ? {} : (0, import_dotenv.parse)(projectEnvText)
   };
   if (globalEnvText !== void 0) sources.push(globalEnvPath);
   if (projectEnvText !== void 0) sources.push(envPath);
@@ -686,6 +882,53 @@ async function setProjectProviderConfig(cwd, providerName, provider) {
   });
   return path;
 }
+async function setProjectConfigValue(cwd, home, key, value) {
+  const segments = configPathSegments(key);
+  const nested = segments.reduceRight(
+    (acc, segment) => ({ [segment]: acc }),
+    value
+  );
+  await loadConfig({ cwd, home, cli: nested, seedGlobalEnv: false });
+  const path = join2(cwd, ".flavor", "flavor.json");
+  await updateProtectedFile({
+    path,
+    decode: (raw) => parseConfigObject(path, raw),
+    encode: (next) => `${JSON.stringify(next, null, 2)}
+`,
+    update: (current) => setPathIn({ ...current ?? {} }, segments, value)
+  });
+  return path;
+}
+async function unsetProjectConfigValue(cwd, key) {
+  const segments = configPathSegments(key);
+  const path = join2(cwd, ".flavor", "flavor.json");
+  await updateProtectedFile({
+    path,
+    decode: (raw) => parseConfigObject(path, raw),
+    encode: (next) => `${JSON.stringify(next, null, 2)}
+`,
+    update: (current) => deletePathIn({ ...current ?? {} }, segments)
+  });
+  return path;
+}
+function setPathIn(target, segments, value) {
+  const [head, ...rest] = segments;
+  if (head === void 0) return target;
+  if (rest.length === 0) return { ...target, [head]: value };
+  const child = isPlainObject(target[head]) ? target[head] : {};
+  return { ...target, [head]: setPathIn(child, rest, value) };
+}
+function deletePathIn(target, segments) {
+  const [head, ...rest] = segments;
+  if (head === void 0 || !(head in target)) return target;
+  if (rest.length === 0) {
+    const { [head]: _removed, ...remainder } = target;
+    return remainder;
+  }
+  const child = isPlainObject(target[head]) ? target[head] : void 0;
+  if (child === void 0) return target;
+  return { ...target, [head]: deletePathIn(child, rest) };
+}
 function redactConfig(config) {
   if (Array.isArray(config)) {
     return config.map((item) => redactConfig(item));
@@ -702,14 +945,9 @@ function redactConfig(config) {
 }
 
 export {
-  PERMISSION_MODES,
-  normalizePermissionMode,
-  PermissionModeSchema,
-  McpServerConfigSchema,
-  McpServerNameSchema,
-  SkillNameSchema,
   readRecoverableFile,
   updateProtectedFile,
+  updatePlainTextFile,
   encryptDocument,
   decryptDocument,
   loadOrCreateConfigKey,
@@ -718,5 +956,7 @@ export {
   setProjectSkillDisabled,
   setGlobalProviderConfig,
   setProjectProviderConfig,
+  setProjectConfigValue,
+  unsetProjectConfigValue,
   redactConfig
 };