gsd-pi 2.37.0 → 2.37.1-dev.49503be

package/dist/resources/extensions/gsd/git-service.js

@@ -349,10 +349,18 @@ export class GitServiceImpl {
         }
         const wtName = detectWorktreeName(this.basePath);
         if (wtName) {
+            // Auto-mode worktrees use milestone/<MID> branches (wtName = milestone ID)
+            const milestoneBranch = `milestone/${wtName}`;
+            const currentBranch = nativeGetCurrentBranch(this.basePath);
+            // If we're on a milestone/<MID> branch, use it (auto-mode case)
+            if (currentBranch.startsWith("milestone/")) {
+                return currentBranch;
+            }
+            // Otherwise check for manual worktree branch (worktree/<name>)
             const wtBranch = `worktree/${wtName}`;
             if (nativeBranchExists(this.basePath, wtBranch))
                 return wtBranch;
-            return nativeGetCurrentBranch(this.basePath);
+            return currentBranch;
         }
         // Repo-level default detection: origin/HEAD → main → master → current branch.
         // Native path uses libgit2 (single call), fallback spawns multiple git processes.

package/dist/resources/extensions/gsd/history.js

@@ -1,6 +1,7 @@
 // GSD Extension — Session History View
 // Human-readable display of past auto-mode unit executions.
-import { formatDuration, padRight, truncateWithEllipsis } from "../shared/format-utils.js";
+import { formatDuration, truncateWithEllipsis } from "../shared/format-utils.js";
+import { padRight } from "../shared/layout-utils.js";
 import { getLedger, getProjectTotals, formatCost, formatTokenCount, aggregateBySlice, aggregateByPhase, aggregateByModel, loadLedgerFromDisk, } from "./metrics.js";
 /**
  * Show recent unit execution history with cost, tokens, and duration.

package/dist/resources/extensions/gsd/metrics.js

@@ -17,8 +17,10 @@ import { gsdRoot } from "./paths.js";
 import { getAndClearSkills } from "./skill-telemetry.js";
 import { loadJsonFile, loadJsonFileOrNull, saveJsonFile } from "./json-persistence.js";
 import { parseUnitId } from "./unit-id.js";
-// Re-export from shared — canonical implementation lives in format-utils.
-export { formatTokenCount } from "../shared/mod.js";
+// Re-export from shared — import directly from format-utils to avoid pulling
+// in the full barrel (mod.js → ui.js → @gsd/pi-tui) which breaks when loaded
+// outside jiti's alias resolution (e.g. dynamic import in auto-loop reports).
+export { formatTokenCount } from "../shared/format-utils.js";
 export function classifyUnitPhase(unitType) {
     switch (unitType) {
         case "research-milestone":

package/dist/resources/extensions/gsd/preferences-types.js

@@ -65,11 +65,12 @@ export const KNOWN_PREFERENCE_KEYS = new Set([
     "compression_strategy",
     "context_selection",
     "widget_mode",
+    "reactive_execution",
 ]);
 /** Canonical list of all dispatch unit types. */
 export const KNOWN_UNIT_TYPES = [
     "research-milestone", "plan-milestone", "research-slice", "plan-slice",
-    "execute-task", "complete-slice", "replan-slice", "reassess-roadmap",
+    "execute-task", "reactive-execute", "complete-slice", "replan-slice", "reassess-roadmap",
     "run-uat", "complete-milestone",
 ];
 export const SKILL_ACTIONS = new Set(["use", "prefer", "avoid"]);

package/dist/resources/extensions/gsd/preferences-validation.js

@@ -500,6 +500,48 @@ export function validatePreferences(preferences) {
             validated.parallel = parallel;
         }
     }
+    // ─── Reactive Execution ─────────────────────────────────────────────────
+    if (preferences.reactive_execution !== undefined) {
+        if (typeof preferences.reactive_execution === "object" && preferences.reactive_execution !== null) {
+            const re = preferences.reactive_execution;
+            const validRe = {};
+            if (re.enabled !== undefined) {
+                if (typeof re.enabled === "boolean")
+                    validRe.enabled = re.enabled;
+                else
+                    errors.push("reactive_execution.enabled must be a boolean");
+            }
+            if (re.max_parallel !== undefined) {
+                const mp = typeof re.max_parallel === "number" ? re.max_parallel : Number(re.max_parallel);
+                if (Number.isFinite(mp) && mp >= 1 && mp <= 8) {
+                    validRe.max_parallel = Math.floor(mp);
+                }
+                else {
+                    errors.push("reactive_execution.max_parallel must be a number between 1 and 8");
+                }
+            }
+            if (re.isolation_mode !== undefined) {
+                if (re.isolation_mode === "same-tree") {
+                    validRe.isolation_mode = "same-tree";
+                }
+                else {
+                    errors.push('reactive_execution.isolation_mode must be "same-tree"');
+                }
+            }
+            const knownReKeys = new Set(["enabled", "max_parallel", "isolation_mode"]);
+            for (const key of Object.keys(re)) {
+                if (!knownReKeys.has(key)) {
+                    warnings.push(`unknown reactive_execution key "${key}" — ignored`);
+                }
+            }
+            if (Object.keys(validRe).length > 0) {
+                validated.reactive_execution = validRe;
+            }
+        }
+        else {
+            errors.push("reactive_execution must be an object");
+        }
+    }
     // ─── Verification Preferences ───────────────────────────────────────────
     if (preferences.verification_commands !== undefined) {
         if (Array.isArray(preferences.verification_commands)) {

package/dist/resources/extensions/gsd/prompts/reactive-execute.md

@@ -0,0 +1,41 @@
+# Reactive Task Execution — Parallel Dispatch
+
+**Working directory:** `{{workingDirectory}}`
+**Milestone:** {{milestoneId}} — {{milestoneTitle}}
+**Slice:** {{sliceId}} — {{sliceTitle}}
+
+## Mission
+
+You are executing **multiple tasks in parallel** for this slice. The task graph below shows which tasks are ready for simultaneous execution based on their input/output dependencies.
+
+**Critical rule:** Use the `subagent` tool in **parallel mode** to dispatch all ready tasks simultaneously. Each subagent gets a self-contained execute-task prompt. After all subagents return, verify each task's outputs and write summaries.
+
+## Task Dependency Graph
+
+{{graphContext}}
+
+## Ready Tasks for Parallel Dispatch
+
+{{readyTaskCount}} tasks are ready for parallel execution:
+
+{{readyTaskList}}
+
+## Execution Protocol
+
+1. **Dispatch all ready tasks** using `subagent` in parallel mode. Each subagent prompt is provided below.
+2. **Wait for all subagents** to complete.
+3. **Verify each task's outputs** — check that expected files were created/modified and that verification commands pass.
+4. **Write task summaries** for each completed task using the task-summary template.
+5. **Mark completed tasks** as done in the slice plan (checkbox `[x]`).
+6. **Commit** all changes with a clear message covering the parallel batch.
+
+If any subagent fails:
+- Write a summary for the failed task with `blocker_discovered: true`
+- Continue marking the successful tasks as done
+- The orchestrator will handle re-dispatch on the next iteration
+
+## Subagent Prompts
+
+{{subagentPrompts}}
+
+{{inlinedTemplates}}

package/dist/resources/extensions/gsd/reactive-graph.js

@@ -0,0 +1,227 @@
+/**
+ * Reactive Task Graph — derives dependency edges from task plan IO signatures.
+ *
+ * Pure functions that build a DAG from task IO intersections and resolve
+ * which tasks are currently ready for parallel dispatch. Used by the
+ * reactive-execute dispatch path (ADR-004).
+ *
+ * Graph derivation and resolution functions are pure (no filesystem access).
+ * The `loadSliceTaskIO` loader at the bottom is the only async/IO function.
+ */
+import { loadFile, parsePlan, parseTaskPlanIO } from "./files.js";
+import { resolveTasksDir, resolveTaskFiles } from "./paths.js";
+import { join } from "node:path";
+import { loadJsonFileOrNull, saveJsonFile } from "./json-persistence.js";
+import { existsSync, unlinkSync } from "node:fs";
+// ─── Graph Construction ───────────────────────────────────────────────────
+/**
+ * Build a dependency graph from task IO signatures.
+ *
+ * A task T_b depends on T_a when any of T_b's inputFiles appear in T_a's
+ * outputFiles. Self-references are excluded.
+ *
+ * Tasks are returned in the same order as the input array.
+ */
+export function deriveTaskGraph(tasks) {
+    // Build output → producer lookup
+    const outputToProducer = new Map();
+    for (const task of tasks) {
+        for (const outFile of task.outputFiles) {
+            const existing = outputToProducer.get(outFile);
+            if (existing) {
+                existing.push(task.id);
+            }
+            else {
+                outputToProducer.set(outFile, [task.id]);
+            }
+        }
+    }
+    return tasks.map((task) => {
+        const deps = new Set();
+        for (const inFile of task.inputFiles) {
+            const producers = outputToProducer.get(inFile);
+            if (producers) {
+                for (const pid of producers) {
+                    if (pid !== task.id)
+                        deps.add(pid);
+                }
+            }
+        }
+        return {
+            ...task,
+            dependsOn: [...deps].sort(),
+        };
+    });
+}
+// ─── Ready Set Resolution ─────────────────────────────────────────────────
+/**
+ * Return task IDs whose dependencies are all in `completed`.
+ * Excludes tasks that are already done or in-flight.
+ */
+export function getReadyTasks(graph, completed, inFlight) {
+    return graph
+        .filter((node) => {
+        if (node.done || completed.has(node.id) || inFlight.has(node.id))
+            return false;
+        return node.dependsOn.every((dep) => completed.has(dep));
+    })
+        .map((node) => node.id);
+}
+// ─── Conflict-Free Subset Selection ──────────────────────────────────────
+/**
+ * Greedy selection of non-conflicting tasks up to `maxParallel`.
+ *
+ * Two tasks conflict if they share any outputFile. We also exclude tasks
+ * whose outputs overlap with `inFlightOutputs` (files being written by
+ * tasks currently in progress).
+ */
+export function chooseNonConflictingSubset(readyIds, graph, maxParallel, inFlightOutputs) {
+    const nodeMap = new Map(graph.map((n) => [n.id, n]));
+    const claimed = new Set(inFlightOutputs);
+    const selected = [];
+    for (const id of readyIds) {
+        if (selected.length >= maxParallel)
+            break;
+        const node = nodeMap.get(id);
+        if (!node)
+            continue;
+        // Check for output overlap with already-selected or in-flight
+        const conflicts = node.outputFiles.some((f) => claimed.has(f));
+        if (conflicts)
+            continue;
+        // Claim this task's outputs
+        for (const f of node.outputFiles)
+            claimed.add(f);
+        selected.push(id);
+    }
+    return selected;
+}
+// ─── Graph Quality Checks ─────────────────────────────────────────────────
+/**
+ * Returns true if any incomplete task has 0 inputFiles AND 0 outputFiles.
+ *
+ * An ambiguous graph means IO annotations are too sparse to derive reliable
+ * edges — the dispatcher should fall back to sequential execution.
+ */
+export function isGraphAmbiguous(graph) {
+    return graph.some((node) => !node.done &&
+        node.inputFiles.length === 0 &&
+        node.outputFiles.length === 0);
+}
+/**
+ * Detect deadlock: no tasks are ready and none are in-flight, yet incomplete
+ * tasks remain. This indicates a circular dependency or impossible state.
+ */
+export function detectDeadlock(graph, completed, inFlight) {
+    const incomplete = graph.filter((n) => !n.done && !completed.has(n.id) && !inFlight.has(n.id));
+    if (incomplete.length === 0)
+        return false; // all done
+    if (inFlight.size > 0)
+        return false; // something is running, wait for it
+    // Nothing in flight, but incomplete tasks remain — check if any are ready
+    const ready = getReadyTasks(graph, completed, inFlight);
+    return ready.length === 0;
+}
+// ─── Graph Metrics ────────────────────────────────────────────────────────
+/** Compute summary metrics for logging. */
+export function graphMetrics(graph) {
+    const completed = new Set(graph.filter((n) => n.done).map((n) => n.id));
+    const ready = getReadyTasks(graph, completed, new Set());
+    const edgeCount = graph.reduce((sum, n) => sum + n.dependsOn.length, 0);
+    return {
+        taskCount: graph.length,
+        edgeCount,
+        readySetSize: ready.length,
+        ambiguous: isGraphAmbiguous(graph),
+    };
+}
+// ─── IO Loader (async, filesystem) ────────────────────────────────────────
+/**
+ * Load TaskIO for all tasks in a slice by reading the slice plan (for done
+ * status and task IDs) and individual task plan files (for IO sections).
+ *
+ * Returns [] when the slice plan or tasks directory doesn't exist.
+ */
+export async function loadSliceTaskIO(basePath, mid, sid) {
+    const { resolveSliceFile } = await import("./paths.js");
+    const slicePlanPath = resolveSliceFile(basePath, mid, sid, "PLAN");
+    const planContent = slicePlanPath ? await loadFile(slicePlanPath) : null;
+    if (!planContent)
+        return [];
+    const plan = parsePlan(planContent);
+    const tDir = resolveTasksDir(basePath, mid, sid);
+    if (!tDir)
+        return [];
+    const results = [];
+    for (const taskEntry of plan.tasks) {
+        const planFiles = resolveTaskFiles(tDir, "PLAN");
+        const taskFileName = planFiles.find((f) => f.toUpperCase().startsWith(taskEntry.id.toUpperCase() + "-"));
+        if (!taskFileName) {
+            // Task plan file missing — include with empty IO (will trigger ambiguous)
+            results.push({
+                id: taskEntry.id,
+                title: taskEntry.title,
+                inputFiles: [],
+                outputFiles: [],
+                done: taskEntry.done,
+            });
+            continue;
+        }
+        const taskContent = await loadFile(join(tDir, taskFileName));
+        if (!taskContent) {
+            results.push({
+                id: taskEntry.id,
+                title: taskEntry.title,
+                inputFiles: [],
+                outputFiles: [],
+                done: taskEntry.done,
+            });
+            continue;
+        }
+        const io = parseTaskPlanIO(taskContent);
+        results.push({
+            id: taskEntry.id,
+            title: taskEntry.title,
+            inputFiles: io.inputFiles,
+            outputFiles: io.outputFiles,
+            done: taskEntry.done,
+        });
+    }
+    return results;
+}
+// ─── State Persistence ────────────────────────────────────────────────────
+function reactiveStatePath(basePath, mid, sid) {
+    return join(basePath, ".gsd", "runtime", `${mid}-${sid}-reactive.json`);
+}
+function isReactiveState(data) {
+    if (!data || typeof data !== "object")
+        return false;
+    const d = data;
+    return typeof d.sliceId === "string" && Array.isArray(d.completed);
+}
+/**
+ * Load persisted reactive execution state for a slice.
+ * Returns null when no state file exists or the file is invalid.
+ */
+export function loadReactiveState(basePath, mid, sid) {
+    return loadJsonFileOrNull(reactiveStatePath(basePath, mid, sid), isReactiveState);
+}
+/**
+ * Save reactive execution state to disk.
+ */
+export function saveReactiveState(basePath, mid, sid, state) {
+    saveJsonFile(reactiveStatePath(basePath, mid, sid), state);
+}
+/**
+ * Remove the reactive state file when a slice completes.
+ */
+export function clearReactiveState(basePath, mid, sid) {
+    const path = reactiveStatePath(basePath, mid, sid);
+    try {
+        if (existsSync(path))
+            unlinkSync(path);
+    }
+    catch {
+        // Non-fatal
+    }
+}

package/dist/resources/extensions/gsd/session-lock.js

@@ -320,7 +320,7 @@ export function updateSessionLock(basePath, unitType, unitId, completedUnits, se
  *
  * This is called periodically during the dispatch loop.
  */
-export function validateSessionLock(basePath) {
+export function getSessionLockStatus(basePath) {
     // Lock was compromised by proper-lockfile (mtime drift from sleep, stall, etc.)
     if (_lockCompromised) {
         // Recovery gate (#1512): Before declaring the lock lost, check if the lock
@@ -335,27 +335,47 @@ export function validateSessionLock(basePath) {
                 const result = acquireSessionLock(basePath);
                 if (result.acquired) {
                     process.stderr.write(`[gsd] Lock recovered after onCompromised — lock file PID matched, re-acquired.\n`);
-                    return true;
+                    return { valid: true, recovered: true };
                 }
             }
             catch {
                 // Re-acquisition failed — fall through to return false
             }
         }
-        return false;
+        return {
+            valid: false,
+            failureReason: "compromised",
+            existingPid: existing?.pid,
+            expectedPid: process.pid,
+        };
     }
     // If we have an OS-level lock, we're still the owner
     if (_releaseFunction && _lockedPath === basePath) {
-        return true;
+        return { valid: true };
     }
     // Fallback: check the lock file PID
     const lp = lockPath(basePath);
     const existing = readExistingLockData(lp);
     if (!existing) {
         // Lock file was deleted — we lost ownership
-        return false;
+        return {
+            valid: false,
+            failureReason: "missing-metadata",
+            expectedPid: process.pid,
+        };
+    }
+    if (existing.pid !== process.pid) {
+        return {
+            valid: false,
+            failureReason: "pid-mismatch",
+            existingPid: existing.pid,
+            expectedPid: process.pid,
+        };
     }
-    return existing.pid === process.pid;
+    return { valid: true };
+}
+export function validateSessionLock(basePath) {
+    return getSessionLockStatus(basePath).valid;
 }
 /**
  * Release the session lock. Called on clean stop/pause.

package/dist/resources/extensions/shared/format-utils.js

@@ -1,10 +1,11 @@
 /**
- * Shared formatting and layout utilities for TUI dashboard components.
+ * Shared pure formatting utilities — no @gsd/pi-tui dependency.
  *
- * Consolidates helpers that were previously duplicated across
- * auto-dashboard.ts, dashboard-overlay.ts, and visualizer-views.ts.
+ * ANSI-aware layout helpers (padRight, joinColumns, centerLine, fitColumns)
+ * live in layout-utils.ts to avoid pulling @gsd/pi-tui into modules that
+ * run outside jiti's alias resolution (e.g. HTML report generation via
+ * dynamic import in auto-loop).
  */
-import { truncateToWidth, visibleWidth } from "@gsd/pi-tui";
 // ─── Duration Formatting ──────────────────────────────────────────────────────
 /** Format a millisecond duration as a compact human-readable string. */
 export function formatDuration(ms) {
@@ -30,43 +31,6 @@ export function formatTokenCount(count) {
         return `${(count / 1000).toFixed(1)}k`;
     return `${(count / 1_000_000).toFixed(2)}M`;
 }
-// ─── Layout Helpers ───────────────────────────────────────────────────────────
-/** Pad a string with trailing spaces to fill `width` (ANSI-aware). */
-export function padRight(content, width) {
-    const vis = visibleWidth(content);
-    return content + " ".repeat(Math.max(0, width - vis));
-}
-/** Build a line with left-aligned and right-aligned content. */
-export function joinColumns(left, right, width) {
-    const leftW = visibleWidth(left);
-    const rightW = visibleWidth(right);
-    if (leftW + rightW + 2 > width) {
-        return truncateToWidth(`${left}  ${right}`, width);
-    }
-    return left + " ".repeat(width - leftW - rightW) + right;
-}
-/** Center content within `width` (ANSI-aware). */
-export function centerLine(content, width) {
-    const vis = visibleWidth(content);
-    if (vis >= width)
-        return truncateToWidth(content, width);
-    const leftPad = Math.floor((width - vis) / 2);
-    return " ".repeat(leftPad) + content;
-}
-/** Join as many parts as fit within `width`, separated by `separator`. */
-export function fitColumns(parts, width, separator = "  ") {
-    const filtered = parts.filter(Boolean);
-    if (filtered.length === 0)
-        return "";
-    let result = filtered[0];
-    for (let i = 1; i < filtered.length; i++) {
-        const candidate = `${result}${separator}${filtered[i]}`;
-        if (visibleWidth(candidate) > width)
-            break;
-        result = candidate;
-    }
-    return truncateToWidth(result, width);
-}
 // ─── Text Truncation ─────────────────────────────────────────────────────────
 /** Truncate a string to `maxLength` characters, replacing the last character with an ellipsis if needed. */
 export function truncateWithEllipsis(text, maxLength) {

package/dist/resources/extensions/shared/layout-utils.js

@@ -0,0 +1,46 @@
+/**
+ * ANSI-aware TUI layout utilities that depend on @gsd/pi-tui.
+ *
+ * Separated from format-utils.ts so that modules needing only pure
+ * formatting (e.g. HTML report generation) can import format-utils
+ * without pulling in the @gsd/pi-tui dependency — which fails when
+ * loaded outside jiti's alias resolution context.
+ */
+import { truncateToWidth, visibleWidth } from "@gsd/pi-tui";
+// ─── Layout Helpers ───────────────────────────────────────────────────────────
+/** Pad a string with trailing spaces to fill `width` (ANSI-aware). */
+export function padRight(content, width) {
+    const vis = visibleWidth(content);
+    return content + " ".repeat(Math.max(0, width - vis));
+}
+/** Build a line with left-aligned and right-aligned content. */
+export function joinColumns(left, right, width) {
+    const leftW = visibleWidth(left);
+    const rightW = visibleWidth(right);
+    if (leftW + rightW + 2 > width) {
+        return truncateToWidth(`${left}  ${right}`, width);
+    }
+    return left + " ".repeat(width - leftW - rightW) + right;
+}
+/** Center content within `width` (ANSI-aware). */
+export function centerLine(content, width) {
+    const vis = visibleWidth(content);
+    if (vis >= width)
+        return truncateToWidth(content, width);
+    const leftPad = Math.floor((width - vis) / 2);
+    return " ".repeat(leftPad) + content;
+}
+/** Join as many parts as fit within `width`, separated by `separator`. */
+export function fitColumns(parts, width, separator = "  ") {
+    const filtered = parts.filter(Boolean);
+    if (filtered.length === 0)
+        return "";
+    let result = filtered[0];
+    for (let i = 1; i < filtered.length; i++) {
+        const candidate = `${result}${separator}${filtered[i]}`;
+        if (visibleWidth(candidate) > width)
+            break;
+        result = candidate;
+    }
+    return truncateToWidth(result, width);
+}

package/dist/resources/extensions/shared/mod.js

@@ -1,6 +1,7 @@
 // Barrel file — re-exports consumed by external modules
 export { makeUI, GLYPH, INDENT, STATUS_GLYPH, STATUS_COLOR, } from "./ui.js";
-export { stripAnsi, formatTokenCount, formatDuration, padRight, joinColumns, centerLine, fitColumns, sparkline, normalizeStringArray, fileLink, } from "./format-utils.js";
+export { stripAnsi, formatTokenCount, formatDuration, sparkline, normalizeStringArray, fileLink, } from "./format-utils.js";
+export { padRight, joinColumns, centerLine, fitColumns, } from "./layout-utils.js";
 export { shortcutDesc } from "./terminal.js";
 export { toPosixPath } from "./path-display.js";
 export { showInterviewRound } from "./interview-ui.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-pi",
-  "version": "2.37.0",
+  "version": "2.37.1-dev.49503be",
   "description": "GSD — Get Shit Done coding agent",
   "license": "MIT",
   "repository": {
@@ -84,6 +84,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.73.0",
+    "@anthropic-ai/vertex-sdk": "^0.14.4",
     "@aws-sdk/client-bedrock-runtime": "^3.983.0",
     "@clack/prompts": "^1.1.0",
     "@google/genai": "^1.40.0",

package/packages/pi-ai/dist/env-api-keys.js

@@ -53,6 +53,19 @@ export function getEnvApiKey(provider) {
     if (provider === "anthropic") {
         return process.env.ANTHROPIC_OAUTH_TOKEN || process.env.ANTHROPIC_API_KEY;
     }
+    // Anthropic on Vertex AI uses Application Default Credentials.
+    // Detected via ANTHROPIC_VERTEX_PROJECT_ID (same env var as Claude Code).
+    if (provider === "anthropic-vertex") {
+        const hasProject = !!process.env.ANTHROPIC_VERTEX_PROJECT_ID;
+        if (hasProject) {
+            return "<authenticated>";
+        }
+        // Fall back to Google Cloud project env vars
+        const hasGoogleProject = !!(process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT);
+        if (hasGoogleProject && hasVertexAdcCredentials()) {
+            return "<authenticated>";
+        }
+    }
     // Vertex AI uses Application Default Credentials, not API keys.
     // Auth is configured via `gcloud auth application-default login`.
     if (provider === "google-vertex") {

package/packages/pi-ai/dist/env-api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-api-keys.js","sourceRoot":"","sources":["../src/env-api-keys.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,IAAI,WAAW,GAA+C,IAAI,CAAC;AACnE,IAAI,QAAQ,GAA4C,IAAI,CAAC;AAC7D,IAAI,KAAK,GAA2C,IAAI,CAAC;AAIzD,MAAM,aAAa,GAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACtE,MAAM,iBAAiB,GAAG,OAAO,GAAG,IAAI,CAAC;AACzC,MAAM,iBAAiB,GAAG,OAAO,GAAG,IAAI,CAAC;AACzC,MAAM,mBAAmB,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,+CAA+C;AAC/C,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACzF,aAAa,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,WAAW,GAAI,CAA8B,CAAC,UAAU,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,aAAa,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,QAAQ,GAAI,CAA8B,CAAC,OAAO,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,aAAa,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7C,KAAK,GAAI,CAAgC,CAAC,IAAI,CAAC;IAChD,CAAC,CAAC,CAAC;AACJ,CAAC;AAID,IAAI,gCAAgC,GAAmB,IAAI,CAAC;AAE5D,SAAS,uBAAuB;IAC/B,IAAI,gCAAgC,KAAK,IAAI,EAAE,CAAC;QAC/C,qEAAqE;QACrE,4EAA4E;QAC5E,qFAAqF;QACrF,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACnG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,8DAA8D;gBAC9D,gCAAgC,GAAG,KAAK,CAAC;YAC1C,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACb,gCAAgC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,kDAAkD;YAClD,gCAAgC,GAAG,WAAW,CAC7C,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,sCAAsC,CAAC,CAC9E,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,gCAAgC,CAAC;AACzC,CAAC;AASD,MAAM,UAAU,YAAY,CAAC,QAAa;IACzC,qCAAqC;IACrC,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7F,CAAC;IAED,gEAAgE;IAChE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3E,CAAC;IAED,gEAAgE;IAChE,kEAAkE;IAClE,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,uBAAuB,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAExD,IAAI,cAAc,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;YACjD,OAAO,iBAAiB,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACnC,uDAAuD;QACvD,yDAAyD;QACzD,mEAAmE;QACnE,gEAAgE;QAChE,6DAA6D;QAC7D,oEAAoE;QACpE,yEAAyE;QACzE,IACC,OAAO,CAAC,GAAG,CAAC,WAAW;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,sCAAsC;YAClD,OAAO,CAAC,GAAG,CAAC,kCAAkC;YAC9C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EACtC,CAAC;YACF,OAAO,iBAAiB,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAA2B;QACtC,MAAM,EAAE,gBAAgB;QACxB,wBAAwB,EAAE,sBAAsB;QAChD,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;QAC5B,GAAG,EAAE,aAAa;QAClB,UAAU,EAAE,oBAAoB;QAChC,mBAAmB,EAAE,oBAAoB;QACzC,GAAG,EAAE,aAAa;QAClB,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,iBAAiB;QAC1B,YAAY,EAAE,oBAAoB;QAClC,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,kBAAkB;QAC5B,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,cAAc;QAC7B,qBAAqB,EAAE,iBAAiB;QACxC,cAAc,EAAE,gBAAgB;QAChC,eAAe,EAAE,uBAAuB;KACxC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC","sourcesContent":["// NEVER convert to top-level imports - breaks browser/Vite builds (web-ui)\nlet _existsSync: typeof import(\"node:fs\").existsSync | null = null;\nlet _homedir: typeof import(\"node:os\").homedir | null = null;\nlet _join: typeof import(\"node:path\").join | null = null;\n\ntype DynamicImport = (specifier: string) => Promise<unknown>;\n\nconst dynamicImport: DynamicImport = (specifier) => import(specifier);\nconst NODE_FS_SPECIFIER = \"node:\" + \"fs\";\nconst NODE_OS_SPECIFIER = \"node:\" + \"os\";\nconst NODE_PATH_SPECIFIER = \"node:\" + \"path\";\n\n// Eagerly load in Node.js/Bun environment only\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\tdynamicImport(NODE_FS_SPECIFIER).then((m) => {\n\t\t_existsSync = (m as typeof import(\"node:fs\")).existsSync;\n\t});\n\tdynamicImport(NODE_OS_SPECIFIER).then((m) => {\n\t\t_homedir = (m as typeof import(\"node:os\")).homedir;\n\t});\n\tdynamicImport(NODE_PATH_SPECIFIER).then((m) => {\n\t\t_join = (m as typeof import(\"node:path\")).join;\n\t});\n}\n\nimport type { KnownProvider } from \"./types.js\";\n\nlet cachedVertexAdcCredentialsExists: boolean | null = null;\n\nfunction hasVertexAdcCredentials(): boolean {\n\tif (cachedVertexAdcCredentialsExists === null) {\n\t\t// If node modules haven't loaded yet (async import race at startup),\n\t\t// return false WITHOUT caching so the next call retries once they're ready.\n\t\t// Only cache false permanently in a browser environment where fs is never available.\n\t\tif (!_existsSync || !_homedir || !_join) {\n\t\t\tconst isNode = typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun);\n\t\t\tif (!isNode) {\n\t\t\t\t// Definitively in a browser — safe to cache false permanently\n\t\t\t\tcachedVertexAdcCredentialsExists = false;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\n\t\t// Check GOOGLE_APPLICATION_CREDENTIALS env var first (standard way)\n\t\tconst gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;\n\t\tif (gacPath) {\n\t\t\tcachedVertexAdcCredentialsExists = _existsSync(gacPath);\n\t\t} else {\n\t\t\t// Fall back to default ADC path (lazy evaluation)\n\t\t\tcachedVertexAdcCredentialsExists = _existsSync(\n\t\t\t\t_join(_homedir(), \".config\", \"gcloud\", \"application_default_credentials.json\"),\n\t\t\t);\n\t\t}\n\t}\n\treturn cachedVertexAdcCredentialsExists;\n}\n\n/**\n * Get API key for provider from known environment variables, e.g. OPENAI_API_KEY.\n *\n * Will not return API keys for providers that require OAuth tokens.\n */\nexport function getEnvApiKey(provider: KnownProvider): string | undefined;\nexport function getEnvApiKey(provider: string): string | undefined;\nexport function getEnvApiKey(provider: any): string | undefined {\n\t// Fall back to environment variables\n\tif (provider === \"github-copilot\") {\n\t\treturn process.env.COPILOT_GITHUB_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN;\n\t}\n\n\t// ANTHROPIC_OAUTH_TOKEN takes precedence over ANTHROPIC_API_KEY\n\tif (provider === \"anthropic\") {\n\t\treturn process.env.ANTHROPIC_OAUTH_TOKEN || process.env.ANTHROPIC_API_KEY;\n\t}\n\n\t// Vertex AI uses Application Default Credentials, not API keys.\n\t// Auth is configured via `gcloud auth application-default login`.\n\tif (provider === \"google-vertex\") {\n\t\tconst hasCredentials = hasVertexAdcCredentials();\n\t\tconst hasProject = !!(process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT);\n\t\tconst hasLocation = !!process.env.GOOGLE_CLOUD_LOCATION;\n\n\t\tif (hasCredentials && hasProject && hasLocation) {\n\t\t\treturn \"<authenticated>\";\n\t\t}\n\t}\n\n\tif (provider === \"amazon-bedrock\") {\n\t\t// Amazon Bedrock supports multiple credential sources:\n\t\t// 1. AWS_PROFILE - named profile from ~/.aws/credentials\n\t\t// 2. AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - standard IAM keys\n\t\t// 3. AWS_BEARER_TOKEN_BEDROCK - Bedrock API keys (bearer token)\n\t\t// 4. AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task roles\n\t\t// 5. AWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI)\n\t\t// 6. AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts)\n\t\tif (\n\t\t\tprocess.env.AWS_PROFILE ||\n\t\t\t(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) ||\n\t\t\tprocess.env.AWS_BEARER_TOKEN_BEDROCK ||\n\t\t\tprocess.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ||\n\t\t\tprocess.env.AWS_CONTAINER_CREDENTIALS_FULL_URI ||\n\t\t\tprocess.env.AWS_WEB_IDENTITY_TOKEN_FILE\n\t\t) {\n\t\t\treturn \"<authenticated>\";\n\t\t}\n\t}\n\n\tconst envMap: Record<string, string> = {\n\t\topenai: \"OPENAI_API_KEY\",\n\t\t\"azure-openai-responses\": \"AZURE_OPENAI_API_KEY\",\n\t\tgoogle: \"GEMINI_API_KEY\",\n\t\tgroq: \"GROQ_API_KEY\",\n\t\tcerebras: \"CEREBRAS_API_KEY\",\n\t\txai: \"XAI_API_KEY\",\n\t\topenrouter: \"OPENROUTER_API_KEY\",\n\t\t\"vercel-ai-gateway\": \"AI_GATEWAY_API_KEY\",\n\t\tzai: \"ZAI_API_KEY\",\n\t\tmistral: \"MISTRAL_API_KEY\",\n\t\tminimax: \"MINIMAX_API_KEY\",\n\t\t\"minimax-cn\": \"MINIMAX_CN_API_KEY\",\n\t\thuggingface: \"HF_TOKEN\",\n\t\topencode: \"OPENCODE_API_KEY\",\n\t\t\"opencode-go\": \"OPENCODE_API_KEY\",\n\t\t\"kimi-coding\": \"KIMI_API_KEY\",\n\t\t\"alibaba-coding-plan\": \"ALIBABA_API_KEY\",\n\t\t\"ollama-cloud\": \"OLLAMA_API_KEY\",\n\t\t\"custom-openai\": \"CUSTOM_OPENAI_API_KEY\",\n\t};\n\n\tconst envVar = envMap[provider];\n\treturn envVar ? process.env[envVar] : undefined;\n}\n"]}
+{"version":3,"file":"env-api-keys.js","sourceRoot":"","sources":["../src/env-api-keys.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,IAAI,WAAW,GAA+C,IAAI,CAAC;AACnE,IAAI,QAAQ,GAA4C,IAAI,CAAC;AAC7D,IAAI,KAAK,GAA2C,IAAI,CAAC;AAIzD,MAAM,aAAa,GAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACtE,MAAM,iBAAiB,GAAG,OAAO,GAAG,IAAI,CAAC;AACzC,MAAM,iBAAiB,GAAG,OAAO,GAAG,IAAI,CAAC;AACzC,MAAM,mBAAmB,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7C,+CAA+C;AAC/C,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACzF,aAAa,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,WAAW,GAAI,CAA8B,CAAC,UAAU,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,aAAa,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,QAAQ,GAAI,CAA8B,CAAC,OAAO,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,aAAa,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7C,KAAK,GAAI,CAAgC,CAAC,IAAI,CAAC;IAChD,CAAC,CAAC,CAAC;AACJ,CAAC;AAID,IAAI,gCAAgC,GAAmB,IAAI,CAAC;AAE5D,SAAS,uBAAuB;IAC/B,IAAI,gCAAgC,KAAK,IAAI,EAAE,CAAC;QAC/C,qEAAqE;QACrE,4EAA4E;QAC5E,qFAAqF;QACrF,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACnG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,8DAA8D;gBAC9D,gCAAgC,GAAG,KAAK,CAAC;YAC1C,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACb,gCAAgC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,kDAAkD;YAClD,gCAAgC,GAAG,WAAW,CAC7C,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,sCAAsC,CAAC,CAC9E,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,gCAAgC,CAAC;AACzC,CAAC;AASD,MAAM,UAAU,YAAY,CAAC,QAAa;IACzC,qCAAqC;IACrC,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7F,CAAC;IAED,gEAAgE;IAChE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3E,CAAC;IAED,+DAA+D;IAC/D,0EAA0E;IAC1E,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC7D,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,iBAAiB,CAAC;QAC1B,CAAC;QACD,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5F,IAAI,gBAAgB,IAAI,uBAAuB,EAAE,EAAE,CAAC;YACnD,OAAO,iBAAiB,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,gEAAgE;IAChE,kEAAkE;IAClE,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,uBAAuB,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAExD,IAAI,cAAc,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;YACjD,OAAO,iBAAiB,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACnC,uDAAuD;QACvD,yDAAyD;QACzD,mEAAmE;QACnE,gEAAgE;QAChE,6DAA6D;QAC7D,oEAAoE;QACpE,yEAAyE;QACzE,IACC,OAAO,CAAC,GAAG,CAAC,WAAW;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,sCAAsC;YAClD,OAAO,CAAC,GAAG,CAAC,kCAAkC;YAC9C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EACtC,CAAC;YACF,OAAO,iBAAiB,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAA2B;QACtC,MAAM,EAAE,gBAAgB;QACxB,wBAAwB,EAAE,sBAAsB;QAChD,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;QAC5B,GAAG,EAAE,aAAa;QAClB,UAAU,EAAE,oBAAoB;QAChC,mBAAmB,EAAE,oBAAoB;QACzC,GAAG,EAAE,aAAa;QAClB,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,iBAAiB;QAC1B,YAAY,EAAE,oBAAoB;QAClC,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,kBAAkB;QAC5B,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,cAAc;QAC7B,qBAAqB,EAAE,iBAAiB;QACxC,cAAc,EAAE,gBAAgB;QAChC,eAAe,EAAE,uBAAuB;KACxC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC","sourcesContent":["// NEVER convert to top-level imports - breaks browser/Vite builds (web-ui)\nlet _existsSync: typeof import(\"node:fs\").existsSync | null = null;\nlet _homedir: typeof import(\"node:os\").homedir | null = null;\nlet _join: typeof import(\"node:path\").join | null = null;\n\ntype DynamicImport = (specifier: string) => Promise<unknown>;\n\nconst dynamicImport: DynamicImport = (specifier) => import(specifier);\nconst NODE_FS_SPECIFIER = \"node:\" + \"fs\";\nconst NODE_OS_SPECIFIER = \"node:\" + \"os\";\nconst NODE_PATH_SPECIFIER = \"node:\" + \"path\";\n\n// Eagerly load in Node.js/Bun environment only\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\tdynamicImport(NODE_FS_SPECIFIER).then((m) => {\n\t\t_existsSync = (m as typeof import(\"node:fs\")).existsSync;\n\t});\n\tdynamicImport(NODE_OS_SPECIFIER).then((m) => {\n\t\t_homedir = (m as typeof import(\"node:os\")).homedir;\n\t});\n\tdynamicImport(NODE_PATH_SPECIFIER).then((m) => {\n\t\t_join = (m as typeof import(\"node:path\")).join;\n\t});\n}\n\nimport type { KnownProvider } from \"./types.js\";\n\nlet cachedVertexAdcCredentialsExists: boolean | null = null;\n\nfunction hasVertexAdcCredentials(): boolean {\n\tif (cachedVertexAdcCredentialsExists === null) {\n\t\t// If node modules haven't loaded yet (async import race at startup),\n\t\t// return false WITHOUT caching so the next call retries once they're ready.\n\t\t// Only cache false permanently in a browser environment where fs is never available.\n\t\tif (!_existsSync || !_homedir || !_join) {\n\t\t\tconst isNode = typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun);\n\t\t\tif (!isNode) {\n\t\t\t\t// Definitively in a browser — safe to cache false permanently\n\t\t\t\tcachedVertexAdcCredentialsExists = false;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\n\t\t// Check GOOGLE_APPLICATION_CREDENTIALS env var first (standard way)\n\t\tconst gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;\n\t\tif (gacPath) {\n\t\t\tcachedVertexAdcCredentialsExists = _existsSync(gacPath);\n\t\t} else {\n\t\t\t// Fall back to default ADC path (lazy evaluation)\n\t\t\tcachedVertexAdcCredentialsExists = _existsSync(\n\t\t\t\t_join(_homedir(), \".config\", \"gcloud\", \"application_default_credentials.json\"),\n\t\t\t);\n\t\t}\n\t}\n\treturn cachedVertexAdcCredentialsExists;\n}\n\n/**\n * Get API key for provider from known environment variables, e.g. OPENAI_API_KEY.\n *\n * Will not return API keys for providers that require OAuth tokens.\n */\nexport function getEnvApiKey(provider: KnownProvider): string | undefined;\nexport function getEnvApiKey(provider: string): string | undefined;\nexport function getEnvApiKey(provider: any): string | undefined {\n\t// Fall back to environment variables\n\tif (provider === \"github-copilot\") {\n\t\treturn process.env.COPILOT_GITHUB_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN;\n\t}\n\n\t// ANTHROPIC_OAUTH_TOKEN takes precedence over ANTHROPIC_API_KEY\n\tif (provider === \"anthropic\") {\n\t\treturn process.env.ANTHROPIC_OAUTH_TOKEN || process.env.ANTHROPIC_API_KEY;\n\t}\n\n\t// Anthropic on Vertex AI uses Application Default Credentials.\n\t// Detected via ANTHROPIC_VERTEX_PROJECT_ID (same env var as Claude Code).\n\tif (provider === \"anthropic-vertex\") {\n\t\tconst hasProject = !!process.env.ANTHROPIC_VERTEX_PROJECT_ID;\n\t\tif (hasProject) {\n\t\t\treturn \"<authenticated>\";\n\t\t}\n\t\t// Fall back to Google Cloud project env vars\n\t\tconst hasGoogleProject = !!(process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT);\n\t\tif (hasGoogleProject && hasVertexAdcCredentials()) {\n\t\t\treturn \"<authenticated>\";\n\t\t}\n\t}\n\n\t// Vertex AI uses Application Default Credentials, not API keys.\n\t// Auth is configured via `gcloud auth application-default login`.\n\tif (provider === \"google-vertex\") {\n\t\tconst hasCredentials = hasVertexAdcCredentials();\n\t\tconst hasProject = !!(process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT);\n\t\tconst hasLocation = !!process.env.GOOGLE_CLOUD_LOCATION;\n\n\t\tif (hasCredentials && hasProject && hasLocation) {\n\t\t\treturn \"<authenticated>\";\n\t\t}\n\t}\n\n\tif (provider === \"amazon-bedrock\") {\n\t\t// Amazon Bedrock supports multiple credential sources:\n\t\t// 1. AWS_PROFILE - named profile from ~/.aws/credentials\n\t\t// 2. AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - standard IAM keys\n\t\t// 3. AWS_BEARER_TOKEN_BEDROCK - Bedrock API keys (bearer token)\n\t\t// 4. AWS_CONTAINER_CREDENTIALS_RELATIVE_URI - ECS task roles\n\t\t// 5. AWS_CONTAINER_CREDENTIALS_FULL_URI - ECS task roles (full URI)\n\t\t// 6. AWS_WEB_IDENTITY_TOKEN_FILE - IRSA (IAM Roles for Service Accounts)\n\t\tif (\n\t\t\tprocess.env.AWS_PROFILE ||\n\t\t\t(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) ||\n\t\t\tprocess.env.AWS_BEARER_TOKEN_BEDROCK ||\n\t\t\tprocess.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ||\n\t\t\tprocess.env.AWS_CONTAINER_CREDENTIALS_FULL_URI ||\n\t\t\tprocess.env.AWS_WEB_IDENTITY_TOKEN_FILE\n\t\t) {\n\t\t\treturn \"<authenticated>\";\n\t\t}\n\t}\n\n\tconst envMap: Record<string, string> = {\n\t\topenai: \"OPENAI_API_KEY\",\n\t\t\"azure-openai-responses\": \"AZURE_OPENAI_API_KEY\",\n\t\tgoogle: \"GEMINI_API_KEY\",\n\t\tgroq: \"GROQ_API_KEY\",\n\t\tcerebras: \"CEREBRAS_API_KEY\",\n\t\txai: \"XAI_API_KEY\",\n\t\topenrouter: \"OPENROUTER_API_KEY\",\n\t\t\"vercel-ai-gateway\": \"AI_GATEWAY_API_KEY\",\n\t\tzai: \"ZAI_API_KEY\",\n\t\tmistral: \"MISTRAL_API_KEY\",\n\t\tminimax: \"MINIMAX_API_KEY\",\n\t\t\"minimax-cn\": \"MINIMAX_CN_API_KEY\",\n\t\thuggingface: \"HF_TOKEN\",\n\t\topencode: \"OPENCODE_API_KEY\",\n\t\t\"opencode-go\": \"OPENCODE_API_KEY\",\n\t\t\"kimi-coding\": \"KIMI_API_KEY\",\n\t\t\"alibaba-coding-plan\": \"ALIBABA_API_KEY\",\n\t\t\"ollama-cloud\": \"OLLAMA_API_KEY\",\n\t\t\"custom-openai\": \"CUSTOM_OPENAI_API_KEY\",\n\t};\n\n\tconst envVar = envMap[provider];\n\treturn envVar ? process.env[envVar] : undefined;\n}\n"]}