larkin 0.4.29 → 0.5.0

package/dist/setup/setup-bind.mjs

@@ -9,12 +9,8 @@ import { fileURLToPath } from "node:url";
 import { isWindows } from "../platform/secure-metadata.mjs";
 import { TargetRootLayout } from "../platform/root-layout.mjs";
 import { planSingleRootBinding } from "./setup-binding.mjs";
-import { configureBuiltinPiProviderModel, piAgentDirectory } from "../runtime/pi-provider-config.mjs";
-import { applyPiProfileMigration, clearStalePiProfileMigrationLock, preparePiProfileMigration, releasePiProfileMigrationLock, rollbackPiProfileMigration, } from "../runtime/pi-profile-migration.mjs";
 import { discoverPiModelCatalog } from "../runtime/pi-model-catalog.mjs";
 import { calculatePiCompactionSettings } from "../runtime/pi-compaction-recovery.mjs";
-import { terminalSetupQuestioner } from "./setup-agent-choice.mjs";
-import { beginBuiltinPiCredentialTransaction, createOfficialPiAuthInteraction, createOfficialPiModelRuntime, runOfficialPiLogin, verifyOfficialPiProviderTurn, } from "../runtime/pi-official-auth.mjs";
 import * as larkinConfigImport from "../platform/config.mjs";
 import { resolveOfficialLarkCli } from "../app/official-lark-cli.mjs";
 import { loadValidatedBotCredential } from "./run-credential-preflight.mjs";
@@ -36,6 +32,7 @@ const options = {
     agent: flag("--agent"),
     profile: flag("--profile"),
     runtime: flag("--runtime"),
+    model: flag("--model"),
     selectionFile: flag("--selection-file"),
     yes: has("--yes"),
     list: has("--list"),
@@ -69,12 +66,6 @@ function larkJson(args) {
         return { ok: false, json: null, raw: stdout, err: stderr || stdout };
     }
 }
-function openAuthUrl(url) {
-    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32.exe" : "xdg-open";
-    const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
-    const result = spawnSync(command, args, { stdio: "ignore", timeout: 5_000 });
-    return result.status === 0;
-}
 function listProfilesFromEnv(env) {
     const official = resolveOfficialLarkCli({ env });
     const result = spawnSync(official.command, [...official.argsPrefix, "profile", "list"], { encoding: "utf8", env });
@@ -176,9 +167,10 @@ function readSetupSelection(fileArg) {
     const bytes = fs.readFileSync(file, "utf8");
     fs.unlinkSync(file);
     const raw = JSON.parse(bytes);
-    if (!raw || !["pi", "codex", "claude"].includes(raw.runtime))
-        die("setup Agent 选择无效");
-    return raw;
+    const runtime = raw?.runtime;
+    if (runtime === "pi" || runtime === "codex" || runtime === "claude")
+        return { runtime };
+    return die("setup Agent 选择无效");
 }
 function fabricateAttachment(root, serverId) {
     const directory = path.join(root, "computer", "servers", serverId);
@@ -208,12 +200,9 @@ function formatExternalPiSetupFailure(error, options) {
     const original = (error instanceof Error ? error.message : String(error)).replace(/[\r\n]+/g, " ").trim();
     const alternatives = catalogModelsFromError(error);
     const parts = [];
-    if (/external Pi (?:auth\.json|models\.json|settings\.json) is required|external Pi profile|external Pi auth\.json has an unsafe mode|external Pi models\.json has an unsafe mode|external Pi settings\.json has an unsafe mode/.test(original)) {
-        parts.push("pi requires the official file-backed Pi profile containing auth.json (0600), models.json, and settings.json, normally after `pi` login and default-model selection. Environment-variable-only credentials are unsupported.");
-    }
     if (original)
         parts.push(original);
-    parts.push("Fix the official `pi` login and default model, then rerun `larkin setup --runtime pi`.");
+    parts.push("Run the official `pi` login flow, then retry `larkin setup --runtime pi`.");
     if (options.agentExisted) {
         parts.push("This Agent already exists; after a successful setup you can switch models with `larkin model <provider>/<model>`.");
     }
@@ -222,19 +211,6 @@ function formatExternalPiSetupFailure(error, options) {
     }
     return parts.join(" ");
 }
-function safeProviderFailure(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (/\b(?:401|403)\b|unauth|invalid.*(?:key|token)|credential/i.test(message)) {
-        return new Error("内置 Pi provider 拒绝认证（401/403）；请重新登录或检查 credential");
-    }
-    if (/timeout|超时|ETIMEDOUT/i.test(message))
-        return new Error("内置 Pi provider readiness 超时；请检查网络和 endpoint");
-    if (/ENOTFOUND|ECONN|fetch failed|network|TLS/i.test(message))
-        return new Error("内置 Pi provider endpoint 不可达；请检查网络、TLS 和 Base URL");
-    if (/model|模型/i.test(message))
-        return new Error("内置 Pi provider 不接受所选模型；请检查 provider/model");
-    return new Error("内置 Pi provider readiness 失败；credential/config 已回滚，请检查 provider 状态后重试");
-}
 function printAgents(config) {
     const names = Object.keys(config.agents);
     if (!names.length) {
@@ -248,9 +224,6 @@ function printAgents(config) {
     }
 }
 export async function main() {
-    if (has("--model")) {
-        die("setup 不支持配置 model；请用 larkin model <id> 单独切换（bun run model -- <id>，带合法值校验）");
-    }
     if (options.help) {
         say(`larkin setup（内部绑定阶段）
 
@@ -260,13 +233,14 @@ export async function main() {
 参数（都可省略；单 bot 单 agent 场景零参数即可）:
   --agent <App ID>     必须与所选 profile 的 App ID 一致；缺省自动使用该 App ID
   --profile <name>     复用已有 lark-cli profile（可用 profile 名或 appId；缺省交互选择）
-  --runtime <runtime>  pi / codex / claude；缺省沿用已有 agent 的 runtime，全新 agent 默认 pi
+  --runtime <runtime>  pi / codex / claude；缺省沿用已有 agent 的 runtime
+  --model <id>         可选；按 runtime 目录校验后写入。省略则沿用已有值或 runtime 默认
   --yes                非交互接受默认项
   --list               查看已经配置的 Agent
   --help               显示帮助
 
 普通用户请直接运行 larkin setup；该内部阶段只负责绑定已取得的凭证。
-模型不在 setup 配置：沿用已有值（换 runtime 时重置为该 runtime 默认），切换用 larkin model <id>。`);
+省略 --model 时沿用已有值（换 runtime 时重置为该 runtime 默认）；也可用 larkin model <id> 事后切换。`);
         return;
     }
     const loaded = loadConfig();
@@ -287,66 +261,55 @@ export async function main() {
         verifyBot(profile);
     const requestedAgent = options.agent || profile.appId;
     const prior = config.agents[profile.appId];
-    const runtime = selection?.runtime || options.runtime || prior?.runtime || "pi";
-    const piDistribution = runtime === "pi"
-        ? (selection?.runtime === "pi" ? selection.distribution : prior?.piDistribution || "external")
-        : undefined;
+    const runtime = selection?.runtime || options.runtime || prior?.runtime;
+    if (!runtime)
+        die("必须指定 --runtime pi|codex|claude");
     validateRuntime(runtime);
+    const requestedModel = options.model?.trim() || undefined;
     const defaultModel = larkinConfig.defaultModelFor(runtime);
-    const selectedModel = selection?.runtime === "pi" && selection.distribution === "builtin" ? selection.model : undefined;
-    let targetModelId = selectedModel || (prior?.runtime === runtime ? prior.model : defaultModel);
+    let targetModelId = requestedModel && requestedModel !== "default"
+        ? requestedModel
+        : (prior?.runtime === runtime ? prior.model : defaultModel);
     let resolvedExternalModel;
-    let pendingMigration = null;
-    let setupConfigCommitted = false;
-    let providerTransaction = null;
-    let providerPublished = false;
-    const authAbort = new AbortController();
-    const cancelOnSignal = (signal) => {
-        authAbort.abort();
-        if (!setupConfigCommitted && pendingMigration) {
-            try {
-                rollbackPiProfileMigration(pendingMigration.state);
-            }
-            catch { /* best effort */ }
-        }
-        if (!providerPublished)
-            providerTransaction?.rollback();
-        process.exit(signal === "SIGINT" ? 130 : 143);
-    };
-    const onSigint = () => cancelOnSignal("SIGINT");
-    const onSigterm = () => cancelOnSignal("SIGTERM");
-    process.once("SIGINT", onSigint);
-    process.once("SIGTERM", onSigterm);
     let runtimeModels = larkinConfig.loadRuntimeModels()[runtime];
-    let authQuestioner = null;
     try {
-        if (runtime === "pi" && piDistribution === "external" && targetModelId === "default") {
-            fs.mkdirSync(CFG_DIR, { recursive: true, mode: 0o700 });
+        if (runtime === "pi" && (targetModelId === "default" || requestedModel)) {
             try {
-                clearStalePiProfileMigrationLock(CFG_DIR, profile.appId);
-                const plan = preparePiProfileMigration(process.env, CFG_DIR, profile.appId, "external");
-                pendingMigration = plan;
-                applyPiProfileMigration(plan);
                 const catalog = await discoverPiModelCatalog({
                     cwd: CFG_DIR,
-                    agentDir: piAgentDirectory(CFG_DIR, profile.appId),
-                    env: { ...process.env, LARKIN_PI_DISTRIBUTION: "external" },
+                    env: process.env,
                 });
-                const effective = catalog.effectiveModel;
-                const entry = effective ? catalog.models.find((model) => model.id === effective) : undefined;
-                if (!effective || !entry) {
-                    throw new Error("Pi official default resolution returned an unavailable model");
+                if (targetModelId === "default") {
+                    const effective = catalog.effectiveModel;
+                    const entry = effective ? catalog.models.find((model) => model.id === effective) : undefined;
+                    if (!effective || !entry) {
+                        throw new Error("Pi official default resolution returned an unavailable model");
+                    }
+                    if (!entry.contextWindow) {
+                        const alternatives = catalog.models
+                            .filter((model) => Number.isFinite(model.contextWindow) && Number(model.contextWindow) > 0)
+                            .map((model) => model.id);
+                        throw Object.assign(new Error("Pi effective model is missing a context window"), { catalogModels: alternatives });
+                    }
+                    calculatePiCompactionSettings(entry.contextWindow);
+                    targetModelId = effective;
+                    resolvedExternalModel = effective;
+                    runtimeModels = [{ id: effective, supportedReasoningEfforts: entry.supportedReasoningEfforts }];
                 }
-                if (!entry.contextWindow) {
-                    const alternatives = catalog.models
-                        .filter((model) => Number.isFinite(model.contextWindow) && Number(model.contextWindow) > 0)
-                        .map((model) => model.id);
-                    throw Object.assign(new Error("Pi effective model is missing a context window"), { catalogModels: alternatives });
+                else {
+                    const entry = catalog.models.find((model) => model.id === targetModelId);
+                    if (!entry)
+                        throw new Error(`目标模型 pi/${targetModelId} 不在 runtime 模型目录中；未修改 Agent 配置`);
+                    if (!entry.contextWindow) {
+                        const alternatives = catalog.models
+                            .filter((model) => Number.isFinite(model.contextWindow) && Number(model.contextWindow) > 0)
+                            .map((model) => model.id);
+                        throw Object.assign(new Error("Pi effective model is missing a context window"), { catalogModels: alternatives });
+                    }
+                    calculatePiCompactionSettings(entry.contextWindow);
+                    resolvedExternalModel = targetModelId;
+                    runtimeModels = [{ id: targetModelId, supportedReasoningEfforts: entry.supportedReasoningEfforts }];
                 }
-                calculatePiCompactionSettings(entry.contextWindow);
-                targetModelId = effective;
-                resolvedExternalModel = effective;
-                runtimeModels = [{ id: effective, supportedReasoningEfforts: entry.supportedReasoningEfforts }];
             }
             catch (error) {
                 throw new Error(formatExternalPiSetupFailure(error, { agentExisted: Boolean(prior) }));
@@ -358,6 +321,9 @@ export async function main() {
                 : [];
             runtimeModels = [{ id: targetModelId, supportedReasoningEfforts: preservedEffort }];
         }
+        else if (requestedModel && requestedModel !== "default") {
+            resolvedExternalModel = requestedModel;
+        }
         const targetModel = runtimeModels.find((model) => model.id === targetModelId);
         if (!targetModel)
             throw new Error(`目标模型 ${runtime}/${targetModelId} 不在 runtime 模型目录中；未修改 Agent 配置`);
@@ -366,67 +332,14 @@ export async function main() {
             profile,
             requestedAgent,
             runtime: selection?.runtime || options.runtime,
-            ...(runtime === "pi" && piDistribution ? { piDistribution } : {}),
-            ...(selectedModel || resolvedExternalModel ? { model: selectedModel || resolvedExternalModel } : {}),
+            ...(resolvedExternalModel ? { model: resolvedExternalModel } : {}),
             defaultModel,
             supportedReasoningEfforts: targetModel.supportedReasoningEfforts || [],
             now: new Date().toISOString(),
         });
         const bound = stored.agents[profile.appId];
         fs.mkdirSync(CFG_DIR, { recursive: true });
-        const authAlreadyCompleted = selection?.runtime === "pi" && selection.distribution === "builtin"
-            && selection.authCompleted === true;
-        const readinessAlreadyCompleted = authAlreadyCompleted
-            && selection.readinessCompleted === true;
-        providerTransaction = selection?.runtime === "pi" && selection.distribution === "builtin"
-            && !authAlreadyCompleted ? beginBuiltinPiCredentialTransaction(CFG_DIR, profile.appId)
-            : null;
-        if (selection?.runtime === "pi" && selection.distribution === "builtin") {
-            const official = selection.preset === "official" ? selection : null;
-            const configured = official ? null : configureBuiltinPiProviderModel(CFG_DIR, profile.appId, selection);
-            const providerId = official?.providerId || configured.provider;
-            const authType = official?.authType || "api_key";
-            let piRuntime = null;
-            if (!authAlreadyCompleted) {
-                piRuntime = await createOfficialPiModelRuntime(CFG_DIR, profile.appId);
-                authQuestioner = terminalSetupQuestioner();
-                say(`正在通过捆绑官方 Pi 登录 ${providerId}（${authType}）…`);
-                try {
-                    await runOfficialPiLogin(piRuntime, providerId, authType, createOfficialPiAuthInteraction({
-                        questioner: authQuestioner,
-                        report: (message) => say(message),
-                        openUrl: openAuthUrl,
-                        signal: authAbort.signal,
-                    }));
-                }
-                catch {
-                    throw new Error(`官方 Pi ${providerId} 登录失败或已取消；credential/config 未修改`);
-                }
-            }
-            if (!readinessAlreadyCompleted) {
-                piRuntime ??= await createOfficialPiModelRuntime(CFG_DIR, profile.appId);
-                say("正在验证内置 Pi provider（受控单轮，不发送飞书（Lark）消息）…");
-                try {
-                    if (!(process.env.LARKIN_TEST_SKIP_BUILTIN_PI_PROVIDER_TURN === "1" && process.env.LARKIN_TEST_BOT_REGISTER_MODULE)) {
-                        await verifyOfficialPiProviderTurn(piRuntime, selection.model, authAbort.signal);
-                    }
-                }
-                catch (error) {
-                    throw safeProviderFailure(error);
-                }
-            }
-        }
         larkinConfig.commitSetupConfig(process.env, loaded.revision, stored);
-        setupConfigCommitted = true;
-        providerTransaction?.commit();
-        providerPublished = true;
-        if (pendingMigration) {
-            try {
-                releasePiProfileMigrationLock(pendingMigration.state);
-            }
-            catch { /* post-commit lock release is best-effort; do not roll back credentials */ }
-            pendingMigration = null;
-        }
         fabricateAttachment(layout.root, stored.serverId);
         say(`\n✓ 已写配置: ${CFG_FILE}`);
         say(`  agent=${profile.appId}  runtime=${bound.runtime}  model=${bound.model}`);
@@ -438,21 +351,8 @@ export async function main() {
         say("  larkin setup");
     }
     catch (error) {
-        if (!setupConfigCommitted && pendingMigration) {
-            try {
-                rollbackPiProfileMigration(pendingMigration.state);
-            }
-            catch { /* best effort */ }
-            pendingMigration = null;
-        }
-        providerTransaction?.rollback();
         throw error;
     }
-    finally {
-        authQuestioner?.close?.();
-        process.off("SIGINT", onSigint);
-        process.off("SIGTERM", onSigterm);
-    }
 }
 if (path.resolve(process.argv[1] || "") === path.resolve(fileURLToPath(import.meta.url))) {
     main().catch((error) => die(error instanceof Error ? error.message : String(error)));

package/dist/setup/setup-binding.mjs

@@ -5,14 +5,13 @@ function cloneAgent(agent) {
     return {
         runtime: agent.runtime,
         model: agent.model,
-        ...(agent.piDistribution ? { piDistribution: agent.piDistribution } : {}),
         ...(agent.effort ? { effort: agent.effort } : {}),
         ...(agent.mentionPolicy ? { mentionPolicy: agent.mentionPolicy } : {}),
         ...(Object.keys(chatMentionPolicies).length ? { chatMentionPolicies } : {}),
         ...(agent.createdAt ? { createdAt: agent.createdAt } : {}),
     };
 }
-export function planSingleRootBinding({ config, profile, requestedAgent, runtime, piDistribution, model, defaultModel, supportedReasoningEfforts, now, }) {
+export function planSingleRootBinding({ config, profile, requestedAgent, runtime, model, defaultModel, supportedReasoningEfforts, now, }) {
     if (!/^cli_[A-Za-z0-9]+$/.test(profile.appId))
         throw new Error(`profile.appId 不是合法飞书 App ID：${profile.appId}`);
     if (typeof defaultModel !== "string" || !defaultModel)
@@ -25,22 +24,20 @@ export function planSingleRootBinding({ config, profile, requestedAgent, runtime
     }
     const agents = Object.fromEntries(Object.entries(config.agents).map(([key, agent]) => [key, cloneAgent(agent)]));
     const prior = agents[profile.appId];
-    const nextRuntime = runtime || prior?.runtime || "pi";
-    const nextPiDistribution = nextRuntime === "pi"
-        ? piDistribution || (prior?.runtime === "pi" ? prior.piDistribution : undefined)
-        : undefined;
+    const nextRuntime = runtime || prior?.runtime;
+    if (!nextRuntime)
+        throw new Error("必须指定 --runtime pi|codex|claude");
     if (prior) {
-        const { effort, piDistribution: _priorPiDistribution, ...withoutEffort } = prior;
+        const { effort, ...withoutEffort } = prior;
         agents[profile.appId] = {
             ...withoutEffort,
             runtime: nextRuntime,
             model: model || (prior.runtime === nextRuntime ? prior.model : defaultModel),
-            ...(nextPiDistribution ? { piDistribution: nextPiDistribution } : {}),
             ...(effort && supportedReasoningEfforts.includes(effort) ? { effort } : {}),
         };
     }
     else {
-        agents[profile.appId] = { runtime: nextRuntime, model: model || "default", ...(nextPiDistribution ? { piDistribution: nextPiDistribution } : {}), createdAt: now };
+        agents[profile.appId] = { runtime: nextRuntime, model: model || "default", createdAt: now };
     }
     return {
         version: 4,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "larkin",
-  "version": "0.4.29",
+  "version": "0.5.0",
   "private": false,
   "larkinPackageRole": "npm-published",
   "files": [
@@ -9,6 +9,7 @@
     "assets/",
     "scripts/npm/",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE",
     "SECURITY.md",
     "CONTRIBUTING.md",
@@ -88,7 +89,6 @@
     "test:live:agent-cli-routing-codex": "bun run build && LARKIN_RUN_AGENT_CLI_ROUTING_CODEX_LIVE=1 bun test --max-concurrency 1 test/live/agent-cli-routing-codex-live.test.mjs"
   },
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.84.2",
     "@larksuite/channel": "^0.4.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/resources": "^2.10.0",
@@ -104,6 +104,7 @@
     "undici": "8.5.0"
   },
   "devDependencies": {
+    "@earendil-works/pi-coding-agent": "0.84.2",
     "@tailwindcss/vite": "^4.3.3",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",

package/dist/app/pi-auth-cli.mjs

@@ -1,277 +0,0 @@
-import fs from "node:fs";
-import * as larkinConfig from "../platform/config.mjs";
-import { createOfficialPiCredentialRuntime, officialPiAuthStatus, } from "../runtime/pi-official-auth.mjs";
-import { configureBuiltinPiProvider, listBuiltinPiProviderCatalog, logoutBuiltinPiProvider, } from "../runtime/pi-provider-login.mjs";
-import { MAX_BUILTIN_PI_API_KEY_LENGTH } from "../runtime/pi-provider-config.mjs";
-const APP_ID = /^cli_[A-Za-z0-9]+$/;
-const USAGE = "Usage: larkin pi-auth status [--agent <App ID>] [--json] | larkin pi-auth providers [--json] | larkin pi-auth login <preset|custom> --agent <App ID> [--model <model>] [--base-url <url>] [--api-key-stdin] [--json] | larkin pi-auth logout <provider> [--agent <App ID>]";
-const API_KEY_ARGV_MESSAGE = "existing-Agent login does not accept --api-key. Use --api-key-stdin or an interactive TTY prompt.";
-const API_KEY_BUDGET_MESSAGE = "API Key 不能为空或包含控制字符";
-const STDIN_CHUNK_BYTES = 1024;
-const STDIN_BOM_BYTES = 3;
-const STDIN_TRAILING_NEWLINE_SLACK = 32;
-const MAX_STDIN_API_KEY_BYTES = MAX_BUILTIN_PI_API_KEY_LENGTH + STDIN_BOM_BYTES + STDIN_TRAILING_NEWLINE_SLACK;
-function flag(args, name) {
-    const index = args.indexOf(name);
-    return index >= 0 ? args[index + 1] : undefined;
-}
-function hasApiKeyArgv(args) {
-    return args.some((argument) => argument === "--api-key" || argument.startsWith("--api-key="));
-}
-function consumeFlags(args, allowed, unary) {
-    let index = 0;
-    while (index < args.length) {
-        const argument = args[index];
-        if (!argument.startsWith("--"))
-            return false;
-        if (unary.has(argument)) {
-            index += 1;
-            continue;
-        }
-        if (allowed.has(argument) && args[index + 1] && !args[index + 1].startsWith("--")) {
-            index += 2;
-            continue;
-        }
-        return false;
-    }
-    return true;
-}
-/** 去掉 BOM 与全部尾部换行；保留内部控制字符给后续校验拒绝。 */
-export function normalizeStdinApiKey(raw) {
-    return raw.replace(/^\uFEFF/, "").replace(/[\r\n]+$/g, "");
-}
-function assertStdinApiKeyBudget(size) {
-    if (size > MAX_STDIN_API_KEY_BYTES)
-        throw new Error(API_KEY_BUDGET_MESSAGE);
-}
-function finishStdinApiKey(chunks) {
-    const normalized = normalizeStdinApiKey(Buffer.concat(chunks).toString("utf8"));
-    if (normalized.length > MAX_BUILTIN_PI_API_KEY_LENGTH)
-        throw new Error(API_KEY_BUDGET_MESSAGE);
-    return normalized;
-}
-function readFdChunk(fd, buffer) {
-    return new Promise((resolve, reject) => {
-        fs.read(fd, buffer, 0, buffer.length, null, (error, bytesRead) => {
-            if (error)
-                reject(error);
-            else
-                resolve(bytesRead);
-        });
-    });
-}
-/** 按块读取 fd，超过 key 上限立即停止，不等待管道 EOF。 */
-async function readBoundedFdSecret(fd) {
-    const chunks = [];
-    let size = 0;
-    const buffer = Buffer.alloc(STDIN_CHUNK_BYTES);
-    while (true) {
-        const bytesRead = await readFdChunk(fd, buffer);
-        if (bytesRead === 0)
-            break;
-        size += bytesRead;
-        assertStdinApiKeyBudget(size);
-        chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
-    }
-    return finishStdinApiKey(chunks);
-}
-async function readBoundedStreamSecret(stdin) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of stdin) {
-        const bytes = Buffer.from(chunk);
-        size += bytes.length;
-        assertStdinApiKeyBudget(size);
-        chunks.push(bytes);
-    }
-    return finishStdinApiKey(chunks);
-}
-export async function readStdinSecret(stdin) {
-    const stream = stdin;
-    if (typeof stream.fd === "number" && stream.fd >= 0 && !stream.isTTY) {
-        if (typeof stream.pause === "function")
-            stream.pause();
-        try {
-            return await readBoundedFdSecret(stream.fd);
-        }
-        catch (error) {
-            if (error instanceof Error && error.message === API_KEY_BUDGET_MESSAGE)
-                throw error;
-            // 回退到异步收集，例如测试传入的假 stream。
-        }
-    }
-    return readBoundedStreamSecret(stdin);
-}
-function createNoEchoQuestioner(stdin, stdout) {
-    return {
-        close() { },
-        secret(prompt) {
-            if (!stdin.isTTY || typeof stdin.setRawMode !== "function") {
-                throw new Error("non-interactive API-key login requires --api-key-stdin");
-            }
-            stdout.write(prompt);
-            const wasRaw = stdin.isRaw;
-            stdin.setRawMode(true);
-            stdin.resume();
-            return new Promise((resolve, reject) => {
-                let value = "";
-                const finish = (error) => {
-                    stdin.off("data", onData);
-                    stdin.setRawMode(Boolean(wasRaw));
-                    stdin.pause();
-                    stdout.write("\n");
-                    if (error)
-                        reject(error);
-                    else
-                        resolve(value);
-                };
-                const onData = (chunk) => {
-                    const bytes = Buffer.from(chunk);
-                    for (const byte of bytes) {
-                        if (byte === 3)
-                            return finish(new Error("pi-auth login cancelled"));
-                        if (byte === 10 || byte === 13)
-                            return finish();
-                        if (byte === 8 || byte === 127) {
-                            value = value.slice(0, -1);
-                            continue;
-                        }
-                        if (byte >= 32 && byte <= 126)
-                            value += String.fromCharCode(byte);
-                    }
-                };
-                stdin.on("data", onData);
-            });
-        },
-    };
-}
-function resolveAgentId(args, env) {
-    const loaded = larkinConfig.loadConfig(env);
-    const agentId = flag(args, "--agent") || loaded.config.activeAgent || undefined;
-    if (!agentId || !APP_ID.test(agentId))
-        throw new Error("请用 --agent <App ID> 选择 Agent");
-    const agent = loaded.config.agents[agentId];
-    if (!agent)
-        throw new Error(`Agent ${agentId} 不存在`);
-    if (agent.runtime !== "pi" || agent.piDistribution !== "builtin")
-        throw new Error(`Agent ${agentId} 不是内置 Pi`);
-    return agentId;
-}
-export async function main(args = process.argv.slice(2), env = process.env, io = { stdin: process.stdin, stdout: process.stdout, isTTY: Boolean(process.stdin.isTTY) }) {
-    const action = args[0] || "status";
-    const json = args.includes("--json");
-    if (hasApiKeyArgv(args))
-        throw new Error(API_KEY_ARGV_MESSAGE);
-    if (action === "providers") {
-        if (!consumeFlags(args.slice(1), new Set(), new Set(["--json"])))
-            throw new Error(USAGE);
-        const providers = listBuiltinPiProviderCatalog();
-        if (json) {
-            console.log(JSON.stringify({ providers }));
-            return;
-        }
-        console.log("Builtin Pi providers:");
-        for (const entry of providers) {
-            const model = entry.defaultModel ? ` default=${entry.defaultModel}` : " (requires --base-url and --model)";
-            console.log(`  ${entry.id}  ${entry.name}${model}`);
-        }
-        return;
-    }
-    if (action === "login") {
-        const preset = args[1];
-        const rest = args.slice(2);
-        if (!preset || preset.startsWith("--")
-            || !consumeFlags(rest, new Set(["--agent", "--model", "--base-url"]), new Set(["--json", "--api-key-stdin"]))) {
-            throw new Error(USAGE);
-        }
-        const agentId = resolveAgentId(rest, env);
-        const stdinKey = rest.includes("--api-key-stdin");
-        let apiKey = "";
-        if (stdinKey)
-            apiKey = await readStdinSecret(io.stdin);
-        else if (io.isTTY) {
-            const questioner = createNoEchoQuestioner(io.stdin, io.stdout);
-            try {
-                apiKey = await questioner.secret("API Key:\n> ");
-            }
-            finally {
-                questioner.close();
-            }
-        }
-        else {
-            throw new Error("non-interactive API-key login requires --api-key-stdin");
-        }
-        const result = await configureBuiltinPiProvider({
-            agentId,
-            preset,
-            apiKey,
-            model: flag(rest, "--model"),
-            baseUrl: flag(rest, "--base-url"),
-            env,
-        });
-        const payload = {
-            agentId: result.agentId,
-            provider: result.provider,
-            model: result.model,
-            credentialType: result.credentialType,
-            applyState: result.applyState,
-            ...(result.applyError ? { applyError: result.applyError } : {}),
-        };
-        if (json)
-            console.log(JSON.stringify(payload));
-        else {
-            const pending = result.applyState === "applied"
-                ? "applied"
-                : result.applyState === "pending"
-                    ? `pending${result.applyError ? ` (${result.applyError})` : ""}`
-                    : "saved; will apply on larkin start";
-            console.log(`Agent ${result.agentId} provider=${result.provider} model=${result.model} credential=${result.credentialType} apply=${pending}`);
-        }
-        return;
-    }
-    const requestedAgent = flag(args, "--agent");
-    let index = action === "logout" ? 2 : 1;
-    let valid = action === "status" || action === "logout";
-    while (valid && index < args.length) {
-        const argument = args[index];
-        if (argument === "--json" && action === "status") {
-            index += 1;
-            continue;
-        }
-        if (argument === "--agent" && args[index + 1]) {
-            index += 2;
-            continue;
-        }
-        valid = false;
-    }
-    if (!valid)
-        throw new Error(USAGE);
-    const loaded = larkinConfig.loadConfig(env);
-    const agentId = requestedAgent || loaded.config.activeAgent || undefined;
-    if (!agentId || !APP_ID.test(agentId))
-        throw new Error("请用 --agent <App ID> 选择 Agent");
-    const agent = loaded.config.agents[agentId];
-    if (!agent)
-        throw new Error(`Agent ${agentId} 不存在`);
-    if (agent.runtime !== "pi" || agent.piDistribution !== "builtin")
-        throw new Error(`Agent ${agentId} 不是内置 Pi`);
-    if (action === "status") {
-        const runtime = await createOfficialPiCredentialRuntime(loaded.configDir, agentId);
-        const statuses = await officialPiAuthStatus(runtime);
-        if (json)
-            console.log(JSON.stringify({ agentId, credentials: statuses }));
-        else if (statuses.length === 0)
-            console.log(`Agent ${agentId} 尚无已配置的官方 Pi credential`);
-        else {
-            console.log(`Agent ${agentId} 官方 Pi credential：`);
-            for (const entry of statuses)
-                console.log(`  ${entry.providerName} (${entry.providerId}): ${entry.credentialType}/${entry.source}${entry.stored ? " [stored]" : " [ambient]"}`);
-        }
-        return;
-    }
-    const providerId = args[1];
-    if (!providerId || providerId.startsWith("--"))
-        throw new Error("logout 需要安全的 provider ID");
-    await logoutBuiltinPiProvider({ agentId, providerId, env });
-    console.log(`Agent ${agentId} 已退出 ${providerId}；其他 provider 未修改`);
-}