larkin 0.4.29 → 0.5.1

package/dist/runtime/pi-provider-config.mjs

@@ -1,334 +0,0 @@
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { internalCommandSpec } from "../app/internal-command.mjs";
-import { isWindows, secureWindowsDirectoryAcl } from "../platform/secure-metadata.mjs";
-export { piDistributionLabel } from "./pi-distribution-label.mjs";
-export const BUNDLED_PI_VERSION = "0.84.2";
-/** API Key 字符上限；stdin 必须在读入任意多余输入前按同一上限截断。 */
-export const MAX_BUILTIN_PI_API_KEY_LENGTH = 16_384;
-// These values mirror the catalog shipped by the pinned official Pi distribution.
-// Keeping the user-facing defaults here makes endpoint changes reviewable in Larkin.
-export const PI_PROVIDER_PRESETS = Object.freeze([
-    { id: "deepseek", name: "DeepSeek（推荐）", provider: "deepseek", baseUrl: "https://api.deepseek.com", defaultModel: "deepseek-v4-pro", api: "openai-completions" },
-    { id: "kimi", name: "Kimi / Moonshot（中国）", provider: "moonshotai-cn", baseUrl: "https://api.moonshot.cn/v1", defaultModel: "kimi-k2.6", api: "openai-completions" },
-    { id: "minimax", name: "MiniMax（中国）", provider: "minimax-cn", baseUrl: "https://api.minimaxi.com/anthropic", defaultModel: "MiniMax-M2.7", api: "anthropic-messages" },
-    { id: "zhipu", name: "智谱 / BigModel", provider: "zai-coding-cn", baseUrl: "https://open.bigmodel.cn/api/coding/paas/v4", defaultModel: "glm-5.2", api: "openai-completions" },
-    { id: "openai", name: "OpenAI", provider: "openai", baseUrl: "https://api.openai.com/v1", defaultModel: "gpt-5.5", api: "openai-completions" },
-    { id: "anthropic", name: "Anthropic Claude", provider: "anthropic", baseUrl: "https://api.anthropic.com", defaultModel: "claude-opus-4-8", api: "anthropic-messages" },
-    { id: "gemini", name: "Google Gemini", provider: "google", baseUrl: "https://generativelanguage.googleapis.com/v1beta", defaultModel: "gemini-3.1-pro-preview", api: "openai-completions" },
-    { id: "groq", name: "Groq", provider: "groq", baseUrl: "https://api.groq.com/openai/v1", defaultModel: "openai/gpt-oss-120b", api: "openai-completions" },
-    { id: "cerebras", name: "Cerebras", provider: "cerebras", baseUrl: "https://api.cerebras.ai/v1", defaultModel: "zai-glm-4.7", api: "openai-completions" },
-    { id: "xai", name: "xAI Grok", provider: "xai", baseUrl: "https://api.x.ai/v1", defaultModel: "grok-4.5", api: "openai-completions" },
-    { id: "fireworks", name: "Fireworks AI", provider: "fireworks", baseUrl: "https://api.fireworks.ai/inference", defaultModel: "accounts/fireworks/models/kimi-k2p6", api: "openai-completions" },
-    { id: "together", name: "Together AI", provider: "together", baseUrl: "https://api.together.ai/v1", defaultModel: "moonshotai/Kimi-K2.6", api: "openai-completions" },
-    { id: "mistral", name: "Mistral", provider: "mistral", baseUrl: "https://api.mistral.ai", defaultModel: "devstral-medium-latest", api: "openai-completions" },
-    { id: "openrouter", name: "OpenRouter", provider: "openrouter", baseUrl: "https://openrouter.ai/api/v1", defaultModel: "moonshotai/kimi-k2.6", api: "openai-completions" },
-    { id: "kimi-coding", name: "Kimi For Coding", provider: "kimi-coding", baseUrl: "https://api.kimi.com/coding", defaultModel: "kimi-for-coding", api: "openai-completions" },
-    { id: "qwen-cn", name: "通义千问 Token Plan（中国）", provider: "qwen-token-plan-cn", baseUrl: "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1", defaultModel: "qwen3.7-max", api: "openai-completions" },
-    { id: "opencode-go", name: "OpenCode Go", provider: "opencode-go", baseUrl: "https://opencode.ai/zen/go/v1", defaultModel: "kimi-k2.6", api: "openai-completions" },
-    { id: "ant-ling", name: "Ant Ling", provider: "ant-ling", baseUrl: "https://api.ant-ling.com/v1", defaultModel: "Ring-2.6-1T", api: "openai-completions" },
-    { id: "nvidia", name: "NVIDIA NIM", provider: "nvidia", baseUrl: "https://integrate.api.nvidia.com/v1", defaultModel: "google/gemma-3-12b-it", api: "openai-completions" },
-    { id: "huggingface", name: "Hugging Face", provider: "huggingface", baseUrl: "https://router.huggingface.co/v1", defaultModel: "MiniMaxAI/MiniMax-M2", api: "openai-completions" },
-    { id: "minimax-global", name: "MiniMax（全球）", provider: "minimax", baseUrl: "https://api.minimax.io/anthropic", defaultModel: "MiniMax-M2.7", api: "anthropic-messages" },
-    { id: "moonshotai", name: "Moonshot（全球）", provider: "moonshotai", baseUrl: "https://api.moonshot.ai/v1", defaultModel: "kimi-k2-0711-preview", api: "openai-completions" },
-    { id: "opencode", name: "OpenCode Zen", provider: "opencode", baseUrl: "https://opencode.ai/zen", defaultModel: "claude-fable-5", api: "openai-completions" },
-    { id: "qwen-token-plan", name: "通义千问 Token Plan（全球）", provider: "qwen-token-plan", baseUrl: "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1", defaultModel: "qwen3.7-max", api: "openai-completions" },
-    { id: "vercel-ai-gateway", name: "Vercel AI Gateway", provider: "vercel-ai-gateway", baseUrl: "https://ai-gateway.vercel.sh", defaultModel: "zai/glm-5.1", api: "anthropic-messages" },
-    { id: "xiaomi", name: "Xiaomi MiMo", provider: "xiaomi", baseUrl: "https://api.xiaomimimo.com/v1", defaultModel: "mimo-v2-flash", api: "openai-completions" },
-    { id: "xiaomi-token-plan-cn", name: "Xiaomi MiMo Token Plan（中国）", provider: "xiaomi-token-plan-cn", baseUrl: "https://token-plan-cn.xiaomimimo.com/v1", defaultModel: "mimo-v2.5-pro", api: "openai-completions" },
-    { id: "xiaomi-token-plan-ams", name: "Xiaomi MiMo Token Plan（阿姆斯特丹）", provider: "xiaomi-token-plan-ams", baseUrl: "https://token-plan-ams.xiaomimimo.com/v1", defaultModel: "mimo-v2.5-pro", api: "openai-completions" },
-    { id: "xiaomi-token-plan-sgp", name: "Xiaomi MiMo Token Plan（新加坡）", provider: "xiaomi-token-plan-sgp", baseUrl: "https://token-plan-sgp.xiaomimimo.com/v1", defaultModel: "mimo-v2.5-pro", api: "openai-completions" },
-    { id: "zai", name: "ZAI Coding Plan（全球）", provider: "zai", baseUrl: "https://api.z.ai/api/coding/paas/v4", defaultModel: "glm-4.5-air", api: "openai-completions" },
-]);
-const APP_ID = /^cli_[A-Za-z0-9]+$/;
-const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:@+\/-]{0,255}$/;
-/** Node 的 URL.hostname 对 IPv6 是 [::1]，不是 ::1。 */
-export function isPiLoopbackHostname(hostname) {
-    const host = hostname.trim().replace(/^\[|\]$/g, "").toLowerCase();
-    return host === "localhost" || host === "127.0.0.1" || host === "::1";
-}
-/** 官方 provider ID（如 zai-coding-cn）映射到 CLI/Dashboard 接受的 preset ID（如 zhipu）。 */
-export function presetIdForOfficialProvider(providerId) {
-    const id = providerId.trim();
-    if (id === "larkin-custom")
-        return "custom";
-    return PI_PROVIDER_PRESETS.find((preset) => preset.provider === id)?.id ?? null;
-}
-/** Agent 范围的缺凭证恢复路径：只用 preset，不指向 setup / import / 全局 ~/.pi。 */
-export function builtinPiProviderRecoveryNextAction(options = {}) {
-    const preset = options.providerId ? presetIdForOfficialProvider(options.providerId) ?? "<preset|custom>" : "<preset|custom>";
-    const agent = options.agentId && /^cli_[A-Za-z0-9]+$/.test(options.agentId) ? options.agentId : "<App ID>";
-    return `在 Dashboard 的 Provider Credentials 中为该 Agent 配置 Provider 与 API Key，或运行 larkin pi-auth login ${preset} --agent ${agent}。`;
-}
-export function validatePiBaseUrl(raw) {
-    const input = raw.trim();
-    if (!input || /[\0\r\n\t]/.test(input))
-        throw new Error("Base URL 不能为空或包含控制字符");
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch {
-        throw new Error("Base URL 不是合法 URL");
-    }
-    if (url.username || url.password)
-        throw new Error("Base URL 不允许包含用户名或凭证");
-    if (url.search || url.hash)
-        throw new Error("Base URL 不允许 query 或 fragment");
-    const local = isPiLoopbackHostname(url.hostname);
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
-        throw new Error("Base URL 必须使用 https；仅 localhost/loopback 开发端点允许 http");
-    }
-    if (/\/(?:chat\/completions|responses|models)\/?$/i.test(url.pathname)) {
-        throw new Error("Base URL 应填写 API 根路径，不要包含 chat/completions、responses 或 models");
-    }
-    return url.toString().replace(/\/$/, "");
-}
-/**
- * 查询 OpenAI 兼容 provider 的 /models 列表（setup 时校验 --model 是否真实可用）。
- * 网络超时/不可达返回 null（不阻塞 setup——运行时对账会严格兜底）；
- * 列表拿到但模型不在其中时抛错。
- */
-export async function listProviderModels(baseUrl, apiKey, fetchImpl = fetch) {
-    try {
-        const url = `${validatePiBaseUrl(baseUrl)}/models`;
-        const response = await fetchImpl(url, {
-            headers: { Authorization: `Bearer ${apiKey}` },
-            signal: AbortSignal.timeout(30_000),
-        });
-        if (!response.ok)
-            throw new Error(`provider /models 查询失败：HTTP ${response.status}`);
-        const payload = await response.json();
-        if (!payload || !Array.isArray(payload.data))
-            throw new Error("provider /models 响应格式非法");
-        return payload.data.map((entry) => String(entry.id ?? "")).filter(Boolean);
-    }
-    catch (error) {
-        if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError"
-            || /fetch failed|network|ETIMEDOUT|ECONNREFUSED|ConnectionRefused|Unable to connect/i.test(error.message))) {
-            return null;
-        }
-        throw error;
-    }
-}
-export function resolveBuiltinPiProviderSetupSelection(input) {
-    if (input.distribution !== "builtin")
-        throw new Error("provider 凭证只能用于内置 Pi");
-    const model = input.model.trim();
-    if (!MODEL_ID.test(model))
-        throw new Error("模型 ID 格式不安全");
-    if (input.preset === "custom") {
-        const provider = "larkin-custom";
-        return {
-            ...input,
-            model: model.startsWith(`${provider}/`) ? model : `${provider}/${model}`,
-            provider,
-            baseUrl: validatePiBaseUrl(input.baseUrl || ""),
-            api: "openai-completions",
-        };
-    }
-    const preset = PI_PROVIDER_PRESETS.find((candidate) => candidate.id === input.preset);
-    if (!preset)
-        throw new Error(`未知 Pi provider preset: ${String(input.preset)}`);
-    return { ...input, model: model.startsWith(`${preset.provider}/`) ? model : `${preset.provider}/${model}`,
-        provider: preset.provider, baseUrl: preset.baseUrl, api: preset.api };
-}
-export function validateBuiltinPiProviderSelection(input) {
-    const key = input.apiKey.trim();
-    if (!key || key.length > MAX_BUILTIN_PI_API_KEY_LENGTH || /[\0\r\n]/.test(key))
-        throw new Error("API Key 不能为空或包含控制字符");
-    return { ...resolveBuiltinPiProviderSetupSelection(input), apiKey: key };
-}
-export function piAgentDirectory(configDir, agentId) {
-    if (!APP_ID.test(agentId))
-        throw new Error("Pi Agent ID 格式无效");
-    return path.join(path.resolve(configDir), "providers", "pi", agentId);
-}
-/** Catalog/CLI/dashboard must use the Agent-owned provider dir, never host ~/.pi. */
-export function ownedPiCatalogAgentDir(configDir, agentId) {
-    return piAgentDirectory(configDir, agentId);
-}
-export function piCatalogCommandSpec(distribution, env = process.env) {
-    if (distribution === "builtin") {
-        const spec = internalCommandSpec("pi-rpc", [], env);
-        return { command: spec.command, commandArgs: spec.args };
-    }
-    return {
-        command: env.LARKIN_PI_COMMAND ?? process.env.LARKIN_PI_COMMAND ?? "pi",
-        commandArgs: [],
-    };
-}
-function assertPrivateDirectory(directory) {
-    if (isWindows) {
-        // Windows 无 POSIX 权限位：icacls 收紧为「当前用户 + SYSTEM」并回读校验。
-        secureWindowsDirectoryAcl(directory, { label: "Pi provider 凭证目录" });
-        return;
-    }
-    const stat = fs.lstatSync(directory);
-    if (!stat.isDirectory() || stat.isSymbolicLink()
-        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-        || (stat.mode & 0o777) !== 0o700) {
-        throw new Error("Pi provider 凭证目录必须是当前用户拥有、非 symlink、权限精确 0700 的目录");
-    }
-}
-export function assertBuiltinPiAgentDirectory(directory) {
-    assertPrivateDirectory(directory);
-    const authFile = path.join(directory, "auth.json");
-    const auth = readSnapshot(authFile);
-    if (!auth)
-        throw new Error("内置 Pi 尚未配置 API Key");
-    try {
-        const value = JSON.parse(auth.toString("utf8"));
-        if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length === 0)
-            throw new Error("empty");
-    }
-    catch {
-        throw new Error("内置 Pi auth.json 格式无效");
-    }
-}
-function ensurePrivateDirectory(directory) {
-    fs.mkdirSync(path.dirname(directory), { recursive: true, mode: 0o700 });
-    fs.chmodSync(path.dirname(directory), 0o700);
-    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    fs.chmodSync(directory, 0o700);
-    assertPrivateDirectory(directory);
-}
-function readSnapshot(file) {
-    try {
-        const stat = fs.lstatSync(file);
-        if (!stat.isFile() || stat.isSymbolicLink()
-            || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-            || (!isWindows && (stat.mode & 0o777) !== 0o600))
-            throw new Error(`Pi provider 文件不安全: ${path.basename(file)}`);
-        return fs.readFileSync(file);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    }
-}
-function atomicPrivateWrite(file, content) {
-    const directory = path.dirname(file);
-    assertPrivateDirectory(directory);
-    const temporary = path.join(directory, `.${path.basename(file)}.${process.pid}.${crypto.randomUUID()}.tmp`);
-    try {
-        fs.writeFileSync(temporary, content, { mode: 0o600, flag: "wx" });
-        fs.renameSync(temporary, file);
-        fs.chmodSync(file, 0o600);
-    }
-    finally {
-        try {
-            fs.unlinkSync(temporary);
-        }
-        catch { /* renamed or absent */ }
-    }
-}
-function restore(file, snapshot) {
-    if (snapshot === null) {
-        try {
-            fs.unlinkSync(file);
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-        }
-    }
-    else
-        atomicPrivateWrite(file, snapshot.toString("utf8"));
-}
-export function configureBuiltinPiProviderModel(configDir, agentId, raw) {
-    const selection = resolveBuiltinPiProviderSetupSelection(raw);
-    const directory = piAgentDirectory(configDir, agentId);
-    ensurePrivateDirectory(directory);
-    if (selection.preset !== "custom")
-        return selection;
-    const modelsFile = path.join(directory, "models.json");
-    const beforeModels = readSnapshot(modelsFile);
-    const currentModels = beforeModels ? JSON.parse(beforeModels.toString("utf8")) : {};
-    if (!currentModels || typeof currentModels !== "object" || Array.isArray(currentModels))
-        throw new Error("现有 Pi models.json 格式无效");
-    const currentProviders = currentModels.providers === undefined ? {} : currentModels.providers;
-    if (!currentProviders || typeof currentProviders !== "object" || Array.isArray(currentProviders))
-        throw new Error("现有 Pi models.json providers 格式无效");
-    const modelId = selection.model.slice(`${selection.provider}/`.length);
-    atomicPrivateWrite(modelsFile, `${JSON.stringify({
-        ...currentModels,
-        providers: {
-            ...currentProviders,
-            [selection.provider]: {
-                baseUrl: selection.baseUrl,
-                api: selection.api,
-                models: [{
-                        id: modelId, name: modelId, reasoning: false, input: ["text"], contextWindow: 272_000, maxTokens: 16_384,
-                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-                    }],
-            },
-        },
-    }, null, 2)}\n`);
-    return selection;
-}
-export function stageBuiltinPiProvider(configDir, agentId, raw) {
-    const selection = validateBuiltinPiProviderSelection(raw);
-    const directory = piAgentDirectory(configDir, agentId);
-    ensurePrivateDirectory(directory);
-    const authFile = path.join(directory, "auth.json");
-    const modelsFile = path.join(directory, "models.json");
-    const beforeAuth = readSnapshot(authFile);
-    const beforeModels = readSnapshot(modelsFile);
-    const currentAuth = beforeAuth ? JSON.parse(beforeAuth.toString("utf8")) : {};
-    if (!currentAuth || typeof currentAuth !== "object" || Array.isArray(currentAuth))
-        throw new Error("现有 Pi auth.json 格式无效");
-    const auth = { ...currentAuth, [selection.provider]: { type: "api_key", key: selection.apiKey } };
-    const currentModels = beforeModels ? JSON.parse(beforeModels.toString("utf8")) : {};
-    if (!currentModels || typeof currentModels !== "object" || Array.isArray(currentModels))
-        throw new Error("现有 Pi models.json 格式无效");
-    const currentProviders = currentModels.providers === undefined ? {} : currentModels.providers;
-    if (!currentProviders || typeof currentProviders !== "object" || Array.isArray(currentProviders))
-        throw new Error("现有 Pi models.json providers 格式无效");
-    const customModels = selection.preset === "custom" ? {
-        ...currentModels,
-        providers: {
-            ...currentProviders,
-            [selection.provider]: {
-                baseUrl: selection.baseUrl,
-                api: selection.api,
-                models: [{
-                        id: selection.model.slice(`${selection.provider}/`.length),
-                        name: selection.model.slice(`${selection.provider}/`.length),
-                        reasoning: false,
-                        input: ["text"],
-                        contextWindow: 272_000,
-                        maxTokens: 16_384,
-                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-                    }],
-            },
-        },
-    } : null;
-    let active = true;
-    try {
-        atomicPrivateWrite(authFile, `${JSON.stringify(auth, null, 2)}\n`);
-        if (customModels)
-            atomicPrivateWrite(modelsFile, `${JSON.stringify(customModels, null, 2)}\n`);
-    }
-    catch (error) {
-        try {
-            restore(authFile, beforeAuth);
-            restore(modelsFile, beforeModels);
-        }
-        catch { /* original error remains primary */ }
-        throw error;
-    }
-    return {
-        directory,
-        commit() { active = false; },
-        rollback() {
-            if (!active)
-                return;
-            restore(authFile, beforeAuth);
-            restore(modelsFile, beforeModels);
-            active = false;
-        },
-    };
-}

package/dist/runtime/pi-provider-login.mjs

@@ -1,240 +0,0 @@
-import { PI_PROVIDER_PRESETS, configureBuiltinPiProviderModel, validateBuiltinPiProviderSelection, } from "./pi-provider-config.mjs";
-import { beginBuiltinPiCredentialTransaction, createOfficialPiAuthInteraction, createOfficialPiLogoutRuntime, createOfficialPiModelRuntime, logoutOfficialPiProvider, runOfficialPiLogin, } from "./pi-official-auth.mjs";
-import { loadConfig, markConfigApplied, mutateConfig, runtimeConfigSignature, } from "../platform/config.mjs";
-import { requestAgentUpsert } from "../app/local-control.mjs";
-import { readProcessState } from "../platform/process-state.mjs";
-const APP_ID = /^cli_[A-Za-z0-9]+$/;
-const PROVIDER_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-const PRESET_IDS = new Set([...PI_PROVIDER_PRESETS.map((preset) => preset.id), "custom"]);
-/** 用户可见 catalog：已知 preset + 自定义 OpenAI 兼容端点，不含 Base URL / secret。 */
-export function listBuiltinPiProviderCatalog() {
-    return [
-        ...PI_PROVIDER_PRESETS.map((preset) => ({
-            id: preset.id,
-            name: preset.name,
-            provider: preset.provider,
-            defaultModel: `${preset.provider}/${preset.defaultModel}`,
-            custom: false,
-            openaiCompatible: preset.api === "openai-completions",
-        })),
-        {
-            id: "custom",
-            name: "Custom OpenAI-compatible",
-            provider: "larkin-custom",
-            defaultModel: null,
-            custom: true,
-            openaiCompatible: true,
-        },
-    ];
-}
-export function sanitizeProviderLoginError(error, secret) {
-    let text = error instanceof Error ? error.message : String(error);
-    if (secret) {
-        let from = 0;
-        while (from < text.length) {
-            const at = text.indexOf(secret, from);
-            if (at < 0)
-                break;
-            text = `${text.slice(0, at)}[redacted]${text.slice(at + secret.length)}`;
-            from = at + 10;
-        }
-    }
-    return text
-        .replace(/\b(?:authorization|proxy-authorization|api[_ -]?key|access[_ -]?token|refresh[_ -]?token|secret|password)\s*[:=]\s*\S+/gi, (match) => `${match.split(/[:=]/, 1)[0]}=[redacted]`)
-        .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
-        .replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[redacted]")
-        .replace(/https?:\/\/[^\s]+/gi, (url) => {
-        try {
-            const parsed = new URL(url);
-            parsed.username = "";
-            parsed.password = "";
-            parsed.search = "";
-            parsed.hash = "";
-            return parsed.toString();
-        }
-        catch {
-            return "(url)";
-        }
-    })
-        .replace(/[\0\r\n\t]+/g, " ")
-        .replace(/\s+/g, " ")
-        .trim()
-        .slice(0, 240) || "builtin Pi provider configuration failed";
-}
-export function resolveBuiltinPiLoginSelection(input) {
-    if (!PRESET_IDS.has(input.preset))
-        throw new Error(`未知 Pi provider preset: ${input.preset}`);
-    const preset = input.preset;
-    if (preset === "custom") {
-        if (!input.baseUrl?.trim())
-            throw new Error("custom OpenAI-compatible endpoint 需要 Base URL");
-        if (!input.model?.trim())
-            throw new Error("custom OpenAI-compatible endpoint 需要 model");
-        return validateBuiltinPiProviderSelection({
-            distribution: "builtin",
-            preset,
-            apiKey: input.apiKey,
-            model: input.model,
-            baseUrl: input.baseUrl,
-        });
-    }
-    if (input.baseUrl?.trim())
-        throw new Error("已知 provider 不接受 --base-url；自定义端点请使用 custom");
-    const known = PI_PROVIDER_PRESETS.find((candidate) => candidate.id === preset);
-    if (!known)
-        throw new Error(`未知 Pi provider preset: ${input.preset}`);
-    return validateBuiltinPiProviderSelection({
-        distribution: "builtin",
-        preset,
-        apiKey: input.apiKey,
-        model: input.model?.trim() || known.defaultModel,
-    });
-}
-export function createApiKeyOnlyInteraction(apiKey, options = {}) {
-    const questioner = {
-        ask: async () => {
-            throw new Error("API-key login does not accept interactive text prompts");
-        },
-        secret: async () => apiKey,
-    };
-    return createOfficialPiAuthInteraction({
-        questioner,
-        report: options.report ?? (() => { }),
-        signal: options.signal,
-    });
-}
-function assertTargetBuiltinPi(env, agentId, load) {
-    if (!APP_ID.test(agentId))
-        throw new Error("请用 --agent <App ID> 选择 Agent");
-    const loaded = load(env);
-    const agent = loaded.config.agents[agentId];
-    if (!agent)
-        throw new Error(`Agent ${agentId} 不存在`);
-    if (agent.runtime !== "pi" || agent.piDistribution !== "builtin") {
-        throw new Error(`Agent ${agentId} 不是内置 Pi`);
-    }
-    return { configDir: loaded.configDir };
-}
-async function applyTargetModel(env, agentId, model, mutate, inspect, upsert, markApplied, secret) {
-    let mutated;
-    try {
-        mutated = mutate(env, { kind: "set-agent-model", agentId, model, requireBuiltinPi: true }, { kind: "user" });
-    }
-    catch (error) {
-        throw new Error(sanitizeProviderLoginError(error, secret));
-    }
-    const stillBuiltin = mutated.config.agents[agentId]?.runtime === "pi"
-        && mutated.config.agents[agentId]?.piDistribution === "builtin";
-    if (!stillBuiltin) {
-        return { applyState: "pending", applyError: sanitizeProviderLoginError(new Error(`Agent ${agentId} 不是内置 Pi`), secret) };
-    }
-    const expectedSignature = runtimeConfigSignature(mutated.config, agentId);
-    const state = inspect(mutated.config.larkinHome);
-    if (state.daemon.state !== "owned" || state.supervisor.state !== "owned") {
-        return { applyState: "saved_not_applied" };
-    }
-    try {
-        const result = await upsert({
-            larkinHome: mutated.config.larkinHome,
-            agentId,
-            expectedSignature,
-        });
-        if (!result.ok) {
-            return {
-                applyState: "pending",
-                applyError: sanitizeProviderLoginError(result.error || "targeted apply failed", secret),
-            };
-        }
-        markApplied(env, agentId, expectedSignature);
-        return { applyState: "applied" };
-    }
-    catch (error) {
-        return { applyState: "pending", applyError: sanitizeProviderLoginError(error, secret) };
-    }
-}
-/**
- * 为已有 builtin Pi Agent 配置已知 preset 或自定义 OpenAI 兼容端点。
- * 凭证事务覆盖 auth.json / models.json / models-store.json；模型写入走独立 CAS。
- * 不读取 host ~/.pi，也不验证真实 provider。
- */
-export async function configureBuiltinPiProvider(input, deps = {}) {
-    const env = input.env ?? process.env;
-    const load = deps.loadConfig ?? loadConfig;
-    const beginTransaction = deps.beginTransaction ?? beginBuiltinPiCredentialTransaction;
-    const configureModel = deps.configureModel ?? configureBuiltinPiProviderModel;
-    const createRuntime = deps.createRuntime ?? createOfficialPiModelRuntime;
-    const runLogin = deps.runLogin ?? runOfficialPiLogin;
-    const createInteraction = deps.createInteraction ?? createApiKeyOnlyInteraction;
-    const mutate = deps.mutateConfig ?? mutateConfig;
-    const inspect = deps.readProcessState ?? readProcessState;
-    const upsert = deps.requestUpsert ?? requestAgentUpsert;
-    const markApplied = deps.markApplied ?? markConfigApplied;
-    let selection;
-    try {
-        selection = resolveBuiltinPiLoginSelection({
-            preset: input.preset,
-            apiKey: input.apiKey,
-            model: input.model,
-            baseUrl: input.baseUrl,
-        });
-    }
-    catch (error) {
-        throw new Error(sanitizeProviderLoginError(error, input.apiKey));
-    }
-    const { configDir } = assertTargetBuiltinPi(env, input.agentId, load);
-    const transaction = beginTransaction(configDir, input.agentId);
-    try {
-        if (selection.preset === "custom") {
-            configureModel(configDir, input.agentId, {
-                distribution: "builtin",
-                preset: "custom",
-                model: selection.model,
-                baseUrl: selection.baseUrl,
-            });
-        }
-        const runtime = await createRuntime(configDir, input.agentId);
-        await runLogin(runtime, selection.provider, "api_key", createInteraction(selection.apiKey));
-        const applied = await applyTargetModel(env, input.agentId, selection.model, mutate, inspect, upsert, markApplied, input.apiKey);
-        transaction.commit();
-        return {
-            agentId: input.agentId,
-            provider: selection.provider,
-            preset: selection.preset,
-            model: selection.model,
-            credentialType: "api_key",
-            applyState: applied.applyState,
-            ...(applied.applyError ? { applyError: applied.applyError } : {}),
-        };
-    }
-    catch (error) {
-        try {
-            transaction.rollback();
-        }
-        catch { /* 原始错误优先 */ }
-        throw new Error(sanitizeProviderLoginError(error, input.apiKey));
-    }
-}
-export async function logoutBuiltinPiProvider(input, deps = {}) {
-    const env = input.env ?? process.env;
-    const load = deps.loadConfig ?? loadConfig;
-    if (!PROVIDER_ID.test(input.providerId))
-        throw new Error("logout 需要安全的 provider ID");
-    const { configDir } = assertTargetBuiltinPi(env, input.agentId, load);
-    const beginTransaction = deps.beginTransaction ?? beginBuiltinPiCredentialTransaction;
-    const createLogoutRuntime = deps.createLogoutRuntime ?? createOfficialPiLogoutRuntime;
-    const logout = deps.logout ?? logoutOfficialPiProvider;
-    const transaction = beginTransaction(configDir, input.agentId);
-    try {
-        const runtime = await createLogoutRuntime(configDir, input.agentId);
-        await logout(runtime, input.providerId);
-        transaction.commit();
-        return { agentId: input.agentId, provider: input.providerId };
-    }
-    catch (error) {
-        try {
-            transaction.rollback();
-        }
-        catch { /* 原始错误优先 */ }
-        throw new Error(sanitizeProviderLoginError(error));
-    }
-}