mu-agent 0.1.4 → 0.1.7

package/judge/dist/setup.js

@@ -0,0 +1,2051 @@
+import { createRequire as __muCreateRequire } from "node:module"; const require = __muCreateRequire(import.meta.url);
+
+// packages/kyrn-judge/src/setup/main.ts
+import { constants } from "node:os";
+import { join as join4 } from "node:path";
+import {
+  applyHttpProxySettings,
+  configureHttpDispatcher,
+  ModelRuntime,
+  SettingsManager as SettingsManager2
+} from "../../dist/bundle/index.js";
+
+// packages/kyrn-judge/src/auth/exit.ts
+import { mkdirSync, rmdirSync } from "node:fs";
+import { resolve } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+async function exitWhenUnlocked(code, files, exit, { limitMs = 5e3, pollMs = 20 } = {}) {
+  const locks = lockFolders(files);
+  const deadline = Date.now() + limitMs;
+  while (true) {
+    const taken = takeAll(locks);
+    if (taken || Date.now() >= deadline) {
+      for (const lock of taken ?? []) drop(lock);
+      exit(code);
+      return;
+    }
+    await sleep(pollMs);
+  }
+}
+function lockFolders(files) {
+  return [...new Set(files.map((file) => `${resolve(file)}.lock`))];
+}
+function takeAll(locks) {
+  const taken = [];
+  for (const lock of locks) {
+    try {
+      mkdirSync(lock);
+      taken.push(lock);
+    } catch (error) {
+      if (error.code !== "EEXIST") continue;
+      for (const mine of taken) drop(mine);
+      return void 0;
+    }
+  }
+  return taken;
+}
+function drop(lock) {
+  try {
+    rmdirSync(lock);
+  } catch {
+  }
+}
+
+// packages/kyrn-judge/src/naming.ts
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function muEnv(name, env = process.env) {
+  return env[`MU_${name}`] || env[`KYRN_${name}`] || void 0;
+}
+var CONFIG_FILE = "mu.json";
+var LEGACY_CONFIG_FILE = "kyrn.json";
+function muHome(home2 = homedir()) {
+  const current = join(home2, ".mu");
+  const legacy = join(home2, ".kyrn");
+  return existsSync(current) || !existsSync(legacy) ? current : legacy;
+}
+
+// packages/kyrn-judge/src/redact.ts
+var REDACTED = "[redacted]";
+var SHAPES = [
+  // A private key, the whole block, or to the end when the text was cut inside it.
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g,
+  // OpenAI, Anthropic, OpenRouter, DeepSeek and the like.
+  /\bsk-[A-Za-z0-9_-]{20,}/g,
+  /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,})/g,
+  /\bglpat-[A-Za-z0-9_-]{20,}/g,
+  /\bxox[abposr]-[A-Za-z0-9-]{10,}/g,
+  /\bAIza[0-9A-Za-z_-]{35}/g,
+  /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+  /\b[rs]k_(?:live|test)_[0-9A-Za-z]{16,}/g,
+  /\bnpm_[A-Za-z0-9]{36}\b/g,
+  /\bhf_[A-Za-z0-9]{30,}/g,
+  // A JSON web token.
+  /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+];
+var BEARER = /\b(Bearer|Basic)(\s+)(?=[A-Za-z._~+/=-]*[0-9])[A-Za-z0-9._~+/=-]{12,}/g;
+var URL_PASSWORD = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:)[^\s@/]+(@)/gi;
+var KEY_WORD = "(?:SECRET|TOKEN|PASSWD|PASSWORD|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY)";
+var ENV_VALUE = new RegExp(`\\b([A-Z0-9_]*${KEY_WORD}[A-Z0-9_]*=)("[^"\\n]{8,}"|'[^'\\n]{8,}'|[^\\s"';&|]{8,})`, "g");
+var QUOTED_VALUE = new RegExp(
+  `(["']?[A-Za-z0-9_-]*${KEY_WORD.replaceAll("_?", "[_-]?")}[A-Za-z0-9_-]*["']?\\s*[:=]\\s*)(["'])[^"'\\s]{8,}\\2`,
+  "gi"
+);
+var LINE_VALUE = new RegExp(
+  `^(\\s*[A-Za-z0-9_.-]*${KEY_WORD.replaceAll("_?", "[_.-]?")}[A-Za-z0-9_.-]*\\s*[:=][ \\t]*)[^\\s#"']{8,}[ \\t]*$`,
+  "gim"
+);
+function redactSecrets(text, known = []) {
+  let clean = text;
+  for (const secret of known) if (clean.includes(secret)) clean = clean.split(secret).join(REDACTED);
+  for (const shape of SHAPES) clean = clean.replace(shape, REDACTED);
+  return clean.replace(BEARER, `$1$2${REDACTED}`).replace(URL_PASSWORD, `$1${REDACTED}$2`).replace(ENV_VALUE, `$1${REDACTED}`).replace(QUOTED_VALUE, `$1$2${REDACTED}$2`).replace(LINE_VALUE, `$1${REDACTED}`);
+}
+
+// packages/kyrn-judge/src/setup/env-file.ts
+var DEFINITION = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/;
+function closingQuote(text, quote) {
+  for (let index = 0; index < text.length; index++) {
+    if (quote === '"' && text[index] === "\\") index++;
+    else if (text[index] === quote) return index;
+  }
+  return -1;
+}
+function readEnvEntries(text) {
+  const entries = [];
+  const lines = text.replace(/^\uFEFF/, "").split(/\r?\n/);
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index].trim();
+    if (!line || line.startsWith("#")) continue;
+    const match = DEFINITION.exec(line);
+    if (!match) continue;
+    const [, name, rest] = match;
+    const quote = rest[0];
+    if (quote !== '"' && quote !== "'") {
+      entries.push({ name, value: rest.replace(/\s+#.*$/, "").trim(), first: index, last: index });
+      continue;
+    }
+    let body = rest.slice(1);
+    let end = closingQuote(body, quote);
+    const startedAt = index;
+    while (end < 0 && index + 1 < lines.length) {
+      body += `
+${lines[++index]}`;
+      end = closingQuote(body, quote);
+    }
+    if (end < 0) {
+      index = startedAt;
+      continue;
+    }
+    const value = body.slice(0, end);
+    entries.push({
+      name,
+      value: quote === '"' ? value.replace(/\\(["\\$`])/g, "$1") : value,
+      first: startedAt,
+      last: index
+    });
+  }
+  return entries;
+}
+function envFileValue(text, name) {
+  return readEnvEntries(text).find((entry) => entry.name === name)?.value;
+}
+function formatEnvValue(value) {
+  if (/^[A-Za-z0-9_./:@+-]*$/.test(value)) return value;
+  if (!value.includes("'")) return `'${value}'`;
+  return `"${value.replace(/(["\\$`])/g, "\\$1")}"`;
+}
+function setEnvValue(text, name, value) {
+  const newline = text.includes("\r\n") ? "\r\n" : "\n";
+  const bom = text.startsWith("\uFEFF") ? "\uFEFF" : "";
+  const lines = text.replace(/^\uFEFF/, "").split(/\r?\n/);
+  const found = readEnvEntries(text).filter((entry) => entry.name === name);
+  const assignment = (exported2) => `${exported2 ? "export " : ""}${name}=${formatEnvValue(value)}`;
+  if (found.length === 0) {
+    const body = lines.join(newline);
+    const separator = body === "" || body.endsWith(newline) ? "" : newline;
+    return `${bom}${body}${separator}${assignment(false)}${newline}`;
+  }
+  const drop2 = /* @__PURE__ */ new Set();
+  for (const entry of found.slice(1)) for (let line = entry.first; line <= entry.last; line++) drop2.add(line);
+  const [first] = found;
+  const exported = /^\s*export\s/.test(lines[first.first]);
+  const next = [];
+  for (let index = 0; index < lines.length; index++) {
+    if (drop2.has(index)) continue;
+    if (index === first.first) next.push(assignment(exported));
+    else if (index > first.first && index <= first.last) continue;
+    else next.push(lines[index]);
+  }
+  return `${bom}${next.join(newline)}`;
+}
+
+// packages/kyrn-judge/src/setup/files.ts
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { basename, dirname, join as join2 } from "node:path";
+var PRIVATE_FILE = 384;
+var PRIVATE_FOLDER = 448;
+function backupStamp(now) {
+  const two = (value) => String(value).padStart(2, "0");
+  return `${now.getFullYear()}-${two(now.getMonth() + 1)}-${two(now.getDate())}T${two(now.getHours())}-${two(now.getMinutes())}-${two(now.getSeconds())}`;
+}
+var Backups = class {
+  constructor(home2, now) {
+    this.saved = /* @__PURE__ */ new Set();
+    this.root = join2(home2, "backups");
+    this.stamp = backupStamp(now);
+  }
+  /** Copies `file` the first time it is about to change in this run. A file that does not exist has nothing to keep. */
+  save(file) {
+    if (this.saved.has(file) || !existsSync2(file)) return;
+    const folder = this.folder();
+    const copy = join2(folder, basename(file));
+    copyFileSync(file, copy);
+    try {
+      chmodSync(copy, PRIVATE_FILE);
+    } catch {
+    }
+    this.saved.add(file);
+  }
+  /** Where this run's copies are, once one was made. */
+  get path() {
+    return this.made;
+  }
+  folder() {
+    if (this.made) return this.made;
+    mkdirSync2(this.root, { recursive: true, mode: PRIVATE_FOLDER });
+    for (let attempt = 1; ; attempt++) {
+      const candidate = join2(this.root, attempt === 1 ? this.stamp : `${this.stamp}-${attempt}`);
+      try {
+        mkdirSync2(candidate, { mode: PRIVATE_FOLDER });
+        this.made = candidate;
+        return candidate;
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+      }
+    }
+  }
+};
+function readJsonFile(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return { state: "absent" };
+    return { state: "unreadable" };
+  }
+  if (!text.trim()) return { state: "ok", value: {} };
+  try {
+    const value = JSON.parse(text.replace(/^/, ""));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? { state: "ok", value } : { state: "unreadable" };
+  } catch {
+    return { state: "unreadable" };
+  }
+}
+function writeFileAtomic(path, text) {
+  mkdirSync2(dirname(path), { recursive: true });
+  let mode = PRIVATE_FILE;
+  try {
+    mode = statSync(path).mode & 511;
+  } catch {
+  }
+  const temporary = `${path}.mu-setup-${process.pid}`;
+  writeFileSync(temporary, text, { mode });
+  try {
+    chmodSync(temporary, mode);
+    renameSync(temporary, path);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+    throw error;
+  }
+}
+function writeJsonFile(path, value) {
+  writeFileAtomic(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function existingProvider(models, id) {
+  const providers = models.providers;
+  return isRecord(providers) && isRecord(providers[id]) ? providers[id] : void 0;
+}
+function mergeModels(existing, added) {
+  const kept = Array.isArray(existing) ? [...existing] : [];
+  const have = new Set(kept.flatMap((model) => isRecord(model) && typeof model.id === "string" ? [model.id] : []));
+  return [...kept, ...added.filter((model) => !have.has(model.id)).map((model) => ({ ...model }))];
+}
+function withProvider(models, id, entry) {
+  const providers = isRecord(models.providers) ? models.providers : {};
+  const current = isRecord(providers[id]) ? providers[id] : {};
+  const next = {
+    ...current,
+    name: typeof current.name === "string" ? current.name : entry.name,
+    baseUrl: entry.baseUrl,
+    api: entry.api,
+    models: mergeModels(current.models, entry.models)
+  };
+  if (entry.apiKey !== void 0 && current.apiKey === void 0) next.apiKey = entry.apiKey;
+  if (entry.compat !== void 0 && current.compat === void 0) next.compat = { ...entry.compat };
+  if (next.name === void 0) delete next.name;
+  return { ...models, providers: { ...providers, [id]: next } };
+}
+function withModel(models, providerId, modelId) {
+  const providers = isRecord(models.providers) ? models.providers : {};
+  const current = isRecord(providers[providerId]) ? providers[providerId] : {};
+  return {
+    ...models,
+    providers: { ...providers, [providerId]: { ...current, models: mergeModels(current.models, [{ id: modelId }]) } }
+  };
+}
+function judgeConfigPath(agentDir2, exists = existsSync2) {
+  const current = join2(agentDir2, CONFIG_FILE);
+  const legacy = join2(agentDir2, LEGACY_CONFIG_FILE);
+  return !exists(current) && exists(legacy) ? legacy : current;
+}
+function tiersOf(config) {
+  const tiers = config?.tiers;
+  const named2 = Array.isArray(tiers) ? tiers.filter((tier) => typeof tier === "string") : [];
+  return named2.length > 0 ? named2 : ["jev"];
+}
+function withTiers(config, tiers) {
+  return { ...config, tiers: [...tiers] };
+}
+function readTextFile(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function writeEnvValue(path, name, value) {
+  writeFileAtomic(path, setEnvValue(readTextFile(path) ?? "", name, value));
+}
+
+// packages/kyrn-judge/src/setup/language.ts
+function languageOf(value) {
+  const tag = value?.trim().split(/[.@]/)[0];
+  if (!tag || tag === "C" || tag === "POSIX") return void 0;
+  return /^zh(?:[-_]|$)/i.test(tag) ? "zh" : "en";
+}
+function setupLanguage(env, systemLocale2) {
+  for (const name of ["MU_LANG", "KYRN_LANG", "LC_ALL", "LC_MESSAGES", "LANG"]) {
+    const found = languageOf(env[name]);
+    if (found) return found;
+  }
+  return languageOf(systemLocale2) ?? "en";
+}
+function systemLocale() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().locale;
+  } catch {
+    return void 0;
+  }
+}
+function article(name) {
+  return `${/^[AEIOUaeioux]/.test(name) ? "an" : "a"} ${name}`;
+}
+
+// packages/kyrn-judge/src/setup/pi-access.ts
+import { CredentialSynchronizationError, SettingsManager } from "../../dist/bundle/index.js";
+function piAccess(runtime, agentDir2) {
+  return {
+    providerExists: (provider) => runtime.getProvider(provider) !== void 0,
+    models: (provider) => runtime.getModels(provider).map((model) => model.id),
+    baseUrl: (provider, api) => runtime.getModels(provider).find((model) => model.api === api)?.baseUrl ?? runtime.getProvider(provider)?.baseUrl,
+    credential: async (provider) => {
+      const found = (await runtime.listCredentials()).find((credential) => credential.providerId === provider);
+      if (!found) return void 0;
+      return found.type === "oauth" ? "oauth" : "api_key";
+    },
+    storeKey: async (provider, key) => {
+      await runtime.refresh({ allowNetwork: false, providers: [provider] });
+      if (!runtime.getProvider(provider)) {
+        throw new Error(`pi has no provider ${provider}${runtime.getError() ? `: ${runtime.getError()}` : ""}`);
+      }
+      let asked = false;
+      try {
+        await runtime.login(provider, "api_key", {
+          // pi's key login asks one question, the key. Anything else is not answered, and nothing is guessed.
+          prompt: async (prompt) => {
+            if (asked || prompt.type !== "secret") throw new Error(`pi asked ${provider} for more than a key`);
+            asked = true;
+            return key;
+          },
+          notify: () => {
+          }
+        });
+      } catch (error) {
+        if (!(error instanceof CredentialSynchronizationError)) throw error;
+      }
+    },
+    setDefaultModel: async (provider, model) => {
+      const settings = SettingsManager.create(agentDir2, agentDir2, { projectTrusted: false });
+      const unreadable = settings.drainErrors().find((problem) => problem.scope === "global");
+      if (unreadable) throw new Error(`settings.json cannot be read: ${unreadable.error.message}`);
+      settings.setDefaultModelAndProvider(provider, model);
+      await settings.flush();
+      const failed = settings.drainErrors()[0];
+      if (failed) throw new Error(`settings.json was not written: ${failed.error.message}`);
+    }
+  };
+}
+
+// packages/kyrn-judge/src/setup/terminal.ts
+import { createInterface } from "node:readline";
+var ESCAPES = /\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b[@-_]/g;
+function askLine(input, output, question) {
+  return new Promise((resolve2) => {
+    const lines = createInterface({ input, output, terminal: input.isTTY === true });
+    let settled = false;
+    const finish = (answer) => {
+      if (settled) return;
+      settled = true;
+      lines.close();
+      resolve2(answer);
+    };
+    lines.on("SIGINT", () => {
+      output.write("\n");
+      finish(void 0);
+    });
+    lines.on("close", () => finish(void 0));
+    lines.question(question, (answer) => finish(answer));
+  });
+}
+function askSecret(input, output, question) {
+  if (!input.isTTY) return askLine(input, output, question);
+  return new Promise((resolve2) => {
+    output.write(question);
+    const wasRaw = input.isRaw;
+    input.setRawMode(true);
+    let value = "";
+    const finish = (answer) => {
+      input.removeListener("data", onData);
+      input.setRawMode(wasRaw);
+      input.pause();
+      output.write("\n");
+      resolve2(answer);
+    };
+    const onData = (chunk) => {
+      const text = (typeof chunk === "string" ? chunk : chunk.toString("utf8")).replace(ESCAPES, "");
+      for (const char of text) {
+        if (char === "\r" || char === "\n") return finish(value);
+        if (char === "") return finish(void 0);
+        if (char === "") {
+          if (value === "") return finish(void 0);
+        } else if (char === "\x7F" || char === "\b") value = Array.from(value).slice(0, -1).join("");
+        else if (char === "") value = "";
+        else if (char >= " ") value += char;
+      }
+    };
+    input.on("data", onData);
+    input.resume();
+  });
+}
+function terminalPrompter(input = process.stdin, output = process.stdout, errors = process.stderr) {
+  return {
+    say: (text) => output.write(`${text}
+`),
+    warn: (text) => errors.write(`${text}
+`),
+    ask: (question) => askLine(input, output, question),
+    secret: (question) => askSecret(input, output, question)
+  };
+}
+async function readAll(input = process.stdin) {
+  const chunks = [];
+  for await (const chunk of input) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// packages/kyrn-judge/src/setup/wizard.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+
+// packages/kyrn-judge/src/setup/check.ts
+var CHECK_TIMEOUT_MS = 1e4;
+function checkRequest(kind, baseUrl, key) {
+  const base = baseUrl.replace(/\/+$/, "");
+  const headers = { accept: "application/json" };
+  switch (kind) {
+    case "anthropic-models":
+      headers["anthropic-version"] = "2023-06-01";
+      if (key?.includes("sk-ant-oat")) {
+        headers.authorization = `Bearer ${key}`;
+        headers["anthropic-beta"] = "oauth-2025-04-20";
+      } else if (key) headers["x-api-key"] = key;
+      return { url: `${base}/v1/models?limit=1000`, headers };
+    case "google-models":
+      if (key) headers["x-goog-api-key"] = key;
+      return { url: `${base}/models?pageSize=1000`, headers };
+    case "openrouter-key":
+      if (key) headers.authorization = `Bearer ${key}`;
+      return { url: `${base}/key`, headers };
+    default:
+      if (key) headers.authorization = `Bearer ${key}`;
+      return { url: `${base}/models`, headers };
+  }
+}
+var BALANCE = /insufficient[\s_-]*(?:balance|quota|credit|funds)|arrear|balance|quota|credit|billing|payment|recharge|top[\s-]?up|余额|欠费|充值|额度/i;
+var REGION = /unsupported_country|country|region|territory|location is not supported|user location|request not allowed|不支持.*地区|地区.*不支持/i;
+var WRONG_KEY = /api[\s_-]?key[\s_-]*(?:not valid|invalid)|invalid[\s_-]*api[\s_-]*key|incorrect api key|invalid authentication|authentication fails|unauthori[sz]ed|token is invalid|令牌.*(?:过期|不正确)|invalid[\s_-]*(?:token|x-api-key)/i;
+var PERMISSION = /scope|permission|not allowed to|insufficient permissions/i;
+function messageOf(body) {
+  try {
+    const parsed = JSON.parse(body);
+    const error = parsed.error;
+    const candidates = [
+      typeof error === "object" && error !== null ? error.message : void 0,
+      typeof error === "string" ? error : void 0,
+      parsed.message,
+      typeof error === "object" && error !== null ? error.code : void 0,
+      parsed.code
+    ];
+    const found = candidates.find((value) => typeof value === "string" && value.trim());
+    if (typeof found === "string") return found;
+  } catch {
+  }
+  return body.trimStart().startsWith("<") ? "" : body;
+}
+function safeMessage(text, key) {
+  const known = key ? [key] : [];
+  const clean = redactSecrets(text, known).replace(/\*{2,}[A-Za-z0-9_-]{0,12}/g, "\u2026").replace(/\s+/g, " ").trim();
+  return clean.length > 160 ? `${clean.slice(0, 157)}...` : clean;
+}
+function classifyAnswer(status, body) {
+  const text = `${messageOf(body)} ${body}`;
+  if (status === 401) return "key";
+  if (status === 402) return "balance";
+  if (status === 404) return "address";
+  if (status >= 500) return "server";
+  if (status === 400 || status === 403 || status === 429) {
+    if (BALANCE.test(text)) return "balance";
+    if (REGION.test(text)) return "region";
+    if (WRONG_KEY.test(text)) return "key";
+    if (status === 429) return "rate";
+    if (status === 403) return PERMISSION.test(text) ? "permission" : "refused";
+  }
+  return "other";
+}
+function errorCode(error, depth = 0) {
+  if (typeof error !== "object" || error === null || depth > 4) return "";
+  const { code, cause, errors } = error;
+  if (typeof code === "string" && code) return code;
+  if (Array.isArray(errors) && errors.length > 0) return errorCode(errors[0], depth + 1);
+  return errorCode(cause, depth + 1);
+}
+function classifyFailure(error) {
+  const name = error instanceof Error ? error.name : "";
+  if (name === "TimeoutError" || name === "AbortError") return "timeout";
+  const code = errorCode(error);
+  if (code === "UND_ERR_CONNECT_TIMEOUT" || code === "ETIMEDOUT" || code === "UND_ERR_HEADERS_TIMEOUT")
+    return "timeout";
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns";
+  if (/CERT|SSL|TLS|SELF_SIGNED|UNABLE_TO_VERIFY/.test(code)) return "tls";
+  return "connection";
+}
+function listedModels(kind, body) {
+  if (typeof body !== "object" || body === null) return void 0;
+  const record = body;
+  const list = Array.isArray(record.data) ? record.data : Array.isArray(record.models) ? record.models : void 0;
+  if (!list) return void 0;
+  const ids = [];
+  for (const entry of list) {
+    if (typeof entry === "string") {
+      ids.push(entry);
+      continue;
+    }
+    if (typeof entry !== "object" || entry === null) continue;
+    const model = entry;
+    if (kind === "google-models") {
+      const methods = model.supportedGenerationMethods;
+      if (Array.isArray(methods) && !methods.includes("generateContent")) continue;
+    }
+    const id = typeof model.id === "string" ? model.id : typeof model.name === "string" ? model.name : void 0;
+    if (id) ids.push(kind === "google-models" ? id.replace(/^models\//, "") : id);
+  }
+  return [...new Set(ids)];
+}
+async function checkKey({
+  kind,
+  baseUrl,
+  key,
+  fetch,
+  timeoutMs = CHECK_TIMEOUT_MS
+}) {
+  const request = checkRequest(kind, baseUrl, key);
+  const url = request.url.split("?")[0];
+  let response;
+  try {
+    response = await fetch(request.url, { headers: request.headers, signal: AbortSignal.timeout(timeoutMs) });
+  } catch (error) {
+    return { ok: false, problem: { kind: classifyFailure(error), url } };
+  }
+  let text = "";
+  try {
+    text = await response.text();
+  } catch {
+  }
+  if (!response.ok) {
+    return {
+      ok: false,
+      problem: {
+        kind: classifyAnswer(response.status, text),
+        url,
+        status: response.status,
+        said: safeMessage(messageOf(text), key) || void 0
+      }
+    };
+  }
+  if (kind === "openrouter-key") return { ok: true, url };
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    return { ok: false, problem: { kind: "response", url, status: response.status } };
+  }
+  const models = listedModels(kind, body);
+  if (!models) return { ok: false, problem: { kind: "response", url, status: response.status } };
+  return { ok: true, url, models };
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+function explainProblem(problem, context, language) {
+  const { service } = context;
+  const host = hostOf(problem.url);
+  const seconds = Math.round((context.timeoutMs ?? CHECK_TIMEOUT_MS) / 1e3);
+  const local = /^(localhost|127\.|\[::1\])/.test(host);
+  const proxyHint = language === "zh" ? context.proxy ? `\u8FD9\u6B21\u8BF7\u6C42\u8D70\u4E86\u4EE3\u7406\uFF08${context.proxy}\uFF09\uFF0C\u786E\u8BA4\u4EE3\u7406\u6B63\u5728\u8FD0\u884C\u3002` : "\u5982\u679C\u9700\u8981\u4EE3\u7406\uFF1A\u8BBE\u7F6E HTTPS_PROXY\uFF0C\u6216\u5728 ~/.mu/agent/settings.json \u91CC\u5199 httpProxy\uFF0C\u7136\u540E\u91CD\u65B0\u8FD0\u884C mu setup\u3002" : context.proxy ? `The request went through your proxy (${context.proxy}): check that it is running.` : "If you need a proxy, set HTTPS_PROXY (or httpProxy in ~/.mu/agent/settings.json) and run mu setup again.";
+  const said = problem.said ? language === "zh" ? `\uFF08\u670D\u52A1\u7684\u539F\u8BDD\uFF1A${problem.said}\uFF09` : ` (The service said: ${problem.said})` : "";
+  const zh = language === "zh";
+  switch (problem.kind) {
+    case "key":
+      return zh ? `${service} \u4E0D\u63A5\u53D7\u8FD9\u4E2A\u5BC6\u94A5\u3002\u68C0\u67E5\u662F\u5426\u5B8C\u6574\u590D\u5236\uFF0C\u4EE5\u53CA\u5B83\u786E\u5B9E\u662F ${service} \u7684\u5BC6\u94A5\u3002` : `${service} does not accept this key. Check that you copied all of it, and that it is ${article(service)} key.`;
+    case "refused":
+      return zh ? `${service} \u62D2\u7EDD\u4E86\u8FD9\u4E2A\u5BC6\u94A5\uFF08HTTP 403\uFF09\uFF1A\u53EF\u80FD\u662F\u5BC6\u94A5\u4E0D\u5BF9\uFF0C\u6216\u5B83\u6CA1\u6709\u8BBF\u95EE\u6743\u9650\u3002${said}` : `${service} refused this key (HTTP 403): it may be wrong, or not allowed access.${said}`;
+    case "permission":
+      return zh ? "\u8FD9\u4E2A\u5BC6\u94A5\u6709\u6548\uFF0C\u4F46\u6CA1\u6709\u8BFB\u53D6\u6A21\u578B\u5217\u8868\u7684\u6743\u9650\uFF08\u53D7\u9650\u5BC6\u94A5\uFF09\u3002\u7ED9\u5B83\u8BFB\u53D6\u6A21\u578B\u7684\u6743\u9650\uFF0C\u6216\u6362\u4E00\u4E2A\u5BC6\u94A5\u3002" : "The key works, but may not read the list of models (a restricted key). Allow it to read models, or use another key.";
+    case "balance":
+      return zh ? `${service} \u7684\u8D26\u6237\u6CA1\u6709\u4F59\u989D\u6216\u989D\u5EA6\u4E86\u3002\u5145\u503C\u540E\u91CD\u65B0\u8FD0\u884C mu setup\u3002` : `The ${service} account has no balance or quota left. Top it up, then run mu setup again.`;
+    case "region":
+      return zh ? `${service} \u4E0D\u5411\u4F60\u6240\u5728\u7684\u5730\u533A\u63D0\u4F9B\u670D\u52A1\u3002\u9700\u8981\u4E00\u4E2A\u4F4D\u4E8E\u652F\u6301\u5730\u533A\u7684\u4EE3\u7406\u6216 VPN\u3002${proxyHint}` : `${service} does not serve the region this request came from. A proxy or VPN in a supported region is needed. ${proxyHint}`;
+    case "rate":
+      return zh ? `${service} \u8BF4\u8BF7\u6C42\u592A\u9891\u7E41\u3002\u7B49\u4E00\u5206\u949F\u518D\u8BD5\u3002` : `${service} says there were too many requests. Wait a minute and try again.`;
+    case "address":
+      return zh ? `${problem.url} \u8FD9\u4E2A\u5730\u5740\u4E0D\u5B58\u5728\uFF08HTTP 404\uFF09\uFF1A\u5730\u5740\u586B\u9519\u4E86\u3002` : `Nothing answers at ${problem.url} (HTTP 404): the address is wrong.`;
+    case "server":
+      return zh ? `${service} \u81EA\u5DF1\u51FA\u9519\u4E86\uFF08HTTP ${problem.status}\uFF09\u3002\u8FC7\u4E00\u4F1A\u513F\u518D\u8BD5\u3002` : `${service} had an error of its own (HTTP ${problem.status}). Try again in a while.`;
+    case "response":
+      return zh ? `${problem.url} \u6709\u56DE\u5E94\uFF0C\u4F46\u4E0D\u662F\u6A21\u578B\u5217\u8868\uFF1A\u68C0\u67E5\u5730\u5740\u548C\u63A5\u53E3\u7C7B\u578B\u3002` : `${problem.url} answered, but not with a list of models: check the address and the API type.`;
+    case "timeout":
+      return zh ? `${seconds} \u79D2\u5185 ${host} \u6CA1\u6709\u56DE\u5E94\u3002\u7F51\u7EDC\u53EF\u80FD\u4E0D\u901A\uFF1A\u6709\u4E9B\u5730\u533A\u8981\u7528\u4EE3\u7406\u6216 VPN \u624D\u80FD\u8BBF\u95EE\u3002${proxyHint}` : `No answer from ${host} within ${seconds} s. The network may block it: in some regions a proxy or VPN is needed. ${proxyHint}`;
+    case "dns":
+      return zh ? `\u627E\u4E0D\u5230 ${host}\uFF1A\u6CA1\u6709\u8054\u7F51\uFF0C\u6216\u8FD9\u91CC\u89E3\u6790\u4E0D\u4E86\u8FD9\u4E2A\u57DF\u540D\u3002${proxyHint}` : `Could not find ${host}: there is no internet connection, or the name cannot be resolved here. ${proxyHint}`;
+    case "connection":
+      if (local) {
+        return zh ? `${host} \u4E0A\u6CA1\u6709\u670D\u52A1\u5728\u76D1\u542C\uFF1A\u5B83\u542F\u52A8\u4E86\u5417\uFF1F` : `Nothing is listening at ${host}: is the service running?`;
+      }
+      return zh ? `\u8FDE\u4E0D\u4E0A ${host}\u3002${proxyHint}` : `Could not connect to ${host}. ${proxyHint}`;
+    case "tls":
+      return zh ? `\u548C ${host} \u7684\u5B89\u5168\u8FDE\u63A5\u5931\u8D25\u4E86\uFF1A\u53EF\u80FD\u6709\u4EE3\u7406\u6216\u9632\u706B\u5899\u5728\u62E6\u622A HTTPS\u3002` : `The secure connection to ${host} failed: a proxy or firewall may be intercepting HTTPS.`;
+    default:
+      return zh ? `${service} \u62D2\u7EDD\u4E86\u8FD9\u6B21\u68C0\u67E5\uFF08HTTP ${problem.status ?? "?"}\uFF09\u3002${said}` : `${service} refused the check (HTTP ${problem.status ?? "?"}).${said}`;
+  }
+}
+
+// packages/kyrn-judge/src/setup/services.ts
+var SK_HEX32 = /^sk-[0-9a-f]{32}$/;
+var ZHIPU = /^[0-9a-f]{32}\.[A-Za-z0-9]{16}$/;
+var SETUP_SERVICES = [
+  {
+    id: "deepseek",
+    name: "DeepSeek",
+    baseUrls: ["https://api.deepseek.com"],
+    api: "openai-completions",
+    models: ["deepseek-v4-pro", "deepseek-chat"],
+    keyShape: SK_HEX32,
+    keyPage: "https://platform.deepseek.com/api_keys",
+    providers: ["deepseek"],
+    builtIn: true
+  },
+  {
+    id: "qwen",
+    name: "Qwen",
+    baseUrls: ["https://dashscope.aliyuncs.com/compatible-mode/v1"],
+    api: "openai-completions",
+    models: ["qwen3-coder-plus", "qwen3-max", "qwen-plus"],
+    // The same shape as DeepSeek's: such a key is asked about, never tried on both.
+    keyShape: SK_HEX32,
+    keyPage: "https://bailian.console.aliyun.com/cn-beijing/model/settings/api-key",
+    providers: ["qwen"],
+    builtIn: false,
+    // As pi's own catalog has Alibaba's compatible mode (its qwen-token-plan providers): no developer role, no `store`.
+    compat: { supportsDeveloperRole: false, supportsStore: false }
+  },
+  {
+    id: "kimi",
+    name: "Kimi",
+    // platform.moonshot.cn issues keys for the first address, platform.moonshot.ai for the second.
+    baseUrls: ["https://api.moonshot.cn/v1", "https://api.moonshot.ai/v1"],
+    api: "openai-completions",
+    models: ["kimi-k2.6"],
+    // 48 letters and digits, but not SiliconFlow's 48 lowercase letters nor an OpenAI key (its T3BlbkFJ).
+    keyShape: /^sk-(?![a-z]{48}$)(?![A-Za-z0-9]*T3BlbkFJ)[A-Za-z0-9]{48}$/,
+    // platform.moonshot.cn/console/api-keys redirects here.
+    keyPage: "https://platform.kimi.com/console/api-keys",
+    providers: ["moonshotai-cn", "moonshotai"],
+    builtIn: true
+  },
+  {
+    id: "glm",
+    name: "GLM",
+    // pi's provider on open.bigmodel.cn (zai-coding-cn) is the Coding Plan's address, below. A pay-as-you-go key
+    // goes here, to a provider of mu's.
+    baseUrls: ["https://open.bigmodel.cn/api/paas/v4"],
+    api: "openai-completions",
+    models: ["glm-*"],
+    keyShape: ZHIPU,
+    keyPage: "https://open.bigmodel.cn/usercenter/apikeys",
+    providers: ["glm"],
+    builtIn: false
+  },
+  {
+    // Not in the app's table: pi has a provider of its own for Zhipu's Coding Plan, which bills the subscription.
+    id: "glm-coding",
+    name: "GLM Coding Plan",
+    baseUrls: ["https://open.bigmodel.cn/api/coding/paas/v4"],
+    api: "openai-completions",
+    models: ["glm-5.3", "glm-*"],
+    keyShape: ZHIPU,
+    keyPage: "https://open.bigmodel.cn/usercenter/apikeys",
+    providers: ["zai-coding-cn"],
+    builtIn: true
+  },
+  {
+    id: "siliconflow",
+    name: "SiliconFlow",
+    baseUrls: ["https://api.siliconflow.cn/v1"],
+    api: "openai-completions",
+    models: ["deepseek-ai/DeepSeek-V3*", "moonshotai/Kimi-K2*", "Qwen/Qwen3-Coder*"],
+    keyShape: /^sk-[a-z]{48}$/,
+    keyPage: "https://cloud.siliconflow.cn/account/ak",
+    providers: ["siliconflow"],
+    builtIn: false
+  },
+  {
+    id: "stepfun",
+    name: "StepFun",
+    baseUrls: ["https://api.stepfun.com/v1"],
+    api: "openai-completions",
+    models: ["step-*"],
+    keyPage: "https://platform.stepfun.com/interface-key",
+    providers: ["stepfun"],
+    builtIn: false
+  },
+  {
+    id: "openrouter",
+    name: "OpenRouter",
+    baseUrls: ["https://openrouter.ai/api/v1"],
+    api: "openai-completions",
+    models: ["moonshotai/kimi-k2.6"],
+    keyShape: /^sk-or-/,
+    keyPage: "https://openrouter.ai/keys",
+    providers: ["openrouter"],
+    builtIn: true,
+    check: "openrouter-key"
+  },
+  {
+    id: "openai",
+    name: "OpenAI",
+    baseUrls: ["https://api.openai.com/v1"],
+    api: "openai-responses",
+    models: ["gpt-5.5"],
+    keyShape: /^sk-(?:proj-|svcacct-|admin-|(?!ant-|or-)[A-Za-z0-9_-]*T3BlbkFJ)/,
+    keyPage: "https://platform.openai.com/api-keys",
+    providers: ["openai"],
+    builtIn: true
+  },
+  {
+    id: "anthropic",
+    name: "Anthropic",
+    baseUrls: ["https://api.anthropic.com"],
+    api: "anthropic-messages",
+    models: ["claude-opus-4-8"],
+    keyShape: /^sk-ant-/,
+    // console.anthropic.com/settings/keys redirects here.
+    keyPage: "https://platform.claude.com/settings/keys",
+    providers: ["anthropic"],
+    builtIn: true
+  },
+  {
+    id: "google",
+    name: "Google Gemini",
+    baseUrls: ["https://generativelanguage.googleapis.com/v1beta"],
+    api: "google-generative-ai",
+    models: ["gemini-3.1-pro-preview"],
+    keyShape: /^AIza[0-9A-Za-z_-]{35}$/,
+    keyPage: "https://aistudio.google.com/apikey",
+    providers: ["google"],
+    builtIn: true
+  },
+  {
+    id: "xai",
+    name: "xAI",
+    baseUrls: ["https://api.x.ai/v1"],
+    // pi's xai provider speaks the Responses API.
+    api: "openai-responses",
+    models: ["grok-4.7"],
+    keyShape: /^xai-/,
+    keyPage: "https://console.x.ai",
+    providers: ["xai"],
+    builtIn: true
+  },
+  {
+    id: "ollama",
+    name: "Ollama",
+    baseUrls: ["http://localhost:11434/v1"],
+    api: "openai-completions",
+    models: [],
+    keyless: true,
+    providers: ["ollama"],
+    builtIn: false
+  },
+  {
+    // Not in the app's table: any address one types, with the API one names.
+    id: "other",
+    name: "Other",
+    baseUrls: [],
+    api: "openai-completions",
+    models: [],
+    providers: [],
+    builtIn: false,
+    keyOptional: true
+  }
+];
+function serviceById(id) {
+  return SETUP_SERVICES.find((service) => service.id === id);
+}
+function cleanKey(raw) {
+  let key = raw.trim();
+  if (key.length >= 2 && (key[0] === '"' || key[0] === "'") && key.at(-1) === key[0]) key = key.slice(1, -1).trim();
+  return key;
+}
+function servicesForKey(key) {
+  const clean = cleanKey(key);
+  return clean ? SETUP_SERVICES.filter((service) => service.keyShape?.test(clean)) : [];
+}
+function checkKindOf(service, api) {
+  if (service.check) return service.check;
+  if (api === "anthropic-messages") return "anthropic-models";
+  if (api === "google-generative-ai") return "google-models";
+  return "openai-models";
+}
+var NOT_CHAT = /embed|rerank|\btts\b|tts-|whisper|audio|speech|\basr\b|transcri|dall-e|image|moderation|\bocr\b|paraformer|cosyvoice|sambert|wanx|flux|stable-diffusion|kolors|video|realtime|davinci|babbage/i;
+function chatModels(listed) {
+  const chat = listed.filter((id) => !NOT_CHAT.test(id));
+  return chat.length > 0 ? chat : [...listed];
+}
+function versionOf(id) {
+  const found = /\d+(?:\.\d+)*/.exec(id);
+  return found ? found[0].split(".").map(Number) : [];
+}
+function newerFirst(a, b) {
+  const [x, y] = [versionOf(a), versionOf(b)];
+  for (let part = 0; part < Math.max(x.length, y.length); part += 1) {
+    if (x[part] === void 0) return 1;
+    if (y[part] === void 0) return -1;
+    if (x[part] !== y[part]) return y[part] - x[part];
+  }
+  return a.length - b.length;
+}
+function named(wanted, listed) {
+  if (!wanted.endsWith("*")) return listed.includes(wanted) ? wanted : void 0;
+  const prefix = wanted.slice(0, -1);
+  return listed.filter((id) => id.startsWith(prefix)).sort(newerFirst)[0];
+}
+function tableModel(service, listed) {
+  for (const wanted of service.models) {
+    const found = named(wanted, listed);
+    if (found) return found;
+  }
+  return void 0;
+}
+function namedModel(service) {
+  return service.models.find((wanted) => !wanted.endsWith("*"));
+}
+
+// packages/kyrn-judge/src/setup/wizard.ts
+var SETUP_DECLINED_FILE = "setup-declined";
+var SETUP_EXIT = { done: 0, failed: 1, usage: 2, start: 3, cancelled: 130 };
+var SETUP_VALUE_FLAGS = [
+  "--service",
+  "--model",
+  "--base-url",
+  "--api",
+  "--name",
+  "--judge"
+];
+var SETUP_FLAGS = {
+  "-h": "help",
+  "--help": "help",
+  help: "help",
+  "--list": "list",
+  "--first-run": "firstRun",
+  "-y": "yes",
+  "--yes": "yes",
+  "--key-stdin": "keyStdin"
+};
+var JEV_KEY_NAMES = ["TYPESAFE_API_KEY", "MU_JUDGE_OPENROUTER_API_KEY", "AI_GATEWAY_API_KEY"];
+var JEV_TIERS = /* @__PURE__ */ new Set(["jev", "jev-direct", "jev-openrouter", "jev-gateway"]);
+var JEV_PAGE = "https://typesafe.ai";
+var BRANDED = /* @__PURE__ */ new Set(["openai", "anthropic", "openrouter", "google", "xai"]);
+var OTHER = {
+  zh: "\u5176\u4ED6 OpenAI \u6216 Anthropic \u517C\u5BB9\u7684\u670D\u52A1",
+  en: "Another OpenAI- or Anthropic-compatible service"
+};
+var NOT_READY = {
+  zh: "Ollama \u8FD8\u6CA1\u51C6\u5907\u597D\uFF08\u7528 `ollama serve` \u542F\u52A8\u5B83\uFF0C\u518D\u62C9\u53D6\u4E00\u4E2A\u6A21\u578B\uFF09\u3002",
+  en: "Ollama is not ready yet (start it with `ollama serve`, pull a model)."
+};
+function parseSetupArgs(argv) {
+  const values = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  const words = [];
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index];
+    const equals = arg.startsWith("--") ? arg.indexOf("=") : -1;
+    const flag = equals > 0 ? arg.slice(0, equals) : arg;
+    if (SETUP_VALUE_FLAGS.includes(flag)) {
+      const value = equals > 0 ? arg.slice(equals + 1) : argv[++index];
+      if (value === void 0 || value === "" || equals < 0 && value.startsWith("-")) {
+        return { error: { zh: `${flag} \u540E\u9762\u8981\u8DDF\u4E00\u4E2A\u503C`, en: `${flag} needs a value` } };
+      }
+      values.set(flag, value);
+    } else if (SETUP_FLAGS[arg]) flags.add(SETUP_FLAGS[arg]);
+    else if (arg.startsWith("-") && arg.length > 1) {
+      return { error: { zh: `\u4E0D\u8BA4\u8BC6\u7684\u9009\u9879 ${arg}`, en: `unknown option ${arg}` } };
+    } else words.push(arg);
+  }
+  const api = values.get("--api");
+  if (api !== void 0 && api !== "openai" && api !== "anthropic") {
+    return { error: { zh: "--api \u53EA\u80FD\u662F openai \u6216 anthropic", en: "--api is openai or anthropic" } };
+  }
+  const judge = values.get("--judge");
+  if (judge !== void 0 && judge !== "jev" && judge !== "model" && judge !== "none") {
+    return { error: { zh: "--judge \u53EA\u80FD\u662F jev\u3001model \u6216 none", en: "--judge is jev, model or none" } };
+  }
+  const service = values.get("--service");
+  if (service !== void 0 && !serviceById(service)) {
+    return {
+      error: {
+        zh: `\u6CA1\u6709\u53EB ${service} \u7684\u670D\u52A1\uFF08mu setup --list \u5217\u51FA\u5168\u90E8\uFF09`,
+        en: `there is no service called ${service} (mu setup --list shows them)`
+      }
+    };
+  }
+  if (words.length > 1) return { error: { zh: "\u53EA\u80FD\u7ED9\u4E00\u4E2A\u5BC6\u94A5", en: "give one key at most" } };
+  return {
+    help: flags.has("help"),
+    list: flags.has("list"),
+    firstRun: flags.has("firstRun"),
+    yes: flags.has("yes"),
+    keyStdin: flags.has("keyStdin"),
+    service,
+    model: values.get("--model"),
+    baseUrl: values.get("--base-url"),
+    api,
+    name: values.get("--name"),
+    judge,
+    words
+  };
+}
+function setupUsage(language) {
+  if (language === "zh") {
+    return [
+      "mu setup\uFF1A\u7ED9 mu \u63A5\u4E0A\u4E00\u4E2A\u5E72\u6D3B\u7684\u6A21\u578B\uFF0C\u518D\u9009\u4E00\u4E2A\u5224\u5B9A\u5668\u3002",
+      "",
+      "  mu setup                 \u5728\u7EC8\u7AEF\u91CC\u4E00\u6B65\u4E00\u6B65\u95EE",
+      "  mu setup <\u5BC6\u94A5>          \u4ECE\u4E00\u4E2A API \u5BC6\u94A5\u5F00\u59CB\uFF1Amu \u6309\u5BC6\u94A5\u7684\u6837\u5B50\u8BA4\u51FA\u5B83\u5C5E\u4E8E\u54EA\u4E2A\u670D\u52A1",
+      "  mu setup --service <id> --key-stdin [--model <id>] [--base-url <\u5730\u5740>] [--judge jev|model|none] [--yes]",
+      "                           \u7ED9\u811A\u672C\u7528\uFF1A\u5BC6\u94A5\u4ECE\u6807\u51C6\u8F93\u5165\u8BFB\u53D6",
+      "  mu setup --list          mu \u8BA4\u8BC6\u7684\u670D\u52A1\u548C\u5B83\u4EEC\u7684 id",
+      "",
+      "\u4E3A\u4EC0\u4E48\u811A\u672C\u8981\u4ECE\u6807\u51C6\u8F93\u5165\u7ED9\u5BC6\u94A5\uFF1A\u5199\u5728\u547D\u4EE4\u884C\u4E0A\u7684\u5BC6\u94A5\u4F1A\u7559\u5728 shell \u7684\u5386\u53F2\u8BB0\u5F55\u91CC\uFF0C",
+      "\u8FD9\u53F0\u7535\u8111\u4E0A\u80FD\u5217\u51FA\u8FDB\u7A0B\u7684\u7A0B\u5E8F\u4E5F\u90FD\u770B\u5F97\u5230\u5B83\u3002mu setup <\u5BC6\u94A5> \u53EA\u662F\u4E3A\u4E86\u4E0A\u624B\u5FEB\uFF1B\u80FD\u5728\u63D0\u793A\u91CC\u7C98\u8D34\u5C31\u7C98\u8D34\u3002",
+      "",
+      "  --judge jev     Jev \u5BC6\u94A5\uFF08TypeSafe\uFF09\u5199\u5728\u6807\u51C6\u8F93\u5165\u7684\u7B2C\u4E8C\u884C\uFF1B\u5DF2\u7ECF\u8BBE\u7F6E\u4E86 TYPESAFE_API_KEY \u5C31\u4E0D\u7528",
+      "  --judge model   \u7528\u521A\u8BBE\u7F6E\u7684\u6A21\u578B\u5F53\u5224\u5B9A\u5668\uFF08\u66F4\u6162\uFF0C\u6BCF\u6B21\u5224\u65AD\u90FD\u82B1 token\uFF09",
+      "  --judge none    \u4E0D\u6539\u5224\u5B9A\u5668\uFF1B\u4E0D\u5199 --judge \u65F6\u4E5F\u4E0D\u6539",
+      "  --api, --name   \u670D\u52A1 other \u7684\u63A5\u53E3\uFF08openai \u6216 anthropic\uFF09\u548C\u5B83\u5728 mu \u91CC\u7684\u540D\u5B57",
+      "  --yes           \u4E0D\u63D0\u95EE\uFF1B\u66FF\u6362\u5DF2\u6709\u7684\u8BBE\u7F6E\uFF08\u8BA2\u9605\u767B\u5F55\u3001\u540C\u540D\u670D\u52A1\u7684\u5730\u5740\u3001Jev \u5BC6\u94A5\uFF09",
+      "",
+      "\u4F1A\u6539\u52A8\u7684\u6587\u4EF6\uFF1A~/.mu/agent \u91CC\u7684 auth.json\uFF08\u5BC6\u94A5\uFF09\u3001models.json\u3001settings.json\u3001mu.json\uFF0C",
+      "\u4EE5\u53CA mu \u8BFB\u53D6\u7684 .env\uFF08Jev \u5BC6\u94A5\uFF09\u3002\u6BCF\u4E2A\u6587\u4EF6\u6539\u52A8\u524D\u90FD\u4F1A\u5148\u590D\u5236\u5230 ~/.mu/backups/<\u65F6\u95F4>/\u3002"
+    ].join("\n");
+  }
+  return [
+    "mu setup: connect a model for mu to work with, and choose its judge.",
+    "",
+    "  mu setup                 asks step by step, in a terminal",
+    "  mu setup <key>           starts from an API key: mu tells by its shape which service it belongs to",
+    "  mu setup --service <id> --key-stdin [--model <id>] [--base-url <url>] [--judge jev|model|none] [--yes]",
+    "                           for scripts: the key is read from stdin",
+    "  mu setup --list          the services mu knows, with their ids",
+    "",
+    "Why stdin for scripts: a key on the command line stays in your shell's history, and every program on this",
+    "computer that lists processes can read it. `mu setup <key>` is there for a quick start; paste the key at the",
+    "prompt when you can.",
+    "",
+    "  --judge jev     the Jev key (TypeSafe) is the second line of stdin, unless TYPESAFE_API_KEY is set already",
+    "  --judge model   the model just set up answers as the judge (slower, and every decision costs tokens)",
+    "  --judge none    leaves the judge as it is, as leaving out --judge does",
+    "  --api, --name   for the service `other`: its API (openai or anthropic) and its name in mu",
+    "  --yes           no questions; replaces what is set up already (a subscription sign-in, a provider's",
+    "                  address, the Jev key)",
+    "",
+    "Files: auth.json (keys), models.json, settings.json and mu.json in ~/.mu/agent, and the .env mu reads",
+    "(the Jev key). Each is copied to ~/.mu/backups/<time>/ before it changes."
+  ].join("\n");
+}
+function label(service, language) {
+  return service.id === "other" ? OTHER[language] : service.name;
+}
+function serviceList(language) {
+  const width = Math.max(...SETUP_SERVICES.map((service) => service.id.length));
+  return SETUP_SERVICES.map((service) => `  ${service.id.padEnd(width)}  ${label(service, language)}`).join("\n");
+}
+function providerIdFor(baseUrl) {
+  let host;
+  try {
+    host = new URL(baseUrl).host.toLowerCase();
+  } catch {
+    return "custom";
+  }
+  const [name, port] = host.split(/:(?=\d+$)/);
+  if (name === "localhost" || /^\d+(\.\d+){3}$/.test(name) || name.startsWith("[")) {
+    return port ? `local-${port}` : "local";
+  }
+  const parts = name.split(".").filter((part) => part !== "api" && part !== "www");
+  const main2 = parts.length >= 2 ? parts[parts.length - 2] : parts[0] ?? "";
+  return main2.replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "custom";
+}
+function hostOf2(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+function tilde(path, env) {
+  const home2 = env.HOME || env.USERPROFILE;
+  return home2 && path.startsWith(home2) ? `~${path.slice(home2.length)}` : path;
+}
+function jevKeyAt(env, envFileText) {
+  for (const name of JEV_KEY_NAMES) {
+    if (name in env) {
+      if (env[name]) return { name, where: "env" };
+      continue;
+    }
+    if (envFileText !== void 0 && envFileValue(envFileText, name)) return { name, where: "file" };
+  }
+  return void 0;
+}
+var Stop = class extends Error {
+  constructor(code) {
+    super(`mu setup stopped (${code})`);
+    this.code = code;
+  }
+};
+var Setup = class {
+  constructor(args, deps) {
+    this.args = args;
+    this.deps = deps;
+    this.io = deps.io;
+    this.language = deps.language;
+    this.scripted = args.keyStdin || args.yes || !deps.interactive;
+  }
+  async run() {
+    try {
+      return await this.steps();
+    } catch (error) {
+      if (error instanceof Stop) return error.code;
+      throw error;
+    }
+  }
+  t(text) {
+    return text[this.language];
+  }
+  /** A service in a sentence: `other` by the name it was given, once it has one ("box does not accept this key"). */
+  name(service) {
+    return service.id === "other" && this.customName ? this.customName : label(service, this.language);
+  }
+  names(services) {
+    return services.map((service) => this.name(service)).join(this.language === "zh" ? " \u548C " : " and ");
+  }
+  path(path) {
+    return tilde(path, this.deps.env);
+  }
+  cancelled() {
+    this.io.say(this.t({ zh: "\u5DF2\u505C\u6B62\uFF0C\u4EC0\u4E48\u90FD\u6CA1\u6709\u6539\u3002", en: "Stopped. Nothing was changed." }));
+    return new Stop(SETUP_EXIT.cancelled);
+  }
+  /** A run that cannot go on, with the reason on stderr. */
+  fail(text, code = SETUP_EXIT.failed) {
+    this.io.warn(`mu setup: ${this.t(text)}`);
+    return new Stop(code);
+  }
+  async ask(question) {
+    const answer = await this.io.ask(question);
+    if (answer === void 0) throw this.cancelled();
+    return answer.trim();
+  }
+  /** A key, typed where it does not show; asked again while it is empty. */
+  async secret(question, allowEmpty = false) {
+    for (; ; ) {
+      const answer = await this.io.secret(question);
+      if (answer === void 0) throw this.cancelled();
+      const key = cleanKey(answer);
+      if (key || allowEmpty) return key;
+    }
+  }
+  pasteKey() {
+    return this.secret(
+      this.t({ zh: "\u7C98\u8D34 API \u5BC6\u94A5\uFF08\u4E0D\u4F1A\u663E\u793A\u51FA\u6765\uFF09\uFF1A", en: "Paste the API key (it is not shown): " })
+    );
+  }
+  async choose(question, choices) {
+    this.io.say(question);
+    for (const [index, choice] of choices.entries()) this.io.say(`  ${index + 1}) ${choice.label}`);
+    const range = `1-${choices.length}`;
+    for (; ; ) {
+      const answer = await this.ask(this.t({ zh: `\u8BF7\u9009\u62E9 ${range} [1]\uFF1A`, en: `Choose ${range} [1]: ` }));
+      if (answer === "") return choices[0].value;
+      const number = Number(answer);
+      if (Number.isInteger(number) && number >= 1 && number <= choices.length) return choices[number - 1].value;
+      this.io.say(this.t({ zh: `\u8BF7\u8F93\u5165 ${range} \u4E4B\u95F4\u7684\u6570\u5B57\u3002`, en: `Type a number from ${range}.` }));
+    }
+  }
+  async confirm(question, yes) {
+    for (; ; ) {
+      const answer = (await this.ask(question)).toLowerCase();
+      if (answer === "") return yes;
+      if (["y", "yes", "\u662F", "\u597D", "\u8981"].includes(answer)) return true;
+      if (["n", "no", "\u5426", "\u4E0D", "\u4E0D\u8981"].includes(answer)) return false;
+    }
+  }
+  async steps() {
+    const { args, deps } = this;
+    if (args.firstRun && !await this.firstStart()) return SETUP_EXIT.done;
+    let key = deps.givenKey ?? args.words[0];
+    if (args.keyStdin) {
+      if (deps.stdinTerminal) {
+        throw this.fail(
+          {
+            zh: "--key-stdin \u4ECE\u7BA1\u9053\u8BFB\u5BC6\u94A5\u3002\u5728\u7EC8\u7AEF\u91CC\u8BF7\u76F4\u63A5\u8FD0\u884C mu setup\uFF0C\u5728\u63D0\u793A\u91CC\u7C98\u8D34\u5BC6\u94A5\uFF08\u4E0D\u4F1A\u663E\u793A\uFF09\u3002",
+            en: "--key-stdin reads the key from a pipe. In a terminal, run mu setup and paste the key at its prompt (it is not shown)."
+          },
+          SETUP_EXIT.usage
+        );
+      }
+      const [modelKey, jevKey] = (await deps.readStdin()).split(/\r?\n/).map((line) => cleanKey(line)).filter(Boolean);
+      key = modelKey;
+      this.jevFromStdin = jevKey;
+    }
+    if (this.scripted && key === void 0 && args.service === void 0) {
+      throw this.fail(
+        deps.interactive ? { zh: "\u6CA1\u6709\u5BC6\u94A5\uFF0C\u4E5F\u6CA1\u6709 --service", en: "no key and no --service were given" } : {
+          zh: "\u95EE\u9898\u8981\u5728\u7EC8\u7AEF\u91CC\u56DE\u7B54\u3002\u811A\u672C\u91CC\u7528\uFF1Amu setup --service <id> --key-stdin\uFF08\u89C1 mu setup --help\uFF09",
+          en: "its questions need a terminal. For a script: mu setup --service <id> --key-stdin (see mu setup --help)"
+        },
+        SETUP_EXIT.usage
+      );
+    }
+    if (!args.firstRun) {
+      this.io.say(
+        this.t({
+          zh: "mu setup\uFF1A\u7ED9 mu \u63A5\u4E0A\u4E00\u4E2A\u5E72\u6D3B\u7684\u6A21\u578B\uFF0C\u518D\u9009\u4E00\u4E2A\u5224\u5B9A\u5668\u3002",
+          en: "mu setup: connect a model for mu to work with, and choose its judge."
+        })
+      );
+    }
+    const start = await this.start(key === void 0 ? void 0 : cleanKey(key));
+    if (start === "subscription") {
+      const code2 = await this.write(void 0, void 0, await this.judge(void 0));
+      return code2 === SETUP_EXIT.done ? this.offerSession() : code2;
+    }
+    const target = await this.checked(start.service, start.key);
+    this.modelKey = target.key;
+    const model = await this.model(target);
+    await this.conflicts(target);
+    const judge = await this.judge({ provider: target.reach.provider, model });
+    const code = await this.write(target, model, judge);
+    return code === SETUP_EXIT.done ? this.offerSession() : code;
+  }
+  /** The launcher's question on a first start. A no is remembered: the question is never asked again. */
+  async firstStart() {
+    const yes = await this.confirm(
+      this.t({
+        zh: "mu \u8FD8\u6CA1\u6709\u53EF\u7528\u7684\u6A21\u578B\u3002\u73B0\u5728\u8BBE\u7F6E\u4E00\u4E2A\u5417\uFF1F[Y/n] ",
+        en: "mu has no model to work with yet. Set one up now? [Y/n] "
+      }),
+      true
+    );
+    if (yes) return true;
+    try {
+      mkdirSync3(this.deps.paths.agentDir, { recursive: true });
+      writeFileSync2(
+        join3(this.deps.paths.agentDir, SETUP_DECLINED_FILE),
+        "mu asked on its first start whether to set up a model, and the answer was no.\nDelete this file to be asked again; run mu setup any time.\n"
+      );
+    } catch {
+    }
+    this.io.say(
+      this.t({
+        zh: "\u597D\u7684\uFF0C\u4EE5\u540E\u4E0D\u518D\u95EE\u4E86\u3002\u9700\u8981\u65F6\u8FD0\u884C mu setup\uFF0C\u6216\u5728 mu \u91CC\u8F93\u5165 /login\u3002",
+        en: "OK, mu will not ask again. Run mu setup when you want, or type /login inside mu."
+      })
+    );
+    return false;
+  }
+  // -----------------------------------------------------------------------------------------------------------
+  // Steps 1 and 2: how a model is reached, and which service a key belongs to
+  // -----------------------------------------------------------------------------------------------------------
+  async start(key) {
+    const named2 = this.args.service === void 0 ? void 0 : serviceById(this.args.service);
+    if (named2) return this.keyFor(named2, key);
+    if (key !== void 0) return { service: await this.serviceOf(key), key };
+    const route = await this.choose(this.t({ zh: "mu \u7528\u4EC0\u4E48\u65B9\u5F0F\u8FDE\u63A5\u6A21\u578B\uFF1F", en: "How should mu reach a model?" }), [
+      {
+        label: this.t({
+          zh: "\u7C98\u8D34 API \u5BC6\u94A5\uFF08mu \u4F1A\u8BA4\u51FA\u5B83\u5C5E\u4E8E\u54EA\u4E2A\u670D\u52A1\uFF09",
+          en: "Paste an API key (mu tells which service it belongs to)"
+        }),
+        value: "key"
+      },
+      { label: this.t({ zh: "\u4ECE\u5217\u8868\u91CC\u9009\u4E00\u4E2A\u670D\u52A1", en: "Choose a service from the list" }), value: "list" },
+      {
+        label: this.t({
+          zh: "\u7528\u8BA2\u9605\u8D26\u53F7\u767B\u5F55\uFF1AChatGPT\u3001Claude\u3001Grok \u6216 Google",
+          en: "Sign in with a subscription: ChatGPT, Claude, Grok or Google"
+        }),
+        value: "subscription"
+      }
+    ]);
+    if (route === "subscription") {
+      const auth = this.path(join3(this.deps.paths.agentDir, "auth.json"));
+      this.io.say(
+        this.t({
+          zh: `\u8BA2\u9605\u8D26\u53F7\u5728 mu \u91CC\u9762\u767B\u5F55\uFF1A\u542F\u52A8 mu\uFF0C\u8F93\u5165 /login\uFF0C\u9009 ChatGPT\uFF08OpenAI Codex\uFF09\u3001Claude\u3001Grok \u6216 Google\uFF0C\u6309\u63D0\u793A\u5728\u6D4F\u89C8\u5668\u91CC\u5B8C\u6210\u3002\u767B\u5F55\u4FE1\u606F\u4FDD\u5B58\u5728 ${auth}\u3002`,
+          en: `A subscription signs in inside mu: start mu, type /login, choose ChatGPT (OpenAI Codex), Claude, Grok or Google, and finish in the browser. The sign-in is kept in ${auth}.`
+        })
+      );
+      return "subscription";
+    }
+    if (route === "list") return this.keyFor(await this.pickService(SETUP_SERVICES), void 0);
+    const pasted = await this.pasteKey();
+    return { service: await this.serviceOf(pasted), key: pasted };
+  }
+  pickService(services, question) {
+    return this.choose(
+      question ?? this.t({ zh: "\u9009\u54EA\u4E2A\u670D\u52A1\uFF1F", en: "Which service?" }),
+      services.map((service) => ({ label: label(service, this.language), value: service }))
+    );
+  }
+  /**
+   * The service a key belongs to, by its shape. When the shape fits several, or none, the person says which: a key is
+   * never tried on one vendor after another.
+   */
+  async serviceOf(key) {
+    const matches = servicesForKey(key);
+    if (matches.length === 1) {
+      this.io.say(
+        this.t({
+          zh: `\u8FD9\u662F ${this.name(matches[0])} \u7684\u5BC6\u94A5\u3002`,
+          en: `This is ${article(this.name(matches[0]))} key.`
+        })
+      );
+      return matches[0];
+    }
+    if (this.scripted) {
+      throw this.fail(
+        matches.length > 1 ? {
+          zh: `${this.names(matches)} \u7684\u5BC6\u94A5\u957F\u5F97\u4E00\u6837\u3002\u7528 --service \u8BF4\u660E\u662F\u54EA\u5BB6\uFF1A${matches.map((service) => service.id).join(" \u6216 ")}`,
+          en: `keys of ${this.names(matches)} look the same. Say which with --service ${matches.map((service) => service.id).join(" or ")}`
+        } : {
+          zh: "\u8BA4\u4E0D\u51FA\u8FD9\u4E2A\u5BC6\u94A5\u5C5E\u4E8E\u54EA\u4E2A\u670D\u52A1\u3002\u7528 --service <id> \u8BF4\u660E\uFF08mu setup --list \u5217\u51FA\u5168\u90E8\uFF09",
+          en: "this key's shape names no service mu knows. Say which with --service <id> (mu setup --list)"
+        },
+        SETUP_EXIT.usage
+      );
+    }
+    if (matches.length > 1) {
+      return this.pickService(
+        matches,
+        this.t({
+          zh: `${this.names(matches)} \u7684\u5BC6\u94A5\u957F\u5F97\u4E00\u6837\u3002\u8FD9\u4E2A\u5BC6\u94A5\u662F\u54EA\u5BB6\u7684\uFF1Fmu \u53EA\u628A\u5BC6\u94A5\u53D1\u7ED9\u5B83\u6240\u5C5E\u7684\u670D\u52A1\u3002`,
+          en: `Keys of ${this.names(matches)} look the same. Which service is this key for? mu sends a key only to the service it belongs to.`
+        })
+      );
+    }
+    return this.pickService(
+      SETUP_SERVICES.filter((service) => !service.keyless),
+      this.t({
+        zh: "mu \u8BA4\u4E0D\u51FA\u8FD9\u4E2A\u5BC6\u94A5\u3002\u5B83\u662F\u54EA\u4E2A\u670D\u52A1\u7684\uFF1F",
+        en: "mu does not recognise this key. Which service is it for?"
+      })
+    );
+  }
+  /** The key for a service that was named: asked for when there is none yet, and held against the service's shapes. */
+  async keyFor(service, given) {
+    if (service.keyless) return { service };
+    if (service.keyOptional && given === void 0) return { service };
+    let key = given;
+    if (key === void 0 && !this.scripted) {
+      if (service.keyPage) {
+        this.io.say(
+          this.t({ zh: `\u5BC6\u94A5\u5728\u8FD9\u91CC\u521B\u5EFA\uFF1A${service.keyPage}`, en: `Keys are made at ${service.keyPage}` })
+        );
+      }
+      key = await this.pasteKey();
+    }
+    if (!key) {
+      if (service.keyOptional) return { service };
+      throw this.fail(
+        { zh: `${this.name(service)} \u9700\u8981\u4E00\u4E2A API \u5BC6\u94A5`, en: `${this.name(service)} needs an API key` },
+        SETUP_EXIT.usage
+      );
+    }
+    const matches = servicesForKey(key);
+    const ownAddress = service.id === "other" || this.args.baseUrl !== void 0;
+    if (matches.length === 0 || matches.includes(service) || ownAddress) return { service, key };
+    if (this.scripted) {
+      this.io.warn(
+        this.t({
+          zh: `\u6CE8\u610F\uFF1A\u8FD9\u4E2A\u5BC6\u94A5\u770B\u8D77\u6765\u662F ${this.names(matches)} \u7684\uFF1B\u6309 --service \u53D1\u7ED9 ${this.name(service)}\u3002`,
+          en: `Note: this key looks like ${article(this.names(matches))} key; it goes to ${this.name(service)}, as --service says.`
+        })
+      );
+      return { service, key };
+    }
+    const chosen = await this.pickService(
+      [service, ...matches],
+      this.t({
+        zh: `\u8FD9\u4E2A\u5BC6\u94A5\u770B\u8D77\u6765\u662F ${this.names(matches)} \u7684\uFF0C\u4E0D\u50CF ${this.name(service)} \u7684\u3002\u5B83\u662F\u54EA\u5BB6\u7684\uFF1F`,
+        en: `This key looks like ${article(this.names(matches))} key, not ${article(this.name(service))} one. Which service is it for?`
+      })
+    );
+    return { service: chosen, key };
+  }
+  // -----------------------------------------------------------------------------------------------------------
+  // Step 3: one request to the service
+  // -----------------------------------------------------------------------------------------------------------
+  /** The addresses to try, in order: the service's own (where pi has them), or the one typed for `other`. */
+  async reaches(service) {
+    const { args, deps } = this;
+    if (service.id !== "other") {
+      const own = service.baseUrls.map((baseUrl2, index) => ({
+        provider: service.providers[index],
+        builtIn: service.builtIn,
+        // pi's own address, with a models.json override: the key goes where pi will send it anyway.
+        baseUrl: service.builtIn && deps.pi.baseUrl(service.providers[index], service.api) || baseUrl2,
+        api: service.api
+      }));
+      return args.baseUrl ? [{ ...own[0], baseUrl: args.baseUrl.replace(/\/+$/, "") }] : own;
+    }
+    let baseUrl = args.baseUrl;
+    if (!baseUrl) {
+      if (this.scripted) {
+        throw this.fail(
+          { zh: "\u670D\u52A1 other \u9700\u8981 --base-url", en: "--service other needs --base-url" },
+          SETUP_EXIT.usage
+        );
+      }
+      for (; ; ) {
+        baseUrl = await this.ask(
+          this.t({
+            zh: "\u670D\u52A1\u7684\u5730\u5740\uFF08base URL\uFF09\uFF0C\u4F8B\u5982 https://api.example.com/v1\uFF1A",
+            en: "The service's address (base URL), e.g. https://api.example.com/v1: "
+          })
+        );
+        if (/^https?:\/\/[^\s/]+/i.test(baseUrl)) break;
+        this.io.say(
+          this.t({ zh: "\u5730\u5740\u4EE5 http:// \u6216 https:// \u5F00\u5934\u3002", en: "The address starts with http:// or https://." })
+        );
+      }
+    }
+    const api = args.api === "anthropic" ? "anthropic-messages" : args.api === "openai" || this.scripted ? "openai-completions" : await this.choose(this.t({ zh: "\u5B83\u7528\u54EA\u79CD\u63A5\u53E3\uFF1F", en: "Which API does it speak?" }), [
+      {
+        label: this.t({
+          zh: "OpenAI \u517C\u5BB9\uFF08chat completions\uFF09",
+          en: "OpenAI-compatible (chat completions)"
+        }),
+        value: "openai-completions"
+      },
+      {
+        label: this.t({ zh: "Anthropic \u517C\u5BB9\uFF08messages\uFF09", en: "Anthropic-compatible (messages)" }),
+        value: "anthropic-messages"
+      }
+    ]);
+    let base = baseUrl.replace(/\/+$/, "");
+    if (api === "anthropic-messages") base = base.replace(/\/v1$/, "");
+    let provider = args.name ?? providerIdFor(base);
+    if (!args.name && deps.pi.providerExists(provider) && !this.inModelsFile(provider))
+      provider = `${provider}-custom`;
+    if (!args.name && !this.scripted) {
+      const typed = await this.ask(
+        this.t({
+          zh: `\u7ED9\u5B83\u8D77\u4E2A\u7B80\u77ED\u7684\u540D\u5B57\uFF08\u5B57\u6BCD\u3001\u6570\u5B57\u3001-\uFF09[${provider}]\uFF1A`,
+          en: `A short name for it in mu (letters, digits, -) [${provider}]: `
+        })
+      );
+      if (typed) provider = typed.toLowerCase().replace(/[^a-z0-9-]+/g, "-");
+    }
+    this.customName = provider;
+    return [{ provider, builtIn: false, baseUrl: base, api }];
+  }
+  inModelsFile(provider) {
+    const models = readJsonFile(join3(this.deps.paths.agentDir, "models.json"));
+    return models.state === "ok" && existingProvider(models.value, provider) !== void 0;
+  }
+  /** A failure as the person can act on it: a local service that is silent is not ready yet, whatever the key. */
+  explain(service, problem) {
+    if (service.keyless && ["connection", "timeout", "dns"].includes(problem.kind)) return this.t(NOT_READY);
+    return explainProblem(
+      problem,
+      { service: this.name(service), proxy: this.deps.proxy, timeoutMs: this.deps.timeoutMs },
+      this.language
+    );
+  }
+  /** The key, checked: asked again, retried, or taken unchecked until the person has one that works, or stops. */
+  async checked(service, firstKey) {
+    let key = firstKey;
+    const reaches = await this.reaches(service);
+    if (service.keyOptional && key === void 0 && !this.scripted) {
+      key = await this.secret(
+        this.t({
+          zh: "\u7C98\u8D34\u5B83\u7684 API \u5BC6\u94A5\uFF1B\u4E0D\u9700\u8981\u5BC6\u94A5\u5C31\u76F4\u63A5\u56DE\u8F66\uFF08\u4E0D\u4F1A\u663E\u793A\uFF09\uFF1A",
+          en: "Paste its API key, or press Enter if it takes none (not shown): "
+        }),
+        true
+      ) || void 0;
+    }
+    if (!reaches[0].builtIn || this.args.baseUrl) this.modelsFileWritable();
+    await this.oauthConflict(service, reaches);
+    for (; ; ) {
+      const result = await this.tryReaches(service, reaches, key);
+      if (result.ok) return { service, reach: result.reach, key, listed: result.listed };
+      const said = this.explain(service, result.problem);
+      if (this.scripted) throw this.fail({ zh: said, en: said });
+      this.io.say(said);
+      const choices = [];
+      if (!service.keyless)
+        choices.push({ label: this.t({ zh: "\u6362\u4E00\u4E2A\u5BC6\u94A5", en: "Paste another key" }), value: "key" });
+      choices.push({ label: this.t({ zh: "\u518D\u8BD5\u4E00\u6B21", en: "Try again" }), value: "again" });
+      if (result.problem.kind !== "key") {
+        choices.push({
+          label: this.t({ zh: "\u4E0D\u68C0\u67E5\u4E86\uFF0C\u7167\u6837\u4FDD\u5B58", en: "Save it without the check" }),
+          value: "unchecked"
+        });
+      }
+      choices.push({
+        label: this.t({ zh: "\u5230\u6B64\u4E3A\u6B62\uFF08\u4EC0\u4E48\u90FD\u4E0D\u6539\uFF09", en: "Stop here (nothing is changed)" }),
+        value: "stop"
+      });
+      const next = await this.choose(this.t({ zh: "\u63A5\u4E0B\u6765\u600E\u4E48\u529E\uFF1F", en: "What now?" }), choices);
+      if (next === "stop") throw this.cancelled();
+      if (next === "unchecked") return { service, reach: reaches[0], key };
+      if (next === "key") key = await this.pasteKey();
+    }
+  }
+  /** Each address of the service in turn: Kimi's .cn, then .ai; an address of one's own, then with /v1 added. */
+  async tryReaches(service, reaches, key) {
+    let first;
+    const candidates = [...reaches];
+    for (let index = 0; index < candidates.length; index++) {
+      const reach = candidates[index];
+      const where = `${this.name(service)}\uFF08${hostOf2(reach.baseUrl)}\uFF09`;
+      this.io.say(
+        key ? this.t({
+          zh: `\u6B63\u5728\u7528 ${where}\u68C0\u67E5\u5BC6\u94A5\u2026\u2026`,
+          en: `Checking the key with ${this.name(service)} (${hostOf2(reach.baseUrl)})...`
+        }) : this.t({
+          zh: `\u6B63\u5728\u68C0\u67E5 ${where}\u2026\u2026`,
+          en: `Checking ${this.name(service)} (${hostOf2(reach.baseUrl)})...`
+        })
+      );
+      const result = await checkKey({
+        kind: checkKindOf(service, reach.api),
+        baseUrl: reach.baseUrl,
+        key,
+        fetch: this.deps.fetch,
+        timeoutMs: this.deps.timeoutMs ?? CHECK_TIMEOUT_MS
+      });
+      if (result.ok) {
+        const count = result.models?.length;
+        this.io.say(
+          count === void 0 ? this.t({ zh: "\u5BC6\u94A5\u53EF\u4EE5\u7528\u3002", en: "The key works." }) : this.t({
+            zh: `\u53EF\u4EE5\u7528\uFF1A\u5217\u51FA\u4E86 ${count} \u4E2A\u6A21\u578B\u3002`,
+            en: `It works: ${count} model${count === 1 ? "" : "s"} listed.`
+          })
+        );
+        return { ok: true, reach, listed: result.models };
+      }
+      if (result.problem.kind === "permission") {
+        this.io.say(this.explain(service, result.problem));
+        return { ok: true, reach };
+      }
+      first ??= result.problem;
+      if (service.id === "other" && result.problem.kind === "address" && reach.api === "openai-completions" && !reach.baseUrl.endsWith("/v1") && index === candidates.length - 1) {
+        candidates.push({ ...reach, baseUrl: `${reach.baseUrl}/v1` });
+      }
+    }
+    return { ok: false, problem: first ?? { kind: "other", url: reaches[0]?.baseUrl ?? "" } };
+  }
+  /** A subscription sign-in is replaced by a key only with a yes. */
+  async oauthConflict(service, reaches) {
+    for (const reach of reaches) {
+      if (await this.deps.pi.credential(reach.provider) !== "oauth") continue;
+      if (this.args.yes) return;
+      if (this.scripted) {
+        throw this.fail({
+          zh: `${this.name(service)} \u5DF2\u7ECF\u7528\u8BA2\u9605\u8D26\u53F7\u767B\u5F55\u4E86\u3002\u8981\u6539\u5B58\u5BC6\u94A5\uFF0C\u52A0\u4E0A --yes`,
+          en: `${this.name(service)} is signed in with a subscription. To store a key instead, add --yes`
+        });
+      }
+      const replace = await this.confirm(
+        this.t({
+          zh: `\u4F60\u5DF2\u7ECF\u7528\u8BA2\u9605\u8D26\u53F7\u767B\u5F55\u4E86 ${this.name(service)}\u3002\u6539\u7528\u8FD9\u4E2A\u5BC6\u94A5\u5417\uFF1F\u767B\u5F55\u4F1A\u88AB\u66FF\u6362\uFF08\u7559\u6709\u5907\u4EFD\uFF09\u3002[y/N] `,
+          en: `You are signed in to ${this.name(service)} with a subscription. Use this key instead? The sign-in is replaced (a copy is kept). [y/N] `
+        }),
+        false
+      );
+      if (!replace) throw this.cancelled();
+      return;
+    }
+  }
+  modelsFileWritable() {
+    const path = join3(this.deps.paths.agentDir, "models.json");
+    if (readJsonFile(path).state !== "unreadable") return;
+    throw this.fail({
+      zh: `${this.path(path)} \u4E0D\u662F\u7EAF JSON\uFF08\u4E5F\u8BB8\u6709\u6CE8\u91CA\u6216\u5199\u9519\u4E86\uFF09\uFF0Cmu setup \u4E0D\u6539\u5199\u5B83\u3002\u5148\u4FEE\u597D\u5B83\uFF0C\u6216\u624B\u52A8\u628A\u670D\u52A1\u52A0\u8FDB\u53BB\u3002`,
+      en: `${this.path(path)} is not plain JSON (it may have comments, or a typo), and mu setup does not rewrite it. Fix it, or add the service by hand.`
+    });
+  }
+  // -----------------------------------------------------------------------------------------------------------
+  // Step 4: the model to start with
+  // -----------------------------------------------------------------------------------------------------------
+  async model(target) {
+    const { service, listed } = target;
+    if (this.args.model) {
+      if (listed && listed.length > 0 && !listed.includes(this.args.model)) {
+        this.io.say(
+          this.t({
+            zh: `\u6CE8\u610F\uFF1A${this.name(service)} \u6CA1\u6709\u5217\u51FA ${this.args.model}\uFF0C\u7167\u6837\u4F7F\u7528\u3002`,
+            en: `Note: ${this.name(service)} does not list ${this.args.model}; it is used anyway.`
+          })
+        );
+      }
+      return this.args.model;
+    }
+    const startWith = this.t({ zh: "\u5148\u7528\u8FD9\u4E2A\u6A21\u578B\uFF1A", en: "Model to start with: " });
+    const chosen = listed && listed.length > 0 ? tableModel(service, listed) : namedModel(service);
+    if (chosen) {
+      this.io.say(`${startWith}${chosen}`);
+      return chosen;
+    }
+    const options = chatModels(listed ?? []);
+    if (options.length === 0) {
+      const none = service.keyless ? NOT_READY : {
+        zh: `${this.name(service)} \u6CA1\u6709\u5217\u51FA\u6A21\u578B\u3002`,
+        en: `${this.name(service)} lists no models.`
+      };
+      if (this.scripted) {
+        throw this.fail({ zh: `${none.zh}\u53EF\u4EE5\u7528 --model \u6307\u5B9A\u4E00\u4E2A\u3002`, en: `${none.en} Name one with --model.` });
+      }
+      this.io.say(this.t(none));
+      for (; ; ) {
+        const typed = await this.ask(this.t({ zh: "\u8981\u7528\u7684\u6A21\u578B\u540D\uFF1A", en: "The name of the model to use: " }));
+        if (typed) return typed;
+      }
+    }
+    if (this.scripted) {
+      this.io.say(`${startWith}${options[0]}`);
+      return options[0];
+    }
+    const shown = options.slice(0, 20);
+    this.io.say(this.t({ zh: "mu \u5148\u7528\u54EA\u4E2A\u6A21\u578B\uFF1F", en: "Which model should mu start with?" }));
+    for (const [index, id] of shown.entries()) this.io.say(`  ${index + 1}) ${id}`);
+    if (options.length > shown.length) {
+      const more = options.length - shown.length;
+      this.io.say(
+        this.t({
+          zh: `  \uFF08\u8FD8\u6709 ${more} \u4E2A\uFF0C\u8F93\u5165\u540D\u5B57\u4E5F\u53EF\u4EE5\uFF09`,
+          en: `  (${more} more: type a name to use one of them)`
+        })
+      );
+    }
+    for (; ; ) {
+      const answer = await this.ask(
+        this.t({
+          zh: `\u8BF7\u9009\u62E9 1-${shown.length}\uFF0C\u6216\u8F93\u5165\u6A21\u578B\u540D [1]\uFF1A`,
+          en: `Choose 1-${shown.length}, or type a model name [1]: `
+        })
+      );
+      if (answer === "") return shown[0];
+      const number = Number(answer);
+      if (Number.isInteger(number) && number >= 1 && number <= shown.length) return shown[number - 1];
+      if (options.includes(answer) || !/^\d+$/.test(answer)) return answer;
+      this.io.say(
+        this.t({
+          zh: `\u8BF7\u8F93\u5165 1-${shown.length} \u4E4B\u95F4\u7684\u6570\u5B57\uFF0C\u6216\u6A21\u578B\u540D\u3002`,
+          en: `Type a number from 1-${shown.length}, or a model name.`
+        })
+      );
+    }
+  }
+  /** A provider models.json has at another address is moved only with a yes. */
+  async conflicts(target) {
+    if (target.reach.builtIn && !this.args.baseUrl) return;
+    const models = readJsonFile(join3(this.deps.paths.agentDir, "models.json"));
+    if (models.state !== "ok") return;
+    const current = existingProvider(models.value, target.reach.provider)?.baseUrl;
+    const old = typeof current === "string" ? current.replace(/\/+$/, "") : void 0;
+    if (!old || old === target.reach.baseUrl || this.args.yes) return;
+    if (this.scripted) {
+      throw this.fail({
+        zh: `models.json \u91CC\u7684 ${target.reach.provider} \u6307\u5411 ${old}\u3002\u8981\u6539\u6210 ${target.reach.baseUrl}\uFF0C\u52A0\u4E0A --yes`,
+        en: `models.json has ${target.reach.provider} at ${old}. To point it at ${target.reach.baseUrl}, add --yes`
+      });
+    }
+    const move = await this.confirm(
+      this.t({
+        zh: `models.json \u91CC\u5DF2\u7ECF\u6709 ${target.reach.provider}\uFF0C\u5730\u5740\u662F ${old}\u3002\u6539\u6210 ${target.reach.baseUrl} \u5417\uFF1F[y/N] `,
+        en: `models.json already has ${target.reach.provider}, at ${old}. Point it at ${target.reach.baseUrl}? [y/N] `
+      }),
+      false
+    );
+    if (!move) throw this.cancelled();
+  }
+  // -----------------------------------------------------------------------------------------------------------
+  // Step 5: the judge
+  // -----------------------------------------------------------------------------------------------------------
+  async judge(model) {
+    const { env, paths } = this.deps;
+    const envText = readTextFile(paths.envFile);
+    const existing = jevKeyAt(env, envText);
+    if (this.scripted) return this.scriptedJudge(model, envText, existing !== void 0);
+    const where = existing ? existing.where === "env" ? this.t({ zh: `\u73AF\u5883\u53D8\u91CF ${existing.name}`, en: `${existing.name} in your environment` }) : this.t({
+      zh: `${this.path(paths.envFile)} \u91CC\u7684 ${existing.name}`,
+      en: `${existing.name} in ${this.path(paths.envFile)}`
+    }) : void 0;
+    const choices = [];
+    if (where) {
+      choices.push({
+        label: this.t({
+          zh: `Jev\uFF08\u63A8\u8350\uFF09\uFF0C\u7528\u5DF2\u7ECF\u8BBE\u7F6E\u7684\u5BC6\u94A5\uFF08${where}\uFF09`,
+          en: `Jev (recommended), with the key already set (${where})`
+        }),
+        value: "keep"
+      });
+    }
+    choices.push({
+      label: where ? this.t({ zh: "Jev\uFF0C\u6362\u4E00\u4E2A\u65B0\u5BC6\u94A5", en: "Jev, with a new key" }) : this.t({
+        zh: `Jev\uFF08\u63A8\u8350\uFF09\uFF1A\u53C8\u5FEB\u53C8\u51C6\uFF0C\u6309\u6B21\u8BA1\u8D39\u3002\u5BC6\u94A5\u5728 TypeSafe \u7533\u8BF7\uFF1A${JEV_PAGE}`,
+        en: `Jev (recommended): fast and accurate, billed per call. Get a key from TypeSafe: ${JEV_PAGE}`
+      }),
+      value: "jev"
+    });
+    if (model) {
+      choices.push({
+        label: this.t({
+          zh: `\u521A\u8BBE\u7F6E\u7684\u6A21\u578B\uFF08${model.provider}/${model.model}\uFF09\uFF1A\u66F4\u6162\uFF0C\u800C\u4E14\u6BCF\u6B21\u5224\u65AD\u90FD\u8981\u82B1 token`,
+          en: `The model you just set up (${model.provider}/${model.model}): slower, and every decision costs tokens`
+        }),
+        value: "model"
+      });
+    }
+    choices.push({
+      label: this.t({
+        zh: "\u6682\u65F6\u4E0D\u8981\uFF1Amu \u5C31\u50CF pi \u4E00\u6837\u5DE5\u4F5C\uFF0C\u6CA1\u6709\u5224\u5B9A\u5668\u56DE\u7B54",
+        en: "Not now: mu then works like pi, with no judge answering"
+      }),
+      value: "none"
+    });
+    const picked = await this.choose(
+      this.t({
+        zh: "mu \u5DE5\u4F5C\u65F6\u8981\u505A\u5F88\u591A\u5C0F\u5224\u65AD\uFF1A\u8FD9\u6761\u6D88\u606F\u8BE5\u600E\u4E48\u5904\u7406\u3001\u8FD9\u4E00\u6B65\u4F1A\u4E0D\u4F1A\u8FDD\u53CD\u4F60\u5B9A\u7684\u89C4\u5219\u2026\u2026\u5224\u5B9A\u5668\u8D1F\u8D23\u56DE\u7B54\u3002\u9009\u54EA\u4E2A\u5224\u5B9A\u5668\uFF1F",
+        en: "mu makes many small decisions as it works: how to take a message, whether a step breaks your rules. A judge answers them. Which judge?"
+      }),
+      choices
+    );
+    if (picked === "jev") return { kind: "jev", key: await this.jevKey() };
+    return { kind: picked };
+  }
+  scriptedJudge(model, envText, keySet) {
+    switch (this.args.judge) {
+      case "jev": {
+        const key = this.jevFromStdin;
+        if (!key) {
+          if (keySet) return { kind: "keep" };
+          throw this.fail(
+            {
+              zh: "--judge jev \u9700\u8981 Jev \u5BC6\u94A5\uFF1A\u5199\u5728\u6807\u51C6\u8F93\u5165\u7684\u7B2C\u4E8C\u884C\uFF0C\u6216\u5148\u8BBE\u7F6E TYPESAFE_API_KEY",
+              en: "--judge jev needs a Jev key: the second line of stdin, or TYPESAFE_API_KEY set beforehand"
+            },
+            SETUP_EXIT.usage
+          );
+        }
+        if (key === this.modelKey) {
+          throw this.fail(
+            { zh: "Jev \u5BC6\u94A5\u548C\u6A21\u578B\u7684\u5BC6\u94A5\u662F\u540C\u4E00\u4E2A", en: "the Jev key is the same as the model's key" },
+            SETUP_EXIT.usage
+          );
+        }
+        const current = envText === void 0 ? void 0 : envFileValue(envText, "TYPESAFE_API_KEY");
+        if (current && current !== key && !this.args.yes) {
+          throw this.fail({
+            zh: `${this.path(this.deps.paths.envFile)} \u91CC\u5DF2\u7ECF\u6709 TYPESAFE_API_KEY\u3002\u8981\u66FF\u6362\u5B83\uFF0C\u52A0\u4E0A --yes`,
+            en: `${this.path(this.deps.paths.envFile)} has a TYPESAFE_API_KEY already. To replace it, add --yes`
+          });
+        }
+        return { kind: "jev", key };
+      }
+      case "model":
+        return model ? { kind: "model" } : void 0;
+      default:
+        return void 0;
+    }
+  }
+  async jevKey() {
+    for (; ; ) {
+      const key = await this.secret(
+        this.t({
+          zh: "\u7C98\u8D34 Jev \u5BC6\u94A5\uFF08TYPESAFE_API_KEY\uFF0C\u4E0D\u4F1A\u663E\u793A\uFF09\uFF1A",
+          en: "Paste the Jev key (TYPESAFE_API_KEY, not shown): "
+        })
+      );
+      if (key === this.modelKey) {
+        this.io.say(
+          this.t({
+            zh: `\u8FD9\u662F\u521A\u624D\u7ED9\u6A21\u578B\u7684\u5BC6\u94A5\u3002Jev \u7684\u5BC6\u94A5\u5728 TypeSafe \u7533\u8BF7\uFF1A${JEV_PAGE}`,
+            en: `That is the key you gave for the model. A Jev key comes from TypeSafe: ${JEV_PAGE}`
+          })
+        );
+        continue;
+      }
+      const branded = servicesForKey(key).find((service) => BRANDED.has(service.id));
+      if (!branded) return key;
+      const anyway = await this.confirm(
+        this.t({
+          zh: `\u8FD9\u770B\u8D77\u6765\u662F ${this.name(branded)} \u7684\u5BC6\u94A5\uFF0C\u4E0D\u662F Jev \u7684\uFF0C\u5B83\u4F1A\u88AB\u53D1\u7ED9 TypeSafe\u3002\u4ECD\u7136\u4F7F\u7528\u5417\uFF1F[y/N] `,
+          en: `This looks like ${article(this.name(branded))} key, not a Jev key, and it would be sent to TypeSafe. Use it anyway? [y/N] `
+        }),
+        false
+      );
+      if (anyway) return key;
+    }
+  }
+  // -----------------------------------------------------------------------------------------------------------
+  // Step 6: the files
+  // -----------------------------------------------------------------------------------------------------------
+  async write(target, model, judge) {
+    const { deps } = this;
+    const { agentDir: agentDir2 } = deps.paths;
+    const backups = new Backups(deps.paths.home, deps.now());
+    const saved = [];
+    const notes = [];
+    const modelsPath = join3(agentDir2, "models.json");
+    const authPath2 = join3(agentDir2, "auth.json");
+    const settingsPath = join3(agentDir2, "settings.json");
+    try {
+      if (target && model) {
+        const { service, reach, key } = target;
+        const provider = reach.provider;
+        const custom = !reach.builtIn;
+        const moved = reach.builtIn && this.args.baseUrl !== void 0;
+        const unknownModel = reach.builtIn && !deps.pi.models(provider).includes(model);
+        if (custom || moved || unknownModel) {
+          const file = readJsonFile(modelsPath);
+          if (file.state === "unreadable") this.modelsFileWritable();
+          let next = file.state === "ok" ? file.value : {};
+          if (custom) {
+            next = withProvider(next, provider, {
+              name: service.id === "other" ? void 0 : service.name,
+              baseUrl: reach.baseUrl,
+              api: reach.api,
+              // pi counts a provider without a key as unusable: a keyless service gets a placeholder, never a real key.
+              apiKey: service.keyless ? "ollama" : key ? void 0 : "none",
+              compat: service.compat,
+              // What the service lists goes into /model, the one to start with first.
+              models: [model, ...chatModels(target.listed ?? []).filter((id) => id !== model)].map((id) => ({
+                id
+              }))
+            });
+          } else {
+            if (moved) {
+              const providers = existingProviders(next);
+              next = {
+                ...next,
+                providers: { ...providers, [provider]: { ...providers[provider], baseUrl: reach.baseUrl } }
+              };
+            }
+            if (unknownModel) next = withModel(next, provider, model);
+          }
+          backups.save(modelsPath);
+          writeJsonFile(modelsPath, next);
+          saved.push(
+            this.savedLine(
+              modelsPath,
+              custom || moved ? this.t({ zh: `${provider}\uFF1A${reach.baseUrl}`, en: `${provider} at ${reach.baseUrl}` }) : this.t({ zh: `\u7ED9 ${provider} \u52A0\u4E0A ${model}`, en: `${model} added to ${provider}` })
+            )
+          );
+        }
+        if (key) {
+          backups.save(authPath2);
+          await deps.pi.storeKey(provider, key);
+          saved.push(
+            this.savedLine(
+              authPath2,
+              this.t({ zh: `${this.name(service)} \u7684\u5BC6\u94A5`, en: `the ${this.name(service)} key` })
+            )
+          );
+        }
+        backups.save(settingsPath);
+        try {
+          await deps.pi.setDefaultModel(provider, model);
+          saved.push(
+            this.savedLine(
+              settingsPath,
+              this.t({ zh: `\u9ED8\u8BA4\u6A21\u578B ${provider}/${model}`, en: `start on ${provider}/${model}` })
+            )
+          );
+        } catch {
+          notes.push(
+            this.t({
+              zh: `${this.path(settingsPath)} \u8BFB\u4E0D\u4E86\uFF0C\u9ED8\u8BA4\u6A21\u578B\u6CA1\u6709\u4FDD\u5B58\u3002\u5728 mu \u91CC\u7528 /model \u9009\u5B83\u3002`,
+              en: `${this.path(settingsPath)} could not be read, so the default model was not saved. Choose it inside mu with /model.`
+            })
+          );
+        }
+      }
+      if (judge && judge.kind !== "none") this.writeJudge(judge, target, model, backups, saved, notes);
+    } catch (error) {
+      if (error instanceof Stop) throw error;
+      let reason = error instanceof Error ? error.message : String(error);
+      for (const secret of [target?.key, judge?.kind === "jev" ? judge.key : void 0]) {
+        if (secret) reason = reason.replaceAll(secret, "\u2026");
+      }
+      this.io.warn(this.t({ zh: `mu setup\uFF1A\u4FDD\u5B58\u65F6\u51FA\u9519\uFF1A${reason}`, en: `mu setup: saving failed: ${reason}` }));
+      if (saved.length > 0) {
+        this.io.warn(this.t({ zh: "\u51FA\u9519\u524D\u5DF2\u7ECF\u4FDD\u5B58\u7684\uFF1A", en: "Saved before that:" }));
+        for (const entry of saved) this.io.warn(entry);
+      }
+      if (backups.path) {
+        this.io.warn(
+          this.t({
+            zh: `\u539F\u6765\u7684\u6587\u4EF6\u5728 ${this.path(backups.path)}`,
+            en: `The earlier versions are in ${this.path(backups.path)}`
+          })
+        );
+      }
+      return SETUP_EXIT.failed;
+    }
+    if (saved.length > 0) {
+      this.io.say(this.t({ zh: "\u5DF2\u4FDD\u5B58\uFF1A", en: "Saved:" }));
+      for (const entry of saved) this.io.say(entry);
+    }
+    if (backups.path) {
+      this.io.say(
+        this.t({
+          zh: `\u6539\u52A8\u524D\u7684\u6587\u4EF6\u5DF2\u590D\u5236\u5230 ${this.path(backups.path)}`,
+          en: `The files as they were are copied to ${this.path(backups.path)}`
+        })
+      );
+    }
+    for (const note of notes) this.io.say(note);
+    this.summary(target, model, judge);
+    return SETUP_EXIT.done;
+  }
+  savedLine(path, what) {
+    return `  ${this.path(path).padEnd(30)} ${what}`;
+  }
+  writeJudge(judge, target, model, backups, saved, notes) {
+    const { env, paths } = this.deps;
+    const configPath = judgeConfigPath(paths.agentDir);
+    const config = readJsonFile(configPath);
+    const current = config.state === "ok" ? config.value : void 0;
+    let tiers;
+    if (judge.kind === "model") {
+      if (target && model) tiers = [`llm:${target.reach.provider}/${model}`];
+    } else if (!tiersOf(current).some((tier) => JEV_TIERS.has(tier))) tiers = ["jev"];
+    if (tiers && config.state === "unreadable") {
+      notes.push(
+        this.t({
+          zh: `${this.path(configPath)} \u4E0D\u662F\u7EAF JSON\uFF0C\u6CA1\u6709\u6539\u5B83\u3002\u8BF7\u624B\u52A8\u52A0\u4E0A "tiers": ${JSON.stringify(tiers)}`,
+          en: `${this.path(configPath)} is not plain JSON and was left as it is. Add "tiers": ${JSON.stringify(tiers)} by hand.`
+        })
+      );
+    } else if (tiers) {
+      backups.save(configPath);
+      writeJsonFile(configPath, withTiers(current ?? {}, tiers));
+      saved.push(
+        this.savedLine(configPath, this.t({ zh: `\u5224\u5B9A\u5668 ${tiers.join(", ")}`, en: `judge: ${tiers.join(", ")}` }))
+      );
+    }
+    if (judge.kind === "jev") {
+      backups.save(paths.envFile);
+      writeEnvValue(paths.envFile, "TYPESAFE_API_KEY", judge.key);
+      saved.push(
+        this.savedLine(
+          paths.envFile,
+          this.t({ zh: "TYPESAFE_API_KEY\uFF08Jev \u5BC6\u94A5\uFF09", en: "TYPESAFE_API_KEY (the Jev key)" })
+        )
+      );
+      if ("TYPESAFE_API_KEY" in env) {
+        notes.push(
+          this.t({
+            zh: `\u6CE8\u610F\uFF1A\u73AF\u5883\u53D8\u91CF\u91CC\u4E5F\u6709 TYPESAFE_API_KEY\uFF0C\u5B83\u6BD4 ${this.path(paths.envFile)} \u4F18\u5148\u3002\u5230\u8BBE\u7F6E\u5B83\u7684\u5730\u65B9\uFF08\u4F8B\u5982 ~/.zshrc\uFF09\u6539\u6389\u6216\u5220\u6389\u3002`,
+            en: `Note: TYPESAFE_API_KEY is also set in your environment, and it wins over ${this.path(paths.envFile)}. Change or remove it where it is set (~/.zshrc, for example).`
+          })
+        );
+      }
+    }
+    const override = env.MU_JUDGE || env.KYRN_JUDGE;
+    if (override) {
+      notes.push(
+        this.t({
+          zh: `\u6CE8\u610F\uFF1A\u73AF\u5883\u53D8\u91CF MU_JUDGE=${override} \u6BD4 mu.json \u4F18\u5148\uFF0C\u7531\u5B83\u51B3\u5B9A\u5224\u5B9A\u5668\u3002`,
+          en: `Note: MU_JUDGE=${override} is set in your environment; it decides the judge over mu.json.`
+        })
+      );
+    }
+  }
+  summary(target, model, judge) {
+    const done = target && model ? this.t({
+      zh: `\u5B8C\u6210\u3002mu \u4F1A\u7528 ${this.name(target.service)} \xB7 ${model} \u5F00\u59CB\u5DE5\u4F5C\u3002`,
+      en: `Done. mu starts on ${this.name(target.service)} \xB7 ${model}.`
+    }) : this.t({ zh: "\u5B8C\u6210\u3002", en: "Done." });
+    const judged = judge === void 0 ? "" : judge.kind === "model" ? this.t({ zh: "\u5224\u5B9A\u5668\uFF1A\u540C\u4E00\u4E2A\u6A21\u578B\u3002", en: " Judge: the same model." }) : judge.kind === "none" ? this.t({ zh: "\u5224\u5B9A\u5668\uFF1A\u6682\u65F6\u6CA1\u6709\u3002", en: " Judge: none for now." }) : this.t({ zh: "\u5224\u5B9A\u5668\uFF1AJev\u3002", en: " Judge: Jev." });
+    this.io.say("");
+    this.io.say(`${done}${judged}`);
+    this.io.say(
+      target ? this.t({
+        zh: "\u5728 mu \u91CC\u7528 /model \u6362\u6A21\u578B\uFF1B\u968F\u65F6\u53EF\u4EE5\u518D\u8FD0\u884C mu setup\u3002",
+        en: "Switch models inside mu with /model; run mu setup again any time."
+      }) : this.t({ zh: "\u542F\u52A8 mu \u540E\u8F93\u5165 /login \u767B\u5F55\u3002", en: "Start mu and type /login to sign in." })
+    );
+  }
+  /** On its own, a finished setup offers a session; on a first start the launcher goes on into one anyway. */
+  async offerSession() {
+    if (this.args.firstRun || this.scripted) return SETUP_EXIT.done;
+    const start = await this.confirm(this.t({ zh: "\u73B0\u5728\u542F\u52A8 mu \u5417\uFF1F[Y/n] ", en: "Start mu now? [Y/n] " }), true);
+    return start ? SETUP_EXIT.start : SETUP_EXIT.done;
+  }
+};
+function existingProviders(models) {
+  const providers = models.providers;
+  return typeof providers === "object" && providers !== null && !Array.isArray(providers) ? providers : {};
+}
+async function runSetup(argv, deps) {
+  const parsed = parseSetupArgs(argv);
+  if ("error" in parsed) {
+    deps.io.warn(`mu setup: ${parsed.error[deps.language]}`);
+    deps.io.warn(setupUsage(deps.language));
+    return SETUP_EXIT.usage;
+  }
+  if (parsed.help) {
+    deps.io.say(setupUsage(deps.language));
+    return SETUP_EXIT.done;
+  }
+  if (parsed.list) {
+    deps.io.say(serviceList(deps.language));
+    return SETUP_EXIT.done;
+  }
+  return new Setup(parsed, deps).run();
+}
+
+// packages/kyrn-judge/src/setup/main.ts
+var givenKey = process.env.MU_SETUP_KEY || void 0;
+delete process.env.MU_SETUP_KEY;
+var home = process.env.MU_SETUP_HOME || muHome();
+var agentDir = muEnv("AGENT_DIR") || join4(home, "agent");
+var envFile = process.env.MU_SETUP_ENV_FILE || join4(home, ".env");
+var authPath = join4(agentDir, "auth.json");
+var modelsStorePath = join4(agentDir, "models-store.json");
+var givenEnv = { ...process.env };
+var PROXY_VARIABLES = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+function useSessionProxy() {
+  const text = readTextFile(envFile);
+  for (const entry of text === void 0 ? [] : readEnvEntries(text)) {
+    const proxyVariable = PROXY_VARIABLES.includes(entry.name) || /^no_proxy$/i.test(entry.name);
+    if (proxyVariable && !(entry.name in process.env)) process.env[entry.name] = entry.value;
+  }
+  const named2 = PROXY_VARIABLES.find((name) => process.env[name]);
+  let fromSettings;
+  try {
+    fromSettings = SettingsManager2.create(agentDir, agentDir, { projectTrusted: false }).getGlobalSettings().httpProxy?.trim();
+  } catch {
+  }
+  applyHttpProxySettings(fromSettings);
+  configureHttpDispatcher();
+  if (named2) return named2 in givenEnv ? named2 : `${named2}, .env`;
+  return fromSettings ? "httpProxy, settings.json" : void 0;
+}
+async function main() {
+  const proxy = useSessionProxy();
+  const runtime = await ModelRuntime.create({
+    authPath,
+    modelsPath: join4(agentDir, "models.json"),
+    modelsStorePath,
+    refreshOnCreate: false
+  });
+  return runSetup(process.argv.slice(2), {
+    io: terminalPrompter(),
+    language: setupLanguage(process.env, systemLocale()),
+    env: givenEnv,
+    paths: { agentDir, home, envFile },
+    pi: piAccess(runtime, agentDir),
+    // pi's fetch now (configureHttpDispatcher installs it): through the proxy, as a session's requests go.
+    fetch: globalThis.fetch,
+    now: () => /* @__PURE__ */ new Date(),
+    interactive: process.stdin.isTTY === true && process.stdout.isTTY === true,
+    stdinTerminal: process.stdin.isTTY === true,
+    readStdin: () => readAll(),
+    givenKey,
+    proxy
+  });
+}
+var leaving = false;
+var leave = (code) => {
+  if (leaving) return;
+  leaving = true;
+  if (process.stdin.isTTY && process.stdin.isRaw) process.stdin.setRawMode(false);
+  void exitWhenUnlocked(code, [authPath, modelsStorePath], (exitCode) => process.exit(exitCode));
+};
+for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"])
+  process.on(signal, () => leave(128 + constants.signals[signal]));
+main().then(leave, (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  process.stderr.write(`mu setup: ${redactSecrets(message, givenKey ? [givenKey] : [])}
+`);
+  leave(1);
+});