nexos-connect 0.4.0 → 0.5.0

package/dist/index.js

@@ -4,10 +4,10 @@
 import { spawnSync } from "child_process";
 import { createRequire } from "module";
 import os from "os";
-import path21 from "path";
+import path24 from "path";
 import crossSpawn from "cross-spawn";
 import pc12 from "picocolors";
-import * as v12 from "valibot";
+import * as v15 from "valibot";
 
 // src/cli/classify-failure.ts
 import { match } from "ts-pattern";
@@ -393,13 +393,13 @@ function buildIdentityMatching(secrets) {
   if (masksByForm.size === 0) return () => [];
   const alternatives = [...masksByForm.keys()].sort((first, second) => second.length - first.length);
   const pattern = new RegExp(alternatives.map(buildFormPattern).join("|"), "g");
-  return (text2) => [...text2.matchAll(pattern)].map((match25) => toSpan(match25, masksByForm.get(match25[0]) ?? match25[0]));
+  return (text2) => [...text2.matchAll(pattern)].map((match27) => toSpan(match27, masksByForm.get(match27[0]) ?? match27[0]));
 }
 function findShapeSpans(text2) {
-  return [...text2.matchAll(KEY_SHAPE_PATTERN)].map((match25) => toSpan(match25, maskKey(match25[0])));
+  return [...text2.matchAll(KEY_SHAPE_PATTERN)].map((match27) => toSpan(match27, maskKey(match27[0])));
 }
-function toSpan(match25, mask) {
-  return { start: match25.index, end: match25.index + match25[0].length, mask };
+function toSpan(match27, mask) {
+  return { start: match27.index, end: match27.index + match27[0].length, mask };
 }
 function pickOuterSpans(spans) {
   const picked = [];
@@ -716,7 +716,7 @@ function refuse({ question, answers }) {
 }
 
 // src/flows/key/find-existing-keys.ts
-import * as v6 from "valibot";
+import * as v9 from "valibot";
 
 // src/harnesses/claude-code/claude-code.ts
 import path3 from "path";
@@ -1388,14 +1388,14 @@ function listKeyValues(program) {
 }
 function listInBody(keyValues, tablePath) {
   return keyValues.flatMap((keyValue) => {
-    const path22 = [...tablePath, ...keyValue.key.keys.map(readKeyName)];
-    const entry = { path: path22, keyValue, tablePath };
+    const path25 = [...tablePath, ...keyValue.key.keys.map(readKeyName)];
+    const entry = { path: path25, keyValue, tablePath };
     if (keyValue.value.type !== "TOMLInlineTable") return [entry];
-    return [entry, ...listInBody(keyValue.value.body, path22)];
+    return [entry, ...listInBody(keyValue.value.body, path25)];
   });
 }
-function isSamePath(path22, other) {
-  return path22.length === other.length && path22.every((key, index) => key === other[index]);
+function isSamePath(path25, other) {
+  return path25.length === other.length && path25.every((key, index) => key === other[index]);
 }
 function replaceValue(source, node, value) {
   if (node.type === "TOMLValue" && node.value === value) return source.text;
@@ -1740,9 +1740,107 @@ function detectBinary(ctx) {
   return { isFound, detail: isFound ? `${BINARY3} found on PATH` : `${BINARY3} not found on PATH` };
 }
 
+// src/harnesses/crush/crush.ts
+import path5 from "path";
+import { match as match8 } from "ts-pattern";
+import * as v5 from "valibot";
+
+// src/shared/text/read-literal-key.ts
+var COMMAND_PREFIX = "!";
+var VARIABLE_MARKER = "$";
+function readLiteralKey(value) {
+  const key = readNonBlank(value);
+  return key === void 0 || isConfigSubstitution(key) ? void 0 : key;
+}
+function isConfigSubstitution(value) {
+  return value.startsWith(COMMAND_PREFIX) || value.includes(VARIABLE_MARKER);
+}
+
+// src/harnesses/crush/crush.ts
+var BINARY4 = "crush";
+var PROVIDER_ID2 = "nexos";
+var PROVIDER_NAME2 = "nexos.ai";
+var PROVIDER_TYPE2 = "openai-compat";
+var CONFIG_SCHEMA_URL = "https://charm.land/crush.json";
+var crush = {
+  kind: "configurable",
+  id: "crush",
+  label: "Crush",
+  binary: BINARY4,
+  protocols: ["openai-chat"],
+  projectSupport: { kind: "supported" },
+  detect: (ctx) => detectCrush(ctx),
+  configPath: (ctx) => resolveConfigPath2(ctx),
+  plan: (desired, ctx) => [planConfig2(desired, ctx)],
+  readKey: (ctx) => readProviderKey(ctx),
+  readSecrets: (ctx) => readProviderSecrets(ctx),
+  postSetupNotes: [
+    "Crush starts on the model setup chose. For another, run its `model large` command.",
+    "Crush ranks its config, highest first: the project's crushrc, the project's .crush.json or crush.json, the user's crushrc, then the user's crush.json. A higher one that sets the same values overrides this file."
+  ]
+};
+function detectCrush(ctx) {
+  const detected = detectConfigFile([resolveConfigPath2(ctx)], ctx.home);
+  if (detected.isFound || ctx.scope === "project" || !ctx.hasBinary(BINARY4)) return detected;
+  return { isFound: true, detail: `${BINARY4} found on PATH` };
+}
+var USER_DIRECTORY = path5.join(".config", "crush");
+var USER_FILE = "crush.json";
+var PROJECT_FILE = ".crush.json";
+function resolveConfigPath2(ctx) {
+  return match8(ctx.scope).with("user", () => path5.join(ctx.home, USER_DIRECTORY, USER_FILE)).with("project", () => path5.join(ctx.cwd, PROJECT_FILE)).exhaustive();
+}
+function planConfig2(desired, ctx) {
+  return {
+    kind: "file",
+    path: resolveConfigPath2(ctx),
+    hasSecret: true,
+    edits: () => ({ format: "jsonc", updates: listUpdates(desired) })
+  };
+}
+function listUpdates(desired) {
+  const contextWindow = findContextWindow(desired.model);
+  const modelEntry = {
+    id: desired.model,
+    name: desired.model,
+    ...contextWindow === void 0 ? {} : { context_window: contextWindow }
+  };
+  const selection = { provider: PROVIDER_ID2, model: desired.model };
+  return [
+    [["$schema"], CONFIG_SCHEMA_URL],
+    [["providers", PROVIDER_ID2, "type"], PROVIDER_TYPE2],
+    [["providers", PROVIDER_ID2, "name"], PROVIDER_NAME2],
+    [["providers", PROVIDER_ID2, "base_url"], desired.openaiBaseUrl],
+    [["providers", PROVIDER_ID2, "api_key"], desired.apiKey],
+    [["providers", PROVIDER_ID2, "models"], [modelEntry]],
+    [["models", "large"], selection],
+    [["models", "small"], selection]
+  ];
+}
+var ConfigSchema = v5.looseObject({
+  providers: v5.optional(
+    v5.looseObject({ [PROVIDER_ID2]: v5.optional(v5.looseObject({ api_key: v5.optional(v5.string()) })) })
+  )
+});
+function readProviderKey(ctx) {
+  const config = readJsoncFile(resolveConfigPath2(ctx), ConfigSchema);
+  const apiKey = config.kind === "valid" ? config.value.providers?.[PROVIDER_ID2]?.api_key : void 0;
+  return readLiteralKey(apiKey);
+}
+var ProvidersSchema = v5.looseObject({ providers: v5.optional(v5.record(v5.string(), v5.unknown())) });
+var ProviderKeySchema = v5.looseObject({ api_key: v5.string() });
+function readProviderSecrets(ctx) {
+  const config = readJsoncFile(resolveConfigPath2(ctx), ProvidersSchema);
+  if (config.kind !== "valid") return [];
+  return Object.values(config.value.providers ?? {}).flatMap((provider) => {
+    const parsed = v5.safeParse(ProviderKeySchema, provider);
+    return parsed.success ? readLiteralKey(parsed.output.api_key) ?? [] : [];
+  });
+}
+
 // src/harnesses/gemini-cli/gemini-cli.ts
 import fs3 from "fs";
-import path5 from "path";
+import path6 from "path";
 var geminiCli = {
   kind: "unsupported",
   id: "gemini-cli",
@@ -1753,7 +1851,7 @@ var geminiCli = {
 };
 var CONFIG_DIRECTORY3 = ".gemini";
 function detectConfigDirectory(ctx) {
-  const directory = path5.join(ctx.home, CONFIG_DIRECTORY3);
+  const directory = path6.join(ctx.home, CONFIG_DIRECTORY3);
   if (!isDirectory(directory)) return { isFound: false, detail: `no ${displayPath(directory, ctx.home)}` };
   return { isFound: true, detail: "installed, but not configurable through the nexos.ai Gateway" };
 }
@@ -1767,20 +1865,20 @@ function isDirectory(directoryPath) {
 }
 
 // src/harnesses/opencode/opencode.ts
-import path6 from "path";
-import { match as match8 } from "ts-pattern";
-import * as v5 from "valibot";
-var BINARY4 = "opencode";
+import path7 from "path";
+import { match as match9 } from "ts-pattern";
+import * as v6 from "valibot";
+var BINARY5 = "opencode";
 var opencode = {
   kind: "configurable",
   id: "opencode",
   label: "OpenCode",
-  binary: BINARY4,
+  binary: BINARY5,
   protocols: ["openai-chat"],
   projectSupport: { kind: "supported" },
   detect: (ctx) => detectOpenCode(ctx),
-  configPath: (ctx) => resolveConfigPath2(ctx),
-  plan: (desired, ctx) => [planConfig2(desired, ctx)],
+  configPath: (ctx) => resolveConfigPath3(ctx),
+  plan: (desired, ctx) => [planConfig3(desired, ctx)],
   launch: (desired) => {
     const config = renderJsonc(null, [
       ...providerUpdates({ providerId: RUN_PROVIDER_ID2, apiKey: `{env:${RUN_KEY_VARIABLE}}`, desired }),
@@ -1788,7 +1886,7 @@ var opencode = {
       [["enabled_providers"], [RUN_PROVIDER_ID2]]
     ]);
     return {
-      binary: BINARY4,
+      binary: BINARY5,
       arguments: [],
       env: {
         [CONFIG_CONTENT_VARIABLE]: config,
@@ -1800,49 +1898,49 @@ var opencode = {
   launchNotes: [
     'OpenCode adds the "nexos-run" model to its recent models, where it shows as unavailable in later sessions.'
   ],
-  readKey: (ctx) => readProviderKey(ctx),
-  readSecrets: (ctx) => readProviderSecrets(ctx),
+  readKey: (ctx) => readProviderKey2(ctx),
+  readSecrets: (ctx) => readProviderSecrets2(ctx),
   postSetupNotes: [
     "OpenCode keeps its own credentials in its auth.json; this key goes in the provider block instead, so no /connect step is needed."
   ]
 };
 function detectOpenCode(ctx) {
   const detected = detectConfigFile(listConfigCandidates(ctx), ctx.home);
-  if (detected.isFound || ctx.scope === "project" || !ctx.hasBinary(BINARY4)) return detected;
-  return { isFound: true, detail: `${BINARY4} found on PATH` };
+  if (detected.isFound || ctx.scope === "project" || !ctx.hasBinary(BINARY5)) return detected;
+  return { isFound: true, detail: `${BINARY5} found on PATH` };
 }
-var USER_CONFIG_DIRECTORY = path6.join(".config", "opencode");
+var USER_CONFIG_DIRECTORY = path7.join(".config", "opencode");
 var JSON_CONFIG_FILE = "opencode.json";
 var JSONC_CONFIG_FILE = "opencode.jsonc";
 function listConfigCandidates(ctx) {
-  const directory = match8(ctx.scope).with("user", () => path6.join(ctx.home, USER_CONFIG_DIRECTORY)).with("project", () => ctx.cwd).exhaustive();
-  return [path6.join(directory, JSON_CONFIG_FILE), path6.join(directory, JSONC_CONFIG_FILE)];
+  const directory = match9(ctx.scope).with("user", () => path7.join(ctx.home, USER_CONFIG_DIRECTORY)).with("project", () => ctx.cwd).exhaustive();
+  return [path7.join(directory, JSON_CONFIG_FILE), path7.join(directory, JSONC_CONFIG_FILE)];
 }
-function resolveConfigPath2(ctx) {
+function resolveConfigPath3(ctx) {
   const candidates = listConfigCandidates(ctx);
   return findFirstExistingFile(candidates) ?? candidates[0];
 }
-function planConfig2(desired, ctx) {
+function planConfig3(desired, ctx) {
   return {
     kind: "file",
-    path: resolveConfigPath2(ctx),
+    path: resolveConfigPath3(ctx),
     hasSecret: true,
-    edits: (current) => ({ format: "jsonc", updates: listUpdates(desired, parseJsoncConfig(current, ConfigSchema)) })
+    edits: (current) => ({ format: "jsonc", updates: listUpdates2(desired, parseJsoncConfig(current, ConfigSchema2)) })
   };
 }
-var PROVIDER_ID2 = "nexos";
-var PROVIDER_NAME2 = "nexos.ai";
+var PROVIDER_ID3 = "nexos";
+var PROVIDER_NAME3 = "nexos.ai";
 var PROVIDER_PACKAGE = "@ai-sdk/openai-compatible";
 var RUN_PROVIDER_ID2 = "nexos-run";
 var RUN_KEY_VARIABLE = "NEXOS_API_KEY";
 var CONFIG_CONTENT_VARIABLE = "OPENCODE_CONFIG_CONTENT";
 var MODELS_FETCH_SWITCH = "OPENCODE_DISABLE_MODELS_FETCH";
 var SWITCH_ON = "1";
-var CONFIG_SCHEMA_URL = "https://opencode.ai/config.json";
+var CONFIG_SCHEMA_URL2 = "https://opencode.ai/config.json";
 function providerUpdates({ providerId, apiKey, desired }) {
   return [
     [["provider", providerId, "npm"], PROVIDER_PACKAGE],
-    [["provider", providerId, "name"], PROVIDER_NAME2],
+    [["provider", providerId, "name"], PROVIDER_NAME3],
     [["provider", providerId, "options", "baseURL"], desired.openaiBaseUrl],
     [["provider", providerId, "options", "apiKey"], apiKey],
     [["provider", providerId, "models", desired.model, "name"], desired.model],
@@ -1859,49 +1957,269 @@ function listLimitUpdates({ providerId, model }) {
     [["provider", providerId, "models", model, "limit", "output"], OUTPUT_TOKENS]
   ];
 }
-function listUpdates(desired, config) {
-  const updates = providerUpdates({ providerId: PROVIDER_ID2, apiKey: desired.apiKey, desired });
+function listUpdates2(desired, config) {
+  const updates = providerUpdates({ providerId: PROVIDER_ID3, apiKey: desired.apiKey, desired });
   if (!isMissingSchemaUrl(config)) return updates;
-  return [[["$schema"], CONFIG_SCHEMA_URL], ...updates];
+  return [[["$schema"], CONFIG_SCHEMA_URL2], ...updates];
 }
 function isMissingSchemaUrl(config) {
-  return match8(config).with({ kind: "absent" }, () => true).with({ kind: "invalid" }, () => false).with({ kind: "valid" }, ({ value }) => value.$schema === void 0).exhaustive();
+  return match9(config).with({ kind: "absent" }, () => true).with({ kind: "invalid" }, () => false).with({ kind: "valid" }, ({ value }) => value.$schema === void 0).exhaustive();
 }
-function readProviderKey(ctx) {
-  const config = readJsoncFile(resolveConfigPath2(ctx), ConfigSchema);
-  const apiKey = config.kind === "valid" ? config.value.provider?.[PROVIDER_ID2]?.options?.apiKey : void 0;
+function readProviderKey2(ctx) {
+  const config = readJsoncFile(resolveConfigPath3(ctx), ConfigSchema2);
+  const apiKey = config.kind === "valid" ? config.value.provider?.[PROVIDER_ID3]?.options?.apiKey : void 0;
   return apiKey === void 0 || isSubstitution(apiKey) ? void 0 : apiKey;
 }
 var SUBSTITUTION_MARKERS = ["{env:", "{file:"];
 function isSubstitution(value) {
   return SUBSTITUTION_MARKERS.some((marker) => value.includes(marker));
 }
-var ProvidersSchema = v5.looseObject({
-  provider: v5.fallback(v5.optional(v5.record(v5.string(), v5.unknown())), void 0)
+var ProvidersSchema2 = v6.looseObject({
+  provider: v6.fallback(v6.optional(v6.record(v6.string(), v6.unknown())), void 0)
 });
-var ProviderKeySchema = v5.looseObject({ options: v5.looseObject({ apiKey: v5.string() }) });
-function readProviderSecrets(ctx) {
-  const config = readJsoncFile(resolveConfigPath2(ctx), ProvidersSchema);
+var ProviderKeySchema2 = v6.looseObject({ options: v6.looseObject({ apiKey: v6.string() }) });
+function readProviderSecrets2(ctx) {
+  const config = readJsoncFile(resolveConfigPath3(ctx), ProvidersSchema2);
   if (config.kind !== "valid") return [];
   return Object.values(config.value.provider ?? {}).flatMap((provider) => {
-    const parsed = v5.safeParse(ProviderKeySchema, provider);
+    const parsed = v6.safeParse(ProviderKeySchema2, provider);
     if (!parsed.success || isSubstitution(parsed.output.options.apiKey)) return [];
     return readNonBlank(parsed.output.options.apiKey) ?? [];
   });
 }
-var ConfigSchema = v5.looseObject({
-  $schema: v5.optional(v5.unknown()),
-  provider: v5.optional(
-    v5.looseObject({
-      [PROVIDER_ID2]: v5.optional(
-        v5.looseObject({ options: v5.optional(v5.looseObject({ apiKey: v5.optional(v5.string()) })) })
+var ConfigSchema2 = v6.looseObject({
+  $schema: v6.optional(v6.unknown()),
+  provider: v6.optional(
+    v6.looseObject({
+      [PROVIDER_ID3]: v6.optional(
+        v6.looseObject({ options: v6.optional(v6.looseObject({ apiKey: v6.optional(v6.string()) })) })
       )
     })
   )
 });
 
+// src/harnesses/pi/pi.ts
+import path8 from "path";
+import * as v7 from "valibot";
+var BINARY6 = "pi";
+var PROVIDER_ID4 = "nexos";
+var PROVIDER_NAME4 = "nexos.ai";
+var API_TYPE = "openai-completions";
+var pi = {
+  kind: "configurable",
+  id: "pi",
+  label: "Pi",
+  binary: BINARY6,
+  protocols: ["openai-chat"],
+  projectSupport: {
+    kind: "unsupported",
+    reason: "it reads models.json only from its agent directory (~/.pi/agent), never from the project"
+  },
+  detect: (ctx) => detectBinary2(ctx),
+  configPath: (ctx) => resolveModelsPath(ctx),
+  plan: (desired, ctx) => [planModels(desired, ctx), planSettings2(desired, ctx)],
+  readKey: (ctx) => readProviderKey3(ctx),
+  readSecrets: (ctx) => readProviderSecrets3(ctx),
+  postSetupNotes: [
+    "Pi starts on the model setup chose. Change it with /model, and press Ctrl+S to make that the default."
+  ]
+};
+function detectBinary2(ctx) {
+  const isFound = ctx.hasBinary(BINARY6);
+  return { isFound, detail: isFound ? `${BINARY6} found on PATH` : `${BINARY6} not found on PATH` };
+}
+var DEFAULT_AGENT_DIRECTORY = path8.join(".pi", "agent");
+var MODELS_FILE = "models.json";
+var SETTINGS_FILE = "settings.json";
+var HOME_PREFIX = "~";
+function resolveAgentDirectory(ctx) {
+  const configured = readNonBlank(ctx.env.PI_CODING_AGENT_DIR);
+  return configured === void 0 ? path8.join(ctx.home, DEFAULT_AGENT_DIRECTORY) : resolveConfiguredPath(configured, ctx);
+}
+function resolveConfiguredPath(configured, ctx) {
+  if (configured === HOME_PREFIX) return ctx.home;
+  if (configured.startsWith(`${HOME_PREFIX}${path8.sep}`)) {
+    return path8.join(ctx.home, configured.slice(HOME_PREFIX.length + 1));
+  }
+  return path8.resolve(ctx.cwd, configured);
+}
+function resolveModelsPath(ctx) {
+  return path8.join(resolveAgentDirectory(ctx), MODELS_FILE);
+}
+function resolveSettingsPath2(ctx) {
+  return path8.join(resolveAgentDirectory(ctx), SETTINGS_FILE);
+}
+function planModels(desired, ctx) {
+  return {
+    kind: "file",
+    path: resolveModelsPath(ctx),
+    hasSecret: true,
+    edits: () => ({ format: "jsonc", updates: listModelUpdates(desired) })
+  };
+}
+function planSettings2(desired, ctx) {
+  return {
+    kind: "file",
+    path: resolveSettingsPath2(ctx),
+    hasSecret: false,
+    edits: () => ({
+      format: "jsonc",
+      updates: [
+        [["defaultProvider"], PROVIDER_ID4],
+        [["defaultModel"], desired.model]
+      ]
+    })
+  };
+}
+function listModelUpdates(desired) {
+  const contextWindow = findContextWindow(desired.model);
+  const modelEntry = {
+    id: desired.model,
+    name: desired.model,
+    ...contextWindow === void 0 ? {} : { contextWindow }
+  };
+  return [
+    [["providers", PROVIDER_ID4, "baseUrl"], desired.openaiBaseUrl],
+    [["providers", PROVIDER_ID4, "api"], API_TYPE],
+    [["providers", PROVIDER_ID4, "apiKey"], desired.apiKey],
+    [["providers", PROVIDER_ID4, "name"], PROVIDER_NAME4],
+    [["providers", PROVIDER_ID4, "models"], [modelEntry]]
+  ];
+}
+var ModelsSchema = v7.looseObject({
+  providers: v7.optional(
+    v7.looseObject({ [PROVIDER_ID4]: v7.optional(v7.looseObject({ apiKey: v7.optional(v7.string()) })) })
+  )
+});
+function readProviderKey3(ctx) {
+  const models = readJsoncFile(resolveModelsPath(ctx), ModelsSchema);
+  const apiKey = models.kind === "valid" ? models.value.providers?.[PROVIDER_ID4]?.apiKey : void 0;
+  return readLiteralKey(apiKey);
+}
+var ProvidersSchema3 = v7.looseObject({ providers: v7.optional(v7.record(v7.string(), v7.unknown())) });
+var ProviderKeySchema3 = v7.looseObject({ apiKey: v7.string() });
+function readProviderSecrets3(ctx) {
+  const models = readJsoncFile(resolveModelsPath(ctx), ProvidersSchema3);
+  if (models.kind !== "valid") return [];
+  return Object.values(models.value.providers ?? {}).flatMap((provider) => {
+    const parsed = v7.safeParse(ProviderKeySchema3, provider);
+    return parsed.success ? readLiteralKey(parsed.output.apiKey) ?? [] : [];
+  });
+}
+
+// src/harnesses/qwen-code/qwen.ts
+import path9 from "path";
+import { match as match10 } from "ts-pattern";
+import * as v8 from "valibot";
+var BINARY7 = "qwen";
+var KEY_VARIABLE = "NEXOS_API_KEY";
+var AUTH_TYPE = "openai";
+var qwen = {
+  kind: "configurable",
+  id: "qwen-code",
+  label: "Qwen Code",
+  binary: BINARY7,
+  protocols: ["openai-chat"],
+  projectSupport: { kind: "supported" },
+  detect: (ctx) => detectQwen(ctx),
+  configPath: (ctx) => resolveSettingsPath3(ctx),
+  plan: (desired, ctx) => [planSettings3(desired, ctx)],
+  readKey: (ctx) => readProviderKey4(ctx),
+  readSecrets: (ctx) => readProviderSecrets4(ctx),
+  postSetupNotes: [
+    "Qwen Code keeps the key in its settings file, so no /auth step is needed.",
+    "Qwen Code ranks its settings, highest first: the system settings file, the project's .qwen/settings.json, then the user's ~/.qwen/settings.json. A higher one that sets the same values overrides this file."
+  ]
+};
+function detectQwen(ctx) {
+  const detected = detectConfigFile([resolveSettingsPath3(ctx)], ctx.home);
+  if (detected.isFound || ctx.scope === "project" || !ctx.hasBinary(BINARY7)) return detected;
+  return { isFound: true, detail: `${BINARY7} found on PATH` };
+}
+var USER_DIRECTORY2 = ".qwen";
+var PROJECT_DIRECTORY = ".qwen";
+var SETTINGS_FILE2 = "settings.json";
+function resolveSettingsPath3(ctx) {
+  return match10(ctx.scope).with("user", () => path9.join(ctx.home, USER_DIRECTORY2, SETTINGS_FILE2)).with("project", () => path9.join(ctx.cwd, PROJECT_DIRECTORY, SETTINGS_FILE2)).exhaustive();
+}
+function planSettings3(desired, ctx) {
+  return {
+    kind: "file",
+    path: resolveSettingsPath3(ctx),
+    hasSecret: true,
+    edits: (current) => ({ format: "jsonc", updates: listUpdates3(desired, current) })
+  };
+}
+function listUpdates3(desired, current) {
+  const provider = {
+    id: desired.model,
+    name: desired.model,
+    baseUrl: desired.openaiBaseUrl,
+    envKey: KEY_VARIABLE
+  };
+  return [
+    [
+      ["modelProviders", "openai"],
+      [...listOtherOpenAiProviders(current), provider]
+    ],
+    [["env", KEY_VARIABLE], desired.apiKey],
+    [["security", "auth", "selectedType"], AUTH_TYPE],
+    [["model", "name"], desired.model]
+  ];
+}
+var ModelProvidersSchema = v8.looseObject({
+  modelProviders: v8.optional(v8.looseObject({ openai: v8.optional(v8.unknown()) }))
+});
+var NexosEntrySchema = v8.looseObject({ envKey: v8.literal(KEY_VARIABLE) });
+function listOtherOpenAiProviders(current) {
+  const parsed = parseJsoncConfig(current, ModelProvidersSchema);
+  if (parsed.kind !== "valid") return [];
+  const openai = parsed.value.modelProviders?.openai;
+  if (openai === void 0) return [];
+  if (!Array.isArray(openai)) throw new MergeConflictError();
+  return openai.filter((entry) => !v8.is(NexosEntrySchema, entry));
+}
+var SettingsSchema2 = v8.looseObject({
+  env: v8.optional(v8.looseObject({ [KEY_VARIABLE]: v8.optional(v8.string()) }))
+});
+function readProviderKey4(ctx) {
+  const settings2 = readJsoncFile(resolveSettingsPath3(ctx), SettingsSchema2);
+  return readLiteralKey(settings2.kind === "valid" ? settings2.value.env?.[KEY_VARIABLE] : void 0);
+}
+var SecretsSchema = v8.looseObject({
+  env: v8.optional(v8.record(v8.string(), v8.unknown())),
+  security: v8.optional(v8.looseObject({ auth: v8.optional(v8.looseObject({ apiKey: v8.optional(v8.string()) })) })),
+  modelProviders: v8.optional(v8.record(v8.string(), v8.unknown()))
+});
+var ProviderEntrySchema = v8.looseObject({ envKey: v8.string() });
+function readProviderSecrets4(ctx) {
+  const settings2 = readJsoncFile(resolveSettingsPath3(ctx), SecretsSchema);
+  if (settings2.kind !== "valid") return [];
+  const { env = {}, security, modelProviders = {} } = settings2.value;
+  const fromEnv = listProviderEnvKeys(modelProviders).flatMap((name) => readEnvSecret(env, name));
+  const fromAuth = readOptionalKey(security?.auth?.apiKey);
+  return [...fromEnv, ...fromAuth];
+}
+function listProviderEnvKeys(modelProviders) {
+  return Object.values(modelProviders).flatMap((providers) => {
+    if (!Array.isArray(providers)) return [];
+    return providers.flatMap((entry) => {
+      const parsed = v8.safeParse(ProviderEntrySchema, entry);
+      return parsed.success ? [parsed.output.envKey] : [];
+    });
+  });
+}
+function readEnvSecret(env, name) {
+  const value = env[name];
+  return typeof value === "string" ? readOptionalKey(value) : [];
+}
+function readOptionalKey(value) {
+  const key = readLiteralKey(value);
+  return key === void 0 ? [] : [key];
+}
+
 // src/harnesses/registry.ts
-var harnesses = [claudeCode, codex, opencode, copilotCli, geminiCli];
+var harnesses = [claudeCode, codex, opencode, copilotCli, pi, crush, qwen, geminiCli];
 function findHarness(id) {
   return harnesses.find((harness) => harness.id === id);
 }
@@ -1916,10 +2234,10 @@ function splitLines(text2) {
 }
 
 // src/product/storage/env-file/syntax/env-syntaxes.ts
-import { match as match9 } from "ts-pattern";
+import { match as match11 } from "ts-pattern";
 
 // src/product/storage/env-file/syntax/posix-env-syntax.ts
-import path7 from "path";
+import path10 from "path";
 
 // src/product/storage/env-file/syntax/env-syntax.ts
 var SHELLS = ["posix", "powershell"];
@@ -1943,7 +2261,7 @@ function createAssignmentMatcher(pattern) {
 // src/product/storage/env-file/syntax/posix-env-syntax.ts
 var POSIX_FILE_NAME = "env";
 var POSIX_ASSIGNMENT = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
-var POSIX_LOAD_COMMAND = `source ${path7.posix.join("~", ENV_DIRECTORY_NAME, POSIX_FILE_NAME)}`;
+var POSIX_LOAD_COMMAND = `source ${path10.posix.join("~", ENV_DIRECTORY_NAME, POSIX_FILE_NAME)}`;
 var POSIX_ENV_SYNTAX = {
   fileName: POSIX_FILE_NAME,
   defaultLineEnding: "\n",
@@ -1974,10 +2292,10 @@ function decodePosixSegment([, singleQuoted, doubleQuoted, escaped, bare]) {
 }
 
 // src/product/storage/env-file/syntax/powershell-env-syntax.ts
-import path8 from "path";
+import path11 from "path";
 var POWERSHELL_FILE_NAME = "env.ps1";
 var POWERSHELL_ASSIGNMENT = /^\s*\$\{?[Ee][Nn][Vv]:([A-Za-z_][A-Za-z0-9_]*)\}?\s*=\s*(.*)$/;
-var POWERSHELL_LOAD_COMMAND = `. "${path8.win32.join("$HOME", ENV_DIRECTORY_NAME, POWERSHELL_FILE_NAME)}"`;
+var POWERSHELL_LOAD_COMMAND = `. "${path11.win32.join("$HOME", ENV_DIRECTORY_NAME, POWERSHELL_FILE_NAME)}"`;
 var POWERSHELL_ENV_SYNTAX = {
   fileName: POWERSHELL_FILE_NAME,
   defaultLineEnding: "\r\n",
@@ -2009,7 +2327,7 @@ var ENV_SYNTAXES = {
   powershell: POWERSHELL_ENV_SYNTAX
 };
 function resolveShell(platform) {
-  return match9(platform).returnType().with("win32", () => "powershell").otherwise(() => "posix");
+  return match11(platform).returnType().with("win32", () => "powershell").otherwise(() => "posix");
 }
 
 // src/product/storage/env-file/parse-env-file.ts
@@ -2028,9 +2346,9 @@ function parseEnvFile(text2, shell) {
 }
 
 // src/flows/key/find-existing-keys.ts
-var OfferableKeySchema = v6.pipe(
-  v6.string(),
-  v6.check((key) => !hasLineBreak(key))
+var OfferableKeySchema = v9.pipe(
+  v9.string(),
+  v9.check((key) => !hasLineBreak(key))
 );
 function findExistingKeys({ ctx, envPath, shell }) {
   const userContext = { ...ctx, scope: "user" };
@@ -2041,7 +2359,7 @@ function findExistingKeys({ ctx, envPath, shell }) {
     ...readFromEachHarness((harness) => harness.readSecrets?.(userContext) ?? []),
     ...readFromEachHarness((harness) => harness.readSecrets?.(projectContext) ?? [])
   ];
-  const offered = machineKeys.find((key) => v6.is(OfferableKeySchema, key));
+  const offered = machineKeys.find((key) => v9.is(OfferableKeySchema, key));
   return { offered, all: [...machineKeys, ...otherSecrets] };
 }
 function readEnvFileKeys(envPath, shell) {
@@ -2076,7 +2394,7 @@ function readSafely(read) {
 }
 
 // src/flows/key/key-step.ts
-import * as v7 from "valibot";
+import * as v10 from "valibot";
 async function resolveKey(input, deps) {
   const { keystore: keystore2, ui } = deps;
   if (input.shouldSaveKey) {
@@ -2101,11 +2419,11 @@ async function resolveKey(input, deps) {
   }
   return await promptForKey({ input, deps, availability, existing: existing.offered });
 }
-var SavedKeySchema = v7.pipe(
-  v7.string(),
-  v7.trim(),
-  v7.nonEmpty(),
-  v7.check((key) => !hasLineBreak(key))
+var SavedKeySchema = v10.pipe(
+  v10.string(),
+  v10.trim(),
+  v10.nonEmpty(),
+  v10.check((key) => !hasLineBreak(key))
 );
 var FORGET_KEY_HINT = `npx ${COMMAND_NAME} ${FORGET_KEY_COMMAND}`;
 async function loadSaved({ keystore: keystore2, ui, masker: masker2 }) {
@@ -2121,7 +2439,7 @@ async function loadSaved({ keystore: keystore2, ui, masker: masker2 }) {
     return void 0;
   }
   if (saved === void 0) return void 0;
-  const parsed = v7.safeParse(SavedKeySchema, saved);
+  const parsed = v10.safeParse(SavedKeySchema, saved);
   if (!parsed.success) {
     ui.dim(`The saved key is not usable. Run \`${FORGET_KEY_HINT}\` and save it again.`);
     return void 0;
@@ -2283,10 +2601,10 @@ function formatProbe(result) {
 }
 
 // src/flows/key/key-check.ts
-import { match as match12 } from "ts-pattern";
+import { match as match14 } from "ts-pattern";
 
 // src/product/gateway/list-models.ts
-import { P as P2, match as match10 } from "ts-pattern";
+import { P as P2, match as match12 } from "ts-pattern";
 
 // src/shared/text/format-count.ts
 function formatCount(count, noun) {
@@ -2294,20 +2612,20 @@ function formatCount(count, noun) {
 }
 
 // src/product/gateway/model-schema.ts
-import * as v8 from "valibot";
-var OptionalTextSchema2 = v8.fallback(v8.optional(v8.pipe(v8.string(), v8.nonEmpty())), void 0);
-var OptionalCountSchema = v8.fallback(v8.optional(v8.pipe(v8.number(), v8.finite())), void 0);
-var EndpointsSchema = v8.fallback(v8.pipe(v8.array(v8.unknown()), v8.transform(keepStrings)), []);
-var ModelSchema2 = v8.pipe(
-  v8.object({
-    id: v8.pipe(v8.string(), v8.nonEmpty()),
+import * as v11 from "valibot";
+var OptionalTextSchema2 = v11.fallback(v11.optional(v11.pipe(v11.string(), v11.nonEmpty())), void 0);
+var OptionalCountSchema = v11.fallback(v11.optional(v11.pipe(v11.number(), v11.finite())), void 0);
+var EndpointsSchema = v11.fallback(v11.pipe(v11.array(v11.unknown()), v11.transform(keepStrings)), []);
+var ModelSchema2 = v11.pipe(
+  v11.object({
+    id: v11.pipe(v11.string(), v11.nonEmpty()),
     developer: OptionalTextSchema2,
     owned_by: OptionalTextSchema2,
     context_length: OptionalCountSchema,
     region: OptionalTextSchema2,
     endpoints: EndpointsSchema
   }),
-  v8.transform((entry) => ({
+  v11.transform((entry) => ({
     id: entry.id,
     developer: entry.developer ?? entry.owned_by ?? null,
     contextLength: entry.context_length ?? null,
@@ -2315,23 +2633,23 @@ var ModelSchema2 = v8.pipe(
     endpoints: entry.endpoints
   }))
 );
-var ModelListSchema = v8.pipe(
-  v8.object({ data: v8.array(v8.unknown()) }),
-  v8.transform(({ data }) => keepUsableModels(data))
+var ModelListSchema = v11.pipe(
+  v11.object({ data: v11.array(v11.unknown()) }),
+  v11.transform(({ data }) => keepUsableModels(data))
 );
-var OpenAiErrorSchema = v8.object({
-  error: v8.object({
-    message: v8.string(),
-    type: v8.optional(v8.string()),
-    code: v8.optional(v8.nullable(v8.string()))
+var OpenAiErrorSchema = v11.object({
+  error: v11.object({
+    message: v11.string(),
+    type: v11.optional(v11.string()),
+    code: v11.optional(v11.nullable(v11.string()))
   })
 });
-var AnthropicErrorSchema = v8.object({
-  type: v8.literal("error"),
-  error: v8.object({ type: v8.string(), message: v8.string() })
+var AnthropicErrorSchema = v11.object({
+  type: v11.literal("error"),
+  error: v11.object({ type: v11.string(), message: v11.string() })
 });
 function parseJsonBody(schema, text2) {
-  const result = v8.safeParse(schema, parseJson(text2));
+  const result = v11.safeParse(schema, parseJson(text2));
   return result.success ? result.output : void 0;
 }
 function keepStrings(values) {
@@ -2340,7 +2658,7 @@ function keepStrings(values) {
 function keepUsableModels(entries) {
   const modelsById = /* @__PURE__ */ new Map();
   for (const entry of entries) {
-    const model = v8.safeParse(ModelSchema2, entry);
+    const model = v11.safeParse(ModelSchema2, entry);
     if (model.success && !modelsById.has(model.output.id)) modelsById.set(model.output.id, model.output);
   }
   return [...modelsById.values()];
@@ -2402,13 +2720,13 @@ function readListing({ status, text: text2 }, masker2) {
 }
 var INVALID_KEY_ERROR_CODE = "invalid_api_key";
 function classifyRejection(status, errorCode) {
-  return match10({ status, errorCode }).returnType().with({ status: P2.union(...KEY_REJECTED_STATUSES) }, { errorCode: INVALID_KEY_ERROR_CODE }, () => "key-rejected").otherwise(() => "bad-status");
+  return match12({ status, errorCode }).returnType().with({ status: P2.union(...KEY_REJECTED_STATUSES) }, { errorCode: INVALID_KEY_ERROR_CODE }, () => "key-rejected").otherwise(() => "bad-status");
 }
 
 // src/product/gateway/probe-result.ts
-import { match as match11 } from "ts-pattern";
+import { match as match13 } from "ts-pattern";
 function isKeyAccepted(probe) {
-  return match11(probe.kind).with("passed", "bad-response", () => true).with("key-rejected", "model-rejected", "unreachable", "timed-out", "bad-status", () => false).exhaustive();
+  return match13(probe.kind).with("passed", "bad-response", () => true).with("key-rejected", "model-rejected", "unreachable", "timed-out", "bad-status", () => false).exhaustive();
 }
 
 // src/flows/key/probe-summaries.ts
@@ -2476,7 +2794,7 @@ async function attemptKeyCheck(params) {
   }
   ui.print(formatProbes([probe]));
   const choice = await ui.chooseOnFetchFailure();
-  return await match12(choice).with("retry", async () => {
+  return await match14(choice).with("retry", async () => {
     spinner.start("Checking again\u2026");
     return await attemptKeyCheck(params);
   }).with("manual", async () => ({
@@ -2496,7 +2814,7 @@ async function attemptKeyCheck(params) {
   })).exhaustive();
 }
 function summarizeKeyCheck(probe, modelCount) {
-  return match12(probe.kind).with("passed", () => `Key verified \u2014 ${formatCount(modelCount, "model")} available.`).with("bad-response", () => "Key verified, but the model list could not be read.").otherwise((kind) => PROBE_SUMMARIES[kind]);
+  return match14(probe.kind).with("passed", () => `Key verified \u2014 ${formatCount(modelCount, "model")} available.`).with("bad-response", () => "Key verified, but the model list could not be read.").otherwise((kind) => PROBE_SUMMARIES[kind]);
 }
 var ASSUMED_YES_CONTINUATION = "Continuing despite the failed check (--yes).";
 function findContinuation({ shouldAssumeYes, requestedModel, masker: masker2 }) {
@@ -2601,16 +2919,16 @@ function findModelWarnings({
 }
 
 // src/flows/model/model-probe.ts
-import { match as match15 } from "ts-pattern";
+import { match as match17 } from "ts-pattern";
 
 // src/product/gateway/models/router-availability.ts
-import { match as match13 } from "ts-pattern";
+import { match as match15 } from "ts-pattern";
 function classifyRouterAvailability(probe) {
-  return match13(probe.kind).returnType().with("passed", () => "available").with("model-rejected", () => "unavailable").otherwise(() => "unknown");
+  return match15(probe.kind).returnType().with("passed", () => "available").with("model-rejected", () => "unavailable").otherwise(() => "unknown");
 }
 
 // src/product/gateway/probe-anthropic.ts
-import { P as P3, match as match14 } from "ts-pattern";
+import { P as P3, match as match16 } from "ts-pattern";
 var MESSAGES_PATH = "/v1/messages";
 var ANTHROPIC_VERSION = "2023-06-01";
 var PING_MAX_TOKENS = 1;
@@ -2666,7 +2984,7 @@ var MODEL_NOT_FOUND_STATUS = 404;
 var KEY_REJECTED_ERROR_TYPES = ["authentication_error", "permission_error"];
 var MODEL_NOT_FOUND_ERROR_TYPE = "not_found_error";
 function classifyRejection2(status, errorType) {
-  return match14({ status, errorType }).returnType().with(
+  return match16({ status, errorType }).returnType().with(
     { status: P3.union(...KEY_REJECTED_STATUSES) },
     { errorType: P3.union(...KEY_REJECTED_ERROR_TYPES) },
     () => "key-rejected"
@@ -2710,21 +3028,21 @@ async function shouldContinueAfterProbe({
   return await ui.confirm(`Continue anyway? ${consequence}`, false);
 }
 function summarizeModelProbe(probe) {
-  return match15(probe.kind).with("passed", () => "Model verified.").otherwise((kind) => PROBE_SUMMARIES[kind]);
+  return match17(probe.kind).with("passed", () => "Model verified.").otherwise((kind) => PROBE_SUMMARIES[kind]);
 }
 
 // src/product/storage/preferences/preferences.ts
 import { randomUUID } from "crypto";
 import fs4 from "fs";
-import path9 from "path";
-import * as v9 from "valibot";
+import path12 from "path";
+import * as v12 from "valibot";
 var PREFERENCES_FILE = "preferences.json";
 function resolvePreferencesPath(home) {
-  return path9.join(home, ENV_DIRECTORY_NAME, PREFERENCES_FILE);
+  return path12.join(home, ENV_DIRECTORY_NAME, PREFERENCES_FILE);
 }
-var ModelIdSchema = v9.pipe(v9.string(), v9.trim(), v9.nonEmpty(), v9.transform(normalizeModel));
-var PreferencesSchema = v9.looseObject({
-  defaultModels: v9.optional(v9.record(v9.string(), ModelIdSchema), {})
+var ModelIdSchema = v12.pipe(v12.string(), v12.trim(), v12.nonEmpty(), v12.transform(normalizeModel));
+var PreferencesSchema = v12.looseObject({
+  defaultModels: v12.optional(v12.record(v12.string(), ModelIdSchema), {})
 });
 var PreferencesError = class extends Error {
   name = "PreferencesError";
@@ -2743,7 +3061,7 @@ function readPreferences(home) {
   const filePath = resolvePreferencesPath(home);
   const text2 = readFileIfExists(filePath);
   if (text2 === null) return { defaultModels: {} };
-  const parsed = v9.safeParse(PreferencesSchema, parseJson2(text2));
+  const parsed = v12.safeParse(PreferencesSchema, parseJson2(text2));
   if (!parsed.success) {
     throw new PreferencesError(
       `${displayPath(filePath, home)} is not a preferences file nexos-connect can read. Fix it or delete it.`
@@ -2760,7 +3078,7 @@ function parseJson2(text2) {
   }
 }
 function writeAtomically(filePath, content) {
-  fs4.mkdirSync(path9.dirname(filePath), { recursive: true });
+  fs4.mkdirSync(path12.dirname(filePath), { recursive: true });
   const temporaryPath = `${filePath}.${randomUUID()}.tmp`;
   try {
     fs4.writeFileSync(temporaryPath, content);
@@ -2772,19 +3090,19 @@ function writeAtomically(filePath, content) {
 }
 
 // src/shared/file-system/describe-file-error.ts
-import * as v10 from "valibot";
+import * as v13 from "valibot";
 function describeFileError({ error, action, home }) {
   const failure = readFileFailure(error);
   if (failure === void 0) return describeError(error);
   return `${displayPath(failure.path, home)}: cannot ${action} it (${failure.reason}). ${failure.nextStep}, then run again.`;
 }
-var FileSystemErrorSchema = v10.object({ code: v10.string(), path: v10.string() });
+var FileSystemErrorSchema = v13.object({ code: v13.string(), path: v13.string() });
 var PERMISSION_CODES = ["EACCES", "EPERM", "EROFS"];
 function readFileFailure(error) {
   if (error instanceof Utf16FileError) {
     return { path: error.filePath, reason: "saved as UTF-16", nextStep: "Re-save it as UTF-8" };
   }
-  if (!v10.is(FileSystemErrorSchema, error)) return void 0;
+  if (!v13.is(FileSystemErrorSchema, error)) return void 0;
   const nextStep = PERMISSION_CODES.includes(error.code) ? "Check its permissions" : "Check that path";
   return { path: error.path, reason: error.code, nextStep };
 }
@@ -2978,9 +3296,9 @@ async function probeRouterIfOffered({
 }
 
 // src/product/storage/env-file/env-file-path.ts
-import path10 from "path";
+import path13 from "path";
 function resolveEnvFilePath(home, shell) {
-  return path10.join(home, ENV_DIRECTORY_NAME, ENV_SYNTAXES[shell].fileName);
+  return path13.join(home, ENV_DIRECTORY_NAME, ENV_SYNTAXES[shell].fileName);
 }
 
 // src/commands/launch/launch.ts
@@ -3048,7 +3366,7 @@ function aKeyStepInput({ ctx, options, environmentKey, masker: masker2 }) {
 }
 
 // src/commands/restore/run-restore.ts
-import path18 from "path";
+import path21 from "path";
 
 // src/cli/resolve-named-harnesses.ts
 function resolveNamedHarnesses(ids) {
@@ -3062,61 +3380,61 @@ function resolveNamedHarnesses(ids) {
 }
 
 // src/product/storage/backups/resolve-backup-root.ts
-import path11 from "path";
-import { match as match16 } from "ts-pattern";
+import path14 from "path";
+import { match as match18 } from "ts-pattern";
 var PROJECT_BACKUP_DIRECTORY = ".nexos-backup";
-var USER_BACKUP_DIRECTORY = path11.join(".nexos", "backups");
+var USER_BACKUP_DIRECTORY = path14.join(".nexos", "backups");
 function formatBackupTimestamp(now) {
   return now.toISOString().replace(/[:.]/g, "-");
 }
 function resolveBackupRoot({ scope, home, cwd, stamp, backupDirectory }) {
   if (backupDirectory !== void 0) {
-    return { path: path11.join(path11.resolve(cwd, backupDirectory), stamp), gitIgnoredDirectory: null };
+    return { path: path14.join(path14.resolve(cwd, backupDirectory), stamp), gitIgnoredDirectory: null };
   }
-  return match16(scope).returnType().with("user", () => ({ path: path11.join(home, USER_BACKUP_DIRECTORY, stamp), gitIgnoredDirectory: null })).with("project", () => {
-    const directory = path11.join(cwd, PROJECT_BACKUP_DIRECTORY);
-    return { path: path11.join(directory, stamp), gitIgnoredDirectory: directory };
+  return match18(scope).returnType().with("user", () => ({ path: path14.join(home, USER_BACKUP_DIRECTORY, stamp), gitIgnoredDirectory: null })).with("project", () => {
+    const directory = path14.join(cwd, PROJECT_BACKUP_DIRECTORY);
+    return { path: path14.join(directory, stamp), gitIgnoredDirectory: directory };
   }).exhaustive();
 }
 
 // src/product/storage/restore-record/restore-record.ts
 import fs6 from "fs";
-import path13 from "path";
-import * as v11 from "valibot";
+import path16 from "path";
+import * as v14 from "valibot";
 
 // src/shared/file-formats/config-format.ts
-import { match as match17 } from "ts-pattern";
+import { match as match19 } from "ts-pattern";
 var CONFIG_FORMATS = ["jsonc", "toml"];
 function renderConfig(current, edits) {
-  return match17(edits).with({ format: "jsonc" }, ({ updates }) => renderJsonc(current, updates)).with({ format: "toml" }, ({ updates }) => renderToml(current, updates)).exhaustive();
+  return match19(edits).with({ format: "jsonc" }, ({ updates }) => renderJsonc(current, updates)).with({ format: "toml" }, ({ updates }) => renderToml(current, updates)).exhaustive();
 }
 function readOriginals(current, edits) {
   const keyPaths = edits.updates.map(([keyPath]) => keyPath);
-  return match17(edits.format).with("jsonc", () => readJsoncOriginals(current, keyPaths)).with("toml", () => readTomlOriginals(current, keyPaths)).exhaustive();
+  return match19(edits.format).with("jsonc", () => readJsoncOriginals(current, keyPaths)).with("toml", () => readTomlOriginals(current, keyPaths)).exhaustive();
 }
 function restoreConfig({ format, current, originals }) {
-  return match17(format).with("jsonc", () => restoreJsonc(current, originals)).with("toml", () => restoreToml(current, originals)).exhaustive();
+  return match19(format).with("jsonc", () => restoreJsonc(current, originals)).with("toml", () => restoreToml(current, originals)).exhaustive();
 }
 function isEmptyConfig(format, text2) {
-  const document = match17(format).with("jsonc", () => parseJsonc(text2)).with("toml", () => parseToml(text2)).exhaustive();
+  const document = match19(format).with("jsonc", () => parseJsonc(text2)).with("toml", () => parseToml(text2)).exhaustive();
   return Object.keys(document).length === 0;
 }
 function parseValueSource(format, source) {
-  return match17(format).with("jsonc", () => parseJsoncValue(source)).with("toml", () => parseTomlValue(source)).exhaustive();
+  return match19(format).with("jsonc", () => parseJsoncValue(source)).with("toml", () => parseTomlValue(source)).exhaustive();
 }
 
 // src/shared/file-system/resolve-owner-only-mode.ts
-import { match as match18 } from "ts-pattern";
+import { match as match20 } from "ts-pattern";
 var OWNER_ONLY_MODE = 384;
 function resolveOwnerOnlyMode(platform) {
-  return match18(platform).returnType().with("win32", () => null).otherwise(() => OWNER_ONLY_MODE);
+  return match20(platform).returnType().with("win32", () => null).otherwise(() => OWNER_ONLY_MODE);
 }
 
 // src/shared/file-system/write-file-with-mode.ts
 import fs5 from "fs";
-import path12 from "path";
+import path15 from "path";
 function writeFileWithMode({ filePath, content, mode }) {
-  fs5.mkdirSync(path12.dirname(filePath), { recursive: true });
+  fs5.mkdirSync(path15.dirname(filePath), { recursive: true });
   if (mode === null) {
     fs5.writeFileSync(filePath, content);
     return;
@@ -3129,27 +3447,27 @@ function writeFileWithMode({ filePath, content, mode }) {
 // src/product/storage/restore-record/restore-record.ts
 var FILE_ORIGINS = ["absent", "blank", "content"];
 var RECORD_VERSION = 1;
-var SegmentsSchema = v11.pipe(v11.tupleWithRest([v11.string()], v11.string()), v11.readonly());
-var RecordedKeySchema = v11.object({
+var SegmentsSchema = v14.pipe(v14.tupleWithRest([v14.string()], v14.string()), v14.readonly());
+var RecordedKeySchema = v14.object({
   keyPath: SegmentsSchema,
-  original: v11.nullable(v11.string()),
-  createdParents: v11.pipe(v11.array(SegmentsSchema), v11.readonly()),
-  holdsSecret: v11.boolean()
+  original: v14.nullable(v14.string()),
+  createdParents: v14.pipe(v14.array(SegmentsSchema), v14.readonly()),
+  holdsSecret: v14.boolean()
 });
-var RecordedFileSchema = v11.object({
+var RecordedFileSchema = v14.object({
   path: SegmentsSchema,
-  format: v11.picklist(CONFIG_FORMATS),
-  origin: v11.picklist(FILE_ORIGINS),
-  keys: v11.pipe(v11.array(RecordedKeySchema), v11.readonly())
+  format: v14.picklist(CONFIG_FORMATS),
+  origin: v14.picklist(FILE_ORIGINS),
+  keys: v14.pipe(v14.array(RecordedKeySchema), v14.readonly())
 });
-var RecordedEnvVariableSchema = v11.object({ name: v11.string(), original: v11.nullable(v11.string()) });
-var HarnessRecordSchema = v11.object({
-  files: v11.pipe(v11.array(RecordedFileSchema), v11.readonly()),
-  envVariables: v11.pipe(v11.array(RecordedEnvVariableSchema), v11.readonly())
+var RecordedEnvVariableSchema = v14.object({ name: v14.string(), original: v14.nullable(v14.string()) });
+var HarnessRecordSchema = v14.object({
+  files: v14.pipe(v14.array(RecordedFileSchema), v14.readonly()),
+  envVariables: v14.pipe(v14.array(RecordedEnvVariableSchema), v14.readonly())
 });
-var RestoreRecordSchema = v11.object({
-  version: v11.literal(RECORD_VERSION),
-  harnesses: v11.record(v11.string(), HarnessRecordSchema)
+var RestoreRecordSchema = v14.object({
+  version: v14.literal(RECORD_VERSION),
+  harnesses: v14.record(v14.string(), HarnessRecordSchema)
 });
 function createEmptyRestoreRecord() {
   return { version: RECORD_VERSION, harnesses: {} };
@@ -3165,7 +3483,7 @@ function readRestoreRecord({ filePath, home }) {
   if (isNewerRecord(json)) {
     throw new RestoreRecordError(`${shownPath} was written by a newer nexos-connect. Update it, then run again.`);
   }
-  const parsed = v11.safeParse(RestoreRecordSchema, json);
+  const parsed = v14.safeParse(RestoreRecordSchema, json);
   if (!parsed.success) {
     throw new RestoreRecordError(
       `${shownPath} is not a restore record nexos-connect can read. Fix it, or move it aside to start a new one, then run again.`
@@ -3181,47 +3499,47 @@ function parseJson3(text2) {
     throw error;
   }
 }
-var VersionSchema = v11.object({ version: v11.number() });
+var VersionSchema = v14.object({ version: v14.number() });
 function isNewerRecord(json) {
-  const parsed = v11.safeParse(VersionSchema, json);
+  const parsed = v14.safeParse(VersionSchema, json);
   return parsed.success && parsed.output.version > RECORD_VERSION;
 }
 var RECORD_DIRECTORY_MODE = 448;
 var JSON_INDENT3 = 2;
-function writeRestoreRecord({ filePath, record: record5, platform }) {
-  if (Object.keys(record5.harnesses).length === 0) {
+function writeRestoreRecord({ filePath, record: record8, platform }) {
+  if (Object.keys(record8.harnesses).length === 0) {
     fs6.rmSync(filePath, { force: true });
     return;
   }
-  fs6.mkdirSync(path13.dirname(filePath), { recursive: true, mode: RECORD_DIRECTORY_MODE });
-  const content = `${JSON.stringify(record5, null, JSON_INDENT3)}
+  fs6.mkdirSync(path16.dirname(filePath), { recursive: true, mode: RECORD_DIRECTORY_MODE });
+  const content = `${JSON.stringify(record8, null, JSON_INDENT3)}
 `;
   writeFileWithMode({ filePath, content, mode: resolveOwnerOnlyMode(platform) });
 }
 
 // src/product/storage/restore-record/restore-record-location.ts
-import path14 from "path";
-import { match as match19 } from "ts-pattern";
+import path17 from "path";
+import { match as match21 } from "ts-pattern";
 var RESTORE_RECORD_FILE = "restore-record.json";
 function resolveRestoreRecordLocation(ctx) {
-  return match19(ctx.scope).returnType().with("user", () => ({
-    filePath: path14.join(ctx.home, ENV_DIRECTORY_NAME, RESTORE_RECORD_FILE),
+  return match21(ctx.scope).returnType().with("user", () => ({
+    filePath: path17.join(ctx.home, ENV_DIRECTORY_NAME, RESTORE_RECORD_FILE),
     root: ctx.home,
     gitIgnoredDirectory: null
   })).with("project", () => {
-    const directory = path14.join(ctx.cwd, PROJECT_BACKUP_DIRECTORY);
-    return { filePath: path14.join(directory, RESTORE_RECORD_FILE), root: ctx.cwd, gitIgnoredDirectory: directory };
+    const directory = path17.join(ctx.cwd, PROJECT_BACKUP_DIRECTORY);
+    return { filePath: path17.join(directory, RESTORE_RECORD_FILE), root: ctx.cwd, gitIgnoredDirectory: directory };
   }).exhaustive();
 }
 function toRecordedPath(filePath, root) {
-  const [first, ...rest] = path14.relative(root, filePath).split(path14.sep);
+  const [first, ...rest] = path17.relative(root, filePath).split(path17.sep);
   if (first === void 0 || !isInsideRoot(filePath, root)) {
     throw new Error(`${filePath} is outside ${root}, so it cannot be recorded for a restore.`);
   }
   return [first, ...rest];
 }
 function fromRecordedPath(recordedPath, root) {
-  const filePath = path14.join(root, ...recordedPath);
+  const filePath = path17.join(root, ...recordedPath);
   if (!isInsideRoot(filePath, root)) {
     throw new Error(
       `${filePath} is outside ${root}, so it cannot be restored. Remove it from the restore record, then run again.`
@@ -3230,9 +3548,9 @@ function fromRecordedPath(recordedPath, root) {
   return filePath;
 }
 function isInsideRoot(filePath, root) {
-  const relativePath = path14.relative(root, filePath);
-  const [first] = relativePath.split(path14.sep);
-  return relativePath !== "" && first !== ".." && !path14.isAbsolute(relativePath);
+  const relativePath = path17.relative(root, filePath);
+  const [first] = relativePath.split(path17.sep);
+  return relativePath !== "" && first !== ".." && !path17.isAbsolute(relativePath);
 }
 
 // src/ui/report/format-restore-preview.ts
@@ -3301,7 +3619,7 @@ function buildCommonLengthTable({ beforeLines, afterLines }) {
 
 // src/ui/diff/render-diff.ts
 import pc3 from "picocolors";
-import { match as match20 } from "ts-pattern";
+import { match as match22 } from "ts-pattern";
 var DIFF_CONTEXT_LINES = 2;
 var ADDED_PREFIX = "  + ";
 var REMOVED_PREFIX = "  - ";
@@ -3333,7 +3651,7 @@ function findVisibleIndexes(lines) {
   return visibleIndexes;
 }
 function renderLine(line) {
-  return match20(line.kind).with("added", () => pc3.green(`${ADDED_PREFIX}${line.text}`)).with("removed", () => pc3.red(`${REMOVED_PREFIX}${line.text}`)).with("unchanged", () => pc3.dim(`${UNCHANGED_PREFIX}${line.text}`)).exhaustive();
+  return match22(line.kind).with("added", () => pc3.green(`${ADDED_PREFIX}${line.text}`)).with("removed", () => pc3.red(`${REMOVED_PREFIX}${line.text}`)).with("unchanged", () => pc3.dim(`${UNCHANGED_PREFIX}${line.text}`)).exhaustive();
 }
 
 // src/ui/report/format-preview.ts
@@ -3380,7 +3698,7 @@ function formatRestoredFile({ file, home, masker: masker2 }) {
 
 // src/ui/report/format-restore-result.ts
 import pc6 from "picocolors";
-import { P as P4, match as match21 } from "ts-pattern";
+import { P as P4, match as match23 } from "ts-pattern";
 
 // src/commands/restore/restore-result.ts
 var RESTORE_OUTCOME_KINDS = ["restored", "unchanged", "nothing-to-restore", "failed"];
@@ -3412,7 +3730,7 @@ var RESTORE_OUTCOME_STYLE = {
 var NO_RECORD = "nexos-connect has no record of setting it up at this scope.";
 function formatOutcome(outcome, { home, masker: masker2 }) {
   const style = RESTORE_OUTCOME_STYLE[outcome.kind];
-  const body = match21(outcome).with({ kind: P4.union("restored", "unchanged") }, (planned) => formatPlannedRestore(planned, home, masker2)).with({ kind: "nothing-to-restore" }, () => [`${INDENT}${pc6.dim(NO_RECORD)}`]).with({ kind: "failed" }, ({ error }) => [`${INDENT}${pc6.red(masker2.maskText(error))}`]).exhaustive();
+  const body = match23(outcome).with({ kind: P4.union("restored", "unchanged") }, (planned) => formatPlannedRestore(planned, home, masker2)).with({ kind: "nothing-to-restore" }, () => [`${INDENT}${pc6.dim(NO_RECORD)}`]).with({ kind: "failed" }, ({ error }) => [`${INDENT}${pc6.red(masker2.maskText(error))}`]).exhaustive();
   return ["", `  ${style.colour(`${style.glyph} ${outcome.target.label} \u2014 ${style.label}`)}`, ...body];
 }
 function formatPlannedRestore(outcome, home, masker2) {
@@ -3453,11 +3771,11 @@ function formatSummary(outcomes) {
 
 // src/commands/restore/apply-restore.ts
 import fs9 from "fs";
-import path16 from "path";
+import path19 from "path";
 
 // src/product/storage/backups/back-up-file.ts
 import fs8 from "fs";
-import path15 from "path";
+import path18 from "path";
 
 // src/shared/file-system/read-file-mode.ts
 import fs7 from "fs";
@@ -3476,15 +3794,15 @@ function readFileMode(filePath, platform) {
 var BACKUP_DIRECTORY_MODE = 448;
 var OWNER_PERMISSION_BITS = 448;
 function backUpFile({ source, root, relativePath, platform }) {
-  const destination = path15.join(root, relativePath);
-  fs8.mkdirSync(path15.dirname(destination), { recursive: true, mode: BACKUP_DIRECTORY_MODE });
+  const destination = path18.join(root, relativePath);
+  fs8.mkdirSync(path18.dirname(destination), { recursive: true, mode: BACKUP_DIRECTORY_MODE });
   fs8.copyFileSync(source, destination, fs8.constants.COPYFILE_EXCL);
   const mode = readFileMode(source, platform);
   if (mode !== null) fs8.chmodSync(destination, mode & OWNER_PERMISSION_BITS);
 }
 var IGNORE_EVERYTHING = "*\n";
 function ignoreBackupsInGit(directory) {
-  const ignoreFile = path15.join(directory, ".gitignore");
+  const ignoreFile = path18.join(directory, ".gitignore");
   if (fs8.existsSync(ignoreFile)) return;
   fs8.mkdirSync(directory, { recursive: true, mode: BACKUP_DIRECTORY_MODE });
   fs8.writeFileSync(ignoreFile, IGNORE_EVERYTHING);
@@ -3513,9 +3831,9 @@ function writeEnvFile({ filePath, content, platform }) {
 }
 
 // src/product/storage/restore-record/remove-harness-records.ts
-function removeHarnessRecords(record5, harnessIds) {
-  const harnesses2 = Object.fromEntries(Object.entries(record5.harnesses).filter(([id]) => !harnessIds.includes(id)));
-  return { ...record5, harnesses: harnesses2 };
+function removeHarnessRecords(record8, harnessIds) {
+  const harnesses2 = Object.fromEntries(Object.entries(record8.harnesses).filter(([id]) => !harnessIds.includes(id)));
+  return { ...record8, harnesses: harnesses2 };
 }
 
 // src/product/storage/env-file/render-env-file.ts
@@ -3647,7 +3965,7 @@ function restoreAgentFiles(outcome, params) {
 }
 function restoreFile({ file, target, params }) {
   const { ctx, backupRoot } = params;
-  const relativePath = path16.join(target.id, path16.basename(file.path));
+  const relativePath = path19.join(target.id, path19.basename(file.path));
   const backup = backUpBeforeWriting({ filePath: file.path, before: file.before, backupRoot, relativePath, ctx });
   if (file.after === null) {
     fs9.rmSync(file.path);
@@ -3666,7 +3984,7 @@ function restoreSharedEnvFile({ outcomes, envFile, params }) {
   if (envFile === null || !envFile.isChanged) return { outcomes, writtenFiles: [] };
   const { ctx, backupRoot } = params;
   try {
-    const relativePath = path16.join(ENV_FILE_BACKUP_DIRECTORY, path16.basename(envFile.path));
+    const relativePath = path19.join(ENV_FILE_BACKUP_DIRECTORY, path19.basename(envFile.path));
     const backup = backUpBeforeWriting({
       filePath: envFile.path,
       before: envFile.before,
@@ -3690,9 +4008,9 @@ function forgetRestored(outcomes, ctx) {
   if (restoredIds.length === 0) return [...outcomes];
   const { filePath } = resolveRestoreRecordLocation(ctx);
   try {
-    const record5 = readRestoreRecord({ filePath, home: ctx.home });
-    if (record5 !== null) {
-      writeRestoreRecord({ filePath, record: removeHarnessRecords(record5, restoredIds), platform: ctx.platform });
+    const record8 = readRestoreRecord({ filePath, home: ctx.home });
+    if (record8 !== null) {
+      writeRestoreRecord({ filePath, record: removeHarnessRecords(record8, restoredIds), platform: ctx.platform });
     }
     return [...outcomes];
   } catch (error) {
@@ -3706,8 +4024,8 @@ function failIfPlanned(outcome, error) {
 }
 
 // src/commands/restore/restore-plan.ts
-import path17 from "path";
-import { match as match22 } from "ts-pattern";
+import path20 from "path";
+import { match as match24 } from "ts-pattern";
 
 // src/product/storage/env-file/read-env-file.ts
 var NO_ENV_FILE = { kind: "read", text: null };
@@ -3722,26 +4040,26 @@ function readEnvFile({ envPath, home }) {
 // src/commands/restore/restore-plan.ts
 function planRestore(params) {
   const { candidates, ctx, envPath } = params;
-  const hasEnvVariables2 = candidates.some(({ record: record5 }) => (record5?.envVariables.length ?? 0) > 0);
+  const hasEnvVariables2 = candidates.some(({ record: record8 }) => (record8?.envVariables.length ?? 0) > 0);
   const envFileRead = hasEnvVariables2 ? readEnvFile({ envPath, home: ctx.home }) : NO_ENV_FILE;
   const namesKept = listNamesRecordedElsewhere(params);
   const outcomes = candidates.map((candidate) => planCandidate({ candidate, envFileRead, namesKept, params }));
   return { outcomes, envFile: planEnvFile({ outcomes, envFileRead, params }) };
 }
-function listNamesRecordedElsewhere({ candidates, record: record5 }) {
+function listNamesRecordedElsewhere({ candidates, record: record8 }) {
   const selectedIds = candidates.map(({ target }) => target.id);
-  const others = Object.entries(record5.harnesses).filter(([id]) => !selectedIds.includes(id));
+  const others = Object.entries(record8.harnesses).filter(([id]) => !selectedIds.includes(id));
   return new Set(others.flatMap(([, harness]) => harness.envVariables.map(({ name }) => name)));
 }
 function planCandidate({ candidate, envFileRead, namesKept, params }) {
-  const { target, record: record5 } = candidate;
-  if (record5 === null) return { kind: "nothing-to-restore", target };
-  const envVariables = record5.envVariables.filter(({ name }) => !namesKept.has(name));
+  const { target, record: record8 } = candidate;
+  if (record8 === null) return { kind: "nothing-to-restore", target };
+  const envVariables = record8.envVariables.filter(({ name }) => !namesKept.has(name));
   if (envVariables.length > 0 && envFileRead.kind === "failed") {
     return { kind: "failed", target, error: envFileRead.error };
   }
   try {
-    const { files, warnings } = planRecordedFiles(record5.files, params.ctx);
+    const { files, warnings } = planRecordedFiles(record8.files, params.ctx);
     const hasEnvChange = hasOwnEnvChange({ envFileRead, envVariables, shell: params.shell });
     const isChanged = hasEnvChange || files.some((file) => file.isChanged);
     return { kind: isChanged ? "restored" : "unchanged", target, files, envVariables, warnings };
@@ -3773,7 +4091,7 @@ function planRecordedFile(file, ctx) {
   };
 }
 function describeMissingFile(filePath, ctx) {
-  const backups = match22(ctx.scope).with("user", () => path17.join(ctx.home, USER_BACKUP_DIRECTORY)).with("project", () => path17.join(ctx.cwd, PROJECT_BACKUP_DIRECTORY)).exhaustive();
+  const backups = match24(ctx.scope).with("user", () => path20.join(ctx.home, USER_BACKUP_DIRECTORY)).with("project", () => path20.join(ctx.cwd, PROJECT_BACKUP_DIRECTORY)).exhaustive();
   return `${displayPath(filePath, ctx.home)} no longer exists, so it was left as it is. Copies from before each run are under ${displayPath(backups, ctx.home)}, unless --backup-dir put them elsewhere.`;
 }
 function restoreFile2({ file, before, filePath, home }) {
@@ -3795,8 +4113,8 @@ function planEnvFile({ outcomes, envFileRead, params }) {
 }
 
 // src/commands/restore/restore-secrets.ts
-function listRestoreSecrets({ record: record5, ctx, envPath, shell }) {
-  const recorded = Object.values(record5.harnesses).flatMap((harness) => [
+function listRestoreSecrets({ record: record8, ctx, envPath, shell }) {
+  const recorded = Object.values(record8.harnesses).flatMap((harness) => [
     ...harness.files.flatMap(listFileSecrets),
     ...listEnvSecrets(harness)
   ]);
@@ -3843,15 +4161,15 @@ async function runRestore(params) {
     ui.outro(FINISHED_WITH_ERRORS);
     return EXIT_CODE.failed;
   }
-  const { record: record5 } = recordRead;
-  if (namedHarnesses.length === 0 && Object.keys(record5.harnesses).length === 0) {
+  const { record: record8 } = recordRead;
+  if (namedHarnesses.length === 0 && Object.keys(record8.harnesses).length === 0) {
     const recordPath = displayPath(resolveRestoreRecordLocation(ctx).filePath, ctx.home);
     ui.outro(`Nothing to restore \u2014 nexos-connect has not set up any agent at ${scope} scope (${recordPath}).`);
     return EXIT_CODE.ok;
   }
   const candidates = await selectCandidates({
     namedHarnesses,
-    record: record5,
+    record: record8,
     ctx,
     shouldAssumeYes: options.shouldAssumeYes,
     ui
@@ -3861,7 +4179,7 @@ async function runRestore(params) {
     return EXIT_CODE.ok;
   }
   const run = { ...params, ui, ctx };
-  const plan = planSelected({ run, candidates, record: record5 });
+  const plan = planSelected({ run, candidates, record: record8 });
   if (options.isDryRun) return report({ run, plan, mode: { kind: "dry-run" }, outro: DRY_RUN_OUTRO });
   const hasChanges = plan.outcomes.some((outcome) => outcome.kind === "restored");
   if (hasChanges && !options.shouldAssumeYes && !await ui.confirm(CONFIRMATION, true)) {
@@ -3888,8 +4206,8 @@ function listRecordedLabels(ctx) {
 }
 function readRecord(ctx) {
   try {
-    const record5 = readRestoreRecord({ filePath: resolveRestoreRecordLocation(ctx).filePath, home: ctx.home });
-    return { kind: "read", record: record5 ?? createEmptyRestoreRecord() };
+    const record8 = readRestoreRecord({ filePath: resolveRestoreRecordLocation(ctx).filePath, home: ctx.home });
+    return { kind: "read", record: record8 ?? createEmptyRestoreRecord() };
   } catch (error) {
     if (!(error instanceof RestoreRecordError)) throw error;
     return { kind: "failed", error: error.message };
@@ -3899,30 +4217,30 @@ function labelOf(harnessId) {
   return findHarness(harnessId)?.label ?? harnessId;
 }
 async function selectCandidates(params) {
-  const { namedHarnesses, record: record5, ctx, ui } = params;
-  if (namedHarnesses.length > 0) return namedHarnesses.map((harness) => toCandidate(harness.id, record5));
-  const recordedIds = Object.keys(record5.harnesses);
-  if (params.shouldAssumeYes) return recordedIds.map((id) => toCandidate(id, record5));
-  const chosenIds = await ui.selectRestoreHarnesses(recordedIds.map((id) => describeChoice({ id, record: record5, ctx })));
-  return chosenIds.map((id) => toCandidate(id, record5));
+  const { namedHarnesses, record: record8, ctx, ui } = params;
+  if (namedHarnesses.length > 0) return namedHarnesses.map((harness) => toCandidate(harness.id, record8));
+  const recordedIds = Object.keys(record8.harnesses);
+  if (params.shouldAssumeYes) return recordedIds.map((id) => toCandidate(id, record8));
+  const chosenIds = await ui.selectRestoreHarnesses(recordedIds.map((id) => describeChoice({ id, record: record8, ctx })));
+  return chosenIds.map((id) => toCandidate(id, record8));
 }
-function toCandidate(id, record5) {
-  return { target: { id, label: labelOf(id) }, record: record5.harnesses[id] ?? null };
+function toCandidate(id, record8) {
+  return { target: { id, label: labelOf(id) }, record: record8.harnesses[id] ?? null };
 }
 var ENV_VARIABLES_HINT = "environment variables";
-function describeChoice({ id, record: record5, ctx }) {
-  const harness = record5.harnesses[id];
+function describeChoice({ id, record: record8, ctx }) {
+  const harness = record8.harnesses[id];
   const root = resolveRestoreRecordLocation(ctx).root;
-  const files = (harness?.files ?? []).map((file) => displayPath(path18.join(root, ...file.path), ctx.home));
+  const files = (harness?.files ?? []).map((file) => displayPath(path21.join(root, ...file.path), ctx.home));
   const variables = (harness?.envVariables.length ?? 0) > 0 ? [ENV_VARIABLES_HINT] : [];
   return { value: id, label: labelOf(id), hint: [...files, ...variables].join(", ") };
 }
-function planSelected({ run, candidates, record: record5 }) {
+function planSelected({ run, candidates, record: record8 }) {
   const { ctx, masker: masker2, ui } = run;
   const shell = resolveShell(ctx.platform);
   const envPath = resolveEnvFilePath(ctx.home, shell);
-  masker2.registerSecrets(listRestoreSecrets({ record: record5, ctx, envPath, shell }));
-  const plan = planRestore({ candidates, record: record5, ctx, envPath, shell });
+  masker2.registerSecrets(listRestoreSecrets({ record: record8, ctx, envPath, shell }));
+  const plan = planRestore({ candidates, record: record8, ctx, envPath, shell });
   const files = plan.outcomes.flatMap((outcome) => isPlannedRestore(outcome) ? outcome.files : []);
   const hasFailedAgent = plan.outcomes.some((outcome) => outcome.kind === "failed");
   ui.print(
@@ -3981,7 +4299,7 @@ function findDetectionStatus(harness, detection) {
 
 // src/ui/report/format-result.ts
 import pc9 from "picocolors";
-import { P as P5, match as match23 } from "ts-pattern";
+import { P as P5, match as match25 } from "ts-pattern";
 
 // src/commands/setup/setup-result.ts
 var OUTCOME_KINDS = ["updated", "unchanged", "not-found", "unsupported", "failed"];
@@ -4023,7 +4341,7 @@ function formatResult(params) {
 function formatOutcome2(outcome, params) {
   const { masker: masker2 } = params;
   const style = OUTCOME_STYLE[outcome.kind];
-  const body = match23(outcome).with({ kind: P5.union("updated", "unchanged") }, (planned) => formatPlannedOutcome(planned, params)).with({ kind: "not-found" }, ({ detail }) => [`${INDENT}${pc9.dim(masker2.maskText(detail))}`]).with({ kind: "unsupported" }, ({ harness }) => [`${INDENT}${pc9.dim(harness.reason)}`]).with({ kind: "failed" }, ({ error }) => [`${INDENT}${pc9.red(masker2.maskText(error))}`]).exhaustive();
+  const body = match25(outcome).with({ kind: P5.union("updated", "unchanged") }, (planned) => formatPlannedOutcome(planned, params)).with({ kind: "not-found" }, ({ detail }) => [`${INDENT}${pc9.dim(masker2.maskText(detail))}`]).with({ kind: "unsupported" }, ({ harness }) => [`${INDENT}${pc9.dim(harness.reason)}`]).with({ kind: "failed" }, ({ error }) => [`${INDENT}${pc9.red(masker2.maskText(error))}`]).exhaustive();
   return ["", `  ${style.colour(`${style.glyph} ${outcome.harness.label} \u2014 ${style.label}`)}`, ...body];
 }
 function formatPlannedOutcome(outcome, { envFile, home, masker: masker2 }) {
@@ -4067,7 +4385,7 @@ function formatLoadStep({ outcomes, envFile, mode }) {
     `  ${formatList(readers)} ${verb} the key from the environment. Load it with:`,
     `${INDENT}${pc9.bold(loadCommand)}`,
     `  ${pc9.dim(`Until then ${pronoun} will not see the key.`)}`,
-    ...match23(envFile.shell).with("powershell", () => [
+    ...match25(envFile.shell).with("powershell", () => [
       `  ${pc9.dim("That lasts for this session only. Add the same line to $PROFILE to keep it.")}`
     ]).with("posix", () => []).exhaustive()
   ];
@@ -4092,7 +4410,7 @@ function formatRunHint({ binary, label }) {
 }
 
 // src/commands/setup/answers/describe-key-destination.ts
-import { match as match24 } from "ts-pattern";
+import { match as match26 } from "ts-pattern";
 
 // src/commands/setup/answers/scope.ts
 async function resolveScope({
@@ -4140,7 +4458,7 @@ function describeKeyDestination({ configurable, ctx, envPath }) {
   return `It will be written to ${formatList(configFiles)}, and to ${envFile}.`;
 }
 function displayScopedPath(filePath, ctx) {
-  return match24(ctx.scope).with("user", () => displayPath(filePath, ctx.home)).with("project", () => displayRelativePath(filePath, ctx.cwd)).exhaustive();
+  return match26(ctx.scope).with("user", () => displayPath(filePath, ctx.home)).with("project", () => displayRelativePath(filePath, ctx.cwd)).exhaustive();
 }
 
 // src/commands/setup/answers/harness-selection.ts
@@ -4211,7 +4529,7 @@ function findIneligibility(harness, scope) {
 }
 
 // src/commands/setup/changes/apply-changes.ts
-import path19 from "path";
+import path22 from "path";
 
 // src/commands/setup/changes/change-plan.ts
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
@@ -4326,32 +4644,32 @@ function classifyFileOrigin(before) {
   if (before === null) return "absent";
   return before.trim() === "" ? "blank" : "content";
 }
-function addFileOriginals({ record: record5, harnessId, file }) {
-  const harness = readHarnessRecord(record5, harnessId);
+function addFileOriginals({ record: record8, harnessId, file }) {
+  const harness = readHarnessRecord(record8, harnessId);
   const existing = harness.files.find((recorded) => isSamePath2(recorded.path, file.path));
   const others = harness.files.filter((recorded) => recorded !== existing);
-  return withHarnessRecord(record5, harnessId, { ...harness, files: [...others, mergeFile(existing, file)] });
+  return withHarnessRecord(record8, harnessId, { ...harness, files: [...others, mergeFile(existing, file)] });
 }
-function addEnvOriginals({ record: record5, harnessId, variables, isFileAbsent }) {
-  const harness = readHarnessRecord(record5, harnessId);
+function addEnvOriginals({ record: record8, harnessId, variables, isFileAbsent }) {
+  const harness = readHarnessRecord(record8, harnessId);
   const kept = isFileAbsent ? [] : harness.envVariables;
   const added = variables.filter((variable) => !kept.some(({ name }) => name === variable.name));
-  return withHarnessRecord(record5, harnessId, { ...harness, envVariables: [...kept, ...added] });
+  return withHarnessRecord(record8, harnessId, { ...harness, envVariables: [...kept, ...added] });
 }
 var EMPTY_HARNESS_RECORD = { files: [], envVariables: [] };
-function readHarnessRecord(record5, harnessId) {
-  return record5.harnesses[harnessId] ?? EMPTY_HARNESS_RECORD;
+function readHarnessRecord(record8, harnessId) {
+  return record8.harnesses[harnessId] ?? EMPTY_HARNESS_RECORD;
 }
-function withHarnessRecord(record5, harnessId, harness) {
-  return { ...record5, harnesses: { ...record5.harnesses, [harnessId]: harness } };
+function withHarnessRecord(record8, harnessId, harness) {
+  return { ...record8, harnesses: { ...record8.harnesses, [harnessId]: harness } };
 }
 function mergeFile(existing, file) {
   if (existing === void 0 || file.origin === "absent") return file;
   const added = file.keys.filter((key) => !existing.keys.some(({ keyPath }) => isSamePath2(keyPath, key.keyPath)));
   return { ...existing, keys: [...existing.keys, ...added] };
 }
-function isSamePath2(path22, other) {
-  return path22.length === other.length && path22.every((segment, index) => segment === other[index]);
+function isSamePath2(path25, other) {
+  return path25.length === other.length && path25.every((segment, index) => segment === other[index]);
 }
 
 // src/commands/setup/changes/record-originals.ts
@@ -4363,7 +4681,7 @@ function recordFileOriginals({ harnessId, file, ctx }) {
     origin: classifyFileOrigin(file.before),
     keys: file.originals
   };
-  updateRestoreRecord(location, ctx, (record5) => addFileOriginals({ record: record5, harnessId, file: recordedFile }));
+  updateRestoreRecord(location, ctx, (record8) => addFileOriginals({ record: record8, harnessId, file: recordedFile }));
 }
 function recordEnvOriginals({ outcomes, envFile, ctx }) {
   const syntax = ENV_SYNTAXES[envFile.shell];
@@ -4372,7 +4690,7 @@ function recordEnvOriginals({ outcomes, envFile, ctx }) {
   updateRestoreRecord(
     resolveRestoreRecordLocation(ctx),
     ctx,
-    (record5) => outcomes.reduce((updated, outcome) => {
+    (record8) => outcomes.reduce((updated, outcome) => {
       if (outcome.kind !== "updated") return updated;
       const variables = Object.keys(outcome.envVariables).map((name) => ({
         name,
@@ -4380,13 +4698,13 @@ function recordEnvOriginals({ outcomes, envFile, ctx }) {
       }));
       if (variables.length === 0) return updated;
       return addEnvOriginals({ record: updated, harnessId: outcome.harness.id, variables, isFileAbsent });
-    }, record5)
+    }, record8)
   );
 }
 function updateRestoreRecord(location, ctx, update) {
   if (location.gitIgnoredDirectory !== null) ignoreBackupsInGit(location.gitIgnoredDirectory);
-  const record5 = readRestoreRecord({ filePath: location.filePath, home: ctx.home }) ?? createEmptyRestoreRecord();
-  writeRestoreRecord({ filePath: location.filePath, record: update(record5), platform: ctx.platform });
+  const record8 = readRestoreRecord({ filePath: location.filePath, home: ctx.home }) ?? createEmptyRestoreRecord();
+  writeRestoreRecord({ filePath: location.filePath, record: update(record8), platform: ctx.platform });
 }
 
 // src/commands/setup/changes/apply-changes.ts
@@ -4408,10 +4726,10 @@ function writeAgentFiles(outcome, params) {
   const writtenFiles = [];
   for (const file of outcome.files.filter((plan) => plan.isChanged)) {
     try {
-      const relativePath = path19.join(outcome.harness.id, path19.basename(file.path));
-      const record5 = () => recordFileOriginals({ harnessId: outcome.harness.id, file, ctx: params.ctx });
+      const relativePath = path22.join(outcome.harness.id, path22.basename(file.path));
+      const record8 = () => recordFileOriginals({ harnessId: outcome.harness.id, file, ctx: params.ctx });
       const write = () => writeFileWithMode({ filePath: file.path, content: file.after, mode: resolveWriteMode(file, params.ctx) });
-      writtenFiles.push(backUpThenWrite({ file, relativePath, record: record5, write, params }));
+      writtenFiles.push(backUpThenWrite({ file, relativePath, record: record8, write, params }));
     } catch (error) {
       const reason = describeFileError({ error, action: "write", home: params.ctx.home });
       return { outcome: { kind: "failed", harness: outcome.harness, error: reason }, writtenFiles };
@@ -4426,11 +4744,11 @@ function replanEnvFile2(envFile, outcomes) {
 function writeSharedEnvFile({ outcomes, envFile, params }) {
   if (envFile === null || !envFile.isChanged) return { outcomes, writtenFiles: [] };
   try {
-    const relativePath = path19.join(ENV_FILE_BACKUP_DIRECTORY, path19.basename(envFile.path));
+    const relativePath = path22.join(ENV_FILE_BACKUP_DIRECTORY, path22.basename(envFile.path));
     const { ctx } = params;
-    const record5 = () => recordEnvOriginals({ outcomes, envFile, ctx });
+    const record8 = () => recordEnvOriginals({ outcomes, envFile, ctx });
     const write = () => writeEnvFile({ filePath: envFile.path, content: envFile.after, platform: ctx.platform });
-    return { outcomes, writtenFiles: [backUpThenWrite({ file: envFile, relativePath, record: record5, write, params })] };
+    return { outcomes, writtenFiles: [backUpThenWrite({ file: envFile, relativePath, record: record8, write, params })] };
   } catch (error) {
     const reason = describeFileError({ error, action: "write", home: params.ctx.home });
     return { outcomes: outcomes.map((outcome) => failIfWritingEnvFile(outcome, reason)), writtenFiles: [] };
@@ -4440,10 +4758,10 @@ function failIfWritingEnvFile(outcome, error) {
   if (outcome.kind !== "updated" || Object.keys(outcome.envVariables).length === 0) return outcome;
   return { kind: "failed", harness: outcome.harness, error };
 }
-function backUpThenWrite({ file, relativePath, record: record5, write, params }) {
+function backUpThenWrite({ file, relativePath, record: record8, write, params }) {
   const { ctx, backupRoot } = params;
   const backup = backUpBeforeWriting({ filePath: file.path, before: file.before, backupRoot, relativePath, ctx });
-  record5();
+  record8();
   write();
   return backup;
 }
@@ -4626,7 +4944,7 @@ function abort(ui) {
 
 // src/harnesses/run-launch.ts
 import fs10 from "fs";
-import path20 from "path";
+import path23 from "path";
 var LAUNCH_DIRECTORY_PREFIX = "nexos-connect-";
 var STALE_DIRECTORY_PATTERN = new RegExp(`^${LAUNCH_DIRECTORY_PREFIX}(\\d+)-`);
 var OWNER_ONLY_MODE2 = 384;
@@ -4639,11 +4957,11 @@ function sweepStaleDirectories(deps) {
     return;
   }
   for (const name of names) {
-    const match25 = STALE_DIRECTORY_PATTERN.exec(name);
-    if (match25 === null) continue;
-    const directory = path20.join(root, name);
+    const match27 = STALE_DIRECTORY_PATTERN.exec(name);
+    if (match27 === null) continue;
+    const directory = path23.join(root, name);
     try {
-      if (deps.isAlive(Number(match25[1]))) continue;
+      if (deps.isAlive(Number(match27[1]))) continue;
       if (deps.uid !== void 0 && fs10.statSync(directory).uid !== deps.uid) continue;
       fs10.rmSync(directory, { recursive: true, force: true });
     } catch {
@@ -4662,10 +4980,10 @@ async function runLaunch(recipe, passthrough, deps) {
   let commandArguments = recipe.arguments;
   if (recipe.files !== void 0 && recipe.files.length > 0) {
     try {
-      directory = fs10.mkdtempSync(path20.join(deps.tmpdir(), `${LAUNCH_DIRECTORY_PREFIX}${deps.pid}-`));
+      directory = fs10.mkdtempSync(path23.join(deps.tmpdir(), `${LAUNCH_DIRECTORY_PREFIX}${deps.pid}-`));
       const byPlaceholder = /* @__PURE__ */ new Map();
       for (const file of recipe.files) {
-        const target = path20.join(directory, file.name);
+        const target = path23.join(directory, file.name);
         fs10.writeFileSync(target, file.content, { mode: OWNER_ONLY_MODE2, flag: "wx" });
         byPlaceholder.set(file.placeholder, target);
       }
@@ -5382,8 +5700,8 @@ var HELP = renderHelp({
   predefinedModelIds: PREDEFINED_MODELS.map((model) => model.id),
   defaultModel: DEFAULT_MODEL,
   backupDirectories: {
-    user: path21.join("~", USER_BACKUP_DIRECTORY),
-    project: `.${path21.sep}${PROJECT_BACKUP_DIRECTORY}`
+    user: path24.join("~", USER_BACKUP_DIRECTORY),
+    project: `.${path24.sep}${PROJECT_BACKUP_DIRECTORY}`
   }
 });
 function isLaunchingHarness(harness) {
@@ -5397,7 +5715,7 @@ function describeUnknownAgent(binary) {
   if (isAgentName(binary)) return `Unknown agent "${binary}". ${oneOf}`;
   return `Unknown agent. ${oneOf}. To pass a key, use --key or set $${KEY_ENV_VARIABLE}.`;
 }
-var PackageSchema = v12.object({ version: v12.string() });
+var PackageSchema = v15.object({ version: v15.string() });
 async function runCommand(ui) {
   const options = parseCliArguments(process.argv.slice(NODE_AND_SCRIPT_ARGUMENT_COUNT));
   if (options.shouldShowHelp) {
@@ -5405,7 +5723,7 @@ async function runCommand(ui) {
     return EXIT_CODE.ok;
   }
   if (options.shouldShowVersion) {
-    console.log(v12.parse(PackageSchema, createRequire(import.meta.url)("../package.json")).version);
+    console.log(v15.parse(PackageSchema, createRequire(import.meta.url)("../package.json")).version);
     return EXIT_CODE.ok;
   }
   if (options.command.kind === "forget-key") return await forgetKey({ keystore, ui, masker });