promptfoo 0.121.4 → 0.121.7

package/dist/src/{modelslab-wu9yi5GE.js → modelslab-EyDczZ5A.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { O as getEnvString, s as logger } from "./logger-DksKw1Qc.js";
-import { m as REQUEST_TIMEOUT_MS, n as fetchWithProxy } from "./fetch-BEWnXrrG.js";
-import { a as fetchWithCache } from "./cache-mb7c8hbp.js";
-import { i as storeBlob } from "./blobs-BQWqnnvL.js";
-import { n as isBlobStorageEnabled } from "./extractor-DNSeBVOJ.js";
-import { t as ellipsize } from "./text-KvuD2Iko.js";
+import { O as getEnvString, s as logger } from "./logger-BbY6ypFL.js";
+import { _ as REQUEST_TIMEOUT_MS, n as fetchWithProxy } from "./fetch-DXUnXkVU.js";
+import { a as fetchWithCache } from "./cache-DpPWrkTE.js";
+import { t as ellipsize } from "./text-Db-Wt2u2.js";
+import { i as storeBlob } from "./blobs-DODuTK-a.js";
+import { n as isBlobStorageEnabled } from "./extractor-CIW3iN-b.js";
 //#region src/providers/modelslab.ts
 /**
 * ModelsLab provider for text-to-image generation.
@@ -161,4 +161,4 @@ var ModelsLabImageProvider = class {
 //#endregion
 export { ModelsLabImageProvider };
 
-//# sourceMappingURL=modelslab-wu9yi5GE.js.map
+//# sourceMappingURL=modelslab-EyDczZ5A.js.map

package/dist/src/{nova-reel-CCFRfeRb.js → nova-reel-BGPNBOMS.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { s as logger } from "./logger-DksKw1Qc.js";
-import { l as sleep } from "./fetch-BEWnXrrG.js";
-import { i as storeBlob } from "./blobs-BQWqnnvL.js";
-import { t as ellipsize } from "./text-KvuD2Iko.js";
-import { t as AwsBedrockGenericProvider } from "./base-fZ9wgg50.js";
+import { s as logger } from "./logger-BbY6ypFL.js";
+import { f as sleep } from "./fetch-DXUnXkVU.js";
+import { t as ellipsize } from "./text-Db-Wt2u2.js";
+import { t as AwsBedrockGenericProvider } from "./base-Co80MMCi.js";
+import { i as storeBlob } from "./blobs-DODuTK-a.js";
 import * as fs$1 from "fs";
 import * as path$1 from "path";
 //#region src/providers/bedrock/nova-reel.ts
@@ -274,4 +274,4 @@ var NovaReelVideoProvider = class extends AwsBedrockGenericProvider {
 //#endregion
 export { NovaReelVideoProvider };
 
-//# sourceMappingURL=nova-reel-CCFRfeRb.js.map
+//# sourceMappingURL=nova-reel-BGPNBOMS.js.map

package/dist/src/{nova-reel-DQrm74ng.js → nova-reel-B_5NKFu1.js}

@@ -1,8 +1,8 @@
 import { a as logger } from "./logger-Ct2S6Yx-.js";
-import { d as sleep } from "./fetch-Di00EQrc.js";
-import { r as storeBlob } from "./blobs-C-F78Kfn.js";
-import { t as ellipsize } from "./text-DHxdyQqT.js";
-import { t as AwsBedrockGenericProvider } from "./base-PYJvBE1i.js";
+import { l as sleep } from "./fetch-It34O8Ur.js";
+import { t as ellipsize } from "./text-DwYK5EBn.js";
+import { t as AwsBedrockGenericProvider } from "./base-CKLo890h.js";
+import { r as storeBlob } from "./blobs-Dwef1Ao1.js";
 import * as fs$1 from "fs";
 import * as path$1 from "path";
 //#region src/providers/bedrock/nova-reel.ts
@@ -273,4 +273,4 @@ var NovaReelVideoProvider = class extends AwsBedrockGenericProvider {
 //#endregion
 export { NovaReelVideoProvider };
 
-//# sourceMappingURL=nova-reel-DQrm74ng.js.map
+//# sourceMappingURL=nova-reel-B_5NKFu1.js.map

package/dist/src/{nova-reel-gr11WG7f.js → nova-reel-C4eUJGse.js}

@@ -1,8 +1,8 @@
-import { a as logger } from "./logger-B88EkIn6.js";
-import { d as sleep } from "./fetch-B0Z3Oe4k.js";
-import { i as storeBlob } from "./blobs-BCZavS8s.js";
+import { a as logger } from "./logger-KD8JjCRJ.js";
+import { m as sleep } from "./fetch-BufrQtvR.js";
+import { i as storeBlob } from "./blobs-CeFdPn_T.js";
 import { t as ellipsize } from "./text-CZr46tp_.js";
-import { t as AwsBedrockGenericProvider } from "./base-yrI1Yal4.js";
+import { t as AwsBedrockGenericProvider } from "./base-E9I8zXjz.js";
 import * as fs$1 from "fs";
 import * as path$1 from "path";
 //#region src/providers/bedrock/nova-reel.ts
@@ -273,4 +273,4 @@ var NovaReelVideoProvider = class extends AwsBedrockGenericProvider {
 //#endregion
 export { NovaReelVideoProvider };
 
-//# sourceMappingURL=nova-reel-gr11WG7f.js.map
+//# sourceMappingURL=nova-reel-C4eUJGse.js.map

package/dist/src/{nova-reel-CrLXVKQf.cjs → nova-reel-CjJRxI1X.cjs}

@@ -1,12 +1,13 @@
-const require_logger = require("./logger-COuQb2xB.cjs");
-const require_fetch = require("./fetch-CJU5ELPa.cjs");
-const require_blobs = require("./blobs-D2FAd1Q5.cjs");
-const require_text = require("./text-BVi-cLPJ.cjs");
-const require_base = require("./base-D-670DX8.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-D_mwlA32.cjs");
+const require_logger = require("./logger-cfNpzI4o.cjs");
+const require_fetch = require("./fetch-Dw4XZHjj.cjs");
+const require_text = require("./text-nywWsRBM.cjs");
+const require_base = require("./base-DGJW48uz.cjs");
+const require_blobs = require("./blobs-B0977K1O.cjs");
 let fs = require("fs");
-fs = require_logger.__toESM(fs);
+fs = require_rolldown_runtime.__toESM(fs, 1);
 let path = require("path");
-path = require_logger.__toESM(path);
+path = require_rolldown_runtime.__toESM(path, 1);
 //#region src/providers/bedrock/nova-reel.ts
 /**
 * Amazon Nova Reel Video Generation Provider
@@ -275,4 +276,4 @@ var NovaReelVideoProvider = class extends require_base.AwsBedrockGenericProvider
 //#endregion
 exports.NovaReelVideoProvider = NovaReelVideoProvider;
 
-//# sourceMappingURL=nova-reel-CrLXVKQf.cjs.map
+//# sourceMappingURL=nova-reel-CjJRxI1X.cjs.map

package/dist/src/{nova-sonic-BYdp-QLs.js → nova-sonic-BNGmgfFz.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { s as logger } from "./logger-DksKw1Qc.js";
-import { a as createEmptyTokenUsage } from "./tokenUsageUtils-CXrvO-wA.js";
-import { t as AwsBedrockGenericProvider } from "./base-fZ9wgg50.js";
+import { s as logger } from "./logger-BbY6ypFL.js";
+import { a as createEmptyTokenUsage } from "./tokenUsageUtils-CDet74yk.js";
+import { t as AwsBedrockGenericProvider } from "./base-Co80MMCi.js";
 import { Buffer } from "node:buffer";
 import { Subject, firstValueFrom } from "rxjs";
 import { take } from "rxjs/operators";
@@ -361,4 +361,4 @@ var NovaSonicProvider = class extends AwsBedrockGenericProvider {
 //#endregion
 export { NovaSonicProvider };
 
-//# sourceMappingURL=nova-sonic-BYdp-QLs.js.map
+//# sourceMappingURL=nova-sonic-BNGmgfFz.js.map

package/dist/src/{nova-sonic-TDgrlTk7.js → nova-sonic-ChPlh5na.js}

@@ -1,6 +1,6 @@
-import { a as logger } from "./logger-B88EkIn6.js";
-import { a as createEmptyTokenUsage } from "./tokenUsageUtils-C-bmyHoE.js";
-import { t as AwsBedrockGenericProvider } from "./base-yrI1Yal4.js";
+import { a as logger } from "./logger-KD8JjCRJ.js";
+import { a as createEmptyTokenUsage } from "./tokenUsageUtils-BjVkdk18.js";
+import { t as AwsBedrockGenericProvider } from "./base-E9I8zXjz.js";
 import { Buffer } from "node:buffer";
 import { Subject, firstValueFrom } from "rxjs";
 import { take } from "rxjs/operators";
@@ -360,4 +360,4 @@ var NovaSonicProvider = class extends AwsBedrockGenericProvider {
 //#endregion
 export { NovaSonicProvider };
 
-//# sourceMappingURL=nova-sonic-TDgrlTk7.js.map
+//# sourceMappingURL=nova-sonic-ChPlh5na.js.map

package/dist/src/{nova-sonic-B_ZXcUJB.js → nova-sonic-CrV0iaY_.js}

@@ -1,6 +1,6 @@
 import { a as logger } from "./logger-Ct2S6Yx-.js";
-import { a as createEmptyTokenUsage } from "./tokenUsageUtils-C-bmyHoE.js";
-import { t as AwsBedrockGenericProvider } from "./base-PYJvBE1i.js";
+import { a as createEmptyTokenUsage } from "./tokenUsageUtils-CmnQ0G2m.js";
+import { t as AwsBedrockGenericProvider } from "./base-CKLo890h.js";
 import { Buffer } from "node:buffer";
 import { Subject, firstValueFrom } from "rxjs";
 import { take } from "rxjs/operators";
@@ -360,4 +360,4 @@ var NovaSonicProvider = class extends AwsBedrockGenericProvider {
 //#endregion
 export { NovaSonicProvider };
 
-//# sourceMappingURL=nova-sonic-B_ZXcUJB.js.map
+//# sourceMappingURL=nova-sonic-CrV0iaY_.js.map

package/dist/src/{nova-sonic-i5tUvXKn.cjs → nova-sonic-DuOG9Aun.cjs}

@@ -1,6 +1,7 @@
-const require_logger = require("./logger-COuQb2xB.cjs");
-const require_tokenUsageUtils = require("./tokenUsageUtils-Bb7DkZPz.cjs");
-const require_base = require("./base-D-670DX8.cjs");
+require("./rolldown-runtime-D_mwlA32.cjs");
+const require_logger = require("./logger-cfNpzI4o.cjs");
+const require_tokenUsageUtils = require("./tokenUsageUtils-_B-P8IAi.cjs");
+const require_base = require("./base-DGJW48uz.cjs");
 let node_buffer = require("node:buffer");
 let rxjs = require("rxjs");
 let rxjs_operators = require("rxjs/operators");
@@ -360,4 +361,4 @@ var NovaSonicProvider = class extends require_base.AwsBedrockGenericProvider {
 //#endregion
 exports.NovaSonicProvider = NovaSonicProvider;
 
-//# sourceMappingURL=nova-sonic-i5tUvXKn.cjs.map
+//# sourceMappingURL=nova-sonic-DuOG9Aun.cjs.map

package/dist/src/{openai-DhVEmgeZ.js → openai-BMHD2Huo.js}

@@ -1,4 +1,4 @@
-import { T as getEnvString } from "./logger-B88EkIn6.js";
+import { T as getEnvString } from "./logger-KD8JjCRJ.js";
 //#region src/providers/openai/index.ts
 var OpenAiGenericProvider = class {
 	modelName;
@@ -44,4 +44,4 @@ var OpenAiGenericProvider = class {
 //#endregion
 export { OpenAiGenericProvider as t };
 
-//# sourceMappingURL=openai-DhVEmgeZ.js.map
+//# sourceMappingURL=openai-BMHD2Huo.js.map

package/dist/src/{openai-URNyItar.cjs → openai-C3uXv8wS.cjs}

@@ -1,4 +1,4 @@
-const require_logger = require("./logger-COuQb2xB.cjs");
+const require_logger = require("./logger-cfNpzI4o.cjs");
 //#region src/providers/openai/index.ts
 var OpenAiGenericProvider = class {
 	modelName;
@@ -49,4 +49,4 @@ Object.defineProperty(exports, "OpenAiGenericProvider", {
 	}
 });
 
-//# sourceMappingURL=openai-URNyItar.cjs.map
+//# sourceMappingURL=openai-C3uXv8wS.cjs.map

package/dist/src/{openai-Qsvz25mV.js → openai-CJrsh9n4.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { O as getEnvString } from "./logger-DksKw1Qc.js";
+import { O as getEnvString } from "./logger-BbY6ypFL.js";
 //#region src/providers/openai/index.ts
 var OpenAiGenericProvider = class {
 	modelName;
@@ -45,4 +45,4 @@ var OpenAiGenericProvider = class {
 //#endregion
 export { OpenAiGenericProvider as t };
 
-//# sourceMappingURL=openai-Qsvz25mV.js.map
+//# sourceMappingURL=openai-CJrsh9n4.js.map

package/dist/src/{openai-iYtrXzOX.js → openai-zgwBb4Ff.js}

@@ -44,4 +44,4 @@ var OpenAiGenericProvider = class {
 //#endregion
 export { OpenAiGenericProvider as t };
 
-//# sourceMappingURL=openai-iYtrXzOX.js.map
+//# sourceMappingURL=openai-zgwBb4Ff.js.map

package/dist/src/{openclaw-CnQ363Wi.js → openclaw-BIHlu_36.js}

@@ -1,9 +1,10 @@
-import { T as getEnvString, a as logger, x as getConfigDirectoryPath } from "./logger-B88EkIn6.js";
-import { I as VERSION, h as REQUEST_TIMEOUT_MS, t as fetchWithProxy } from "./fetch-B0Z3Oe4k.js";
-import { n as sha256 } from "./createHash-CwDVU5xr.js";
-import { t as OpenAiChatCompletionProvider } from "./chat-BfPaS15_.js";
-import { t as OpenAiResponsesProvider } from "./responses-C-flexAY.js";
-import { t as OpenAiEmbeddingProvider } from "./embedding-DD9wa3ae.js";
+import { T as getEnvString, a as logger, x as getConfigDirectoryPath } from "./logger-KD8JjCRJ.js";
+import { t as fetchWithProxy, v as REQUEST_TIMEOUT_MS } from "./fetch-BufrQtvR.js";
+import { n as VERSION } from "./version-BK20a4sw.js";
+import { n as sha256 } from "./createHash-CGVzWdjj.js";
+import { t as OpenAiChatCompletionProvider } from "./chat-CUCorGiL.js";
+import { t as OpenAiResponsesProvider } from "./responses-B6ktc3Ra.js";
+import { t as OpenAiEmbeddingProvider } from "./embedding-C251p1-8.js";
 import fs from "fs";
 import path from "path";
 import os from "os";
@@ -322,6 +323,7 @@ function resolveGatewayPortOverride(env) {
 	return Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 ? parsedPort : void 0;
 }
 function toAuthSecret(kind, value) {
+	if (typeof value !== "string") return;
 	const trimmed = value?.trim();
 	return trimmed ? {
 		kind,
@@ -910,7 +912,7 @@ var OpenClawAgentProvider = class {
 	}
 	resolveScopesForDeviceToken(deviceToken) {
 		if (this.hasExplicitScopes) return this.scopes;
-		return deviceToken.scopes && deviceToken.scopes.length > 0 ? deviceToken.scopes : this.scopes;
+		return normalizeScopes([...this.scopes, ...deviceToken.scopes || []]);
 	}
 	storeDeviceTokenFromHello(payload, authState) {
 		if (!authState?.deviceIdentity) return;
@@ -1196,4 +1198,4 @@ function createOpenClawProvider(providerPath, providerOptions = {}, env) {
 //#endregion
 export { createOpenClawProvider };
 
-//# sourceMappingURL=openclaw-CnQ363Wi.js.map
+//# sourceMappingURL=openclaw-BIHlu_36.js.map

package/dist/src/{openclaw-CwzlQSQX.js → openclaw-CF7fMido.js}

@@ -1,9 +1,10 @@
 import { T as getEnvString, a as logger, x as getConfigDirectoryPath } from "./logger-Ct2S6Yx-.js";
-import { F as VERSION, h as REQUEST_TIMEOUT_MS, t as fetchWithProxy } from "./fetch-Di00EQrc.js";
-import { n as sha256 } from "./createHash-4gFQpDDv.js";
-import { t as OpenAiChatCompletionProvider } from "./chat-I9izLm49.js";
-import { t as OpenAiResponsesProvider } from "./responses--OsX2aYW.js";
-import { t as OpenAiEmbeddingProvider } from "./embedding-nFbumxcv.js";
+import { p as REQUEST_TIMEOUT_MS, t as fetchWithProxy } from "./fetch-It34O8Ur.js";
+import { n as VERSION } from "./version-lpHV_53E.js";
+import { n as sha256 } from "./createHash-BtbSX3mj.js";
+import { t as OpenAiChatCompletionProvider } from "./chat-Dabu84Br.js";
+import { t as OpenAiEmbeddingProvider } from "./embedding-Bi3rxrZF.js";
+import { t as OpenAiResponsesProvider } from "./responses-URRzV8qE.js";
 import fs from "fs";
 import path from "path";
 import os from "os";
@@ -322,6 +323,7 @@ function resolveGatewayPortOverride(env) {
 	return Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 ? parsedPort : void 0;
 }
 function toAuthSecret(kind, value) {
+	if (typeof value !== "string") return;
 	const trimmed = value?.trim();
 	return trimmed ? {
 		kind,
@@ -910,7 +912,7 @@ var OpenClawAgentProvider = class {
 	}
 	resolveScopesForDeviceToken(deviceToken) {
 		if (this.hasExplicitScopes) return this.scopes;
-		return deviceToken.scopes && deviceToken.scopes.length > 0 ? deviceToken.scopes : this.scopes;
+		return normalizeScopes([...this.scopes, ...deviceToken.scopes || []]);
 	}
 	storeDeviceTokenFromHello(payload, authState) {
 		if (!authState?.deviceIdentity) return;
@@ -1196,4 +1198,4 @@ function createOpenClawProvider(providerPath, providerOptions = {}, env) {
 //#endregion
 export { createOpenClawProvider };
 
-//# sourceMappingURL=openclaw-CwzlQSQX.js.map
+//# sourceMappingURL=openclaw-CF7fMido.js.map

package/dist/src/{openclaw-wX9rtfke.cjs → openclaw-Dphc01BY.cjs}

@@ -1,21 +1,23 @@
-const require_logger = require("./logger-COuQb2xB.cjs");
-const require_fetch = require("./fetch-CJU5ELPa.cjs");
-const require_createHash = require("./createHash-B7KvgoOD.cjs");
-const require_chat = require("./chat-CclRbxGf.cjs");
-const require_responses = require("./responses-Bi9vBuW_.cjs");
-const require_embedding = require("./embedding-I45KG3o7.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-D_mwlA32.cjs");
+const require_logger = require("./logger-cfNpzI4o.cjs");
+const require_fetch = require("./fetch-Dw4XZHjj.cjs");
+const require_version = require("./version-BWCSaByA.cjs");
+const require_createHash = require("./createHash-CSiqnK5P.cjs");
+const require_chat = require("./chat-DxTDQ83C.cjs");
+const require_embedding = require("./embedding-BbrwopfX.cjs");
+const require_responses = require("./responses-1UFFF9N_.cjs");
 let fs = require("fs");
-fs = require_logger.__toESM(fs);
+fs = require_rolldown_runtime.__toESM(fs, 1);
 let path = require("path");
-path = require_logger.__toESM(path);
+path = require_rolldown_runtime.__toESM(path, 1);
 let os = require("os");
-os = require_logger.__toESM(os);
+os = require_rolldown_runtime.__toESM(os, 1);
 let crypto = require("crypto");
-crypto = require_logger.__toESM(crypto);
+crypto = require_rolldown_runtime.__toESM(crypto, 1);
 let ws = require("ws");
-ws = require_logger.__toESM(ws);
+ws = require_rolldown_runtime.__toESM(ws, 1);
 let json5 = require("json5");
-json5 = require_logger.__toESM(json5);
+json5 = require_rolldown_runtime.__toESM(json5, 1);
 //#region src/providers/openclaw/device-auth.ts
 const DEFAULT_CLIENT_DIR = "openclaw";
 const DEFAULT_DEVICE_IDENTITY_FILE = "device-identity.json";
@@ -328,6 +330,7 @@ function resolveGatewayPortOverride(env) {
 	return Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 ? parsedPort : void 0;
 }
 function toAuthSecret(kind, value) {
+	if (typeof value !== "string") return;
 	const trimmed = value?.trim();
 	return trimmed ? {
 		kind,
@@ -842,7 +845,7 @@ var OpenClawAgentProvider = class {
 			client: {
 				id: CLIENT_ID,
 				displayName: "promptfoo",
-				version: require_fetch.VERSION,
+				version: require_version.VERSION,
 				platform: process.platform,
 				...this.openclawConfig.device_family && { deviceFamily: this.openclawConfig.device_family },
 				mode: CLIENT_MODE
@@ -916,7 +919,7 @@ var OpenClawAgentProvider = class {
 	}
 	resolveScopesForDeviceToken(deviceToken) {
 		if (this.hasExplicitScopes) return this.scopes;
-		return deviceToken.scopes && deviceToken.scopes.length > 0 ? deviceToken.scopes : this.scopes;
+		return normalizeScopes([...this.scopes, ...deviceToken.scopes || []]);
 	}
 	storeDeviceTokenFromHello(payload, authState) {
 		if (!authState?.deviceIdentity) return;
@@ -1202,4 +1205,4 @@ function createOpenClawProvider(providerPath, providerOptions = {}, env) {
 //#endregion
 exports.createOpenClawProvider = createOpenClawProvider;
 
-//# sourceMappingURL=openclaw-wX9rtfke.cjs.map
+//# sourceMappingURL=openclaw-Dphc01BY.cjs.map

package/dist/src/{openclaw-CLWrW03k.js → openclaw-zIJAsz3P.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
-import { C as getConfigDirectoryPath, O as getEnvString, s as logger } from "./logger-DksKw1Qc.js";
-import { F as VERSION, m as REQUEST_TIMEOUT_MS, n as fetchWithProxy } from "./fetch-BEWnXrrG.js";
-import { n as sha256 } from "./createHash-ChI45QR1.js";
-import { t as OpenAiChatCompletionProvider } from "./chat-Dr3DUQ0D.js";
-import { t as OpenAiResponsesProvider } from "./responses-DL9m8CyY.js";
-import { t as OpenAiEmbeddingProvider } from "./embedding-D3xTseo7.js";
+import { C as getConfigDirectoryPath, O as getEnvString, s as logger } from "./logger-BbY6ypFL.js";
+import { _ as REQUEST_TIMEOUT_MS, n as fetchWithProxy } from "./fetch-DXUnXkVU.js";
+import { n as VERSION } from "./version-eRkNuGv8.js";
+import { n as sha256 } from "./createHash-CgRvs4Fn.js";
+import { t as OpenAiChatCompletionProvider } from "./chat-DqUFcWI0.js";
+import { t as OpenAiEmbeddingProvider } from "./embedding--UZVe4_7.js";
+import { t as OpenAiResponsesProvider } from "./responses-B3W2JvOQ.js";
 import fs from "fs";
 import path from "path";
 import os from "os";
@@ -323,6 +324,7 @@ function resolveGatewayPortOverride(env) {
 	return Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 ? parsedPort : void 0;
 }
 function toAuthSecret(kind, value) {
+	if (typeof value !== "string") return;
 	const trimmed = value?.trim();
 	return trimmed ? {
 		kind,
@@ -911,7 +913,7 @@ var OpenClawAgentProvider = class {
 	}
 	resolveScopesForDeviceToken(deviceToken) {
 		if (this.hasExplicitScopes) return this.scopes;
-		return deviceToken.scopes && deviceToken.scopes.length > 0 ? deviceToken.scopes : this.scopes;
+		return normalizeScopes([...this.scopes, ...deviceToken.scopes || []]);
 	}
 	storeDeviceTokenFromHello(payload, authState) {
 		if (!authState?.deviceIdentity) return;
@@ -1197,4 +1199,4 @@ function createOpenClawProvider(providerPath, providerOptions = {}, env) {
 //#endregion
 export { createOpenClawProvider };
 
-//# sourceMappingURL=openclaw-CLWrW03k.js.map
+//# sourceMappingURL=openclaw-zIJAsz3P.js.map

package/dist/src/{opencode-sdk-BUu5Nevv.js → opencode-sdk-B3vlPLsp.js}

@@ -1,6 +1,6 @@
-import { T as getEnvString, a as logger, k as state, t as getLogLevel } from "./logger-B88EkIn6.js";
-import { r as importModule } from "./esm-Dh4dOLlt.js";
-import { i as initializeAgenticCache, n as generateCacheKey, r as getCachedResponse, t as cacheResponse } from "./agentic-utils-qFlm6zes.js";
+import { T as getEnvString, a as logger, k as state, t as getLogLevel } from "./logger-KD8JjCRJ.js";
+import { r as importModule } from "./esm-B6whoAcf.js";
+import { i as initializeAgenticCache, n as generateCacheKey, r as getCachedResponse, t as cacheResponse } from "./agentic-utils-CJ0j3fBi.js";
 import { createRequire } from "node:module";
 import fs from "fs";
 import path from "path";
@@ -57,6 +57,38 @@ function getSessionPath(sessionId) {
 		sessionID: sessionId
 	};
 }
+/**
+* Convert the user-facing object-shaped permission config into the
+* rule-array shape required by the v2 `session.create.permission` API.
+*
+* - `{ bash: 'allow' }` → `[{ permission: 'bash', pattern: '*', action: 'allow' }]`
+* - `{ bash: { 'git *': 'allow', '*': 'ask' } }` → two rules with the
+*   corresponding glob pattern preserved per entry.
+*
+* Returns `undefined` when the config has no usable entries so callers can
+* omit the field entirely.
+*/
+function convertPermissionConfigToRuleset(config) {
+	if (!config) return;
+	const rules = [];
+	for (const [tool, value] of Object.entries(config)) {
+		if (value === void 0) continue;
+		if (typeof value === "string") {
+			rules.push({
+				permission: tool,
+				pattern: "*",
+				action: value
+			});
+			continue;
+		}
+		if (value && typeof value === "object") for (const [pattern, action] of Object.entries(value)) rules.push({
+			permission: tool,
+			pattern,
+			action
+		});
+	}
+	return rules.length > 0 ? rules : void 0;
+}
 function tryParseJson(value) {
 	try {
 		return JSON.stringify(JSON.parse(value));
@@ -432,7 +464,10 @@ var OpenCodeSDKProvider = class {
 	buildCreateSessionParameters(config, sessionQuery) {
 		if (!this.opencodeModule) throw new Error("OpenCode SDK module is not loaded");
 		const createBody = { title: `promptfoo-${Date.now()}` };
-		if (config.permission && this.opencodeModule.apiVersion === "v2") createBody.permission = config.permission;
+		if (config.permission && this.opencodeModule.apiVersion === "v2") {
+			const ruleset = convertPermissionConfigToRuleset(config.permission);
+			if (ruleset) createBody.permission = ruleset;
+		}
 		if (this.opencodeModule.apiVersion === "v2") return {
 			...sessionQuery,
 			...createBody
@@ -555,4 +590,4 @@ var OpenCodeSDKProvider = class {
 //#endregion
 export { OpenCodeSDKProvider };
 
-//# sourceMappingURL=opencode-sdk-BUu5Nevv.js.map
+//# sourceMappingURL=opencode-sdk-B3vlPLsp.js.map

package/dist/src/{opencode-sdk-BxD8vXp_.js → opencode-sdk-D05JSgMQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { N as state, O as getEnvString, n as getLogLevel, s as logger } from "./logger-DksKw1Qc.js";
-import { r as importModule } from "./esm-tVgYPY-f.js";
-import { i as initializeAgenticCache, n as generateCacheKey, r as getCachedResponse, t as cacheResponse } from "./agentic-utils-w68v6_Dz.js";
+import { N as state, O as getEnvString, n as getLogLevel, s as logger } from "./logger-BbY6ypFL.js";
+import { r as importModule } from "./esm-Bexx2PFc.js";
+import { i as initializeAgenticCache, n as generateCacheKey, r as getCachedResponse, t as cacheResponse } from "./agentic-utils-DDEGRV9v.js";
 import { createRequire } from "node:module";
 import fs from "fs";
 import path from "path";
@@ -58,6 +58,38 @@ function getSessionPath(sessionId) {
 		sessionID: sessionId
 	};
 }
+/**
+* Convert the user-facing object-shaped permission config into the
+* rule-array shape required by the v2 `session.create.permission` API.
+*
+* - `{ bash: 'allow' }` → `[{ permission: 'bash', pattern: '*', action: 'allow' }]`
+* - `{ bash: { 'git *': 'allow', '*': 'ask' } }` → two rules with the
+*   corresponding glob pattern preserved per entry.
+*
+* Returns `undefined` when the config has no usable entries so callers can
+* omit the field entirely.
+*/
+function convertPermissionConfigToRuleset(config) {
+	if (!config) return;
+	const rules = [];
+	for (const [tool, value] of Object.entries(config)) {
+		if (value === void 0) continue;
+		if (typeof value === "string") {
+			rules.push({
+				permission: tool,
+				pattern: "*",
+				action: value
+			});
+			continue;
+		}
+		if (value && typeof value === "object") for (const [pattern, action] of Object.entries(value)) rules.push({
+			permission: tool,
+			pattern,
+			action
+		});
+	}
+	return rules.length > 0 ? rules : void 0;
+}
 function tryParseJson(value) {
 	try {
 		return JSON.stringify(JSON.parse(value));
@@ -433,7 +465,10 @@ var OpenCodeSDKProvider = class {
 	buildCreateSessionParameters(config, sessionQuery) {
 		if (!this.opencodeModule) throw new Error("OpenCode SDK module is not loaded");
 		const createBody = { title: `promptfoo-${Date.now()}` };
-		if (config.permission && this.opencodeModule.apiVersion === "v2") createBody.permission = config.permission;
+		if (config.permission && this.opencodeModule.apiVersion === "v2") {
+			const ruleset = convertPermissionConfigToRuleset(config.permission);
+			if (ruleset) createBody.permission = ruleset;
+		}
 		if (this.opencodeModule.apiVersion === "v2") return {
 			...sessionQuery,
 			...createBody
@@ -556,4 +591,4 @@ var OpenCodeSDKProvider = class {
 //#endregion
 export { OpenCodeSDKProvider };
 
-//# sourceMappingURL=opencode-sdk-BxD8vXp_.js.map
+//# sourceMappingURL=opencode-sdk-D05JSgMQ.js.map

package/dist/src/{opencode-sdk-BZ2idgYA.cjs → opencode-sdk-DoY6GbWw.cjs}

@@ -1,15 +1,16 @@
-const require_logger = require("./logger-COuQb2xB.cjs");
-const require_esm = require("./esm-CtEPLdAj.cjs");
-const require_agentic_utils = require("./agentic-utils-BpX5b23w.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-D_mwlA32.cjs");
+const require_logger = require("./logger-cfNpzI4o.cjs");
+const require_esm = require("./esm-BIKakvNa.cjs");
+const require_agentic_utils = require("./agentic-utils-DvPWSUpb.cjs");
 let fs = require("fs");
-fs = require_logger.__toESM(fs);
+fs = require_rolldown_runtime.__toESM(fs, 1);
 let path = require("path");
-path = require_logger.__toESM(path);
-let node_module = require("node:module");
+path = require_rolldown_runtime.__toESM(path, 1);
 let os = require("os");
-os = require_logger.__toESM(os);
+os = require_rolldown_runtime.__toESM(os, 1);
 let dedent = require("dedent");
-dedent = require_logger.__toESM(dedent);
+dedent = require_rolldown_runtime.__toESM(dedent, 1);
+let node_module = require("node:module");
 //#region src/providers/opencode-sdk.ts
 /**
 * Check if promptfoo is in debug mode
@@ -61,6 +62,38 @@ function getSessionPath(sessionId) {
 		sessionID: sessionId
 	};
 }
+/**
+* Convert the user-facing object-shaped permission config into the
+* rule-array shape required by the v2 `session.create.permission` API.
+*
+* - `{ bash: 'allow' }` → `[{ permission: 'bash', pattern: '*', action: 'allow' }]`
+* - `{ bash: { 'git *': 'allow', '*': 'ask' } }` → two rules with the
+*   corresponding glob pattern preserved per entry.
+*
+* Returns `undefined` when the config has no usable entries so callers can
+* omit the field entirely.
+*/
+function convertPermissionConfigToRuleset(config) {
+	if (!config) return;
+	const rules = [];
+	for (const [tool, value] of Object.entries(config)) {
+		if (value === void 0) continue;
+		if (typeof value === "string") {
+			rules.push({
+				permission: tool,
+				pattern: "*",
+				action: value
+			});
+			continue;
+		}
+		if (value && typeof value === "object") for (const [pattern, action] of Object.entries(value)) rules.push({
+			permission: tool,
+			pattern,
+			action
+		});
+	}
+	return rules.length > 0 ? rules : void 0;
+}
 function tryParseJson(value) {
 	try {
 		return JSON.stringify(JSON.parse(value));
@@ -436,7 +469,10 @@ var OpenCodeSDKProvider = class {
 	buildCreateSessionParameters(config, sessionQuery) {
 		if (!this.opencodeModule) throw new Error("OpenCode SDK module is not loaded");
 		const createBody = { title: `promptfoo-${Date.now()}` };
-		if (config.permission && this.opencodeModule.apiVersion === "v2") createBody.permission = config.permission;
+		if (config.permission && this.opencodeModule.apiVersion === "v2") {
+			const ruleset = convertPermissionConfigToRuleset(config.permission);
+			if (ruleset) createBody.permission = ruleset;
+		}
 		if (this.opencodeModule.apiVersion === "v2") return {
 			...sessionQuery,
 			...createBody
@@ -559,4 +595,4 @@ var OpenCodeSDKProvider = class {
 //#endregion
 exports.OpenCodeSDKProvider = OpenCodeSDKProvider;
 
-//# sourceMappingURL=opencode-sdk-BZ2idgYA.cjs.map
+//# sourceMappingURL=opencode-sdk-DoY6GbWw.cjs.map