zidane 9.1.3 → 9.1.4

package/dist/chat.js

@@ -1,6 +1,6 @@
 import { n as composeExtensionPreset, t as buildExtensionPreset } from "./compose-preset-1td8qO5b.js";
 import { appendDynamicSection } from "./prompt.js";
-import { At as formatBindingForDisplay, Dt as KEYBINDING_DEF_BY_ACTION, Et as KEYBINDING_DEFS, Ft as normalizeBindingValue, It as readKeybindings, Lt as readKeybindingsRaw, Mt as keybindingsPath, Nt as matchesBinding, Ot as KEYBINDING_KEY_COL_WIDTH, Pt as mergeKeybindings, Rt as resolveExtensionKeybindings, Tt as DEFAULT_KEYBINDINGS, jt as groupBindings, kt as ensureKeybindingsFile, zt as stripJsonComments } from "./registry-CnnKaY9s.js";
+import { At as formatBindingForDisplay, Dt as KEYBINDING_DEF_BY_ACTION, Et as KEYBINDING_DEFS, Ft as normalizeBindingValue, It as readKeybindings, Lt as readKeybindingsRaw, Mt as keybindingsPath, Nt as matchesBinding, Ot as KEYBINDING_KEY_COL_WIDTH, Pt as mergeKeybindings, Rt as resolveExtensionKeybindings, Tt as DEFAULT_KEYBINDINGS, jt as groupBindings, kt as ensureKeybindingsFile, zt as stripJsonComments } from "./registry-YUUqbYGr.js";
 import { i as nodeEntryPort } from "./contexts-DLZTSRHU.js";
 import { i as shouldAutoCompact, n as OUTPUT_RESERVE_TOKENS, r as effectiveContextWindow, t as AUTO_COMPACT_MIN_GROWTH_FRACTION } from "./policy-Cr07FrCw.js";
 import { a as mainCheckoutRoot, c as projectRootOf, i as folderLocation, l as repoKeyOf, n as findGitRoot, o as normalizeRemoteUrl, r as findProjectRoot, s as planWorktreeProjectRootRemaps, t as cachedRepoKeyOf } from "./project-root-BZcgGJMi.js";
@@ -18,19 +18,19 @@ import { t as projectUserPaths } from "./project-user-paths-Chsi83mp.js";
 import { r as EMPTY_EXTENSION_REGISTRY } from "./row-fields-CAYcZogp.js";
 import { n as githubAvatarUrl, r as githubPreviewImageUrl } from "./sources-h464u_hH.js";
 import { F as parseBindingSpec, I as parseBindingSpecs, N as bindingAlternatives } from "./references-DZ5qTYDl.js";
-import { b as defineExtension, c as inlineLoadedExtension, i as discoverExtensions, m as scanExtensionDirectories, n as defaultExtensionScanPaths } from "./discovery-CX7nbMCn.js";
-import { I as filterExtensionRegistry, N as buildExtensionRegistry, P as disposeExtensionRegistry, R as partitionExtensionCatalog } from "./extensions-ADlhBQ_1.js";
+import { b as defineExtension, c as inlineLoadedExtension, i as discoverExtensions, m as scanExtensionDirectories, n as defaultExtensionScanPaths } from "./discovery-DD4wPWKS.js";
+import { I as filterExtensionRegistry, N as buildExtensionRegistry, P as disposeExtensionRegistry, R as partitionExtensionCatalog } from "./extensions-DklXPjiq.js";
 import { t as resolveStorageDirs } from "./xdg-DFSAQQG8.js";
 import { a as DEFAULT_OAUTH_ACCOUNT_LABEL, d as isReservedCredKey, i as CRED_KEY_SLOT_SEPARATOR, l as credentialSlotOf, n as ALTERNATE_CRED_KEY_SUFFIX, o as accountCredKey, p as oauthAccountLabel, r as API_KEY_ACCOUNT_LABEL, s as alternateCredKey, t as ACCOUNT_CRED_KEY_INFIX, u as isAccountCredKey } from "./cred-keys-C0KaSRp7.js";
-import { A as getContextWindow, B as restoreModelOptions, C as writeCredentials, D as credKeyOf, E as cerebrasDescriptor, F as modelSupportsReasoning, I as modelsForDescriptor, L as openaiDescriptor, M as localDescriptor, N as modelLabel, O as defaultModelOf, P as modelOptionsFor, R as openrouterDescriptor, S as writeCredentialEntry, T as anthropicDescriptor, _ as setCredentialLabel, a as ensureCredentialIds, b as storedCredentialById, c as providerFactoryOptions, d as readCredentials, f as readProviderCredential, g as removeStoredCredential, h as removeProviderCredential, i as credentialsPath, j as getModelInfo, k as enabledModelOptions, l as providerFieldViews, m as readProviderCredentials, n as configureProviderCredential, o as isSecretCustomField, p as readProviderCredentialPair, r as configuredProviderFields, t as applyApiKeyEnv, u as readCredentialEntry, v as setPreferredCredential, w as BUILTIN_PROVIDERS, x as storedCredentialsOf, y as setProviderCredential, z as piIdOf } from "./credentials-Bqg-qNBM.js";
+import { A as getContextWindow, B as restoreModelOptions, C as writeCredentials, D as credKeyOf, E as cerebrasDescriptor, F as modelSupportsReasoning, I as modelsForDescriptor, L as openaiDescriptor, M as localDescriptor, N as modelLabel, O as defaultModelOf, P as modelOptionsFor, R as openrouterDescriptor, S as writeCredentialEntry, T as anthropicDescriptor, _ as setCredentialLabel, a as ensureCredentialIds, b as storedCredentialById, c as providerFactoryOptions, d as readCredentials, f as readProviderCredential, g as removeStoredCredential, h as removeProviderCredential, i as credentialsPath, j as getModelInfo, k as enabledModelOptions, l as providerFieldViews, m as readProviderCredentials, n as configureProviderCredential, o as isSecretCustomField, p as readProviderCredentialPair, r as configuredProviderFields, t as applyApiKeyEnv, u as readCredentialEntry, v as setPreferredCredential, w as BUILTIN_PROVIDERS, x as storedCredentialsOf, y as setProviderCredential, z as piIdOf } from "./credentials-D71duF64.js";
 import { a as INTERACTION_GUIDANCE, c as PLAN_MODE_DOCTRINE_NO_PROMPTS, d as buildBuildSystem, f as buildPlanSystem, i as IDENTITY_PREFIX, l as SUBAGENT_GUIDANCE, n as COMMUNICATION_DOCTRINE, o as INTERACTION_GUIDANCE_NO_PROMPTS, p as envSection, r as DOING_TASKS_DOCTRINE, s as PLAN_MODE_DOCTRINE, t as ACTIONS_WITH_CARE_DOCTRINE, u as TOKEN_DISCIPLINE_DOCTRINE } from "./agent-prompt-BXVwL89Y.js";
 import { a as mostConstrainedWindow, d as TODO_STATUS_GLYPHS, i as formatUsagePercent, s as showsAccount, t as activeSnapshotFor, u as accentColor } from "./provider-usage-format-C1qmZJj7.js";
-import { A as TODOWRITE_TOOL, B as selectActiveTodos, C as profileTools, D as DEFAULT_MAX_TODO_ITEMS, E as singleAgentRegistry, F as getTodosForRun, I as isTodoTool, L as pickActiveRunId, N as createTodoTools, O as TODOREAD_TOOL, P as getArchivedTodosForRun, R as pruneTodosByRun, S as profileComposition, T as sessionComposition, U as useActiveTodos, V as setTodosForRun, _ as availableAgents, a as deleteSessionData, b as compositionFits, c as newSession, d as BUILTIN_AGENTS, f as DEFAULT_AGENT_ID, h as PLAN_AGENT, i as createSessionInStore, j as TODO_WRITE_COUNTS_METADATA_KEY, k as TODOS_METADATA_KEY, l as BUILD_AGENT, m as DEFAULT_PERSIST_EXCLUDE_TOOLS, o as describeForkFailure, p as DEFAULT_BUDGET_EXCLUDE_TOOLS, r as createMainSession, s as forkSession, u as BUILD_CODEMODE_AGENT, v as builtInPromptOf, w as resolveAgentId, x as compositionTools, y as compositionByKey, z as sanitizeTodoItems } from "./setting-D_FpKFMw.js";
+import { A as TODOWRITE_TOOL, B as selectActiveTodos, C as profileTools, D as DEFAULT_MAX_TODO_ITEMS, E as singleAgentRegistry, F as getTodosForRun, I as isTodoTool, L as pickActiveRunId, N as createTodoTools, O as TODOREAD_TOOL, P as getArchivedTodosForRun, R as pruneTodosByRun, S as profileComposition, T as sessionComposition, U as useActiveTodos, V as setTodosForRun, _ as availableAgents, a as deleteSessionData, b as compositionFits, c as newSession, d as BUILTIN_AGENTS, f as DEFAULT_AGENT_ID, h as PLAN_AGENT, i as createSessionInStore, j as TODO_WRITE_COUNTS_METADATA_KEY, k as TODOS_METADATA_KEY, l as BUILD_AGENT, m as DEFAULT_PERSIST_EXCLUDE_TOOLS, o as describeForkFailure, p as DEFAULT_BUDGET_EXCLUDE_TOOLS, r as createMainSession, s as forkSession, u as BUILD_CODEMODE_AGENT, v as builtInPromptOf, w as resolveAgentId, x as compositionTools, y as compositionByKey, z as sanitizeTodoItems } from "./setting-_jh2OtiL.js";
 import { _ as verifyEnvironment, a as availableEnvironmentActions, f as readSessionEnvironment, h as runSessionEnvironmentAction, i as assertEnvironmentReady, m as resolveExecution, n as EnvironmentNotReadyError, o as createEnvironmentRegistry, r as LOCAL_ENVIRONMENT, s as environmentActionSummaries, t as ENVIRONMENT_METADATA_KEY, v as workspacePath } from "./environment-DWlIhAKo.js";
 import { C as providerKeySetChanged, D as sanitizeModelChain, E as restoreChainFallbacks, O as toggleChainEntry, a as replaceTurnTextBlocks, c as SESSION_ACCOUNT_METADATA_KEY, d as sessionModelFallbacks, f as buildRunModel, g as chainsEqual, h as chainPositionOf, l as modelChainMetadata, m as chainEntryKey, n as deleteTurnSafely, o as truncateTurnsAt, p as chainAccountConflict, r as editableTurnText, s as turnAsText, t as countNeighbors, u as readSessionAccount, v as filterChainFallbacks, y as modelPickKey } from "./turn-operations-CWoCTC_L.js";
 import { A as SESSION_EVENT_STATUS_STYLE, C as formatModelSetting, K as renderSessionEventXml, O as ORCHESTRATED_BY_KEY, P as WORKER_REPORT_FRAGMENT, Q as sessionEventMeta, R as isMainSession, S as spacesEnabled, U as parseSessionEventXml, V as orchestratedBy, X as sessionEventExcerpt, Y as sessionDirLabel, Z as sessionEventLabel, _ as spaceIdForNewSession, a as defaultSessionAgent, b as spaceOfSwitchItem, c as extensionSpace, ct as formatCostUsd, d as newSessionModel, dt as formatRunReceiptLine, f as newSpaceId, ft as formatTokenCount, g as sessionSpaceFilter, gt as runReceiptFromRun, h as resolveSessionSpace, ht as nameFromModelId, i as activeSpaceOf, it as RUN_RECEIPT_GLYPH, j as SESSION_ROLE_KEY, l as findSpace, lt as formatRunDuration, m as readSessionSpaceId, mt as hasRunReceipt, n as DEFAULT_SPACE_NAME, nt as sideSessionParent, o as defaultSessionKnobs, p as normalizeSpaces, pt as formatTokensPerSecond, r as SPACE_METADATA_KEY, rt as truncateTitle, s as defaultSessionModel, st as fitRunReceiptCells, t as DEFAULT_SPACE_ID, tt as shortSessionId, u as isExtensionSpaceId, ut as formatRunReceiptCells, v as spaceMetadata, w as parseModelSetting, x as spaceSwitchItems, y as spaceModelDefault } from "./spaces-BaE3ZcBx.js";
 import { A as readProjects, C as addToSafelistForCwd, D as listSafelists, E as isOnSafelist, M as safelistProjectKey, N as suggestSafelistEntries, O as matchesSafelistEntry, P as writeProjects, S as addToSafelist, T as getSafelistForCwd, a as renderSystemMdSeed, c as buildMcpServers, d as discoverProjectMcps, i as discoverSystemMd, j as removeFromSafelist, k as projectsFilePath, l as dedupMcpServersByName, n as createMemoryEnvironmentSecrets, o as userScopeOverridesLoad, p as parseMcpsFile, r as environmentCredentialsPath, s as userSystemMdPath, t as createFileEnvironmentSecrets, u as defaultMcpsConfigPaths, w as getSafelist, x as IMPLICITLY_SAFE_TOOLS } from "./environment-credentials-C8jkOGQ6.js";
-import { $ as CLAUDE_IMPORT_NOTES, $n as buildPluginContributions, $t as createExtensionMcpHost, A as clearProviderUsageCache, An as renderAgentsMdBlock, At as writeWorkspaceFile, B as exportFilename, Bt as mcpsWritePath, C as parseSemver, Cn as discoverProjectSkills, Ct as confineToWorkspace, D as resolvePlatformPackage, Dn as createChatTurnsReadTool, Dt as gitStatusOf, E as reinstallHint, En as chatReferenceTokensForPrompt, Et as gitStatus, F as redeemProviderReset, Ft as supersededTools, G as detectOnboardingEnvironment, Gt as runIntegrationSignIn, H as resolveSessionExportTarget, Ht as upsertMcpServer, I as usageChecksOptedOut, In as builtinEnvironmentProviders, It as makeToolContext, J as probeLocalModelServers, Jn as resolveCwdPath, Jt as supportsOAuth, K as detectOtherAgents, Kn as extractEditPayloadForGate, Kt as runOAuthLogin, L as usageSourceFor, Ln as localEnvironmentProvider, Lt as fileEntriesFromPaths, M as fetchProviderUsage, Mn as resolveSessionModel, Mt as invalidateDiagnostics, N as fetchProviderUsageAccounts, Nt as listDiagnosticsTools, O as updateChecksOptedOut, Ot as listWorkspace, P as providerUsageSupported, Pt as runDiagnostics, Q as listExtensionSource, Qn as scopeCwd, Qt as createArtifactKindsHost, R as fetchGithubUsage, Rn as WORKTREE_ENVIRONMENT_KIND, Rt as listProjectFiles, S as overrideManager, Sn as defaultSkillScanPaths, St as assembleDiff, T as performSelfUpdate, Tt as gitShowHead, U as writeSessionExport, Ut as oauthUsesManualCodePaste, V as renderSession, Vt as removeMcpServer, W as connectorGithubToken, X as onboardingProviders, Xn as folderlessCwd, Y as FEATURED_PROVIDERS, Yn as serializePreview, Yt as tryOpenBrowser, Z as clearExtensionSourceCache, Zn as resolveSessionCwd, Zt as createMcpStatusTracker, _ as checkForUpdate, _n as storeHasDurability, _r as liveAgentProfiles, _t as gitOriginUrl, a as updateAppliedMarkerPath, ar as refreshMcpToolsCatalog, at as createGitWatches, b as detectLibc, bn as buildSkillsConfig, br as createMemoryApprovalsStore, bt as WORKSPACE_MAX_ENTRIES, c as UPDATE_LOCK_FILE, cn as patchMcpCredential, cr as imageGenerationTools, ct as forgetGitCaches, d as describeUpdateLockHolder, dr as listDecisionModels, dt as gitCreateBranch, en as resolveConfig, er as discoverProjectPlugins, et as claudeImportHostNote, f as isUpdateLockStale, fn as createCatalogPorts, fr as parseDecisionModel, ft as gitInfo, g as SELF_UPDATE_TIMEOUT_MS, gr as changedCatalogItems, gt as cloneRepository, h as findInstalledCompanion, ht as gitSwitch, i as readUpdateAppliedMarker, ir as mcpToolsCachePath, it as previewClaudeImport, j as fetchAllProviderUsage, jn as createProviderBuilder, jt as resolvePaths, k as USAGE_CACHE_TTL_MS, kn as discoverAgentsMd, kt as readWorkspaceFile, l as UPDATE_LOCK_STALE_MS, ln as provisionSessionEnvironment, lr as imageModelSources, lt as gitBranches, m as updateLockPath, mr as testDecisionModel, mt as gitPrList, n as hasUpdateAppliedMarker, nn as createChatHost, nr as clearMcpToolsCache, nt as hasClaudeCodeSetup, o as watchInstalledVersion, on as createFileMcpCredentialStore, or as saveMcpToolsCache, ot as watchGitRepository, p as readUpdateLock, pn as linkCatalogs, pr as resolveDecisionsOption, pt as gitPr, q as onboardingInstallSignals, qn as readFileSafe, qt as signsInWithIntegration, r as probeInstalledVersion, rn as createInteractionHub, rr as loadMcpToolsCache, rt as importFromClaudeCode, s as writeUpdateAppliedMarker, sn as mcpCredentialsPath, sr as subscribeMcpToolsCache, st as gitSync, t as UPDATE_APPLIED_MARKER, tn as resolveStoragePaths, tt as countClaudeSessionFiles, u as acquireUpdateLock, ur as listImageModels, ut as gitCommit, v as checkTarballAvailable, vn as isStaleRunMarker, vr as runCompaction, vt as createCapabilityProbe, w as performInPlaceSelfUpdate, wt as gitDiff, x as detectPackageManager, xt as WORKSPACE_MAX_FILE_BYTES, y as compareSemver, yn as createPromptSubmissions, yr as createApprovalHub, yt as searchWorkspace, zn as createWorktreeEnvironmentProvider } from "./auto-update-restart-CQJtndMG.js";
+import { $ as CLAUDE_IMPORT_NOTES, $n as buildPluginContributions, $t as createExtensionMcpHost, A as clearProviderUsageCache, An as renderAgentsMdBlock, At as writeWorkspaceFile, B as exportFilename, Bt as mcpsWritePath, C as parseSemver, Cn as discoverProjectSkills, Ct as confineToWorkspace, D as resolvePlatformPackage, Dn as createChatTurnsReadTool, Dt as gitStatusOf, E as reinstallHint, En as chatReferenceTokensForPrompt, Et as gitStatus, F as redeemProviderReset, Ft as supersededTools, G as detectOnboardingEnvironment, Gt as runIntegrationSignIn, H as resolveSessionExportTarget, Ht as upsertMcpServer, I as usageChecksOptedOut, In as builtinEnvironmentProviders, It as makeToolContext, J as probeLocalModelServers, Jn as resolveCwdPath, Jt as supportsOAuth, K as detectOtherAgents, Kn as extractEditPayloadForGate, Kt as runOAuthLogin, L as usageSourceFor, Ln as localEnvironmentProvider, Lt as fileEntriesFromPaths, M as fetchProviderUsage, Mn as resolveSessionModel, Mt as invalidateDiagnostics, N as fetchProviderUsageAccounts, Nt as listDiagnosticsTools, O as updateChecksOptedOut, Ot as listWorkspace, P as providerUsageSupported, Pt as runDiagnostics, Q as listExtensionSource, Qn as scopeCwd, Qt as createArtifactKindsHost, R as fetchGithubUsage, Rn as WORKTREE_ENVIRONMENT_KIND, Rt as listProjectFiles, S as overrideManager, Sn as defaultSkillScanPaths, St as assembleDiff, T as performSelfUpdate, Tt as gitShowHead, U as writeSessionExport, Ut as oauthUsesManualCodePaste, V as renderSession, Vt as removeMcpServer, W as connectorGithubToken, X as onboardingProviders, Xn as folderlessCwd, Y as FEATURED_PROVIDERS, Yn as serializePreview, Yt as tryOpenBrowser, Z as clearExtensionSourceCache, Zn as resolveSessionCwd, Zt as createMcpStatusTracker, _ as checkForUpdate, _n as storeHasDurability, _r as liveAgentProfiles, _t as gitOriginUrl, a as updateAppliedMarkerPath, ar as refreshMcpToolsCatalog, at as createGitWatches, b as detectLibc, bn as buildSkillsConfig, br as createMemoryApprovalsStore, bt as WORKSPACE_MAX_ENTRIES, c as UPDATE_LOCK_FILE, cn as patchMcpCredential, cr as imageGenerationTools, ct as forgetGitCaches, d as describeUpdateLockHolder, dr as listDecisionModels, dt as gitCreateBranch, en as resolveConfig, er as discoverProjectPlugins, et as claudeImportHostNote, f as isUpdateLockStale, fn as createCatalogPorts, fr as parseDecisionModel, ft as gitInfo, g as SELF_UPDATE_TIMEOUT_MS, gr as changedCatalogItems, gt as cloneRepository, h as findInstalledCompanion, ht as gitSwitch, i as readUpdateAppliedMarker, ir as mcpToolsCachePath, it as previewClaudeImport, j as fetchAllProviderUsage, jn as createProviderBuilder, jt as resolvePaths, k as USAGE_CACHE_TTL_MS, kn as discoverAgentsMd, kt as readWorkspaceFile, l as UPDATE_LOCK_STALE_MS, ln as provisionSessionEnvironment, lr as imageModelSources, lt as gitBranches, m as updateLockPath, mr as testDecisionModel, mt as gitPrList, n as hasUpdateAppliedMarker, nn as createChatHost, nr as clearMcpToolsCache, nt as hasClaudeCodeSetup, o as watchInstalledVersion, on as createFileMcpCredentialStore, or as saveMcpToolsCache, ot as watchGitRepository, p as readUpdateLock, pn as linkCatalogs, pr as resolveDecisionsOption, pt as gitPr, q as onboardingInstallSignals, qn as readFileSafe, qt as signsInWithIntegration, r as probeInstalledVersion, rn as createInteractionHub, rr as loadMcpToolsCache, rt as importFromClaudeCode, s as writeUpdateAppliedMarker, sn as mcpCredentialsPath, sr as subscribeMcpToolsCache, st as gitSync, t as UPDATE_APPLIED_MARKER, tn as resolveStoragePaths, tt as countClaudeSessionFiles, u as acquireUpdateLock, ur as listImageModels, ut as gitCommit, v as checkTarballAvailable, vn as isStaleRunMarker, vr as runCompaction, vt as createCapabilityProbe, w as performInPlaceSelfUpdate, wt as gitDiff, x as detectPackageManager, xt as WORKSPACE_MAX_FILE_BYTES, y as compareSemver, yn as createPromptSubmissions, yr as createApprovalHub, yt as searchWorkspace, zn as createWorktreeEnvironmentProvider } from "./auto-update-restart-CF_kjcJd.js";
 import { A as summarizeOutcomes, C as buildEditOutcomesAnnotation, D as resolveApprovalForPayload, E as parseEditOutcomesFromResult, O as rewriteMultiEditHeader, S as tokenize, T as mergeApprovalAndBodyOutcomes, _ as extractEditPayload, b as splitLines, c as inferPromptRefs, d as applyEditPayload, f as buildContextualDiff, g as computeLineDiff, h as computeInlineDiff, k as stripEditOutcomesAnnotation, n as titleFromText, o as modelConcern, p as buildUnifiedDiff, t as oneLineTitle, u as splitPromptSegments, v as filetypeFromPath, w as maskToOutcomeKinds, x as summarizeEditPayload, y as previewEditPayload } from "./session-title-text-CQvgo3yS.js";
 import { C as titleFromTurns, D as usageByModel, E as updateToolEventOutcomes, S as sumRunCosts, T as toolResultText, _ as runProgress, a as eventsFromTurns, b as sessionEnvironmentSummary, c as headerFromData, d as loadState, f as marginTopFor, g as runInProgress, h as replayTurns, i as deriveSessionTitle, l as lastContextSizeFromTurns, n as compactSummaryEvent, o as getSessionHeader, r as createStateStore, u as listSessionMeta, v as saveState, w as toolCallPreview, x as stripSpawnTokensLine } from "./store-ByCDaKgJ.js";
 import { r as buildSpawnStartEvent, t as buildSpawnEndEvent } from "./spawn-markers-Dn8JJJFW.js";
@@ -39,13 +39,13 @@ import { A as entryParent, C as ENTRY_EMPTY_DIRS_LIMIT, D as copyNames, E as ENT
 import { A as chatWindowBehavior, C as isModelInteraction, E as pendingInteractionsFromTurns, M as EditOutcomeLedger, O as serializeInteractionResponse, S as isInteractionTool, T as makeRequestInteraction, _ as PRESENT_PLAN_TOOL, a as TITLE_SOURCE_KEY, b as createInteractionTools, f as normalizeLaunchOverrides, g as HOST_INTERACTION_ID_PREFIX, h as AUTOMATIC_INTERACTION_INSTRUCTION, i as TITLE_CHECK_KEY, j as runEndNotice, k as chatAutoCompactBehavior, l as isTitleStale, m as ASK_USER_TOOL, n as createSessionExecutionCache, o as autoTitleAction, p as toTodosSnapshot, r as TITLE_CHECKED_KEY, s as describeTitleStatus, t as testModel, u as userPromptCount, v as buildResumedToolResultsTurn, y as createAutomaticInteractionResponse } from "./model-test-CAtJ76kM.js";
 import { A as decisionsEnabled, C as CATPPUCCIN_LATTE, D as SETTINGS_DEFAULTS_VERSION, E as DEFAULT_SETTINGS, M as settingsFromStored, N as sparseSettingsUpdate, O as SETTINGS_DEFAULTS_VERSION_KEY, S as CATPPUCCIN_FRAPPE, T as CATPPUCCIN_MOCHA, _ as resolveChipColor, a as SETTINGS_INPUTS, b as GRUVBOX_DARK, d as settingKeywords, g as DEFAULT_THEME, h as BUILTIN_THEMES, i as SETTINGS_CHOICES, j as migrateStoredSettings, l as enforceSettingsInvariants, m as toggleHeldOn, n as DURABILITY_OPTIONS, o as SETTINGS_SECTIONS, p as toggleApplies, r as SETTINGS_CATEGORIES, s as SETTINGS_TOGGLES, t as APPROVAL_MODE_OPTIONS, u as requirementMet, v as resolveTheme, w as CATPPUCCIN_MACCHIATO, x as GRUVBOX_LIGHT, y as VAPORWAVE_THEME } from "./settings-catalog-DEZlXP51.js";
 import { $ as nativeExtensionSource, A as transcriptPresetNotice, At as chatReferenceTokensFromText, B as ONBOARDING_AGENT_BRANDS, Bt as FEATURE_GATES, C as SETUP_PALETTE_ITEM, Ct as autoTextModelId, D as TRANSCRIPT_PRESET_KEYS, Dt as currentModels, E as TRANSCRIPT_PRESETS, Et as currentModelKeys, F as ONBOARDING_FEATURES, Ft as compactingLabel, G as defaultExtensionSource, Gt as remoteHostsGate, H as providerBrand, Ht as defineFeatureGate, I as ONBOARDING_FEATURE_GROUPS, J as EXCLUDED_NATIVE_EXTENSIONS, K as nativeExtensionEntry, L as onboardingFeatureCopy, M as transcriptPresetOfPaletteItem, Mt as uniqueChatIdsFromReferences, N as transcriptPresetPaletteItem, Nt as cacheBreakChip, O as TRANSCRIPT_PRESET_PALETTE_ID, Ot as parseModelId, P as transcriptPresetPalettePicker, Pt as cacheBreakNoticeText, Q as nativeExtensionByName, R as onboardingFeatures, Rt as retryLabel, S as ONBOARDING_VERSION, T as planOnboarding, Tt as compareModelVersion, U as DEFAULT_EXTENSION_SOURCE, Ut as engagedKillSwitches, V as PROVIDER_BRANDS, Vt as daemonGate, W as DEFAULT_EXTENSION_SOURCE_UNREACHABLE, Wt as isKillSwitchEngaged, X as NATIVE_EXTENSIONS_REPO, Y as NATIVE_EXTENSIONS, Z as NATIVE_EXTENSION_GROUPS, _ as createOnboardingFlow, a as effectiveOnboardingMode, at as mcpFailureLine, b as onboardingReducer, c as migratedOnboardingRecords, d as onboardingRecords, et as enabledMcpsWith, f as onboardingSettingsChange, g as canSkipOnboardingStep, gt as formatEstimate, h as applySettingsPatch, ht as estimateReadout, i as buildOnboardingResult, it as isMcpAuthRefusal, j as transcriptPresetOf, jt as createChatsCompletionProvider, k as transcriptPreset, kt as CHATS_TRIGGER, l as needsOnboarding, m as ONBOARDING_STEP_SETTINGS, n as localDayString, nt as MCP_KEY_REFUSED_HINT, o as isExistingInstall, p as ONBOARDING_SETTING_KEYS, pt as calibrationFactor, q as nativeExtensionListing, r as summarizeUsage, rt as classifyMcpTest, s as mergeOnboardingState, tt as enabledMcpsWithout, u as onboardingRecord, v as currentOnboardingStep, vt as runEstimateView, w as onboardingStep, x as ONBOARDING_STEPS, y as onboardingProgress, yt as runningEstimateViews, z as LOCAL_SERVER_BRANDS } from "./usage-summary-BM7B3JdI.js";
-import { i as detectAuth } from "./cli-shared-DeRHgYvl.js";
+import { i as detectAuth } from "./cli-shared-DIV9c5Nr.js";
 import { c as applyEnvironmentSettingsChange, d as isEnvironmentEnabled, f as readEnvironmentSettings, i as overlayHostSettings, l as defaultEnvironmentKind, n as WINDOW_LOCAL_SETTINGS, o as settingsToWire, p as resolveProviderConfig, r as isWindowOnlySetting, s as splitHostSettingsPatch, t as HOST_ENABLED_LISTS, u as describeEnvironments } from "./host-scoped-settings-WBYaCork.js";
 import { t as HostRegistryError } from "./types-CiUp8oom.js";
 import { r as parseRemoteHostUrl, t as RemoteHostError } from "./url-znC3tmKE.js";
-import { n as hostCredentialKey, r as hostsFilePath, t as createHostRegistry } from "./registry-CN6JlZKj.js";
+import { n as hostCredentialKey, r as hostsFilePath, t as createHostRegistry } from "./registry-CQOU5jvF.js";
 import { t as cliStyle } from "./cli-style-DBEm6CyT.js";
-import { C as upgradeError, D as summarizeArtifactCounts, E as groupArtifacts, S as readFailedUpdate, T as upgradeInstalledPackages, _ as UPDATE_FAILED_FILE, a as UPDATE_RESULT_FILE, b as isAutoInstallCandidate, c as readUpdateWorkerResult, d as buildRestartHint, f as buildUpdateHint, g as AUTO_INSTALL_RETRY_BACKOFF_MS, h as useUpdateCheck, i as UPDATE_LOG_FILE, l as runUpdateWorkerMain, m as useRestartRequired, n as buildHints, o as autoInstallViaWorker, p as useAutoInstallUpdate, r as shortChord, s as followRunningUpdate, t as formatPathForCwd, u as startUpdateWorker, v as autoInstallUpdate, w as writeFailedUpdate, x as isTransientFailure, y as clearFailedUpdate } from "./path-display-DRAEpKOU.js";
+import { C as upgradeError, D as summarizeArtifactCounts, E as groupArtifacts, S as readFailedUpdate, T as upgradeInstalledPackages, _ as UPDATE_FAILED_FILE, a as UPDATE_RESULT_FILE, b as isAutoInstallCandidate, c as readUpdateWorkerResult, d as buildRestartHint, f as buildUpdateHint, g as AUTO_INSTALL_RETRY_BACKOFF_MS, h as useUpdateCheck, i as UPDATE_LOG_FILE, l as runUpdateWorkerMain, m as useRestartRequired, n as buildHints, o as autoInstallViaWorker, p as useAutoInstallUpdate, r as shortChord, s as followRunningUpdate, t as formatPathForCwd, u as startUpdateWorker, v as autoInstallUpdate, w as writeFailedUpdate, x as isTransientFailure, y as clearFailedUpdate } from "./path-display-CAWz-sMq.js";
 import { A as clipHintsToWidth, B as createDiscoverySlot, C as McpAuthProvider, D as useInteractionsActions, E as InteractionsProvider, G as ConfigProvider, H as useDiscovery, I as SettingsProvider, J as createArtifactsCompletionProvider, K as useConfig, L as useSettings, M as hintsLength, N as truncateTrailing, O as useInteractionsQueue, P as useEnabledToggleSet, Q as bootTick, R as parseEditorCommand, S as parentServerName, T as useMcpAuthState, U as useDiscoveryOptional, V as DiscoveryProvider, X as useCompletion, Y as scoreArtifacts, Z as bootProfileEnabled, _ as buildToolToggle, a as useSurfaces, b as buildVisibleMcpRows, c as useStreamBuffer, d as useSafeModeQueue, f as hasUntimedOpenCalls, g as redirectUriFromAuthUrl, h as normalizeRedirectPaste, i as useSelectStyle, k as EMPTY_HINTS, l as SafeModeProvider, m as fetchOAuthRedirect, n as ThemeProvider, o as useSyntaxStyles, p as withRunningCallStarts, q as ARTIFACTS_COMPLETION_PROVIDER_ID, r as useColors, s as useTheme, t as computeTurnAnchors, u as useSafeModeActions, v as useMcpToolToggleMap, w as useMcpAuthDispatch, x as indexOfServerRow, y as useMcpToolToggleSet, z as quoteForShell } from "./transcript-anchors-DMjvyUjk.js";
 import { $ as ONBOARDING_WORDS, A as stepTranscriptCap, B as RUN_WAITING_LABEL, Bt as FILES_TRIGGER, Ct as getMcpAuthStatus, Dt as chunkMarkdownForRender, Et as MARKDOWN_RENDER_CHUNK_TARGET_BYTES, F as spawnLane, Ft as DAEMON_HEALTH_GLYPH, G as APPROVAL_MODE_TRADEOFFS, Gt as blendHsl, H as runRetryingLabel, Ht as uniqueFilesFromReferences, I as spawnLaneResolver, It as DAEMON_HEALTH_STYLE, J as createOnboardingRun, Jt as cacheHintText, K as SETTING_TRADEOFFS, Kt as buildLinearRamp, L as spawnParents, Lt as SKILLS_TRIGGER, N as turnContextSize, Nt as splitMarkdownCodeBlocks, Q as ONBOARDING_AGENT_NAMES, R as RUN_STATUS_TIME_MS, Rt as createSkillsCompletionProvider, St as MCP_STATUS_LABEL, Tt as reduceMcpAuth, U as runStatusKey, Ut as COMMANDS_TRIGGER, V as runFoldStatus, Vt as createFilesCompletionProvider, W as runTailActivity, Wt as createCommandsCompletionProvider, X as onboardingSwitchedFeatures, Y as onboardingImportParts, Z as LOCAL_SERVER_NAMES, _ as capTranscriptEvents, _t as buildModelCatalog, a as displayNameFor, at as TUTORIAL_TOPICS, b as finalizeStreamingMarkdown, bt as indexOfEntry, c as MAX_TRANSCRIPT_EVENTS, ct as ONBOARDING_PREVIEW_EVENTS, dt as CONNECTORS, et as connectorAuthText, ft as CONNECTOR_CATEGORIES, gt as connectorServerConfig, ht as connectorInstalled, it as TUTORIALS, jt as normalizeMarkdownCodeFences, lt as defaultImportSelection, m as TRANSCRIPT_TRIM_TO_EVENTS, mt as connectorInputError, n as reconcileEvents, nt as joinNames, o as formatToolCall, ot as tutorialOnServer, p as TRANSCRIPT_TRIM_STEP_EVENTS, pt as connectorById, q as connectorsFromImport, qt as CACHE_HINT_MIN_TOKENS, r as TOOL_DISPLAY, rt as nativeExtensionNeedText, s as toolInputCode, st as ONBOARDING_PREVIEW_ATTACHMENTS, tt as joinFewNames, ut as importsSomething, vt as customModelTargets, wt as mcpFailureEvent, x as finalizeStreamingMarkdownForOwner, yt as filterModelCatalog, z as RUN_WAITING_DELAY_MS, zt as uniqueSkillNamesFromReferences } from "./transcript-reconcile-DpQO85wl.js";
 import { t as extensionMark } from "./extension-mark-_rhkDWL5.js";

package/dist/{cli-shared-DeRHgYvl.js → cli-shared-DIV9c5Nr.js}

@@ -1,8 +1,8 @@
 import { t as createProcessContext } from "./contexts-DLZTSRHU.js";
 import { createSandboxContext } from "./contexts/sandbox.js";
 import { p as oauthAccountLabel, r as API_KEY_ACCOUNT_LABEL } from "./cred-keys-C0KaSRp7.js";
-import { D as credKeyOf, d as readCredentials, x as storedCredentialsOf } from "./credentials-Bqg-qNBM.js";
-import { i as integrationCredentialKey, r as fromEntries } from "./auth-store-port-BKpjlJ8a.js";
+import { D as credKeyOf, d as readCredentials, x as storedCredentialsOf } from "./credentials-D71duF64.js";
+import { i as integrationCredentialKey, r as fromEntries } from "./auth-store-port-DBl2JUC6.js";
 import { t as createDaytonaProvider } from "./daytona-CgC8wQzg.js";
 import { n as hostWorkspaceMounts, t as createDockerContext } from "./docker-D3CARts8.js";
 import { t as createE2BProvider } from "./e2b-4ByYdO1e.js";
@@ -256,4 +256,4 @@ function isRemoteSandboxContext(type) {
 //#endregion
 export { integrationCredentialsOf as a, detectAuth as i, isRemoteSandboxContext as n, isIntegrationCredentialKey as o, activeAccountOf as r, createCliExecution as t };
 
-//# sourceMappingURL=cli-shared-DeRHgYvl.js.map
+//# sourceMappingURL=cli-shared-DIV9c5Nr.js.map

package/dist/{cli-shared-DeRHgYvl.js.map → cli-shared-DIV9c5Nr.js.map}

@@ -1 +1 @@
-{"version":3,"file":"cli-shared-DeRHgYvl.js","names":[],"sources":["../src/chat/providers-integration.ts","../src/chat/auth.ts","../src/cli-shared.ts"],"sourcesContent":["/**\n * Providers that sign in through an integration (`ProviderDescriptor.integration`):\n * their connections, read from the integration's entry in `credentials.json`\n * and shaped like provider credentials, for the code that asks \"is this\n * provider signed in, and as whom\" (`detectAuth`) and the usage probes.\n *\n * Read from the file, not from a registry: pickers and probes run in every\n * host and process, with or without the extension runtime that registered\n * the integration, and the file is what every runtime writes.\n */\n\nimport type { CredentialsFile, ProviderCredential } from './credentials'\nimport { fromEntries, integrationCredentialKey } from '../extensions/integrations/auth-store-port'\n\n/** One connection of a provider's integration, as a provider credential. */\nexport interface IntegrationProviderCredential {\n  /** Identity of the connection for lists and caches (`integration:<id>@<account>`); not a credentials-file key. */\n  key: string\n  /** The connection's credential: an OAuth grant (its extras spread in), or an API key / token as `apikey`. `id` is the account. */\n  credential: ProviderCredential\n  /** The integration's default connection. */\n  active: boolean\n  /** The connection's account (its stable id). */\n  account: string\n  /** What to show for it. */\n  label: string\n}\n\n/**\n * The connections of `integrationId` in a read credentials file, the default first.\n *\n * @param all - The parsed credentials file.\n * @param integrationId - The integration the provider signs in with.\n */\nexport function integrationCredentialsOf(all: CredentialsFile, integrationId: string): IntegrationProviderCredential[] {\n  const fileKey = integrationCredentialKey(integrationId)\n  const entry = all[fileKey]\n  const stored = entry ? fromEntries(integrationId, entry) ?? [] : []\n  return stored.map(({ connection, credential, refreshToken }, i) => {\n    const label = connection.label ?? connection.account\n    const asProvider: ProviderCredential = credential.type === 'oauth'\n      ? {\n          ...credential.extra,\n          kind: 'oauth',\n          access: credential.accessToken,\n          ...(refreshToken ? { refresh: refreshToken } : {}),\n          ...(credential.expiresAt !== undefined ? { expires: credential.expiresAt } : {}),\n          label,\n          id: connection.account,\n        }\n      : { kind: 'apikey', value: credential.type === 'apiKey' ? credential.key : credential.token, id: connection.account }\n    return { key: `${fileKey}@${connection.account}`, credential: asProvider, active: i === 0, account: connection.account, label }\n  })\n}\n\n/**\n * Whether a usage credential key names an integration connection (whose\n * refresh only the integration's registry can run).\n *\n * @param key - A {@link IntegrationProviderCredential.key} or a credentials-file key.\n */\nexport function isIntegrationCredentialKey(key: string): boolean {\n  return key.startsWith(integrationCredentialKey(''))\n}\n","import type { ProviderCredential } from './credentials'\nimport type { ProviderDescriptor } from './providers'\nimport { API_KEY_ACCOUNT_LABEL } from './cred-keys'\nimport { oauthAccountLabel, readCredentials, storedCredentialsOf } from './credentials'\nimport { credKeyOf } from './providers'\nimport { integrationCredentialsOf } from './providers-integration'\n\nexport { API_KEY_ACCOUNT_LABEL } from './cred-keys'\n\n/**\n * Provider identifier as known to the TUI. Built-in keys include `anthropic`,\n * `openai`, `openrouter` and `cerebras`, and hosts can register additional\n * keys via {@link ProviderDescriptor} — so the type is open.\n */\nexport type ProviderKey = string\n\n/** One credential source detected for a provider. */\nexport interface AuthMethod {\n  /** Where the credential comes from: an environment variable, a stored OAuth grant, or a stored API key. */\n  source: 'env' | 'oauth' | 'apikey'\n  /**\n   * Human-readable detail: the env var name, the credentials file, or an\n   * OAuth grant's expiry. The OAuth account name is in `label`, not here.\n   */\n  detail: string\n  /**\n   * True for the credential every reader actually resolves.\n   *\n   * Exactly one STORED credential is active: the one in the canonical file key\n   * (see `alternateCredKey`). A provider can hold an API key and any number of\n   * OAuth accounts, so the list alone does not say which one wins. `env` is\n   * never marked active — it is an observable signal, not a stored credential\n   * the user can promote.\n   *\n   * Optional so hosts that build `ProviderAuth` themselves (this type is public\n   * via `zidane/chat`) keep compiling; absent reads as \"not active\".\n   * {@link detectAuth} always sets it.\n   */\n  active?: boolean\n  /**\n   * Credentials-file key of a STORED credential — the identity to hand to\n   * `setPreferredCredential({ key })` / `removeStoredCredential`. Several OAuth\n   * accounts share `source: 'oauth'`, so `source` alone does not select one.\n   * Absent for `env`.\n   */\n  key?: string\n  /**\n   * Account name — always set for stored OAuth credentials: the user-given one,\n   * or `DEFAULT_OAUTH_ACCOUNT_LABEL` when the grant was never named.\n   */\n  label?: string\n  /**\n   * Set for a connection of the provider's integration\n   * (`ProviderDescriptor.integration`): sign it in, out or make it the\n   * default through the integration, not the provider's credential slots\n   * (such a method has no {@link key}). `id` is its account.\n   */\n  integration?: { id: string, account: string }\n  /**\n   * Stable id of a STORED credential (`ProviderCredential.id`): unlike\n   * {@link key}, it does not move when another account is promoted. What a\n   * session pinned to this account stores. Absent for `env`, and for an entry\n   * written before ids until its next write.\n   */\n  id?: string\n}\n\n/** One stored credential of a provider that a session can run on (see {@link ProviderAuth.accounts}). */\nexport interface ProviderAccount {\n  /** The credential's stable id: what a session pins (`metadata.account`). */\n  id: string\n  /** Display name: the OAuth account's label, or `API key`. */\n  label: string\n  /** Whether the account is an OAuth grant or an API key. */\n  kind: 'oauth' | 'apikey'\n  /** The provider's active credential (what an unpinned session runs on). */\n  active: boolean\n}\n\n/** Authentication state of one provider, as listed by {@link detectAuth}. */\nexport interface ProviderAuth {\n  /** Provider key. */\n  key: ProviderKey\n  /** Display name of the provider. */\n  label: string\n  /** True when at least one credential source is present. */\n  available: boolean\n  /** Credential sources currently present, stored credentials first. */\n  methods: AuthMethod[]\n  /**\n   * The stored credentials a session can be pinned to, active first — set\n   * only when there is a choice: the provider's factory takes an account\n   * (`ProviderDescriptor.accounts`) and at least two are stored. Absent:\n   * one account (or none), so pickers show the provider as before.\n   */\n  accounts?: ProviderAccount[]\n  /**\n   * Env var this provider reads, when it declares one.\n   *\n   * Carried separately from {@link methods} because the settings list shows the\n   * env slot even when it holds nothing. `methods` only ever lists sources that\n   * are actually present, since `available` is derived from it.\n   */\n  envKey?: string\n}\n\n/** The stored, id-carrying credentials among `methods`, as accounts (order kept: active first). */\nfunction accountsOf(methods: readonly AuthMethod[]): ProviderAccount[] {\n  const out: ProviderAccount[] = []\n  for (const method of methods) {\n    if (!method.id || (method.source !== 'oauth' && method.source !== 'apikey'))\n      continue\n    out.push({\n      id: method.id,\n      label: method.source === 'oauth' ? (method.label ?? 'Default') : API_KEY_ACCOUNT_LABEL,\n      kind: method.source,\n      active: method.active === true,\n    })\n  }\n  return out\n}\n\n/**\n * Detect available auth for every registered provider.\n *\n * A method appears in `methods` for every layer that has a credential:\n *\n *   - `kind: 'apikey'` from `credentials.json` (injected into env at TUI launch)\n *   - explicit env var (descriptor's `envKey`)\n *   - `kind: 'oauth'` from `credentials.json` (migrated on first read from a\n *     legacy `.credentials.json`, see `readCredentials`), one per stored account\n *\n * The preferred credential lives in the canonical file key and is flagged\n * {@link AuthMethod.active}; the others sit in sibling slots and are reported\n * too, keyed by {@link AuthMethod.key}, so the UI can offer to promote or\n * remove them. Order within `methods` is presentational — active first — not a\n * resolution order, because the active flag answers that directly.\n *\n * Never refreshes tokens or rewrites existing credentials. The one write is\n * the first-read migration of a legacy `.credentials.json` when\n * `credentials.json` does not exist yet (see `readCredentials`).\n *\n * @param dataDir - Directory holding `credentials.json`.\n * @param registry - Provider descriptors keyed by id.\n * @param env - Environment used to look for ambient credentials. Defaults to `process.env`.\n */\nexport function detectAuth(\n  dataDir: string,\n  registry: Readonly<Record<string, ProviderDescriptor>>,\n  env: Record<string, string | undefined> = process.env,\n): ProviderAuth[] {\n  const creds = readCredentials(dataDir)\n\n  return Object.values(registry).map((descriptor) => {\n    const methods: AuthMethod[] = []\n    const stored = storedCredentialsOf(creds, credKeyOf(descriptor))\n    const fileEntry = stored.find(s => s.active)?.credential\n\n    // 1. Stored API key / OAuth accounts, active first. Every slot goes through\n    //    the same description so a parked credential renders identically to the\n    //    preferred one, differing only in `active`.\n    const describeStored = (key: string, entry: ProviderCredential, active: boolean): AuthMethod | undefined => {\n      const id = typeof entry.id === 'string' && entry.id ? { id: entry.id } : {}\n      if (entry.kind === 'apikey' && entry.value)\n        return { source: 'apikey', detail: 'credentials.json', active, key, ...id }\n      if (entry.kind === 'oauth' && entry.access) {\n        const label = oauthAccountLabel(entry)\n        const expiry = typeof entry.expires === 'number'\n          ? `expires ${new Date(entry.expires).toLocaleString()}`\n          : 'credentials.json'\n        return { source: 'oauth', detail: expiry, active, key, label, ...id }\n      }\n      return undefined\n    }\n\n    for (const slot of stored) {\n      const method = describeStored(slot.key, slot.credential, slot.active)\n      if (method)\n        methods.push(method)\n    }\n\n    // 1a. Connections of the integration the provider signs in with. The\n    //     default is active unless a slot of the provider's own already is.\n    if (descriptor.integration) {\n      const ownActive = methods.some(m => m.active)\n      for (const connection of integrationCredentialsOf(creds, descriptor.integration)) {\n        const method = describeStored(connection.key, connection.credential, connection.active && !ownActive)\n        if (!method)\n          continue\n        const { key: _key, ...rest } = method\n        methods.push({ ...rest, label: connection.label, id: connection.account, integration: { id: descriptor.integration, account: connection.account } })\n      }\n    }\n\n    // 1b. customFields-only credential (descriptor has no `envKey` and is\n    //     authenticated entirely by configuration — e.g. the `local` provider,\n    //     where the auth signal is the configured base URL). The credential\n    //     is \"present\" when every required field has a stored value.\n    if (\n      fileEntry?.kind === 'apikey'\n      && !fileEntry.value\n      && descriptor.customFields\n      && descriptor.customFields.length > 0\n    ) {\n      const stored = fileEntry.customFields ?? {}\n      const required = descriptor.customFields.filter(f => f.required)\n      const allRequiredPresent = required.every(\n        f => typeof stored[f.key] === 'string' && (stored[f.key] as string).length > 0,\n      )\n      if (allRequiredPresent) {\n        methods.push({ source: 'apikey', detail: 'credentials.json (configured)', active: true })\n      }\n    }\n\n    // 1c. Env-only custom field configuration. This lets local/OpenAI-compatible\n    // endpoints participate in auth/model detection when configured through\n    // `LOCAL_LLM_BASE_URL` without first writing credentials.json.\n    if (descriptor.customFields && descriptor.customFields.length > 0) {\n      const required = descriptor.customFields.filter(f => f.required)\n      const allRequiredPresent = required.length > 0 && required.every(\n        f => typeof env[f.envVar] === 'string' && (env[f.envVar] as string).length > 0,\n      )\n\n      if (allRequiredPresent) {\n        methods.push({ source: 'env', detail: required.map(f => f.envVar).join(', '), active: false })\n      }\n    }\n\n    // 2. Env var (may be set by `applyApiKeyEnv` from a stored key, or by the\n    //    user's shell. Either way, treated as the same observable signal.)\n    if (descriptor.envKey && env[descriptor.envKey])\n      methods.push({ source: 'env', detail: descriptor.envKey, active: false })\n\n    // Selection identity is the file key for stored credentials and `source`\n    // for everything else. Two API-key rows cannot be a choice the user can\n    // express (there is one API key per provider) — a customFields-configured\n    // credential sitting beside a stored one, or a stale duplicate from an\n    // older build, collapses to the FIRST, which the order above makes the\n    // active one. OAuth accounts are distinct by key and all survive.\n    const unique: AuthMethod[] = []\n    for (const method of methods) {\n      const duplicate = unique.some(seen =>\n        method.source === 'oauth'\n          ? seen.key !== undefined && seen.key === method.key\n          : seen.source === method.source,\n      )\n      if (!duplicate)\n        unique.push(method)\n    }\n\n    const accounts = descriptor.accounts === true ? accountsOf(unique) : []\n    return {\n      key: descriptor.key,\n      label: descriptor.label,\n      available: unique.length > 0,\n      methods: unique,\n      ...(accounts.length >= 2 ? { accounts } : {}),\n      ...(descriptor.envKey ? { envKey: descriptor.envKey } : {}),\n    }\n  })\n}\n\n/**\n * The id of the account a provider's unpinned sessions run on: its active\n * stored credential, or its integration's default connection. `undefined`\n * when it has no stored account (env only, or signed out).\n *\n * @param dataDir - Directory holding `credentials.json`.\n * @param descriptor - The provider.\n * @param env - Environment used to look for ambient credentials. Defaults to `process.env`.\n */\nexport function activeAccountOf(dataDir: string, descriptor: ProviderDescriptor, env: Record<string, string | undefined> = process.env): string | undefined {\n  const [auth] = detectAuth(dataDir, { [descriptor.key]: descriptor }, env)\n  return auth?.methods.find(method => method.active === true && method.id)?.id\n}\n","/**\n * Shared glue for the CLI entrypoints (`start.ts` — human renderer,\n * `headless-cli.ts` — machine contract). Both build an execution context,\n * resolve a session (memory or sqlite), and parse `--mcp` config the same way;\n * this module is the single source of truth for that wiring so the two CLIs\n * stay in lockstep without duplicating it.\n */\n\nimport type { ExecutionContext } from './contexts'\nimport type { DurabilityMode } from './durable/setting'\nimport type { DurableOptions, DurableRuntime } from './durable/types'\nimport type { Session } from './session'\nimport { createProcessContext, createSandboxContext } from './contexts'\nimport { createDaytonaProvider } from './contexts/daytona'\nimport { createDockerContext, hostWorkspaceMounts } from './contexts/docker'\nimport { createE2BProvider } from './contexts/e2b'\nimport { LEASE_STALE_MS } from './durable/lease'\nimport { DEFAULT_DURABILITY } from './durable/setting'\nimport { sqliteRuntimeForStore } from './durable/sqlite-runtime'\nimport { createMemoryStore, createSession, loadSession } from './session'\n\nexport { parseMcpConfig } from './start/shared-options'\n\n/**\n * Build the execution context for a CLI run: `process` (default), `docker`,\n * `e2b`, or `daytona`.\n *\n * The `e2b` backend reads its `E2B_API_KEY` / `E2B_DOMAIN` / `E2B_TEMPLATE`\n * from the environment (point `E2B_DOMAIN` at a self-hosted cluster, and set\n * `E2B_TEMPLATE` to a template that exists there — the default `base` does\n * not); `--cwd` becomes the sandbox working directory.\n *\n * The Daytona backend reads `DAYTONA_API_KEY` / `DAYTONA_API_URL` /\n * `DAYTONA_TARGET` from the environment. `--cwd` becomes the sandbox working\n * directory.\n *\n * Docker: when `--cwd` is an existing host directory, its git worktree (and\n * the git common dir, for linked worktrees) is bind-mounted at the same\n * absolute path (git hooks/config read-only); otherwise, or when that tree\n * is `/`, `$HOME`, or an ancestor of it, `--cwd` is a container-only path.\n *\n * `env` (from `--env` / `--pass-env`) is forwarded to whichever context is\n * selected: baked into remote sandboxes at create time, set on the Docker\n * container, or merged into the in-process command environment.\n *\n * `pregame` (from `--pregame`) is supported by the remote sandbox providers:\n * a setup script uploaded and run in the sandbox once it's ready, before\n * prompting begins.\n *\n * `sandboxId` (from `--sandbox`) attaches to a pre-existing remote sandbox\n * instead of creating a fresh one.\n */\nexport function createCliExecution(type: string, opts: { image?: string, cwd?: string, env?: Record<string, string>, pregame?: { name: string, content: string }, sandboxId?: string, sandboxOnDestroy?: 'kill' | 'pause' | 'leave' }): ExecutionContext {\n  switch (type) {\n    case 'docker': {\n      // An existing host dir is bind-mounted at the same path so the agent\n      // works on the real checkout; a container-only path mounts nothing.\n      const mounts = opts.cwd ? hostWorkspaceMounts(opts.cwd) : []\n      return createDockerContext({ image: opts.image, cwd: opts.cwd, env: opts.env, ...(mounts.length > 0 ? { mounts } : {}) })\n    }\n    case 'e2b':\n      return createSandboxContext(createE2BProvider({ cwd: opts.cwd, env: opts.env, ...(opts.pregame ? { pregame: opts.pregame } : {}), ...(opts.sandboxId ? { sandboxId: opts.sandboxId } : {}), ...(opts.sandboxOnDestroy ? { onDestroy: opts.sandboxOnDestroy } : {}) }))\n    case 'daytona':\n      return createSandboxContext(createDaytonaProvider({ cwd: opts.cwd, env: opts.env, ...(opts.pregame ? { pregame: opts.pregame } : {}), ...(opts.sandboxId ? { sandboxId: opts.sandboxId } : {}), ...(opts.sandboxOnDestroy ? { onDestroy: opts.sandboxOnDestroy } : {}) }))\n    case 'process':\n    default:\n      return createProcessContext({ cwd: opts.cwd, env: opts.env })\n  }\n}\n\n/**\n * Contexts whose filesystem is a remote sandbox: host paths don't exist\n * there, so host-derived cwds must not be forwarded.\n */\nexport function isRemoteSandboxContext(type: string): boolean {\n  return type === 'e2b' || type === 'daytona'\n}\n\n/** The session of a CLI run, with what durability gives it. */\nexport interface CliSession {\n  session: Session\n  /**\n   * `createAgent`'s `durable`: the SQLite runtime the session is stored on,\n   * unless `durability` is `off` or the session lives in memory. `on`\n   * resumes an interrupted run before a run; `resume-ask` heals it.\n   */\n  durable?: DurableOptions\n  /** A checkpoint run a dead process left in the session, to continue (`agent.resume`) before the prompt. */\n  resumeRunId?: string\n}\n\n/**\n * Resolve the session for a CLI run.\n * - `sessionDb` set → sqlite-backed; resume `sessionId` if it exists, else\n *   create it (or a fresh id when `sessionId` is omitted).\n * - `sessionDb` absent → in-memory store (no durability).\n *\n * Fresh sessions are saved immediately so the store has a header row from\n * the start — incremental `appendTurns` against a header-less sqlite store\n * would otherwise be silent no-ops, and an error / Ctrl+C before the final\n * save would lose the whole run.\n *\n * Durability (`Settings.durability`, default `resume-ask`): unless `off`,\n * runs keep checkpoints on the session's SQLite file. An existing session\n * whose last run a dead process left is resumed (`on`), or resumed when\n * `ask` says so (`resume-ask`; without `ask`, nobody to ask, it is\n * not); otherwise its interrupted tool calls are healed\n * (`healInterruptedToolCalls`).\n * @param sessionDb - SQLite sessions file.\n * @param sessionId - Session to resume or create.\n * @param options - Durability of the run, and how to ask before resuming.\n * @param options.durability - `on`, `resume-ask` or `off`.\n * @param options.ask - Ask the user whether to resume an interrupted run.\n */\nexport async function createCliSession(sessionDb?: string, sessionId?: string, options: { durability?: DurabilityMode, ask?: () => Promise<boolean> } = {}): Promise<CliSession> {\n  if (sessionDb) {\n    const { createSqliteStore } = await import('./session/sqlite')\n    const store = createSqliteStore({ path: sessionDb })\n    const durability = options.durability ?? DEFAULT_DURABILITY\n    const durable = durability === 'off' ? undefined : sqliteRuntimeForStore(store)\n    const withDurable = (session: Session, resumeRunId?: string): CliSession => ({\n      session,\n      ...(durable ? { durable: { runtime: durable, onInterrupted: durability === 'on' ? 'resume' : 'heal' } } : {}),\n      ...(resumeRunId !== undefined ? { resumeRunId } : {}),\n    })\n    if (sessionId) {\n      const existing = await loadSession(store, sessionId)\n      if (existing) {\n        const resumeRunId = durable ? await interruptedRun(durable, sessionId, durability, options.ask) : undefined\n        // No run claim on this path: resolving the session IS the run start,\n        // so heal here (see `healInterruptedToolCalls`). A resumed run\n        // dispatches its pending calls itself.\n        if (resumeRunId === undefined)\n          await existing.healInterruptedToolCalls()\n        return withDurable(existing, resumeRunId)\n      }\n      const session = await createSession({ store, id: sessionId })\n      await session.save()\n      return withDurable(session)\n    }\n    const session = await createSession({ store })\n    await session.save()\n    return withDurable(session)\n  }\n  return { session: await createSession({ store: createMemoryStore() }) }\n}\n\n/** The run of `sessionId` a dead process left, when the durability says to resume it. */\nasync function interruptedRun(durable: DurableRuntime, sessionId: string, durability: DurabilityMode, ask: (() => Promise<boolean>) | undefined): Promise<string | undefined> {\n  const pending = (await durable.lease?.resumable({ staleAt: Date.now() - LEASE_STALE_MS }) ?? []).filter(run => run.sessionId === sessionId).at(-1)\n  if (!pending)\n    return undefined\n  if (durability === 'on' || (durability === 'resume-ask' && await ask?.()))\n    return pending.runId\n  return undefined\n}\n\n/**\n * Install SIGINT/SIGTERM handlers for a CLI run. The first signal aborts the\n * returned `AbortSignal` so the running agent can unwind cleanly (persist the\n * session, destroy execution contexts) and the process exits through the\n * normal path — which is what fires the `process.on('exit')` orphan reaper\n * for detached background process groups. A second signal force-exits\n * immediately (the synchronous 'exit' reaper still runs, but async cleanup\n * such as Docker container teardown is skipped).\n */\nexport function installCliSignalHandlers(): AbortSignal {\n  const controller = new AbortController()\n  const onSignal = (name: NodeJS.Signals): void => {\n    if (controller.signal.aborted)\n      process.exit(name === 'SIGTERM' ? 143 : 130) // 128 + signal number\n    controller.abort(new Error(`Received ${name}, stopping the run`))\n  }\n  process.on('SIGINT', () => onSignal('SIGINT'))\n  process.on('SIGTERM', () => onSignal('SIGTERM'))\n  return controller.signal\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkCA,SAAgB,yBAAyB,KAAsB,eAAwD;CACrH,MAAM,UAAU,yBAAyB,aAAa;CACtD,MAAM,QAAQ,IAAI;CAElB,QADe,QAAQ,YAAY,eAAe,KAAK,KAAK,CAAC,IAAI,CAAC,EAAA,CACpD,KAAK,EAAE,YAAY,YAAY,gBAAgB,MAAM;EACjE,MAAM,QAAQ,WAAW,SAAS,WAAW;EAC7C,MAAM,aAAiC,WAAW,SAAS,UACvD;GACE,GAAG,WAAW;GACd,MAAM;GACN,QAAQ,WAAW;GACnB,GAAI,eAAe,EAAE,SAAS,aAAa,IAAI,CAAC;GAChD,GAAI,WAAW,cAAc,KAAA,IAAY,EAAE,SAAS,WAAW,UAAU,IAAI,CAAC;GAC9E;GACA,IAAI,WAAW;EACjB,IACA;GAAE,MAAM;GAAU,OAAO,WAAW,SAAS,WAAW,WAAW,MAAM,WAAW;GAAO,IAAI,WAAW;EAAQ;EACtH,OAAO;GAAE,KAAK,GAAG,QAAQ,GAAG,WAAW;GAAW,YAAY;GAAY,QAAQ,MAAM;GAAG,SAAS,WAAW;GAAS;EAAM;CAChI,CAAC;AACH;;;;;;;AAQA,SAAgB,2BAA2B,KAAsB;CAC/D,OAAO,IAAI,WAAW,yBAAyB,EAAE,CAAC;AACpD;;;;AC4CA,SAAS,WAAW,SAAmD;CACrE,MAAM,MAAyB,CAAC;CAChC,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,CAAC,OAAO,MAAO,OAAO,WAAW,WAAW,OAAO,WAAW,UAChE;EACF,IAAI,KAAK;GACP,IAAI,OAAO;GACX,OAAO,OAAO,WAAW,UAAW,OAAO,SAAS,YAAa;GACjE,MAAM,OAAO;GACb,QAAQ,OAAO,WAAW;EAC5B,CAAC;CACH;CACA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAgB,WACd,SACA,UACA,MAA0C,QAAQ,KAClC;CAChB,MAAM,QAAQ,gBAAgB,OAAO;CAErC,OAAO,OAAO,OAAO,QAAQ,CAAC,CAAC,KAAK,eAAe;EACjD,MAAM,UAAwB,CAAC;EAC/B,MAAM,SAAS,oBAAoB,OAAO,UAAU,UAAU,CAAC;EAC/D,MAAM,YAAY,OAAO,MAAK,MAAK,EAAE,MAAM,CAAC,EAAE;EAK9C,MAAM,kBAAkB,KAAa,OAA2B,WAA4C;GAC1G,MAAM,KAAK,OAAO,MAAM,OAAO,YAAY,MAAM,KAAK,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC;GAC1E,IAAI,MAAM,SAAS,YAAY,MAAM,OACnC,OAAO;IAAE,QAAQ;IAAU,QAAQ;IAAoB;IAAQ;IAAK,GAAG;GAAG;GAC5E,IAAI,MAAM,SAAS,WAAW,MAAM,QAAQ;IAC1C,MAAM,QAAQ,kBAAkB,KAAK;IAIrC,OAAO;KAAE,QAAQ;KAAS,QAHX,OAAO,MAAM,YAAY,WACpC,WAAW,IAAI,KAAK,MAAM,OAAO,CAAC,CAAC,eAAe,MAClD;KACsC;KAAQ;KAAK;KAAO,GAAG;IAAG;GACtE;EAEF;EAEA,KAAK,MAAM,QAAQ,QAAQ;GACzB,MAAM,SAAS,eAAe,KAAK,KAAK,KAAK,YAAY,KAAK,MAAM;GACpE,IAAI,QACF,QAAQ,KAAK,MAAM;EACvB;EAIA,IAAI,WAAW,aAAa;GAC1B,MAAM,YAAY,QAAQ,MAAK,MAAK,EAAE,MAAM;GAC5C,KAAK,MAAM,cAAc,yBAAyB,OAAO,WAAW,WAAW,GAAG;IAChF,MAAM,SAAS,eAAe,WAAW,KAAK,WAAW,YAAY,WAAW,UAAU,CAAC,SAAS;IACpG,IAAI,CAAC,QACH;IACF,MAAM,EAAE,KAAK,MAAM,GAAG,SAAS;IAC/B,QAAQ,KAAK;KAAE,GAAG;KAAM,OAAO,WAAW;KAAO,IAAI,WAAW;KAAS,aAAa;MAAE,IAAI,WAAW;MAAa,SAAS,WAAW;KAAQ;IAAE,CAAC;GACrJ;EACF;EAMA,IACE,WAAW,SAAS,YACjB,CAAC,UAAU,SACX,WAAW,gBACX,WAAW,aAAa,SAAS,GACpC;GACA,MAAM,SAAS,UAAU,gBAAgB,CAAC;GAK1C,IAJiB,WAAW,aAAa,QAAO,MAAK,EAAE,QACrB,CAAC,CAAC,OAClC,MAAK,OAAO,OAAO,EAAE,SAAS,YAAa,OAAO,EAAE,IAAI,CAAY,SAAS,CAE1D,GACnB,QAAQ,KAAK;IAAE,QAAQ;IAAU,QAAQ;IAAiC,QAAQ;GAAK,CAAC;EAE5F;EAKA,IAAI,WAAW,gBAAgB,WAAW,aAAa,SAAS,GAAG;GACjE,MAAM,WAAW,WAAW,aAAa,QAAO,MAAK,EAAE,QAAQ;GAK/D,IAJ2B,SAAS,SAAS,KAAK,SAAS,OACzD,MAAK,OAAO,IAAI,EAAE,YAAY,YAAa,IAAI,EAAE,OAAO,CAAY,SAAS,CAC/E,GAGE,QAAQ,KAAK;IAAE,QAAQ;IAAO,QAAQ,SAAS,KAAI,MAAK,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI;IAAG,QAAQ;GAAM,CAAC;EAEjG;EAIA,IAAI,WAAW,UAAU,IAAI,WAAW,SACtC,QAAQ,KAAK;GAAE,QAAQ;GAAO,QAAQ,WAAW;GAAQ,QAAQ;EAAM,CAAC;EAQ1E,MAAM,SAAuB,CAAC;EAC9B,KAAK,MAAM,UAAU,SAMnB,IAAI,CALc,OAAO,MAAK,SAC5B,OAAO,WAAW,UACd,KAAK,QAAQ,KAAA,KAAa,KAAK,QAAQ,OAAO,MAC9C,KAAK,WAAW,OAAO,MAEhB,GACX,OAAO,KAAK,MAAM;EAGtB,MAAM,WAAW,WAAW,aAAa,OAAO,WAAW,MAAM,IAAI,CAAC;EACtE,OAAO;GACL,KAAK,WAAW;GAChB,OAAO,WAAW;GAClB,WAAW,OAAO,SAAS;GAC3B,SAAS;GACT,GAAI,SAAS,UAAU,IAAI,EAAE,SAAS,IAAI,CAAC;GAC3C,GAAI,WAAW,SAAS,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;EAC3D;CACF,CAAC;AACH;;;;;;;;;;AAWA,SAAgB,gBAAgB,SAAiB,YAAgC,MAA0C,QAAQ,KAAyB;CAC1J,MAAM,CAAC,QAAQ,WAAW,SAAS,GAAG,WAAW,MAAM,WAAW,GAAG,GAAG;CACxE,OAAO,MAAM,QAAQ,MAAK,WAAU,OAAO,WAAW,QAAQ,OAAO,EAAE,CAAC,EAAE;AAC5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC9NA,SAAgB,mBAAmB,MAAc,MAAwM;CACvP,QAAQ,MAAR;EACE,KAAK,UAAU;GAGb,MAAM,SAAS,KAAK,MAAM,oBAAoB,KAAK,GAAG,IAAI,CAAC;GAC3D,OAAO,oBAAoB;IAAE,OAAO,KAAK;IAAO,KAAK,KAAK;IAAK,KAAK,KAAK;IAAK,GAAI,OAAO,SAAS,IAAI,EAAE,OAAO,IAAI,CAAC;GAAG,CAAC;EAC1H;EACA,KAAK,OACH,OAAO,qBAAqB,kBAAkB;GAAE,KAAK,KAAK;GAAK,KAAK,KAAK;GAAK,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;GAAI,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;GAAI,GAAI,KAAK,mBAAmB,EAAE,WAAW,KAAK,iBAAiB,IAAI,CAAC;EAAG,CAAC,CAAC;EACvQ,KAAK,WACH,OAAO,qBAAqB,sBAAsB;GAAE,KAAK,KAAK;GAAK,KAAK,KAAK;GAAK,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;GAAI,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;GAAI,GAAI,KAAK,mBAAmB,EAAE,WAAW,KAAK,iBAAiB,IAAI,CAAC;EAAG,CAAC,CAAC;EAE3Q,SACE,OAAO,qBAAqB;GAAE,KAAK,KAAK;GAAK,KAAK,KAAK;EAAI,CAAC;CAChE;AACF;;;;;AAMA,SAAgB,uBAAuB,MAAuB;CAC5D,OAAO,SAAS,SAAS,SAAS;AACpC"}
+{"version":3,"file":"cli-shared-DIV9c5Nr.js","names":[],"sources":["../src/chat/providers-integration.ts","../src/chat/auth.ts","../src/cli-shared.ts"],"sourcesContent":["/**\n * Providers that sign in through an integration (`ProviderDescriptor.integration`):\n * their connections, read from the integration's entry in `credentials.json`\n * and shaped like provider credentials, for the code that asks \"is this\n * provider signed in, and as whom\" (`detectAuth`) and the usage probes.\n *\n * Read from the file, not from a registry: pickers and probes run in every\n * host and process, with or without the extension runtime that registered\n * the integration, and the file is what every runtime writes.\n */\n\nimport type { CredentialsFile, ProviderCredential } from './credentials'\nimport { fromEntries, integrationCredentialKey } from '../extensions/integrations/auth-store-port'\n\n/** One connection of a provider's integration, as a provider credential. */\nexport interface IntegrationProviderCredential {\n  /** Identity of the connection for lists and caches (`integration:<id>@<account>`); not a credentials-file key. */\n  key: string\n  /** The connection's credential: an OAuth grant (its extras spread in), or an API key / token as `apikey`. `id` is the account. */\n  credential: ProviderCredential\n  /** The integration's default connection. */\n  active: boolean\n  /** The connection's account (its stable id). */\n  account: string\n  /** What to show for it. */\n  label: string\n}\n\n/**\n * The connections of `integrationId` in a read credentials file, the default first.\n *\n * @param all - The parsed credentials file.\n * @param integrationId - The integration the provider signs in with.\n */\nexport function integrationCredentialsOf(all: CredentialsFile, integrationId: string): IntegrationProviderCredential[] {\n  const fileKey = integrationCredentialKey(integrationId)\n  const entry = all[fileKey]\n  const stored = entry ? fromEntries(integrationId, entry) ?? [] : []\n  return stored.map(({ connection, credential, refreshToken }, i) => {\n    const label = connection.label ?? connection.account\n    const asProvider: ProviderCredential = credential.type === 'oauth'\n      ? {\n          ...credential.extra,\n          kind: 'oauth',\n          access: credential.accessToken,\n          ...(refreshToken ? { refresh: refreshToken } : {}),\n          ...(credential.expiresAt !== undefined ? { expires: credential.expiresAt } : {}),\n          label,\n          id: connection.account,\n        }\n      : { kind: 'apikey', value: credential.type === 'apiKey' ? credential.key : credential.token, id: connection.account }\n    return { key: `${fileKey}@${connection.account}`, credential: asProvider, active: i === 0, account: connection.account, label }\n  })\n}\n\n/**\n * Whether a usage credential key names an integration connection (whose\n * refresh only the integration's registry can run).\n *\n * @param key - A {@link IntegrationProviderCredential.key} or a credentials-file key.\n */\nexport function isIntegrationCredentialKey(key: string): boolean {\n  return key.startsWith(integrationCredentialKey(''))\n}\n","import type { ProviderCredential } from './credentials'\nimport type { ProviderDescriptor } from './providers'\nimport { API_KEY_ACCOUNT_LABEL } from './cred-keys'\nimport { oauthAccountLabel, readCredentials, storedCredentialsOf } from './credentials'\nimport { credKeyOf } from './providers'\nimport { integrationCredentialsOf } from './providers-integration'\n\nexport { API_KEY_ACCOUNT_LABEL } from './cred-keys'\n\n/**\n * Provider identifier as known to the TUI. Built-in keys include `anthropic`,\n * `openai`, `openrouter` and `cerebras`, and hosts can register additional\n * keys via {@link ProviderDescriptor} — so the type is open.\n */\nexport type ProviderKey = string\n\n/** One credential source detected for a provider. */\nexport interface AuthMethod {\n  /** Where the credential comes from: an environment variable, a stored OAuth grant, or a stored API key. */\n  source: 'env' | 'oauth' | 'apikey'\n  /**\n   * Human-readable detail: the env var name, the credentials file, or an\n   * OAuth grant's expiry. The OAuth account name is in `label`, not here.\n   */\n  detail: string\n  /**\n   * True for the credential every reader actually resolves.\n   *\n   * Exactly one STORED credential is active: the one in the canonical file key\n   * (see `alternateCredKey`). A provider can hold an API key and any number of\n   * OAuth accounts, so the list alone does not say which one wins. `env` is\n   * never marked active — it is an observable signal, not a stored credential\n   * the user can promote.\n   *\n   * Optional so hosts that build `ProviderAuth` themselves (this type is public\n   * via `zidane/chat`) keep compiling; absent reads as \"not active\".\n   * {@link detectAuth} always sets it.\n   */\n  active?: boolean\n  /**\n   * Credentials-file key of a STORED credential — the identity to hand to\n   * `setPreferredCredential({ key })` / `removeStoredCredential`. Several OAuth\n   * accounts share `source: 'oauth'`, so `source` alone does not select one.\n   * Absent for `env`.\n   */\n  key?: string\n  /**\n   * Account name — always set for stored OAuth credentials: the user-given one,\n   * or `DEFAULT_OAUTH_ACCOUNT_LABEL` when the grant was never named.\n   */\n  label?: string\n  /**\n   * Set for a connection of the provider's integration\n   * (`ProviderDescriptor.integration`): sign it in, out or make it the\n   * default through the integration, not the provider's credential slots\n   * (such a method has no {@link key}). `id` is its account.\n   */\n  integration?: { id: string, account: string }\n  /**\n   * Stable id of a STORED credential (`ProviderCredential.id`): unlike\n   * {@link key}, it does not move when another account is promoted. What a\n   * session pinned to this account stores. Absent for `env`, and for an entry\n   * written before ids until its next write.\n   */\n  id?: string\n}\n\n/** One stored credential of a provider that a session can run on (see {@link ProviderAuth.accounts}). */\nexport interface ProviderAccount {\n  /** The credential's stable id: what a session pins (`metadata.account`). */\n  id: string\n  /** Display name: the OAuth account's label, or `API key`. */\n  label: string\n  /** Whether the account is an OAuth grant or an API key. */\n  kind: 'oauth' | 'apikey'\n  /** The provider's active credential (what an unpinned session runs on). */\n  active: boolean\n}\n\n/** Authentication state of one provider, as listed by {@link detectAuth}. */\nexport interface ProviderAuth {\n  /** Provider key. */\n  key: ProviderKey\n  /** Display name of the provider. */\n  label: string\n  /** True when at least one credential source is present. */\n  available: boolean\n  /** Credential sources currently present, stored credentials first. */\n  methods: AuthMethod[]\n  /**\n   * The stored credentials a session can be pinned to, active first — set\n   * only when there is a choice: the provider's factory takes an account\n   * (`ProviderDescriptor.accounts`) and at least two are stored. Absent:\n   * one account (or none), so pickers show the provider as before.\n   */\n  accounts?: ProviderAccount[]\n  /**\n   * Env var this provider reads, when it declares one.\n   *\n   * Carried separately from {@link methods} because the settings list shows the\n   * env slot even when it holds nothing. `methods` only ever lists sources that\n   * are actually present, since `available` is derived from it.\n   */\n  envKey?: string\n}\n\n/** The stored, id-carrying credentials among `methods`, as accounts (order kept: active first). */\nfunction accountsOf(methods: readonly AuthMethod[]): ProviderAccount[] {\n  const out: ProviderAccount[] = []\n  for (const method of methods) {\n    if (!method.id || (method.source !== 'oauth' && method.source !== 'apikey'))\n      continue\n    out.push({\n      id: method.id,\n      label: method.source === 'oauth' ? (method.label ?? 'Default') : API_KEY_ACCOUNT_LABEL,\n      kind: method.source,\n      active: method.active === true,\n    })\n  }\n  return out\n}\n\n/**\n * Detect available auth for every registered provider.\n *\n * A method appears in `methods` for every layer that has a credential:\n *\n *   - `kind: 'apikey'` from `credentials.json` (injected into env at TUI launch)\n *   - explicit env var (descriptor's `envKey`)\n *   - `kind: 'oauth'` from `credentials.json` (migrated on first read from a\n *     legacy `.credentials.json`, see `readCredentials`), one per stored account\n *\n * The preferred credential lives in the canonical file key and is flagged\n * {@link AuthMethod.active}; the others sit in sibling slots and are reported\n * too, keyed by {@link AuthMethod.key}, so the UI can offer to promote or\n * remove them. Order within `methods` is presentational — active first — not a\n * resolution order, because the active flag answers that directly.\n *\n * Never refreshes tokens or rewrites existing credentials. The one write is\n * the first-read migration of a legacy `.credentials.json` when\n * `credentials.json` does not exist yet (see `readCredentials`).\n *\n * @param dataDir - Directory holding `credentials.json`.\n * @param registry - Provider descriptors keyed by id.\n * @param env - Environment used to look for ambient credentials. Defaults to `process.env`.\n */\nexport function detectAuth(\n  dataDir: string,\n  registry: Readonly<Record<string, ProviderDescriptor>>,\n  env: Record<string, string | undefined> = process.env,\n): ProviderAuth[] {\n  const creds = readCredentials(dataDir)\n\n  return Object.values(registry).map((descriptor) => {\n    const methods: AuthMethod[] = []\n    const stored = storedCredentialsOf(creds, credKeyOf(descriptor))\n    const fileEntry = stored.find(s => s.active)?.credential\n\n    // 1. Stored API key / OAuth accounts, active first. Every slot goes through\n    //    the same description so a parked credential renders identically to the\n    //    preferred one, differing only in `active`.\n    const describeStored = (key: string, entry: ProviderCredential, active: boolean): AuthMethod | undefined => {\n      const id = typeof entry.id === 'string' && entry.id ? { id: entry.id } : {}\n      if (entry.kind === 'apikey' && entry.value)\n        return { source: 'apikey', detail: 'credentials.json', active, key, ...id }\n      if (entry.kind === 'oauth' && entry.access) {\n        const label = oauthAccountLabel(entry)\n        const expiry = typeof entry.expires === 'number'\n          ? `expires ${new Date(entry.expires).toLocaleString()}`\n          : 'credentials.json'\n        return { source: 'oauth', detail: expiry, active, key, label, ...id }\n      }\n      return undefined\n    }\n\n    for (const slot of stored) {\n      const method = describeStored(slot.key, slot.credential, slot.active)\n      if (method)\n        methods.push(method)\n    }\n\n    // 1a. Connections of the integration the provider signs in with. The\n    //     default is active unless a slot of the provider's own already is.\n    if (descriptor.integration) {\n      const ownActive = methods.some(m => m.active)\n      for (const connection of integrationCredentialsOf(creds, descriptor.integration)) {\n        const method = describeStored(connection.key, connection.credential, connection.active && !ownActive)\n        if (!method)\n          continue\n        const { key: _key, ...rest } = method\n        methods.push({ ...rest, label: connection.label, id: connection.account, integration: { id: descriptor.integration, account: connection.account } })\n      }\n    }\n\n    // 1b. customFields-only credential (descriptor has no `envKey` and is\n    //     authenticated entirely by configuration — e.g. the `local` provider,\n    //     where the auth signal is the configured base URL). The credential\n    //     is \"present\" when every required field has a stored value.\n    if (\n      fileEntry?.kind === 'apikey'\n      && !fileEntry.value\n      && descriptor.customFields\n      && descriptor.customFields.length > 0\n    ) {\n      const stored = fileEntry.customFields ?? {}\n      const required = descriptor.customFields.filter(f => f.required)\n      const allRequiredPresent = required.every(\n        f => typeof stored[f.key] === 'string' && (stored[f.key] as string).length > 0,\n      )\n      if (allRequiredPresent) {\n        methods.push({ source: 'apikey', detail: 'credentials.json (configured)', active: true })\n      }\n    }\n\n    // 1c. Env-only custom field configuration. This lets local/OpenAI-compatible\n    // endpoints participate in auth/model detection when configured through\n    // `LOCAL_LLM_BASE_URL` without first writing credentials.json.\n    if (descriptor.customFields && descriptor.customFields.length > 0) {\n      const required = descriptor.customFields.filter(f => f.required)\n      const allRequiredPresent = required.length > 0 && required.every(\n        f => typeof env[f.envVar] === 'string' && (env[f.envVar] as string).length > 0,\n      )\n\n      if (allRequiredPresent) {\n        methods.push({ source: 'env', detail: required.map(f => f.envVar).join(', '), active: false })\n      }\n    }\n\n    // 2. Env var (may be set by `applyApiKeyEnv` from a stored key, or by the\n    //    user's shell. Either way, treated as the same observable signal.)\n    if (descriptor.envKey && env[descriptor.envKey])\n      methods.push({ source: 'env', detail: descriptor.envKey, active: false })\n\n    // Selection identity is the file key for stored credentials and `source`\n    // for everything else. Two API-key rows cannot be a choice the user can\n    // express (there is one API key per provider) — a customFields-configured\n    // credential sitting beside a stored one, or a stale duplicate from an\n    // older build, collapses to the FIRST, which the order above makes the\n    // active one. OAuth accounts are distinct by key and all survive.\n    const unique: AuthMethod[] = []\n    for (const method of methods) {\n      const duplicate = unique.some(seen =>\n        method.source === 'oauth'\n          ? seen.key !== undefined && seen.key === method.key\n          : seen.source === method.source,\n      )\n      if (!duplicate)\n        unique.push(method)\n    }\n\n    const accounts = descriptor.accounts === true ? accountsOf(unique) : []\n    return {\n      key: descriptor.key,\n      label: descriptor.label,\n      available: unique.length > 0,\n      methods: unique,\n      ...(accounts.length >= 2 ? { accounts } : {}),\n      ...(descriptor.envKey ? { envKey: descriptor.envKey } : {}),\n    }\n  })\n}\n\n/**\n * The id of the account a provider's unpinned sessions run on: its active\n * stored credential, or its integration's default connection. `undefined`\n * when it has no stored account (env only, or signed out).\n *\n * @param dataDir - Directory holding `credentials.json`.\n * @param descriptor - The provider.\n * @param env - Environment used to look for ambient credentials. Defaults to `process.env`.\n */\nexport function activeAccountOf(dataDir: string, descriptor: ProviderDescriptor, env: Record<string, string | undefined> = process.env): string | undefined {\n  const [auth] = detectAuth(dataDir, { [descriptor.key]: descriptor }, env)\n  return auth?.methods.find(method => method.active === true && method.id)?.id\n}\n","/**\n * Shared glue for the CLI entrypoints (`start.ts` — human renderer,\n * `headless-cli.ts` — machine contract). Both build an execution context,\n * resolve a session (memory or sqlite), and parse `--mcp` config the same way;\n * this module is the single source of truth for that wiring so the two CLIs\n * stay in lockstep without duplicating it.\n */\n\nimport type { ExecutionContext } from './contexts'\nimport type { DurabilityMode } from './durable/setting'\nimport type { DurableOptions, DurableRuntime } from './durable/types'\nimport type { Session } from './session'\nimport { createProcessContext, createSandboxContext } from './contexts'\nimport { createDaytonaProvider } from './contexts/daytona'\nimport { createDockerContext, hostWorkspaceMounts } from './contexts/docker'\nimport { createE2BProvider } from './contexts/e2b'\nimport { LEASE_STALE_MS } from './durable/lease'\nimport { DEFAULT_DURABILITY } from './durable/setting'\nimport { sqliteRuntimeForStore } from './durable/sqlite-runtime'\nimport { createMemoryStore, createSession, loadSession } from './session'\n\nexport { parseMcpConfig } from './start/shared-options'\n\n/**\n * Build the execution context for a CLI run: `process` (default), `docker`,\n * `e2b`, or `daytona`.\n *\n * The `e2b` backend reads its `E2B_API_KEY` / `E2B_DOMAIN` / `E2B_TEMPLATE`\n * from the environment (point `E2B_DOMAIN` at a self-hosted cluster, and set\n * `E2B_TEMPLATE` to a template that exists there — the default `base` does\n * not); `--cwd` becomes the sandbox working directory.\n *\n * The Daytona backend reads `DAYTONA_API_KEY` / `DAYTONA_API_URL` /\n * `DAYTONA_TARGET` from the environment. `--cwd` becomes the sandbox working\n * directory.\n *\n * Docker: when `--cwd` is an existing host directory, its git worktree (and\n * the git common dir, for linked worktrees) is bind-mounted at the same\n * absolute path (git hooks/config read-only); otherwise, or when that tree\n * is `/`, `$HOME`, or an ancestor of it, `--cwd` is a container-only path.\n *\n * `env` (from `--env` / `--pass-env`) is forwarded to whichever context is\n * selected: baked into remote sandboxes at create time, set on the Docker\n * container, or merged into the in-process command environment.\n *\n * `pregame` (from `--pregame`) is supported by the remote sandbox providers:\n * a setup script uploaded and run in the sandbox once it's ready, before\n * prompting begins.\n *\n * `sandboxId` (from `--sandbox`) attaches to a pre-existing remote sandbox\n * instead of creating a fresh one.\n */\nexport function createCliExecution(type: string, opts: { image?: string, cwd?: string, env?: Record<string, string>, pregame?: { name: string, content: string }, sandboxId?: string, sandboxOnDestroy?: 'kill' | 'pause' | 'leave' }): ExecutionContext {\n  switch (type) {\n    case 'docker': {\n      // An existing host dir is bind-mounted at the same path so the agent\n      // works on the real checkout; a container-only path mounts nothing.\n      const mounts = opts.cwd ? hostWorkspaceMounts(opts.cwd) : []\n      return createDockerContext({ image: opts.image, cwd: opts.cwd, env: opts.env, ...(mounts.length > 0 ? { mounts } : {}) })\n    }\n    case 'e2b':\n      return createSandboxContext(createE2BProvider({ cwd: opts.cwd, env: opts.env, ...(opts.pregame ? { pregame: opts.pregame } : {}), ...(opts.sandboxId ? { sandboxId: opts.sandboxId } : {}), ...(opts.sandboxOnDestroy ? { onDestroy: opts.sandboxOnDestroy } : {}) }))\n    case 'daytona':\n      return createSandboxContext(createDaytonaProvider({ cwd: opts.cwd, env: opts.env, ...(opts.pregame ? { pregame: opts.pregame } : {}), ...(opts.sandboxId ? { sandboxId: opts.sandboxId } : {}), ...(opts.sandboxOnDestroy ? { onDestroy: opts.sandboxOnDestroy } : {}) }))\n    case 'process':\n    default:\n      return createProcessContext({ cwd: opts.cwd, env: opts.env })\n  }\n}\n\n/**\n * Contexts whose filesystem is a remote sandbox: host paths don't exist\n * there, so host-derived cwds must not be forwarded.\n */\nexport function isRemoteSandboxContext(type: string): boolean {\n  return type === 'e2b' || type === 'daytona'\n}\n\n/** The session of a CLI run, with what durability gives it. */\nexport interface CliSession {\n  session: Session\n  /**\n   * `createAgent`'s `durable`: the SQLite runtime the session is stored on,\n   * unless `durability` is `off` or the session lives in memory. `on`\n   * resumes an interrupted run before a run; `resume-ask` heals it.\n   */\n  durable?: DurableOptions\n  /** A checkpoint run a dead process left in the session, to continue (`agent.resume`) before the prompt. */\n  resumeRunId?: string\n}\n\n/**\n * Resolve the session for a CLI run.\n * - `sessionDb` set → sqlite-backed; resume `sessionId` if it exists, else\n *   create it (or a fresh id when `sessionId` is omitted).\n * - `sessionDb` absent → in-memory store (no durability).\n *\n * Fresh sessions are saved immediately so the store has a header row from\n * the start — incremental `appendTurns` against a header-less sqlite store\n * would otherwise be silent no-ops, and an error / Ctrl+C before the final\n * save would lose the whole run.\n *\n * Durability (`Settings.durability`, default `resume-ask`): unless `off`,\n * runs keep checkpoints on the session's SQLite file. An existing session\n * whose last run a dead process left is resumed (`on`), or resumed when\n * `ask` says so (`resume-ask`; without `ask`, nobody to ask, it is\n * not); otherwise its interrupted tool calls are healed\n * (`healInterruptedToolCalls`).\n * @param sessionDb - SQLite sessions file.\n * @param sessionId - Session to resume or create.\n * @param options - Durability of the run, and how to ask before resuming.\n * @param options.durability - `on`, `resume-ask` or `off`.\n * @param options.ask - Ask the user whether to resume an interrupted run.\n */\nexport async function createCliSession(sessionDb?: string, sessionId?: string, options: { durability?: DurabilityMode, ask?: () => Promise<boolean> } = {}): Promise<CliSession> {\n  if (sessionDb) {\n    const { createSqliteStore } = await import('./session/sqlite')\n    const store = createSqliteStore({ path: sessionDb })\n    const durability = options.durability ?? DEFAULT_DURABILITY\n    const durable = durability === 'off' ? undefined : sqliteRuntimeForStore(store)\n    const withDurable = (session: Session, resumeRunId?: string): CliSession => ({\n      session,\n      ...(durable ? { durable: { runtime: durable, onInterrupted: durability === 'on' ? 'resume' : 'heal' } } : {}),\n      ...(resumeRunId !== undefined ? { resumeRunId } : {}),\n    })\n    if (sessionId) {\n      const existing = await loadSession(store, sessionId)\n      if (existing) {\n        const resumeRunId = durable ? await interruptedRun(durable, sessionId, durability, options.ask) : undefined\n        // No run claim on this path: resolving the session IS the run start,\n        // so heal here (see `healInterruptedToolCalls`). A resumed run\n        // dispatches its pending calls itself.\n        if (resumeRunId === undefined)\n          await existing.healInterruptedToolCalls()\n        return withDurable(existing, resumeRunId)\n      }\n      const session = await createSession({ store, id: sessionId })\n      await session.save()\n      return withDurable(session)\n    }\n    const session = await createSession({ store })\n    await session.save()\n    return withDurable(session)\n  }\n  return { session: await createSession({ store: createMemoryStore() }) }\n}\n\n/** The run of `sessionId` a dead process left, when the durability says to resume it. */\nasync function interruptedRun(durable: DurableRuntime, sessionId: string, durability: DurabilityMode, ask: (() => Promise<boolean>) | undefined): Promise<string | undefined> {\n  const pending = (await durable.lease?.resumable({ staleAt: Date.now() - LEASE_STALE_MS }) ?? []).filter(run => run.sessionId === sessionId).at(-1)\n  if (!pending)\n    return undefined\n  if (durability === 'on' || (durability === 'resume-ask' && await ask?.()))\n    return pending.runId\n  return undefined\n}\n\n/**\n * Install SIGINT/SIGTERM handlers for a CLI run. The first signal aborts the\n * returned `AbortSignal` so the running agent can unwind cleanly (persist the\n * session, destroy execution contexts) and the process exits through the\n * normal path — which is what fires the `process.on('exit')` orphan reaper\n * for detached background process groups. A second signal force-exits\n * immediately (the synchronous 'exit' reaper still runs, but async cleanup\n * such as Docker container teardown is skipped).\n */\nexport function installCliSignalHandlers(): AbortSignal {\n  const controller = new AbortController()\n  const onSignal = (name: NodeJS.Signals): void => {\n    if (controller.signal.aborted)\n      process.exit(name === 'SIGTERM' ? 143 : 130) // 128 + signal number\n    controller.abort(new Error(`Received ${name}, stopping the run`))\n  }\n  process.on('SIGINT', () => onSignal('SIGINT'))\n  process.on('SIGTERM', () => onSignal('SIGTERM'))\n  return controller.signal\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkCA,SAAgB,yBAAyB,KAAsB,eAAwD;CACrH,MAAM,UAAU,yBAAyB,aAAa;CACtD,MAAM,QAAQ,IAAI;CAElB,QADe,QAAQ,YAAY,eAAe,KAAK,KAAK,CAAC,IAAI,CAAC,EAAA,CACpD,KAAK,EAAE,YAAY,YAAY,gBAAgB,MAAM;EACjE,MAAM,QAAQ,WAAW,SAAS,WAAW;EAC7C,MAAM,aAAiC,WAAW,SAAS,UACvD;GACE,GAAG,WAAW;GACd,MAAM;GACN,QAAQ,WAAW;GACnB,GAAI,eAAe,EAAE,SAAS,aAAa,IAAI,CAAC;GAChD,GAAI,WAAW,cAAc,KAAA,IAAY,EAAE,SAAS,WAAW,UAAU,IAAI,CAAC;GAC9E;GACA,IAAI,WAAW;EACjB,IACA;GAAE,MAAM;GAAU,OAAO,WAAW,SAAS,WAAW,WAAW,MAAM,WAAW;GAAO,IAAI,WAAW;EAAQ;EACtH,OAAO;GAAE,KAAK,GAAG,QAAQ,GAAG,WAAW;GAAW,YAAY;GAAY,QAAQ,MAAM;GAAG,SAAS,WAAW;GAAS;EAAM;CAChI,CAAC;AACH;;;;;;;AAQA,SAAgB,2BAA2B,KAAsB;CAC/D,OAAO,IAAI,WAAW,yBAAyB,EAAE,CAAC;AACpD;;;;AC4CA,SAAS,WAAW,SAAmD;CACrE,MAAM,MAAyB,CAAC;CAChC,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,CAAC,OAAO,MAAO,OAAO,WAAW,WAAW,OAAO,WAAW,UAChE;EACF,IAAI,KAAK;GACP,IAAI,OAAO;GACX,OAAO,OAAO,WAAW,UAAW,OAAO,SAAS,YAAa;GACjE,MAAM,OAAO;GACb,QAAQ,OAAO,WAAW;EAC5B,CAAC;CACH;CACA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAgB,WACd,SACA,UACA,MAA0C,QAAQ,KAClC;CAChB,MAAM,QAAQ,gBAAgB,OAAO;CAErC,OAAO,OAAO,OAAO,QAAQ,CAAC,CAAC,KAAK,eAAe;EACjD,MAAM,UAAwB,CAAC;EAC/B,MAAM,SAAS,oBAAoB,OAAO,UAAU,UAAU,CAAC;EAC/D,MAAM,YAAY,OAAO,MAAK,MAAK,EAAE,MAAM,CAAC,EAAE;EAK9C,MAAM,kBAAkB,KAAa,OAA2B,WAA4C;GAC1G,MAAM,KAAK,OAAO,MAAM,OAAO,YAAY,MAAM,KAAK,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC;GAC1E,IAAI,MAAM,SAAS,YAAY,MAAM,OACnC,OAAO;IAAE,QAAQ;IAAU,QAAQ;IAAoB;IAAQ;IAAK,GAAG;GAAG;GAC5E,IAAI,MAAM,SAAS,WAAW,MAAM,QAAQ;IAC1C,MAAM,QAAQ,kBAAkB,KAAK;IAIrC,OAAO;KAAE,QAAQ;KAAS,QAHX,OAAO,MAAM,YAAY,WACpC,WAAW,IAAI,KAAK,MAAM,OAAO,CAAC,CAAC,eAAe,MAClD;KACsC;KAAQ;KAAK;KAAO,GAAG;IAAG;GACtE;EAEF;EAEA,KAAK,MAAM,QAAQ,QAAQ;GACzB,MAAM,SAAS,eAAe,KAAK,KAAK,KAAK,YAAY,KAAK,MAAM;GACpE,IAAI,QACF,QAAQ,KAAK,MAAM;EACvB;EAIA,IAAI,WAAW,aAAa;GAC1B,MAAM,YAAY,QAAQ,MAAK,MAAK,EAAE,MAAM;GAC5C,KAAK,MAAM,cAAc,yBAAyB,OAAO,WAAW,WAAW,GAAG;IAChF,MAAM,SAAS,eAAe,WAAW,KAAK,WAAW,YAAY,WAAW,UAAU,CAAC,SAAS;IACpG,IAAI,CAAC,QACH;IACF,MAAM,EAAE,KAAK,MAAM,GAAG,SAAS;IAC/B,QAAQ,KAAK;KAAE,GAAG;KAAM,OAAO,WAAW;KAAO,IAAI,WAAW;KAAS,aAAa;MAAE,IAAI,WAAW;MAAa,SAAS,WAAW;KAAQ;IAAE,CAAC;GACrJ;EACF;EAMA,IACE,WAAW,SAAS,YACjB,CAAC,UAAU,SACX,WAAW,gBACX,WAAW,aAAa,SAAS,GACpC;GACA,MAAM,SAAS,UAAU,gBAAgB,CAAC;GAK1C,IAJiB,WAAW,aAAa,QAAO,MAAK,EAAE,QACrB,CAAC,CAAC,OAClC,MAAK,OAAO,OAAO,EAAE,SAAS,YAAa,OAAO,EAAE,IAAI,CAAY,SAAS,CAE1D,GACnB,QAAQ,KAAK;IAAE,QAAQ;IAAU,QAAQ;IAAiC,QAAQ;GAAK,CAAC;EAE5F;EAKA,IAAI,WAAW,gBAAgB,WAAW,aAAa,SAAS,GAAG;GACjE,MAAM,WAAW,WAAW,aAAa,QAAO,MAAK,EAAE,QAAQ;GAK/D,IAJ2B,SAAS,SAAS,KAAK,SAAS,OACzD,MAAK,OAAO,IAAI,EAAE,YAAY,YAAa,IAAI,EAAE,OAAO,CAAY,SAAS,CAC/E,GAGE,QAAQ,KAAK;IAAE,QAAQ;IAAO,QAAQ,SAAS,KAAI,MAAK,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI;IAAG,QAAQ;GAAM,CAAC;EAEjG;EAIA,IAAI,WAAW,UAAU,IAAI,WAAW,SACtC,QAAQ,KAAK;GAAE,QAAQ;GAAO,QAAQ,WAAW;GAAQ,QAAQ;EAAM,CAAC;EAQ1E,MAAM,SAAuB,CAAC;EAC9B,KAAK,MAAM,UAAU,SAMnB,IAAI,CALc,OAAO,MAAK,SAC5B,OAAO,WAAW,UACd,KAAK,QAAQ,KAAA,KAAa,KAAK,QAAQ,OAAO,MAC9C,KAAK,WAAW,OAAO,MAEhB,GACX,OAAO,KAAK,MAAM;EAGtB,MAAM,WAAW,WAAW,aAAa,OAAO,WAAW,MAAM,IAAI,CAAC;EACtE,OAAO;GACL,KAAK,WAAW;GAChB,OAAO,WAAW;GAClB,WAAW,OAAO,SAAS;GAC3B,SAAS;GACT,GAAI,SAAS,UAAU,IAAI,EAAE,SAAS,IAAI,CAAC;GAC3C,GAAI,WAAW,SAAS,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;EAC3D;CACF,CAAC;AACH;;;;;;;;;;AAWA,SAAgB,gBAAgB,SAAiB,YAAgC,MAA0C,QAAQ,KAAyB;CAC1J,MAAM,CAAC,QAAQ,WAAW,SAAS,GAAG,WAAW,MAAM,WAAW,GAAG,GAAG;CACxE,OAAO,MAAM,QAAQ,MAAK,WAAU,OAAO,WAAW,QAAQ,OAAO,EAAE,CAAC,EAAE;AAC5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC9NA,SAAgB,mBAAmB,MAAc,MAAwM;CACvP,QAAQ,MAAR;EACE,KAAK,UAAU;GAGb,MAAM,SAAS,KAAK,MAAM,oBAAoB,KAAK,GAAG,IAAI,CAAC;GAC3D,OAAO,oBAAoB;IAAE,OAAO,KAAK;IAAO,KAAK,KAAK;IAAK,KAAK,KAAK;IAAK,GAAI,OAAO,SAAS,IAAI,EAAE,OAAO,IAAI,CAAC;GAAG,CAAC;EAC1H;EACA,KAAK,OACH,OAAO,qBAAqB,kBAAkB;GAAE,KAAK,KAAK;GAAK,KAAK,KAAK;GAAK,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;GAAI,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;GAAI,GAAI,KAAK,mBAAmB,EAAE,WAAW,KAAK,iBAAiB,IAAI,CAAC;EAAG,CAAC,CAAC;EACvQ,KAAK,WACH,OAAO,qBAAqB,sBAAsB;GAAE,KAAK,KAAK;GAAK,KAAK,KAAK;GAAK,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;GAAI,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;GAAI,GAAI,KAAK,mBAAmB,EAAE,WAAW,KAAK,iBAAiB,IAAI,CAAC;EAAG,CAAC,CAAC;EAE3Q,SACE,OAAO,qBAAqB;GAAE,KAAK,KAAK;GAAK,KAAK,KAAK;EAAI,CAAC;CAChE;AACF;;;;;AAMA,SAAgB,uBAAuB,MAAuB;CAC5D,OAAO,SAAS,SAAS,SAAS;AACpC"}

package/dist/{credentials-Bqg-qNBM.js → credentials-D71duF64.js}

@@ -12,7 +12,7 @@ import { cerebras } from "./providers/cerebras.js";
 import { t as generatePkce } from "./pkce-CNABhw6J.js";
 import { n as createCursorOAuthProvider } from "./cursor-ntwMDfyD.js";
 import { n as zai, r as mistral } from "./providers-CShv3UgY.js";
-import { i as google, l as GOOGLE_IMAGE_MODELS, n as GOOGLE_EXTRA_MODELS, o as googleVertex, t as GOOGLE_DEFAULT_MODEL } from "./google-B-Dhmzzf.js";
+import { i as google, l as GOOGLE_IMAGE_MODELS, n as GOOGLE_EXTRA_MODELS, o as googleVertex, t as GOOGLE_DEFAULT_MODEL } from "./google-BtMW9KzL.js";
 import { a as OPENAI_DECISION_MODELS, o as OPENAI_IMAGE_MODELS, r as openai } from "./openai-CQw3EVu6.js";
 import { a as openrouterImageModels, i as OPENROUTER_DECISION_MODELS, r as openrouter, t as OPENROUTER_DEFAULT_MODEL } from "./openrouter-CgBpQR6G.js";
 import { n as XAI_IMAGE_MODELS, t as xai } from "./xai-BDoEXsjQ.js";
@@ -2393,4 +2393,4 @@ function configureProviderCredential(dataDir, descriptor, input) {
 //#endregion
 export { getContextWindow as A, restoreModelOptions as B, writeCredentials as C, credKeyOf as D, cerebrasDescriptor as E, modelSupportsReasoning as F, modelsForDescriptor as I, openaiDescriptor as L, localDescriptor as M, modelLabel as N, defaultModelOf as O, modelOptionsFor as P, openrouterDescriptor as R, writeCredentialEntry as S, anthropicDescriptor as T, setCredentialLabel as _, ensureCredentialIds as a, storedCredentialById as b, providerFactoryOptions as c, readCredentials as d, readProviderCredential as f, removeStoredCredential as g, removeProviderCredential as h, credentialsPath as i, getModelInfo as j, enabledModelOptions as k, providerFieldViews as l, readProviderCredentials as m, configureProviderCredential as n, isSecretCustomField as o, readProviderCredentialPair as p, configuredProviderFields as r, onProviderAccountsChange as s, applyApiKeyEnv as t, readCredentialEntry as u, setPreferredCredential as v, BUILTIN_PROVIDERS as w, storedCredentialsOf as x, setProviderCredential as y, piIdOf as z };
 
-//# sourceMappingURL=credentials-Bqg-qNBM.js.map
+//# sourceMappingURL=credentials-D71duF64.js.map