DEFAULT_OAUTH_WARN_MS,

formatRemainingShort,

} from "../../agents/auth-health.js";

import { resolveAuthProfileOrder } from "../../agents/auth-profiles/order.js";

import { resolveAuthStorePathForDisplay } from "../../agents/auth-profiles/paths.js";

import { ensureAuthProfileStoreWithoutExternalProfiles as ensureAuthProfileStore } from "../../agents/auth-profiles/store.js";

import type { AuthProfileCredential } from "../../agents/auth-profiles/types.js";

resolveProviderEnvApiKeyCandidates,

resolveProviderEnvAuthEvidence,

} from "../../agents/model-auth-env-vars.js";

import { resolveEnvApiKey } from "../../agents/model-auth.js";

import { resolveEnvApiKey, resolveUsableCustomProviderApiKey } from "../../agents/model-auth.js";

import {

buildModelAliasIndex,

isCliProvider,

modelKey,

normalizeProviderId,

parseModelRef,

resolveConfiguredModelRef,

resolveModelRefFromString,

} from "../../agents/model-selection.js";

import {

OPENAI_CODEX_PROVIDER_ID,

openAIProviderUsesCodexRuntimeByDefault,

} from "../../agents/openai-codex-routing.js";

import { resolveProviderIdForAuth } from "../../agents/provider-auth-aliases.js";

import { resolveDefaultAgentWorkspaceDir } from "../../agents/workspace.js";

import { createConfigIO } from "../../config/config.js";

import {

.map((p) => (typeof p === "string" ? normalizeProviderId(p) : ""))

.filter(Boolean),

);

const providersFromModels = new Set<string>();

const providerUses: Array<{ provider: string; allowCodexRuntimeFallback: boolean }> = [];

const addProviderUse = (raw: string | undefined, allowCodexRuntimeFallback: boolean) => {

const aliasIndex = buildModelAliasIndex({

cfg,

defaultProvider: DEFAULT_PROVIDER,

...DISPLAY_MODEL_PARSE_OPTIONS,

});

const resolveStatusModelRef = (raw: string | undefined) => {

const modelRef = raw?.trim();

if (!modelRef) {

return;

return undefined;

}

const parsed = parseModelRef(modelRef, DEFAULT_PROVIDER, DISPLAY_MODEL_PARSE_OPTIONS);

if (parsed?.provider) {

return resolveModelRefFromString({

cfg,

raw: modelRef,

defaultProvider: DEFAULT_PROVIDER,

aliasIndex,

...DISPLAY_MODEL_PARSE_OPTIONS,

})?.ref;

};

const providersFromModels = new Set<string>();

const providerUses: Array<{ provider: string; allowCodexRuntimeFallback: boolean }> = [];

const addProviderUse = (raw: string | undefined, allowCodexRuntimeFallback: boolean) => {

const ref = resolveStatusModelRef(raw);

if (ref?.provider) {

providerUses.push({

provider: normalizeProviderId(parsed.provider),

provider: normalizeProviderId(ref.provider),

allowCodexRuntimeFallback,

});

}

};

for (const raw of [defaultLabel, ...fallbacks, imageModel, ...imageFallbacks, ...allowed]) {

const parsed = parseModelRef(raw ?? "", DEFAULT_PROVIDER, DISPLAY_MODEL_PARSE_OPTIONS);

if (parsed?.provider) {

providersFromModels.add(normalizeProviderId(parsed.provider));

const ref = resolveStatusModelRef(raw);

if (ref?.provider) {

providersFromModels.add(normalizeProviderId(ref.provider));

}

}

for (const raw of [defaultLabel, ...fallbacks]) {

providerConfig: resolveProviderConfigForStatus(cfg, normalized),

},

});

if (!resolved) {

continue;

}

syntheticAuthByProvider.set(normalized, {

value: "plugin-owned",

source: resolved?.source ?? "plugin synthetic auth",

credential: resolved?.apiKey,

mode: resolved?.mode,

expiresAt: resolved?.expiresAt,

source: resolved.source,

credential: resolved.apiKey,

mode: resolved.mode,

expiresAt: resolved.expiresAt,

});

}

const runtimeCredentialsByProvider = new Map(

return hasAny;

});

const providerAuthMap = new Map(providerAuth.map((entry) => [entry.provider, entry]));

const resolveProviderAuthHealthId = (provider: string): string =>

resolveProviderIdForAuth(provider, { config: cfg, workspaceDir });

const hasUsableNonProfileAuth = (provider: string): boolean => {

const authProvider = resolveProviderAuthHealthId(provider);

for (const candidate of new Set([provider, authProvider])) {

const auth = providerAuthMap.get(candidate);

if (

auth?.env ||

auth?.syntheticAuth ||

syntheticAuthByProvider.has(candidate) ||

resolveUsableCustomProviderApiKey({ cfg, provider: candidate })

) {

return true;

}

}

return false;

};

const hasUsableProviderAuth = (provider: string): boolean => {

const authProvider = resolveProviderAuthHealthId(provider);

for (const candidate of new Set([provider, authProvider])) {

const orderedProfiles = resolveAuthProfileOrder({

cfg,

store,

provider: candidate,

});

if (orderedProfiles.length > 0 || hasUsableNonProfileAuth(candidate)) {

return true;

}

}

return false;

};

const hasUsableAuthForProviderInUse = (

provider: string,

options: { allowCodexRuntimeFallback: boolean },

): boolean => {

if (providerAuthMap.has(provider) || syntheticAuthByProvider.has(provider)) {

if (hasUsableProviderAuth(provider)) {

return true;

}

if (!options.allowCodexRuntimeFallback) {

return false;

}

return (

openAIProviderUsesCodexRuntimeByDefault({ provider, config: cfg }) &&

providerAuthMap.has(OPENAI_CODEX_PROVIDER_ID)

hasUsableProviderAuth(OPENAI_CODEX_PROVIDER_ID)

);

};

const missingProvidersInUse = Array.from(

throw new Error("--probe-max-tokens must be > 0.");

}

const aliasIndex = buildModelAliasIndex({

cfg,

defaultProvider: DEFAULT_PROVIDER,

...DISPLAY_MODEL_PARSE_OPTIONS,

});

const rawCandidates = [

rawModel || resolvedLabel,

...fallbacks,

})();

const checkStatus = (() => {

const providersInUse = new Set<string>();

for (const usage of providerUses) {

providersInUse.add(usage.provider);

providersInUse.add(resolveProviderAuthHealthId(usage.provider));

if (

usage.allowCodexRuntimeFallback &&

openAIProviderUsesCodexRuntimeByDefault({ provider: usage.provider, config: cfg }) &&

providerAuthMap.has(OPENAI_CODEX_PROVIDER_ID)

) {

providersInUse.add(OPENAI_CODEX_PROVIDER_ID);

}

}

const hasExpiredOrMissing =

oauthProfiles.some((profile) => ["expired", "missing"].includes(profile.status)) ||

missingProvidersInUse.length > 0;

const hasExpiring = oauthProfiles.some((profile) => profile.status === "expiring");

authHealth.providers.some(

(provider) =>

providersInUse.has(provider.provider) &&

["expired", "missing"].includes(provider.status) &&

!hasUsableNonProfileAuth(provider.provider),

) || missingProvidersInUse.length > 0;

const hasExpiring = authHealth.providers.some(

(provider) =>

providersInUse.has(provider.provider) &&

provider.status === "expiring" &&

!hasUsableNonProfileAuth(provider.provider),

);

if (hasExpiredOrMissing) {

return 1;

}