Module providers 

Static provider registry — Rust equivalent of frontend/app/view/agent/providers/index.ts.

All string data is &'static str / &'static [&'static str] so lookups are zero-allocation. The registry is initialised once via LazyLock and then read-only for the lifetime of the process.

Structs

AppServerConfig

Optional App Server capability advertised by a provider. Presence does not select the controller: controller_type remains the rollout switch.

InstructionDirScan

A directory a provider reads instruction files out of.

ProviderConfig

All configuration needed to launch, authenticate, and stream output from a provider CLI.

Enums

AppServerKind

Protocol spoken by a provider-neutral App Server controller.

ControllerType

How the provider process is managed.

Constants

CLAUDE_MD_ISOLATION_PLACEHOLDER 🔒

Placeholder written by seed_claude_md_placeholder_if_missing — explains itself so an operator who opens the file isn’t confused by an unexplained empty one.

CLAUDE_TRANSCRIPT_RETENTION_DAYS

Days Claude Code keeps session transcripts in an AgentMux-owned config dir (SPEC_DURABLE_CONVERSATION_MEMORY_2026_09_23.md §4.1).

Statics

ALIASES 🔒

ANTIGRAVITY 🔒

CLAUDE 🔒

CODEX 🔒

COPILOT 🔒

GEMINI 🔒

KIMI 🔒

MUX_CODE 🔒

OPENCLAW 🔒

PI 🔒

QWEN 🔒

REGISTRY 🔒

Functions

all_providers

Every registered provider, for callers that must act on all of them rather than look one up by id — e.g. a migration backfilling conversation history for every provider that has a linkable native history directory (ProviderConfig::history_native_subdir), so a future provider gains that behavior automatically instead of needing a follow-up patch to an id list maintained elsewhere.

antigravity_install_paths 🔒

%LOCALAPPDATA%\agy\bin\agy.exe on Windows and ~/.local/bin/agy elsewhere: the default TARGET_DIR of Google’s installers, https://antigravity.google/cli/install.ps1 and the .sh one beside it.

default_auth_dir

provider’s DEFAULT auth/config dir: ~/.agentmux/shared/providers/<auth_dir_name>/ — account-wide and version/channel-independent, so one login is shared by every instance (the structural fix for the per-channel validate-spin regression). A per-account auth dir (identity_handlers) still wins for explicit multi-account. Shared by agent open and provider.ensureauthdir.

default_model_for

The model a freshly opened pane of this provider starts on, or None for a provider whose model the runtime menu does not wire (it passes no --model).

get_provider

Look up a provider by canonical ID or alias.

is_known_startup_instructions_filename

Whether path matches ANY registered provider’s startup_instructions_filename — used by the “click Launch” RPC write path (editor_handlers.rs’s WriteAgentConfig handler), which receives an already-built file list from the frontend with no accompanying provider ID, so it can’t otherwise tell “this is the startup instructions file” from “this is some other config file” without either re-deriving the mapping itself (drift risk) or checking membership here (single source of truth). See docs/specs/SPEC_PROVIDER_AWARE_STARTUP_INSTRUCTIONS_2026_08_24.md §3.

is_pi_acp

Whether cmd (a path or bare name) is the pi-acp adapter.

is_provider_ambient_home_dir

True when dir resolves to provider’s literal ambient home directory (e.g. ~/.claude for Claude Code) rather than an AgentMux-isolated dir. Used to block identity bindings/spawns from ever pointing a spawned agent at the operator’s own global CLI login — a real, currently-live instance of exactly this was found in this repo’s own data (an account’s secret_ref.dir set to the literal ambient path — see docs/status/STATUS_IDENTITY_ISOLATION_GATE_NOT_ENFORCING_2026_08_20.md §8), which nothing in the codebase previously validated against. See docs/specs/SPEC_BLOCK_AMBIENT_HOME_DIR_IDENTITY_BINDING_2026_08_25.md.

known_install_paths

Where a PATH-only provider’s own installer puts its CLI, for the case where that folder is not on this process’s PATH yet. Antigravity’s installer adds its folder to the user’s PATH, but an AgentMux that is already running keeps the PATH it started with, so without this the CLI would read as missing until AgentMux restarts.

normalize_path_lexically 🔒

Lexically normalizes a path with NO filesystem access (unlike canonicalize, safe to call on a path that doesn’t exist). Collapses . and .. components (codex P1, PR #2802: without this, a not-yet- created dir like $HOME/.claude/. compared unequal to $HOME/.claude under plain string comparison, bypassing the guard entirely on a fresh machine — a .. segment is normalized the same way for the same reason). Never pops past a root/prefix/leading .. — a leading .. with nothing to cancel stays literal, standard lexical-normalization semantics.

paths_resolve_to_same_dir 🔒

The actual comparison, split out with the reference side pre-resolved (not calling get_home_dir() internally) so it’s directly testable against a tempdir instead of the real $HOME/%USERPROFILE% — same “inject the path, don’t resolve it internally” pattern read_claude_global_config already uses (agent_handlers/bundle.rs).

pi_beside_pi_acp

The pi installed next to cmd when cmd is pi-acp, for PI_ACP_PI_COMMAND (blockcontroller/acp.rs) and the auth check (run_auth_check). Without it pi-acp runs whatever pi is on PATH, often none (the managed install’s .bin isn’t on PATH) or an older one. SPEC_PI_HARNESS_VIA_PI_ACP_2026_10_06.md.

prepare_provider_auth_dir

Prepare an isolated provider auth/config directory for use as CLAUDE_CONFIG_DIR (or a provider’s equivalent): create it, then apply every isolation guarantee that directory needs before a CLI is pointed at it.

resolve_provider_alias

Resolve a provider alias to its canonical ID.

seed_claude_md_placeholder_if_missing

Seeds an empty placeholder CLAUDE.md into an isolated Claude Code CLAUDE_CONFIG_DIR the first time it’s used, so Claude Code CLI’s own user-level CLAUDE.md discovery always finds something there instead of silently falling through to the operator’s real $HOME/.claude/CLAUDE.md. CLAUDE_CONFIG_DIR relocates credential/ session/project storage but AgentMux never wrote a CLAUDE.md into the relocated dir — verified live on a real machine: 18+ isolated claude config dirs, none with a CLAUDE.md, and a session whose CLAUDE_CONFIG_DIR was a genuinely separate (non-ambient) dir still received the real host file’s contents. See docs/specs/SPEC_ISOLATE_HOST_CLAUDE_MD_2026_08_31.md.

seed_transcript_retention_if_missing

Seeds cleanupPeriodDays into an isolated Claude Code config dir’s settings.json when it isn’t set. Claude Code’s default is 30 days, and its startup sweep deletes transcripts under <config_dir>/projects, which AgentMux junctions to the account’s shared history — so any channel that launched an agent without this setting deleted every channel’s month-old conversations, leaving --resume nothing to find.