registry / @su-record/vibe / 3.0.0

@su-record/vibe@3.0.0

AI Coding Framework for Claude Code — 10+ agents, 59 skills, multi-LLM orchestration

AI Security Review

scanned 21d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The risky primitives are aligned with an AI coding framework that installs local skills, agents, hooks, and provider integrations.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install postinstall or user-invoked vibe CLI setup/update commands

Impact

Writes package-managed config/assets and optional Claude/Codex/Cursor/Gemini-related files; no confirmed exfiltration, persistence malware, or destructive behavior

Mechanism

local installer and configuration management for bundled AI-agent assets

Rationale

Static source inspection shows install-time and runtime setup code that writes local AI-tooling assets and hook scripts, but the behavior is visible, package-aligned, and lacks concrete credential harvesting or exfiltration. Scanner findings are explained by a CLI framework that manages agent configuration and bundled hooks.

Evidence

package.jsondist/cli/postinstall.jsdist/cli/postinstall/main.jsdist/cli/setup/GlobalInstaller.jshooks/scripts/context-save.jsdist/infra/lib/llm-availability.jsdist/cli/postinstall/index.jsdist/cli/postinstall/fs-utils.jsdist/cli/postinstall/global-config.js

Network endpoints4

github.com/su-record/vibe.git

github.com/su-record/vibe#readme

console.anthropic.com/settings/keys

z.ai

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.

Evidence for block

Evidence against

package.json postinstall imports dist/cli/postinstall/main.js, which implements setup behavior rather than obfuscated payload execution.
dist/cli/postinstall/* is transparent installer code for agent/skill/rule files; no hidden download or credential exfiltration found in reviewed install entrypoints.
hooks/scripts/context-save.js reads git/spec metadata and calls bundled memory autoSaveContext using local package file URLs from hooks/scripts/utils.js.
dist/cli/setup/GlobalInstaller.js installs/copies @su-record/vibe into a global config dir and copies bundled hook scripts as part of explicit CLI setup/update behavior.
dist/infra/lib/llm-availability.js only checks tool/config presence and env key existence, not secret values or outbound sends.
Network/API URLs in CLI/help/config code are package-aligned provider endpoints for Anthropic, Z.ai, Figma, Slack, Telegram, GitHub, and npm install fallback.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

13 flagged

package.jsonView file

Lines 15-55json

15 "./memory": {

16 "types": "./dist/infra/lib/memory/index.d.ts",

17 "default": "./dist/infra/lib/memory/index.js"

18 }

19 },

20 "bin": {

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/lib/llm-availability.jsView file

6*/ L7: import { execSync } from 'child_process'; L8: import path from 'path';

High

Child Process

Package source references child process execution.

dist/infra/lib/llm-availability.jsView on unpkg · L6

Findings

2 Critical5 High8 Medium6 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltahooks/scripts/context-save.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/infra/lib/llm-availability.js

HighShelldist/infra/lib/PythonParser.js

HighSame File Env Network Executiondist/infra/lib/codex-proxy.js

HighRuntime Package Installdist/cli/setup/GlobalInstaller.js

MediumDynamic Requiredist/infra/lib/MemoryManager.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/commands/codex-proxy.js

MediumShips Build Helpervibe/setup.sh

LPM CLI

Eval

Filesystem

NativeBindings

Network

Shell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 383 file(s), 2.35 MB of source, external domains: aistudio.google.com, api.anthropic.com, api.example.com, api.figma.com, api.openai.com, api.slack.com, api.telegram.org, api.z.ai, auth.openai.com, chatgpt.com, console.anthropic.com, generativelanguage.googleapis.com, github.com, nodejs.org, platform.openai.com, raw.githubusercontent.com, registry.npmjs.org, rubygems.org, www.w3.org, z.ai

dist/infra/lib/PythonParser.jsView file

8import os from 'os'; L9: const execAsync = promisify(exec); L10: // Determine Python command based on platform

High

Shell

Package source references shell execution.

dist/infra/lib/PythonParser.jsView on unpkg · L8

dist/tools/convention/applyQualityRules.jsView file

21react: ['dangerouslySetInnerHTML', 'props drilling (3+ levels)'], L22: javascript: ['var usage', '== instead of ===', 'eval() usage'], L23: css: ['!important abuse', 'inline style abuse']

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/convention/applyQualityRules.jsView on unpkg · L21

dist/infra/lib/MemoryManager.jsView file

33try { L34: const fs = require('fs'); L35: if (fs.existsSync(cwdClaudePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/lib/MemoryManager.jsView on unpkg · L33

dist/cli/commands/codex-proxy.jsView file

33console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`); L34: console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`); L35: console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`); ... L75: // 2. 환경변수 L76: if (process.env.OPENAI_API_KEY) { L77: return { provider: 'openai', label: 'OpenAI (OPENAI_API_KEY)', key: process.env.OPENAI_API_KEY }; ... L142: function readCodexModelsCache() { L143: const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'); L144: const cachePath = path.join(codexHome, 'models_cache.json'); L145: try { L146: const data = JSON.parse(fs.readFileSync(cachePath, 'utf-8')); L147: return (data.models || []).map(m => m.slug).filter(Boolean);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

dist/infra/lib/codex-proxy.jsView file

912const settings = getProxySettings(); L913: const defaultModel = model || process.env.CODEX_PROXY_MODEL || resolveDefaultModel(settings.model); L914: const modelSlots = resolveModelSlots(defaultModel); ... L921: console.log(`Codex Proxy :${port} | ${authLabel} | opus=${modelSlots.opus} sonnet=${modelSlots.sonnet} haiku=${modelSlots.haiku}`); L922: const child = spawn('claude', ['--dangerously-sk[redacted]', ...claudeArgs], { L923: stdio: 'inherit', ... L925: ...process.env, L926: ANTHROPIC_BASE_URL: `http://localhost:${port}`, L927: ANTHROPIC_AUTH_TOKEN: 'codex-proxy',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/infra/lib/codex-proxy.jsView on unpkg · L912

dist/cli/setup/GlobalInstaller.jsView file

55else { L56: execSync(`npm install @su-record/vibe@${currentVersion} --prefix "${globalCoreDir}" --no-save`, { L57: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/setup/GlobalInstaller.jsView on unpkg · L55

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

hooks/scripts/context-save.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @su-record/vibe@2.16.4 matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:2.16.4 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

hooks/scripts/context-save.jsView on unpkg

skills/e2e-commerce/templates/test-scenarios.mdView file

16patternName = generic_password severity = medium line = 16 matchedText = user: { ..." },

Medium

Secret Pattern

Hardcoded password in skills/e2e-commerce/templates/test-scenarios.md

skills/e2e-commerce/templates/test-scenarios.mdView on unpkg · L16

vibe/rules/quality/testing-strategy.mdView file

121patternName = generic_password severity = medium line = 121 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in vibe/rules/quality/testing-strategy.md

vibe/rules/quality/testing-strategy.mdView on unpkg · L121

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/e2e-commerce/templates/test-scenarios.md

MediumSecret Patternvibe/rules/quality/testing-strategy.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/tools/convention/applyQualityRules.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

main → dist/cli/index.jstypes → ./dist/cli/index.d.tsexports mapbin → vibe

Runtimenode >=18.0.0

Artifact9.70 MB · 1,814 files1 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

13 flagged

package.jsonView file

Lines 15-55json

15 "./memory": {

16 "types": "./dist/infra/lib/memory/index.d.ts",

17 "default": "./dist/infra/lib/memory/index.js"

18 }

19 },

20 "bin": {

21 "vibe": "dist/cli/index.js"

22 },

23 "scripts": {

24 "build": "tsc && chmod +x dist/cli/index.js",

25 "dev": "tsc --watch",

26 "gen:skill-docs": "npx tsx scripts/gen-skill-docs.ts",

27 "gen:skill-docs:check": "npx tsx scripts/gen-skill-docs.ts --check",

28 "sync:agent-models": "npx tsx scripts/sync-agent-models.ts",

29 "sync:agent-models:check": "npx tsx scripts/sync-agent-models.ts --check",

30 "validate:skill-invocation": "npx tsx scripts/validate-skill-invocation.ts",

31 "validate:counts": "npx tsx scripts/validate-counts.ts",

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "prepublishOnly": "pnpm build",

35 "postinstall": "node -e \"import('./dist/cli/postinstall/main.js').then(m=>m.main()).catch(()=>{})\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L35

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "release": "pnpm version patch && npm publish --access public"

37 },

38 "keywords": [

39 "ai",

40 "core",

41 "coding",

42 "spec-driven",

43 "claude",

44 "agent",

45 "requirements",

46 "user-story",

47 "ultrawork",

48 "parallel-agents",

49 "memory-management",

50 "knowledge-graph",

51 "code-analysis",

52 "code-quality",

53 "harness"

54 ],

55 "author": "Su",

dist/infra/lib/llm-availability.jsView file

Lines 1-26javascript

1/**

2 * LLM 가용성 감지 유틸

3 *

4 * Claude/Codex/Antigravity CLI 활성화 여부를 런타임에 판단.

5 * 결과는 프로세스당 1회 캐시.

6 */

7import { execSync } from 'child_process';

8import path from 'path'

dist/infra/lib/PythonParser.jsView file

Lines 1-28javascript

1// Python code parser utility for v1.3

2// Uses Python's ast module via child_process

3import { exec } from 'child_process';

4import { promisify } from 'util';

5import { writeFile, unlink } from 'fs/promises';

6

dist/tools/convention/applyQualityRules.jsView file

Lines 1-41javascript

1// Convention management tool - completely independent

2// Code Quality Standards

3const QUALITY_RULES = {

4 NAMING: {

5 variables: 'nouns (userList, userData)',

6 functions: 'verb+noun (fetchData, updateUser)',

7 events: 'handle prefix (handleClick, handleSubmit)'

dist/infra/lib/MemoryManager.jsView file

Lines 13-53javascript

13 storage;

14 graph;

15 memorySearch;

16 observations;

17 sessionRAG;

18 ragRetriever;

19 reflections;

20 // Map of projectPath -> MemoryManager instance (for project-based memory)

21 static instances = new Map

dist/cli/commands/codex-proxy.jsView file

Lines 13-53javascript

13 'codex-cli': 'Codex CLI (ChatGPT Pro)',

14 'apikey': 'API Key',

15 'env': 'CODEX_PROXY_API_KEY',

16};

17// ─── 실행 ────────────────────────────────────────────────────

18export function

dist/infra/lib/codex-proxy.jsView file

Lines 892-932javascript

892 // Sonnet → codex 코딩 모델 (spark 제외, 정확도 우선)

893 const codexModel = models.find(m => m.includes('codex') && !m.includes('mini'

dist/cli/setup/GlobalInstaller.jsView file

55else { L56: execSync(`npm install @su-record/vibe@${currentVersion} --prefix "${globalCoreDir}" --no-save`, { L57: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/setup/GlobalInstaller.jsView on unpkg · L55

vibe/setup.shView file

•path = vibe/setup.sh kind = build_helper sizeBytes = 837 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vibe/setup.shView on unpkg

hooks/scripts/context-save.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @su-record/vibe@2.16.4 matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:2.16.4 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

hooks/scripts/context-save.jsView on unpkg

skills/e2e-commerce/templates/test-scenarios.mdView file

16patternName = generic_password severity = medium line = 16 matchedText = user: { ..." },

Medium

Secret Pattern

Hardcoded password in skills/e2e-commerce/templates/test-scenarios.md

skills/e2e-commerce/templates/test-scenarios.mdView on unpkg · L16

vibe/rules/quality/testing-strategy.mdView file

121patternName = generic_password severity = medium line = 121 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in vibe/rules/quality/testing-strategy.md

vibe/rules/quality/testing-strategy.mdView on unpkg · L121

;

High

Child Process

Package source references child process execution.

dist/infra/lib/llm-availability.jsView on unpkg · L6

9import fs from 'fs';

10import os from 'os';

11import { getZaiApiKey, getZaiCodingApiKey } from './config/GlobalConfigManager.js';

12let cached = null;

13function checkCliInstalled(binName, configDir) {

14 const hasDir = fs.existsSync(configDir);

15 if (!/^[a-z]+$/.test(binName))

16 return hasDir;

17 let hasBin = false;

18 try {

19 execSync(`which ${binName}`, { stdio: 'ignore' });

20 hasBin = true;

21 }

22 catch {

23 // not found

24 }

25 return hasBin || hasDir;

26}

import { existsSync, unlinkSync } from 'fs';

7import path from 'path';

8import os from 'os';

9const execAsync = promisify(exec);

10// Determine Python command based on platform

High

Shell

Package source references shell execution.

dist/infra/lib/PythonParser.jsView on unpkg · L8

11function getPythonCommand() {

12 if (process.platform === 'win32') {

13 // Try common Windows Python locations

14 const pythonPaths = [

15 `${process.env.LOCALAPPDATA}\\Programs\\Python\\Python312\\python.exe`,

16 `${process.env.LOCALAPPDATA}\\Programs\\Python\\Python311\\python.exe`,

17 `${process.env.LOCALAPPDATA}\\Programs\\Python\\Python310\\python.exe`,

18 'py', // Python Launcher

19 'python'

20 ];

21 for (const pythonPath of pythonPaths) {

22 try {

23 if (pythonPath.includes('\\') && existsSync(pythonPath)) {

24 return `"${pythonPath}"`;

25 }

26 }

27 catch { /* ignore: optional operation */

28 continue;

,

8 booleans: 'is/has/can prefix (isLoading, hasError, canEdit)',

9 constants: 'UPPER_SNAKE_CASE (MAX_RETRY_COUNT, API_TIMEOUT)',

10 components: 'PascalCase (UserProfile, HeaderSection)',

11 hooks: 'use prefix (useUserData, useAuth)'

12 },

13 STRUCTURE: {

14 componentOrder: ['State & Refs', 'Custom Hooks', 'Event Handlers', 'Effects', 'Early returns', 'Main return JSX'],

15 functionMaxLines: 20,

16 componentMaxLines: 50,

17 maxNestingDepth: 3

18 },

19 ANTIPATTERNS: {

20 typescript: ['any type usage', '@ts-ignore usage', 'as any casting'],

21 react: ['dangerouslySetInnerHTML', 'props drilling (3+ levels)'],

22 javascript: ['var usage', '== instead of ===', 'eval() usage'],

23 css: ['!important abuse', 'inline style abuse']

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/tools/convention/applyQualityRules.jsView on unpkg · L21

24 },

25 ASYNC_STATES: ['data', 'isLoading', 'error'],

26 STATE_MANAGEMENT: {

27 simple: 'useState',

28 complex: 'useReducer',

29 globalUI: 'Context API',

30 globalApp: 'Zustand',

31 server: 'TanStack Query'

32 }

33};

34export const applyQualityRulesDefinition = {

35 name: 'apply_quality_rules',

36 description: 'apply rules|apply standards|follow conventions - Apply quality rules',

37 inputSchema: {

38 type: 'object',

39 properties: {

40 scope: { type: 'string', description: 'Application scope', enum: ['naming', 'structure', 'typescript', 'react', 'accessibility', 'all'] },

41 language: { type: 'string', description: 'Programming language context', enum: ['javascript', 'typescript', 'react', 'vue', 'general'] }

();

22 static instance = null;

23 static cleanupRegistered = false;

24 constructor(projectPath) {

25 // Determine project path

26 let resolvedPath = projectPath;

27 if (!resolvedPath && process.env.CLAUDE_PROJECT_DIR) {

28 resolvedPath = process.env.CLAUDE_PROJECT_DIR;

29 }

30 if (!resolvedPath) {

31 // Only use cwd if it looks like a real project (has .claude folder)

32 const cwdClaudePath = path.join(process.cwd(), '.claude');

33 try {

34 const fs = require('fs');

35 if (fs.existsSync(cwdClaudePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/lib/MemoryManager.jsView on unpkg · L33

36 resolvedPath = process.cwd();

37 }

38 }

39 catch {

40 // Ignore errors

41 }

42 }

43 if (!resolvedPath) {

44 throw new Error('No valid project path found. Provide projectPath or set CLAUDE_PROJECT_DIR environment variable.');

45 }

46 // Normalize path

47 resolvedPath = path.resolve(resolvedPath);

48 // Skip memory creation for core package itself

49 if (this.isCorePackage(resolvedPath)) {

50 throw new Error('Memory storage disabled for core package development folder.');

51 }

52 // Initialize modules

53 this.storage = new MemoryStorage(resolvedPath);

codexLaunch

(

model

,

claudeArgs

) {

19 launchSession(model, claudeArgs);

20}

21// ─── 셸 함수 출력 ───────────────────────────────────────────

22export function codexShell(modelArg) {

23 const settings = getProxySettings();

24 const model = modelArg || settings.model;

25 console.log(generateShellFunction(model));

26}

27// ─── 상태 확인 ───────────────────────────────────────────────

28export function codexStatus() {

29 const auth = checkAuthSource();

30 const settings = getProxySettings();

31 console.log(`\n Provider: ${settings.provider || '미설정'}`);

32 console.log(` 모델: ${settings.model || '(기본값)'}`);

33 console.log(` 인증: ${auth ? AUTH_LABELS[auth.source] || auth.source : '미설정'}`);

34 console.log(` Target: ${settings.targetUrl || 'https://api.openai.com'}`);

35 console.log(` 명령어: ${settings.alias || 'vibe codex'}\n`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands/codex-proxy.jsView on unpkg · L33

36}

37// ─── Setup ──────────────────────────────────────────────────

38export async function codexSetup() {

39 p.intro('Codex Proxy 설정');

40 // 1. 인증 자동 감지

41 const detected = detectAuth();

42 if (detected) {

43 p.log.success(`${detected.label} 인증 확인됨`);

44 // 2. 모델 자동 조회

45 const models = detected.provider === 'chatgpt-pro'

46 ? readCodexModelsCache()

47 : detected.key ? await fetchModels(detected.url || 'https://api.openai.com', detected.key) : [];

48 const model = await selectModel(models);

49 const alias = await selectAlias();

50 saveConfig(detected.provider, { key: detected.key, url: detected.url }, model, alias);

51 await registerShell(alias);

52 p.outro(`설정 완료! ${alias} 로 실행하세요`);

53 }

)

&&

!

m.

includes

(

'spark'

)

&&

m

!==

defaultModel)

894 || models.find(m => m.includes('codex') && !m.includes('mini') && !m.includes('spark'))

895 || defaultModel;

896 // Haiku → codex-spark (고속), 없으면 mini

897 const miniModel = models.find(m => m.includes('codex-spark'))

898 || models.find(m => m.includes('mini'))

899 || defaultModel;

900 return { opus, sonnet: codexModel, haiku: miniModel };

901}

902// ─── 세션 실행 (프록시 + Claude Code 원샷) ──────────────────

903export function launchSession(model, claudeArgs = []) {

904 const authSource = checkAuthSource();

905 if (!authSource) {

906 console.error('인증 정보 없음.');

907 console.error(' ChatGPT Pro: npm i -g @openai/codex && codex login');

908 console.error(' Antigravity: ANTIGRAVITY_API_KEY 또는 CODEX_PROXY_API_KEY 설정');

909 console.error(' OpenAI: vibe gpt key <key> 또는 OPENAI_API_KEY 설정');

910 process.exit(1);

911 }

912 const settings = getProxySettings();

913 const defaultModel = model || process.env.CODEX_PROXY_MODEL || resolveDefaultModel(settings.model);

914 const modelSlots = resolveModelSlots(defaultModel);

915 const config = { port: 0, defaultModel };

916 const server = createProxyServer(config);

917 server.listen(0, '127.0.0.1', () => {

918 const addr = server.address();

919 const port = addr.port;

920 const authLabel = AUTH_SOURCE_LABELS[authSource.source];

921 console.log(`Codex Proxy :${port} | ${authLabel} | opus=${modelSlots.opus} sonnet=${modelSlots.sonnet} haiku=${modelSlots.haiku}`);

922 const child = spawn('claude', ['--dangerously-skip-permissions', ...claudeArgs], {

923 stdio: 'inherit',

924 env: {

925 ...process.env,

926 ANTHROPIC_BASE_URL: `http://localhost:${port}`,

927 ANTHROPIC_AUTH_TOKEN: 'codex-proxy',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/infra/lib/codex-proxy.jsView on unpkg · L912

928 ANTHROPIC_API_KEY: 'codex-proxy',

929 API_TIMEOUT_MS: '3000000',

930 ANTHROPIC_DEFAULT_OPUS_MODEL: modelSlots.opus,

931 ANTHROPIC_DEFAULT_SONNET_MODEL: modelSlots.sonnet,

932 ANTHROPIC_DEFAULT_HAIKU_MODEL: modelSlots.haiku,