@azure-id/orc 0.55.0

package/bin/providers.json

@@ -0,0 +1,437 @@
+{
+  "_readme": [
+    "DATED provider catalog for `orc extra`. Providers, NEVER models.",
+    "",
+    "Between this package's cutoff and any given release the model lineup moves:",
+    "DeepSeek V3.2 -> V4, Kimi K2 -> K2.7, GLM 4.6 -> 5.2, MiniMax M2 -> M2.7,",
+    "Qwen 3 -> 3.6, MiMo v2 -> v2.5. A SHIPPED MODEL LIST IS WRONG WITHIN A",
+    "QUARTER, and wrong SILENTLY: a user picks from a stale dropdown and gets a",
+    "404 in the middle of a wave. So model ids come from the provider's own",
+    "/v1/models at ping time and are cached in the profile (`models_seen`).",
+    "",
+    "`as_of` is load-bearing, exactly like bin/pricing.json: a catalog older than",
+    "90 days prints a staleness warning beside every provider listing. Bump the",
+    "date only when you have re-checked the base URLs against each provider's",
+    "own docs.",
+    "",
+    "`auth_env` names the ENVIRONMENT VARIABLE, not a header. Claude Code picks",
+    "the header FROM the variable you set: ANTHROPIC_AUTH_TOKEN -> `Authorization:",
+    "Bearer`, ANTHROPIC_API_KEY -> `x-api-key`. Ollama's Anthropic endpoint",
+    "REJECTS x-api-key, so a row that said `bearer` plus a resolver that set",
+    "ANTHROPIC_API_KEY would fail at 401 with nothing on screen explaining why.",
+    "",
+    "`api_base` (OpenAI-compatible, engine `api`) and `anthropic_base` (the",
+    "/anthropic shim, engine `claude-shim`) are INDEPENDENTLY probeable: they are",
+    "different URLs with different capabilities, and `/v1/models` does not",
+    "necessarily live under the shim one.",
+    "",
+    "`custom` is a real row and is the escape hatch that keeps this catalog from",
+    "being a gate: anything OpenAI- or Anthropic-compatible works by typing a",
+    "base URL, with no entry here.",
+    "",
+    "`provider_routing` marks a provider that accepts an OpenRouter-style `provider` block in the request body (zdr, data_collection, require_parameters, only, allow_fallbacks). Only engine `api` composes a body, so this is the ONE enforceable privacy control in the whole subsystem — and it exists on the aggregator, plus `custom` because a custom base URL is routinely an aggregator-compatible gateway. Everything else gets `orc extra privacy` REFUSED BY NAME rather than an unknown body field that 400s mid-wave.",
+    "",
+    "`cli_bin` names the LOCAL BINARY a provider's only surface is. A row that",
+    "carries it is a tool that may simply not be installed, which is a state",
+    "before it is a failure: `orc extra tools` computes it fresh on every read",
+    "(never stored — a stored `installing` flag is a lie the moment the user hits",
+    "Ctrl-C), and `orc extra add --provider <that row>` REFUSES while it is",
+    "absent, naming the install command instead of creating a profile that cannot",
+    "work.",
+    "",
+    "`install` is per platform and per package manager and it AGES WITH THIS FILE.",
+    "The common failure is `npm i -g codex`, which installs an unrelated 2012",
+    "package — so the exact string has to come from here rather than from memory,",
+    "and it is dated for the same reason a base URL is.",
+    "",
+    "`no_install_alternative` is an asymmetry made data: a provider whose tool is",
+    "absent may have an install-free route (an ordinary `api` row serving the same",
+    "models), or it may not. `null` MEANS THERE IS NONE — never that the catalog",
+    "forgot to look — and a renderer must say the difference out loud.",
+    "",
+    "`models_public: true` says this provider's models list answers WITHOUT a",
+    "credential. It exists because `orc extra ping`'s cheapest rung treats a 200",
+    "on /models as verification, and on a provider whose list is public that would",
+    "mark a profile verified with a garbage key. Such a row fills models_seen and",
+    "then falls THROUGH to the paid rung; the free answer is recorded as",
+    "`models-public` and is never the profile's verification.",
+    "",
+    "`credential` on a cli row says how that tool takes a key, because the two",
+    "shipped ones are opposites: codex accepts a key on stdin and in an env var,",
+    "opencode's own login always prompts and cannot be driven — so ORC injects the",
+    "key into the child's environment instead and NEVER writes another tool's",
+    "credential store. `orc extra keyhelp` renders which of the three routes",
+    "applies."
+  ],
+  "version": 1,
+  "as_of": "2026-08-22",
+  "providers": [
+    {
+      "id": "deepseek",
+      "label": "DeepSeek",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://api.deepseek.com",
+      "anthropic_base": "https://api.deepseek.com/anthropic",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "DEEPSEEK_API_KEY",
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://api-docs.deepseek.com/quick_start/agent_integrations/claude_code/",
+      "terms_url": "https://platform.deepseek.com/downloads/DeepSeek%20Open%20Platform%20Terms%20of%20Service.html",
+      "notes": "Peak / off-peak rates differ; the off-peak window is the cheap one."
+    },
+    {
+      "id": "zai",
+      "label": "Z.ai (GLM)",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://api.z.ai/api/paas/v4",
+      "anthropic_base": "https://api.z.ai/api/anthropic",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "ZAI_API_KEY",
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://docs.z.ai/",
+      "terms_url": "https://z.ai/terms",
+      "notes": "GLM Coding Plan is a subscription; a plan key and an API key are not the same credential."
+    },
+    {
+      "id": "moonshot",
+      "label": "Moonshot (Kimi)",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://api.moonshot.ai/v1",
+      "anthropic_base": "https://api.moonshot.ai/anthropic",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "MOONSHOT_API_KEY",
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [
+        {
+          "id": "cn",
+          "label": "China",
+          "api_base": "https://api.moonshot.cn/v1",
+          "anthropic_base": "https://api.moonshot.cn/anthropic"
+        }
+      ],
+      "docs_url": "https://platform.moonshot.ai/docs",
+      "terms_url": "https://platform.moonshot.ai/docs/agreement",
+      "notes": null
+    },
+    {
+      "id": "minimax",
+      "label": "MiniMax",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://api.minimax.io/v1",
+      "anthropic_base": "https://api.minimax.io/anthropic",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "MINIMAX_API_KEY",
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [
+        {
+          "id": "cn",
+          "label": "China",
+          "api_base": "https://api.minimaxi.com/v1",
+          "anthropic_base": "https://api.minimaxi.com/anthropic"
+        }
+      ],
+      "docs_url": "https://platform.minimax.io/docs/token-plan/claude-code",
+      "terms_url": "https://platform.minimax.io/document/Terms%20of%20Service",
+      "notes": "A key issued in one region does NOT work against the other region's host."
+    },
+    {
+      "id": "qwen",
+      "label": "Alibaba Qwen (DashScope)",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",
+      "anthropic_base": "https://dashscope-intl.aliyuncs.com/apps/anthropic",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "DASHSCOPE_API_KEY",
+      "models_path": "/models",
+      "context_tokens": null,
+      "regions": [
+        {
+          "id": "cn",
+          "label": "China (Beijing)",
+          "api_base": "https://dashscope.aliyuncs.com/compatible-mode/v1",
+          "anthropic_base": "https://dashscope.aliyuncs.com/apps/anthropic"
+        }
+      ],
+      "docs_url": "https://www.alibabacloud.com/help/en/model-studio/compatibility-of-openai-with-dashscope",
+      "terms_url": "https://www.alibabacloud.com/help/en/legal",
+      "notes": "DashScope's OpenAI-compatible mode already carries /v1 in the base; models_path is /models."
+    },
+    {
+      "id": "mimo",
+      "label": "Xiaomi MiMo",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://api.xiaomimimo.com/v1",
+      "anthropic_base": "https://api.xiaomimimo.com/anthropic",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "MIMO_API_KEY",
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://api.xiaomimimo.com/docs",
+      "terms_url": "https://api.xiaomimimo.com/terms",
+      "notes": "Open weights; a self-hosted deployment is the `custom` row, not this one."
+    },
+    {
+      "id": "stepfun",
+      "label": "StepFun",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://api.stepfun.ai/v1",
+      "anthropic_base": "https://api.stepfun.ai/anthropic",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "STEPFUN_API_KEY",
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://platform.stepfun.com/docs",
+      "terms_url": "https://platform.stepfun.com/terms",
+      "notes": null
+    },
+    {
+      "id": "siliconflow",
+      "label": "SiliconFlow",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://api.siliconflow.com/v1",
+      "anthropic_base": "https://api.siliconflow.com/anthropic",
+      "auth_env": "ANTHROPIC_API_KEY",
+      "env_key_default": "SILICONFLOW_API_KEY",
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://docs.siliconflow.com/",
+      "terms_url": "https://siliconflow.com/terms",
+      "notes": "An AGGREGATOR: the model id names an upstream. Verify model_reported on every return."
+    },
+    {
+      "id": "openrouter",
+      "label": "OpenRouter",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "https://openrouter.ai/api/v1",
+      "anthropic_base": "https://openrouter.ai/api",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "OPENROUTER_API_KEY",
+      "models_path": "/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://openrouter.ai/docs/guides/overview/models",
+      "terms_url": "https://openrouter.ai/terms",
+      "notes": "An AGGREGATOR with TWO fallback kinds. Model-level fallback changes the model id (visible). Provider-level fallback is ON BY DEFAULT and KEEPS the model id while changing who serves it — visible only on engine `api`, via the response's `provider` field.",
+      "provider_routing": true
+    },
+    {
+      "id": "ollama",
+      "label": "Ollama (local)",
+      "engines": [
+        "api",
+        "claude-shim"
+      ],
+      "api_base": "http://localhost:11434/v1",
+      "anthropic_base": "http://localhost:11434",
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "OLLAMA_API_KEY",
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://docs.ollama.com/api/anthropic-compatibility",
+      "terms_url": "https://ollama.com/terms",
+      "notes": "Local: nothing leaves the machine, and the credential is a placeholder. Its /v1/messages REJECTS x-api-key, which is why auth_env is ANTHROPIC_AUTH_TOKEN and must stay that way."
+    },
+    {
+      "id": "opencode",
+      "label": "OpenCode",
+      "engines": [
+        "cli"
+      ],
+      "api_base": null,
+      "anthropic_base": null,
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": null,
+      "models_path": null,
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://opencode.ai/docs/cli/",
+      "terms_url": "https://opencode.ai/docs/",
+      "notes": "A LOCAL agentic CLI, so the thing that can be absent is the binary, not a URL. It reports token counts but NEVER which model answered — a substitution is invisible on this engine, and every render says so.",
+      "cli_bin": "opencode",
+      "min_version": "1.10.0",
+      "version_cmd": [
+        "--version"
+      ],
+      "auth_cmd": [
+        "auth",
+        "list"
+      ],
+      "models_cmd": [
+        "models"
+      ],
+      "no_install_alternative": "opencode-zen",
+      "credential": {
+        "env_route": true,
+        "env_var": null,
+        "stdin_login": null,
+        "interactive_login": "opencode auth login",
+        "note": "opencode reads a key from the environment or a .env file at startup, so ORC injects it into the child process and never touches ~/.local/share/opencode/auth.json. `opencode auth login` has no flag for the key itself and always prompts — it cannot be driven, and ORC says so rather than pretending."
+      },
+      "install": {
+        "docs_url": "https://opencode.ai/docs/",
+        "bin_name": "opencode",
+        "cmds": [
+          {
+            "manager": "npm",
+            "platforms": [
+              "win32",
+              "darwin",
+              "linux"
+            ],
+            "cmd": "npm i -g opencode-ai"
+          },
+          {
+            "manager": "script",
+            "platforms": [
+              "darwin",
+              "linux"
+            ],
+            "cmd": "curl -fsSL https://opencode.ai/install | bash"
+          }
+        ]
+      }
+    },
+    {
+      "id": "codex",
+      "label": "Codex",
+      "engines": [
+        "cli"
+      ],
+      "api_base": null,
+      "anthropic_base": null,
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "OPENAI_API_KEY",
+      "models_path": null,
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://developers.openai.com/codex/cli",
+      "terms_url": "https://openai.com/policies/terms-of-use",
+      "notes": "CLI-only: there is no endpoint to point ORC at, which is why no_install_alternative is null. Custom providers live in the USER-level ~/.codex/config.toml, which ORC reads and NEVER writes. `-m` alone does not set the compute budget — the dispatch always passes `-c model_reasoning_effort` too, and an unsupported level is coerced SILENTLY, so the effort is reported as requested and never as confirmed.",
+      "cli_bin": "codex",
+      "min_version": null,
+      "version_cmd": [
+        "--version"
+      ],
+      "auth_cmd": [
+        "login",
+        "status"
+      ],
+      "models_cmd": [
+        "debug",
+        "models"
+      ],
+      "no_install_alternative": null,
+      "credential": {
+        "env_route": true,
+        "env_var": "CODEX_API_KEY",
+        "stdin_login": "codex login --with-api-key",
+        "interactive_login": "codex login --device-auth",
+        "note": "Every codex login path reads the key from STDIN and never from an argument — the tool's own docs say so, which is ORC's rule arrived at independently. CODEX_API_KEY scopes a key to ONE invocation and writes nothing global, so it is the default route."
+      },
+      "install": {
+        "docs_url": "https://developers.openai.com/codex/cli",
+        "bin_name": "codex",
+        "cmds": [
+          {
+            "manager": "npm",
+            "platforms": [
+              "win32",
+              "darwin",
+              "linux"
+            ],
+            "cmd": "npm i -g @openai/codex"
+          },
+          {
+            "manager": "brew",
+            "platforms": [
+              "darwin"
+            ],
+            "cmd": "brew install --cask codex"
+          },
+          {
+            "manager": "winget",
+            "platforms": [
+              "win32"
+            ],
+            "cmd": "winget install OpenAI.Codex"
+          }
+        ]
+      }
+    },
+    {
+      "id": "opencode-zen",
+      "label": "OpenCode Zen",
+      "engines": [
+        "api"
+      ],
+      "api_base": "https://opencode.ai/zen/v1",
+      "anthropic_base": null,
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": "OPENCODE_ZEN_API_KEY",
+      "models_path": "/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": "https://opencode.ai/docs/zen/",
+      "terms_url": "https://opencode.ai/docs/",
+      "notes": "The install-free route to the same catalogue: an ordinary OpenAI-compatible endpoint, reachable with a key and no local tool at all. Its /models answers WITHOUT a credential, which is why models_public is set — the free rung proves the URL and nothing else here.",
+      "models_public": true
+    },
+    {
+      "id": "custom",
+      "label": "Custom endpoint",
+      "engines": [
+        "api",
+        "claude-shim",
+        "cli"
+      ],
+      "api_base": null,
+      "anthropic_base": null,
+      "auth_env": "ANTHROPIC_AUTH_TOKEN",
+      "env_key_default": null,
+      "models_path": "/v1/models",
+      "context_tokens": null,
+      "regions": [],
+      "docs_url": null,
+      "terms_url": null,
+      "notes": "You supply the base URL and the auth shape. This row is why the catalog is not a gate.",
+      "provider_routing": true
+    }
+  ]
+}

package/bin/ui.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * ui.js — a tiny zero-dependency terminal UI kit shared by the orc CLI.
+ *
+ * NOT the web panel. `bin/webui/` is `orc ui`, the local browser control panel;
+ * this file is the TERMINAL styling kit the CLI prints through. One letter
+ * apart, entirely different jobs — do not let the names collide.
+ *
+ * Rules that keep automated callers safe:
+ *  - COLOR is emitted ONLY on a real TTY and only when NO_COLOR is unset. Piped
+ *    output (tests, `| cat`, CI) is byte-identical to the plain text — no ANSI.
+ *  - GLYPHS fall back to ASCII on a console that can't render UTF-8 (legacy
+ *    Windows cmd without a UTF-8 codepage), detected conservatively.
+ * Nothing here changes the machine-stable command outputs (`where`,
+ * `pattern status`, `doctor` exit codes) — it only styles human-facing text.
+ */
+
+const useColor =
+  !!process.stdout.isTTY && !process.env.NO_COLOR && process.env.TERM !== "dumb";
+
+const wrap = (code) => (s) =>
+  useColor ? `\x1b[${code}m${s}\x1b[0m` : String(s);
+
+const color = {
+  bold: wrap(1),
+  dim: wrap(2),
+  red: wrap(31),
+  green: wrap(32),
+  yellow: wrap(33),
+  blue: wrap(34),
+  magenta: wrap(35),
+  cyan: wrap(36),
+  gray: wrap(90),
+};
+
+// UTF-8-capable console? Windows Terminal / VS Code / a UTF-8 codepage set it;
+// bare legacy cmd.exe does not. Non-Windows is always fine.
+const unicodeOk =
+  process.platform !== "win32" ||
+  !!(
+    process.env.WT_SESSION ||
+    process.env.TERM_PROGRAM ||
+    /utf-?8/i.test(process.env.PYTHONIOENCODING || "") ||
+    process.env.ConEmuTask
+  );
+
+const glyph = {
+  ok: unicodeOk ? "✔" : "OK",
+  warn: unicodeOk ? "⚠" : "!",
+  bad: unicodeOk ? "✖" : "x",
+  arrow: unicodeOk ? "→" : "->",
+  bullet: unicodeOk ? "•" : "*",
+};
+
+// Section header: a bold title with an underline the same visible width.
+function header(title) {
+  return "\n" + color.bold(title) + "\n" + color.gray("─".repeat(strip(title).length));
+}
+
+// Strip ANSI so width math is correct.
+function strip(s) {
+  return String(s).replace(/\x1b\[[0-9;]*m/g, "");
+}
+
+// Aligned two-column key/value rows: [[key, value, note?], …].
+function kv(rows, { indent = "  " } = {}) {
+  const pad = Math.max(0, ...rows.map((r) => strip(String(r[0])).length));
+  return rows
+    .map((r) => {
+      const key = String(r[0]);
+      const gap = " ".repeat(pad - strip(key).length + 2);
+      const note = r[2] ? "  " + color.gray(r[2]) : "";
+      return `${indent}${key}${gap}${r[1]}${note}`;
+    })
+    .join("\n");
+}
+
+// A light box around a block of lines (for "next steps" call-outs).
+function box(lines) {
+  const width = Math.max(0, ...lines.map((l) => strip(l).length));
+  const bar = unicodeOk ? "─" : "-";
+  const top = unicodeOk ? "┌" + bar.repeat(width + 2) + "┐" : "+" + bar.repeat(width + 2) + "+";
+  const bot = unicodeOk ? "└" + bar.repeat(width + 2) + "┘" : "+" + bar.repeat(width + 2) + "+";
+  const side = unicodeOk ? "│" : "|";
+  const mid = lines.map((l) => `${side} ${l}${" ".repeat(width - strip(l).length)} ${side}`);
+  return [top, ...mid, bot].map((l) => color.gray(l)).join("\n");
+}
+
+const mark = {
+  ok: (s) => color.green(glyph.ok) + " " + s,
+  warn: (s) => color.yellow(glyph.warn) + " " + s,
+  bad: (s) => color.red(glyph.bad) + " " + s,
+};
+
+module.exports = { color, glyph, header, kv, box, mark, strip, useColor, unicodeOk };