@bman654/clodex 2.18.6 → 2.18.8

package/README.md

@@ -244,7 +244,7 @@ Manage favorite models (max 20) and short aliases. Favorites feed the endpoint-m
 | `--unalias <name>` | Remove a saved short name |
 | `--context <model=stop>` | Choose how much of a model's context window to use: `standard`, `max`, `default` to clear, or a token count such as `500k`. Applies to this run unless `--save` is given |
 | `--save` | With `--context`: store the stop as that model's default |
-| `--json` | Print resolved metadata for saved favorites as JSON (ids, aliases, context stop and windows, output limit, pricing boundary, effort levels). Diagnostics go to stderr so stdout stays parseable |
+| `--json` | Print resolved metadata for saved favorites as JSON (ids, aliases, context stop and windows, output limit, pricing boundary, effort levels). A model saved under several aliases lists them all in `aliases`, in saved order; `alias` is the first. Diagnostics go to stderr so stdout stays parseable |
 | `--help`, `--version` | Help / version |
 
 #### Context stops and the pricing boundary
@@ -324,9 +324,9 @@ and their seeded flags when discovery omits them. Models not using Responses-Lit
 this version header and are not hidden by this check. This check does not establish your
 account's model entitlement.
 
-Providers supported: `openai` (API key, platform.openai.com), `openai-oauth` (ChatGPT/Codex plan), and `opencode-go` (OpenCode Go API key). OpenCode Go exposes its Anthropic Messages, Chat Completions, and Responses models; entries whose transport has not been verified against the live endpoint are left out. See [OpenCode Go provider](docs/opencode-go.md).
+Providers supported: `openai` (API key, platform.openai.com), `openai-oauth` (ChatGPT/Codex plan), and `opencode-go` (OpenCode Go API key). OpenCode Go exposes its Anthropic Messages, Chat Completions, and Responses models; only entries whose transport has been verified, live or against OpenCode's per-model endpoint table, are included. See [OpenCode Go provider](docs/opencode-go.md).
 
-A **custom OpenAI-compatible server** is any OpenAI-style API, given by its base URL (the part before `/chat/completions`), such as `https://openrouter.ai/api/v1`. `providers add` asks for a name, the base URL and an API key (leave it empty for a local server without auth), lists the server's models to check the connection, and saves the provider as `custom-<name>`. Its models then appear in `clodex models`; once saved as favorites they are addressed as `clodex:custom-<name>:<model>` and can be given a short alias with `clodex models --alias`. The base URL is checked before anything is saved: plain `http://` is accepted only after you confirm it, and only for loopback or private-network addresses, and an `https://` URL whose host is, or resolves to, a loopback (`127.0.0.0/8`, `::1`), private, link-local, unique-local, carrier-grade-NAT or well-known cloud-metadata address is refused. A model's id and name are stored with surrounding whitespace trimmed, and a model whose trimmed id or name still contains a control character is skipped, whether the list is fetched by `providers add` or by `providers refresh-models`, and error text from the server is shown with control characters replaced by spaces. Only the OpenAI-compatible kind is offered in the menu.
+A **custom OpenAI-compatible server** is any OpenAI-style API, given by its base URL (the part before `/chat/completions`), such as `https://openrouter.ai/api/v1`. `providers add` asks for a name, the base URL and an API key (leave it empty for a local server without auth), lists the server's models to check the connection, and saves the provider as `custom-<name>`. Its models then appear in `clodex models`; once saved as favorites they are addressed as `clodex:custom-<name>:<model>` and can be given a short alias with `clodex models --alias`. The base URL is checked before anything is saved and again when its models are refreshed: plain `http://` is accepted only after you confirm it, and only if every address the host resolves to is on this machine, your LAN or a private network such as Tailscale (loopback, private, unique-local IPv6 or carrier-grade-NAT `100.64.0.0/10` addresses); `https://` is accepted on any of those networks as well as the public internet; and a link-local (`169.254.0.0/16`, `fe80::/10`) or well-known cloud-metadata address is refused whether or not HTTP was approved. A server on another machine in your tailnet can be added by its `100.x` address, its MagicDNS name, or the HTTPS name `tailscale serve` gives it. A model's id and name are stored with surrounding whitespace trimmed, and a model whose trimmed id or name still contains a control character is skipped, whether the list is fetched by `providers add` or by `providers refresh-models`, and error text from the server is shown with control characters replaced by spaces. Only the OpenAI-compatible kind is offered in the menu.
 
 ### `clodex install-vscode-launcher`
 

package/dist/cli.js

@@ -346,7 +346,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.18.6",
+  version: "2.18.8",
   publishConfig: {
     access: "public"
   },
@@ -3486,11 +3486,11 @@ function applyClodexPatches(source, config) {
   };
   for (const [id, value] of Object.entries(MODEL_CONFIG)) {
     const spec = value && typeof value === "object" ? value : { alias: value };
-    if (spec.alias !== void 0) {
-      const rawAlias = String(spec.alias).trim();
-      const a = rawAlias.toLowerCase();
+    const aliasNames = spec.alias === void 0 ? [] : [String(spec.alias), ...(spec.moreAliases ?? []).map(String)];
+    for (const name of aliasNames) {
+      const a = name.trim().toLowerCase();
       if (!/^[a-z0-9][a-z0-9._-]*(\[1m\])?$/.test(a)) {
-        fail('clodex patch: alias "' + spec.alias + '" is not a safe lowercase alias');
+        fail('clodex patch: alias "' + name + '" is not a safe lowercase alias');
       }
       if (isReservedModelAlias(a)) {
         fail('clodex patch: reserved alias "' + a + '" cannot be reassigned');
@@ -3498,25 +3498,24 @@ function applyClodexPatches(source, config) {
       ALIAS_TO_ID[a] = String(id);
       IDENTITIES.push(a);
       if (spec.display) DISPLAY_BY_IDENTITY[a] = String(spec.display);
-    } else {
+      registerCapabilityKeys(name);
+    }
+    if (aliasNames.length === 0) {
       IDENTITIES.push(String(id));
       if (spec.display) DISPLAY_BY_IDENTITY[String(id)] = String(spec.display);
     }
-    if (spec.alias !== void 0) {
-      registerCapabilityKeys(String(spec.alias));
-    }
     registerCapabilityKeys(String(id));
     if (spec.context !== void 0) {
       const n = Number(spec.context);
       if (!Number.isInteger(n) || n <= 0) {
         fail('clodex patch: context for "' + id + '" must be a positive integer, got ' + spec.context);
       }
-      if (/\[1m\]/i.test(String(spec.alias ?? "")) || /\[1m\]/i.test(id)) {
+      if (aliasNames.some((name) => /\[1m\]/i.test(name)) || /\[1m\]/i.test(id)) {
         fail(
           'clodex patch: "' + id + '" sets context but keeps the [1m] suffix \u2014 drop the suffix from both the id and the alias'
         );
       }
-      if (spec.alias !== void 0) CONTEXT_BY_KEY[String(spec.alias).trim().toLowerCase()] = n;
+      for (const name of aliasNames) CONTEXT_BY_KEY[name.trim().toLowerCase()] = n;
       CONTEXT_BY_KEY[String(id).trim().toLowerCase()] = n;
     }
     if (spec.effort) {
@@ -3526,8 +3525,8 @@ function applyClodexPatches(source, config) {
           `clodex patch: effort for "${id}" must include low, medium, and high with a native default`
         );
       }
-      if (spec.alias !== void 0) {
-        for (const key of capabilityKeys(String(spec.alias))) {
+      for (const name of aliasNames) {
+        for (const key of capabilityKeys(name)) {
           EFFORT_BY_KEY[key] = effort;
         }
       }
@@ -4186,11 +4185,12 @@ function configuredAliases(config) {
   const aliases = /* @__PURE__ */ new Map();
   for (const [id, entry] of Object.entries(config)) {
     if (entry.alias === void 0) continue;
-    const alias = String(entry.alias).trim().toLowerCase();
-    aliases.set(alias, {
-      id,
-      ...entry.display === void 0 ? {} : { display: String(entry.display) }
-    });
+    for (const name of [entry.alias, ...entry.moreAliases ?? []]) {
+      aliases.set(String(name).trim().toLowerCase(), {
+        id,
+        ...entry.display === void 0 ? {} : { display: String(entry.display) }
+      });
+    }
   }
   return [...aliases].map(([alias, entry]) => ({ alias, ...entry }));
 }
@@ -4902,17 +4902,27 @@ var opencode_go_models_default = [
       output: 0.6,
       cache_read: 3e-3
     },
-    modelFormat: "anthropic",
-    npm: "@ai-sdk/anthropic",
-    apiUrl: "https://opencode.ai/zen/go",
+    modelFormat: "openai",
+    npm: "@ai-sdk/openai-compatible",
+    apiUrl: "https://opencode.ai/zen/go/v1",
     reasoning: true,
     modalities: [
       "text",
       "image"
     ],
     compatibility: {
-      supportsCountTokens: false,
-      supportsReasoningEffort: false
+      reasoningEffortMap: {
+        minimal: null,
+        low: null,
+        medium: null,
+        high: "high",
+        max: "max"
+      },
+      supportsStore: false,
+      supportsDeveloperRole: false,
+      maxTokensField: "max_tokens",
+      requiresReasoningContentOnAssistantMessages: true,
+      thinkingFormat: "deepseek"
     },
     upstreamModelId: "deepseek-v4.1-flash",
     family: "deepseek"
@@ -14408,20 +14418,23 @@ function buildPatchModelConfig(favorites, aliases, modelMetaFor) {
     alias: source,
     reason: "target-not-favorite"
   })));
-  const aliasByFavorite = new Map(
-    normalizedAliases.aliases.filter((alias) => favoriteTargets.has(`${alias.providerId}:${alias.modelId}`)).map((alias) => [
-      `${alias.providerId}:${alias.modelId}`,
-      alias.name
-    ])
-  );
+  const aliasesByFavorite = /* @__PURE__ */ new Map();
+  for (const alias of normalizedAliases.aliases) {
+    const key = `${alias.providerId}:${alias.modelId}`;
+    if (!favoriteTargets.has(key)) continue;
+    const names = aliasesByFavorite.get(key) ?? [];
+    names.push(alias.name);
+    aliasesByFavorite.set(key, names);
+  }
   for (const favorite of favorites) {
     const id = stripOneMContextSuffix(httpProxyModelId(favorite.providerId, favorite.modelId));
     if (config[id]) continue;
     const meta = modelMetaFor(favorite.providerId, favorite.modelId);
     const context = meta?.contextWindow;
-    const alias = aliasByFavorite.get(`${favorite.providerId}:${favorite.modelId}`);
+    const [alias, ...moreAliases] = aliasesByFavorite.get(`${favorite.providerId}:${favorite.modelId}`) ?? [];
     const entry = {};
     if (alias) entry.alias = alias;
+    if (moreAliases.length > 0) entry.moreAliases = moreAliases;
     if (context === void 0 || context <= 0) unknownWindows.push(id);
     else if (context !== 2e5) entry.context = context;
     const display = meta?.displayName?.trim();
@@ -14461,7 +14474,9 @@ function computePatchConfigHash(config, transformsVersion = PATCH_TRANSFORMS_VER
       entry.context ?? null,
       entry.display ?? null,
       entry.effort?.levels ?? null,
-      entry.effort?.defaultLevel ?? null
+      entry.effort?.defaultLevel ?? null,
+      // Appended only when present, so a config with one alias per model keeps its hash.
+      ...entry.moreAliases ? [entry.moreAliases] : []
     ];
   });
   const payload = [transformsVersion, canonical];
@@ -14940,7 +14955,7 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
   };
   writePatchManifest(manifest);
   const modelCount = Object.keys(desired.config).length;
-  const aliasCount = Object.values(desired.config).filter((entry) => entry.alias).length;
+  const aliasCount = Object.values(desired.config).reduce((n, entry) => n + (entry.alias ? 1 : 0) + (entry.moreAliases?.length ?? 0), 0);
   const windowCount = Object.values(desired.config).filter((entry) => entry.context).length;
   return {
     ok: true,
@@ -15185,14 +15200,14 @@ function effortFor(meta) {
     ...meta.effort ? { providerLevels: meta.effort.levels } : {}
   };
 }
-function metadataFor(id, meta, alias) {
+function metadataFor(id, meta, aliases) {
   const effective = positive(meta.contextWindow);
   const effort = effortFor(meta);
   return {
     id,
     ...meta.providerId ? { providerId: meta.providerId } : {},
     ...meta.modelId ? { modelId: meta.modelId } : {},
-    ...alias ? { alias } : {},
+    ...aliases.length > 0 ? { alias: aliases[0], aliases } : {},
     ...meta.displayName?.trim() ? { displayName: meta.displayName.trim() } : {},
     context: {
       stop: meta.contextStop ?? "standard",
@@ -15209,7 +15224,11 @@ function metadataFor(id, meta, alias) {
 function buildModelMetadata() {
   const desired = buildDesiredPatchConfig({ sessionStops: true });
   return Object.entries(desired.config).map(
-    ([id, entry]) => metadataFor(id, desired.metaById[id] ?? {}, entry.alias)
+    ([id, entry]) => metadataFor(
+      id,
+      desired.metaById[id] ?? {},
+      entry.alias === void 0 ? [] : [entry.alias, ...entry.moreAliases ?? []]
+    )
   );
 }
 function formatModelMetadata(entries) {
@@ -16009,21 +16028,17 @@ var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
   "169.254.169.254",
   "metadata.google.internal",
   "169.254.170.2",
-  "fd00:ec2::254"
+  "fd00:ec2::254",
+  "100.100.100.200",
+  // Alibaba Cloud ECS
+  "fd20:ce::254"
+  // Google Cloud IPv6
 ]);
-function isBlockedIp(ipStr, allowInsecureLocal) {
+var NON_PUBLIC_RANGES = /* @__PURE__ */ new Set(["loopback", "private", "uniqueLocal", "carrierGradeNat"]);
+function isBlockedIp(ipStr) {
   try {
     const ip = ipaddr.process(ipStr);
-    const range = ip.range();
-    if (allowInsecureLocal && (range === "loopback" || range === "private")) {
-      return false;
-    }
-    if (range === "loopback") return true;
-    if (range === "private") return true;
-    if (range === "linkLocal") return true;
-    if (range === "uniqueLocal") return true;
-    if (range === "carrierGradeNat") return true;
-    return false;
+    return ip.range() === "linkLocal" || BLOCKED_HOSTNAMES.has(ip.toString());
   } catch {
     return true;
   }
@@ -16057,10 +16072,10 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     return {
       ok: false,
       error: "Only HTTPS URLs are allowed.",
-      hint: "For local or LAN servers (Ollama, LM Studio, vLLM), allow insecure HTTP when prompted."
+      hint: "For a server on this machine, your LAN or Tailscale (Ollama, LM Studio, vLLM), allow insecure HTTP when prompted."
     };
   } else if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return { ok: false, error: "URL must use https:// or user-approved http:// for local/LAN servers." };
+    return { ok: false, error: "URL must use https:// or user-approved http:// for local, LAN or Tailscale servers." };
   }
   const rawHostname = parsed.hostname.toLowerCase();
   const hostname = rawHostname.replace(/^\[(.*)\]$/, "$1");
@@ -16068,7 +16083,7 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     return {
       ok: false,
       error: "This URL points to a blocked internal/metadata host.",
-      hint: "Use a public API endpoint for your provider."
+      hint: "Use your model server's own loopback, LAN, Tailscale or public address."
     };
   }
   const addresses = await resolveHostAddresses(hostname);
@@ -16085,19 +16100,18 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     } catch {
       continue;
     }
-    if (isBlockedIp(addr, allowLocal)) {
+    if (isBlockedIp(addr)) {
       return {
         ok: false,
-        error: "URL resolves to a private or restricted network address.",
-        hint: "Use a public HTTPS endpoint, or explicitly allow insecure HTTP for a trusted local/LAN server."
+        error: "URL resolves to a restricted link-local or cloud metadata address.",
+        hint: "Link-local addresses are not supported. Use the server's loopback, LAN, Tailscale or public address."
       };
     }
   }
   if (parsed.protocol === "http:") {
     const allResolvedAddressesAreLocal = addresses.every((addr) => {
       try {
-        const range = ipaddr.process(addr).range();
-        return range === "loopback" || range === "private" || range === "uniqueLocal";
+        return NON_PUBLIC_RANGES.has(ipaddr.process(addr).range());
       } catch {
         return false;
       }
@@ -16105,8 +16119,8 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     if (!allowLocal || !allResolvedAddressesAreLocal) {
       return {
         ok: false,
-        error: "HTTP is only allowed for local loopback or private-network addresses.",
-        hint: "Use https://, or allow insecure HTTP for a trusted local/LAN server."
+        error: "HTTP is only allowed for addresses on this machine, your LAN or a private network such as Tailscale.",
+        hint: "Use https:// for a server on the public internet."
       };
     }
   }
@@ -16354,9 +16368,9 @@ async function runCustomEndpointAddFlow(onResult) {
   }
   let allowInsecureLocal = false;
   if (/^http:\/\//i.test(String(baseUrl).trim())) {
-    p3.log.warn("HTTP is not encrypted. Only use it for a trusted local or LAN server.");
+    p3.log.warn("HTTP is not encrypted. Only use it for a trusted server on this machine, your LAN or Tailscale.");
     const allow = await p3.confirm({
-      message: "Allow insecure HTTP for this local/LAN server?",
+      message: "Allow insecure HTTP for this local, LAN or Tailscale server?",
       initialValue: true
     });
     if (p3.isCancel(allow)) {
@@ -16879,8 +16893,9 @@ async function refreshApiListProvider(provider, apiKey) {
   let safeBaseUrl = baseUrl;
   const templateDefault = catalogTemplate?.defaultBaseUrl?.trim();
   if (configuredUrl && configuredUrl !== templateDefault) {
+    const customEndpoint = provider.templateId === "custom-openai" || provider.templateId === "custom-anthropic";
     const urlCheck = await validateCustomEndpointUrl(baseUrl, {
-      allowInsecureLocal: catalogTemplate?.apiKeyOptional === true
+      allowInsecureLocal: catalogTemplate?.apiKeyOptional === true || customEndpoint
     });
     if (!urlCheck.ok || !urlCheck.normalizedUrl) {
       return { models: [], error: `${urlCheck.error ?? "Invalid API base URL."} ${urlCheck.hint ?? ""}`.trim() };
@@ -17078,7 +17093,7 @@ async function refreshProviderModels(providerId, apiKey, registry, credentialSna
       }
     } else {
       const template = resolveProviderTemplate(provider);
-      const keyOptional = template?.apiKeyOptional === true;
+      const keyOptional = template?.apiKeyOptional === true || isAnonymousProvider(provider);
       const effectiveKey = keyOptional && isLikelyPlaceholderKey(apiKey) ? "" : apiKey;
       if (!keyOptional && isLikelyPlaceholderKey(effectiveKey)) {
         if (cachedModelCount(cacheProvider) > 0) {
@@ -22645,9 +22660,9 @@ ${pc13.bold("Behavior:")}
   standard (the provider's tuned default), max (its ceiling), default (clear a
   saved choice), or a token count such as 500k. Applies to this run only unless
   --save is given. The model is a saved alias or clodex:<provider-id>:<model-id>.
-  --json prints the resolved metadata for saved favorites as JSON: ids,
-  aliases, context stop and windows, output limit, pricing boundary, and effort
-  levels. Diagnostics go to stderr so stdout stays parseable.
+  --json prints the resolved metadata for saved favorites as JSON: ids, every
+  saved alias, context stop and windows, output limit, pricing boundary, and
+  effort levels. Diagnostics go to stderr so stdout stays parseable.
 
 ${pc13.bold("How it works:")}
   claude and server use the global favorites list.