@botconnector/bccli 0.4.0-beta.35 → 0.4.0-beta.37

package/README.md

@@ -15,6 +15,7 @@ cd project-kamu && bccli
 |---|---|
 | `bccli` | mode interaktif |
 | `bccli -p "tugas"` | satu tugas tanpa interaksi (skrip/CI) |
+| `bccli -p "tugas" --output-format json` | hasil akhir sebagai satu objek JSON; `stream-json` = event JSONL per tahap (tool_use/tool_result/message/result) untuk CI |
 | `bccli -c` / `bccli -r` | lanjutkan sesi terakhir / pilih sesi |
 | `bccli -m provider/model` | pilih model |
 | `bccli --reasoning <auto|off|low|medium|high|max>` | pilih level reasoning untuk invocation ini |

package/dist/args-MNVI2OJI.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import {
+  helpText,
+  parseCliArgs
+} from "./chunk-ASTNW3X2.js";
+import "./chunk-R3ND76LW.js";
+import "./chunk-YURAIW7A.js";
+import "./chunk-H5N4ST6B.js";
+import "./chunk-4RMP4CNT.js";
+export {
+  helpText,
+  parseCliArgs
+};

package/dist/chunk-3HCOAJEQ.js

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+
+// src/mcp/oauth.ts
+import { spawn } from "child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { createServer } from "http";
+import { dirname, join } from "path";
+import { auth } from "@modelcontextprotocol/sdk/client/auth.js";
+var oauthStorePath = (home) => join(home, "mcp-oauth.json");
+function readStore(home) {
+  const path = oauthStorePath(home);
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeStore(home, store) {
+  const path = oauthStorePath(home);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(store, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+function hasStoredTokens(home, serverUrl) {
+  return Boolean(readStore(home)[serverUrl]?.tokens);
+}
+function clearTokens(home, serverUrl) {
+  const store = readStore(home);
+  const entry = store[serverUrl];
+  if (!entry?.tokens && !entry?.client && !entry?.codeVerifier && !entry?.discovery) return false;
+  delete store[serverUrl];
+  writeStore(home, store);
+  return true;
+}
+function defaultOpen(url) {
+  const target = url.href;
+  const child = process.platform === "win32" ? spawn("cmd", ["/c", "start", "", target], { detached: true, stdio: "ignore" }) : spawn(process.platform === "darwin" ? "open" : "xdg-open", [target], { detached: true, stdio: "ignore" });
+  child.unref();
+  child.on("error", () => {
+  });
+}
+var FileOAuthProvider = class {
+  opts;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  /**
+   * Always defined: MCP SDK treats a missing redirectUrl as a non-interactive
+   * (client_credentials) flow and would try a token exchange without a code.
+   */
+  get redirectUrl() {
+    return this.opts.redirectUrl ?? "http://127.0.0.1:1/callback";
+  }
+  get clientMetadata() {
+    return {
+      client_name: "BCCLI",
+      redirect_uris: [String(this.redirectUrl)],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    };
+  }
+  entry() {
+    return readStore(this.opts.home)[this.opts.serverUrl] ?? {};
+  }
+  patch(patch) {
+    const store = readStore(this.opts.home);
+    const next = { ...store[this.opts.serverUrl], ...patch };
+    for (const key of Object.keys(next)) {
+      if (next[key] === void 0) delete next[key];
+    }
+    store[this.opts.serverUrl] = next;
+    if (Object.keys(next).length === 0) delete store[this.opts.serverUrl];
+    writeStore(this.opts.home, store);
+  }
+  clientInformation() {
+    return this.entry().client;
+  }
+  saveClientInformation(clientInformation) {
+    this.patch({ client: clientInformation });
+  }
+  tokens() {
+    return this.entry().tokens;
+  }
+  saveTokens(tokens) {
+    this.patch({ tokens });
+  }
+  saveCodeVerifier(codeVerifier) {
+    this.patch({ codeVerifier });
+  }
+  codeVerifier() {
+    return this.entry().codeVerifier ?? "";
+  }
+  redirectToAuthorization(authorizationUrl) {
+    return (this.opts.open ?? defaultOpen)(authorizationUrl);
+  }
+  saveDiscoveryState(state) {
+    this.patch({ discovery: state });
+  }
+  discoveryState() {
+    return this.entry().discovery;
+  }
+  invalidateCredentials(scope) {
+    if (scope === "all") {
+      this.patch({ client: void 0, tokens: void 0, codeVerifier: void 0, discovery: void 0 });
+      return;
+    }
+    if (scope === "client") this.patch({ client: void 0 });
+    if (scope === "tokens") this.patch({ tokens: void 0 });
+    if (scope === "verifier") this.patch({ codeVerifier: void 0 });
+    if (scope === "discovery") this.patch({ discovery: void 0 });
+  }
+};
+function parseCallback(input) {
+  const url = typeof input === "string" ? new URL(input) : input;
+  const error = url.searchParams.get("error");
+  if (error) {
+    const description = url.searchParams.get("error_description");
+    throw new Error(description ? `OAuth ${error}: ${description}` : `OAuth ${error}`);
+  }
+  const code = url.searchParams.get("code");
+  if (!code) throw new Error("OAuth callback is missing the code parameter.");
+  const state = url.searchParams.get("state") ?? void 0;
+  return { code, state };
+}
+var CALLBACK_TIMEOUT_MS = 18e4;
+async function authorizeMcpServer(spec, deps) {
+  let settle;
+  const codeReceived = new Promise((resolve, reject) => {
+    settle = { resolve, reject };
+  });
+  codeReceived.catch(() => {
+  });
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      res.writeHead(404);
+      res.end();
+      return;
+    }
+    try {
+      const { code } = parseCallback(url);
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end("<html><body><p>BCCLI is connected. You can close this tab.</p></body></html>");
+      settle.resolve(code);
+    } catch (error) {
+      res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+      res.end(`<html><body><p>${error.message}</p></body></html>`);
+      settle.reject(error);
+    }
+  });
+  const port = await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      resolve(typeof address === "object" && address ? address.port : 0);
+    });
+  });
+  try {
+    const provider = new FileOAuthProvider({
+      home: deps.home,
+      serverUrl: spec.config.url,
+      redirectUrl: `http://127.0.0.1:${port}/callback`,
+      open: deps.open
+    });
+    const serverUrl = new URL(spec.config.url);
+    const result = await auth(provider, { serverUrl, fetchFn: deps.fetchFn });
+    if (result === "AUTHORIZED") return;
+    const timer = setTimeout(() => settle.reject(new Error("Timed out waiting for the OAuth callback.")), CALLBACK_TIMEOUT_MS);
+    let code;
+    try {
+      code = await codeReceived;
+    } finally {
+      clearTimeout(timer);
+    }
+    const second = await auth(provider, { serverUrl, authorizationCode: code, fetchFn: deps.fetchFn });
+    if (second !== "AUTHORIZED") throw new Error("OAuth authorization did not complete.");
+  } finally {
+    server.close();
+  }
+}
+
+export {
+  hasStoredTokens,
+  clearTokens,
+  FileOAuthProvider,
+  authorizeMcpServer
+};

package/dist/{chunk-SJH3YLW4.js → chunk-3JRBXJVB.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  contentText
+} from "./chunk-7TABTC32.js";
 
 // src/session.ts
 import { randomBytes } from "crypto";
@@ -36,7 +39,7 @@ var Session = class _Session {
     return readdirSync(dir).filter((f) => f.endsWith(".jsonl")).map((f) => {
       const session = new _Session(join(dir, f));
       const first = session.load().find((m) => m.role === "user");
-      return { session, mtime: statSync(session.file).mtime, preview: first ? String(first.content).slice(0, 80) : "" };
+      return { session, mtime: statSync(session.file).mtime, preview: first ? contentText(first.content).slice(0, 80) : "" };
     }).sort((a, b) => b.mtime.getTime() - a.mtime.getTime() || b.session.file.localeCompare(a.session.file));
   }
   static latest(home, cwd) {

package/dist/{chunk-IJGTX7RC.js → chunk-4RMP4CNT.js}

@@ -1,18 +1,5 @@
 #!/usr/bin/env node
 
-// src/presets.ts
-var PRESETS = [
-  { id: "bc-cloud", name: "BotConnector Cloud", baseURL: "https://api.botconnector.id/v1", apiKeyEnv: "BOTCONNECTOR_API_KEY" },
-  { id: "openrouter", name: "OpenRouter", baseURL: "https://openrouter.ai/api/v1", apiKeyEnv: "OPENROUTER_API_KEY" },
-  { id: "openai", name: "OpenAI", baseURL: "https://api.openai.com/v1", apiKeyEnv: "OPENAI_API_KEY" },
-  { id: "gemini", name: "Google Gemini", baseURL: "https://generativelanguage.googleapis.com/v1beta/openai", apiKeyEnv: "GEMINI_API_KEY" },
-  { id: "deepseek", name: "DeepSeek", baseURL: "https://api.deepseek.com/v1", apiKeyEnv: "DEEPSEEK_API_KEY" },
-  { id: "groq", name: "Groq", baseURL: "https://api.groq.com/openai/v1", apiKeyEnv: "GROQ_API_KEY" },
-  { id: "ollama-cloud", name: "Ollama Cloud", baseURL: "https://ollama.com/v1", apiKeyEnv: "OLLAMA_API_KEY" },
-  { id: "ollama", name: "Ollama lokal", baseURL: "http://127.0.0.1:11434/v1", local: true },
-  { id: "lmstudio", name: "LM Studio lokal", baseURL: "http://127.0.0.1:1234/v1", local: true }
-];
-
 // src/i18n/id.ts
 var ID = {
   "MCP servers (enter: install / remove \xB7 esc close) \xB7 \u2713 active \u25CB not installed \u2717 error": "Server MCP (enter: pasang / hapus \xB7 esc tutup) \xB7 \u2713 aktif \u25CB belum \u2717 error",
@@ -49,7 +36,7 @@ var ID = {
   "Session number (enter = new): ": "Nomor sesi (enter = baru): ",
   'This repo wants to run the MCP server "{name}" ({what}). Allow? [y/N] ': 'Repo ini ingin menjalankan server MCP "{name}" ({what}). Izinkan? [y/N] ',
   "Conversation summarized to fit the model context.": "Percakapan diringkas agar muat di konteks model.",
-  'Step limit of 50 reached. Type "continue" to keep going.': 'Batas 50 langkah tercapai. Ketik "lanjut" untuk meneruskan.',
+  'Step limit of {n} reached. Type "continue" to keep going.': 'Batas {n} langkah tercapai. Ketik "lanjut" untuk meneruskan.',
   "Cancelled.": "Dibatalkan.",
   "Permission mode: {mode}": "Mode izin: {mode}",
   "Folder: {cwd}": "Folder: {cwd}",
@@ -68,6 +55,15 @@ var ID = {
   "File: {file}": "File: {file}",
   "git is not installed or not on PATH, so /diff cannot be used.": "git tidak terpasang atau tidak ada di PATH, jadi /diff tidak bisa dipakai.",
   "This folder is not a git repository, so there is no diff.": "Folder ini bukan repository git, jadi tidak ada diff.",
+  "git is not installed or not on PATH, so /worktree cannot be used.": "git tidak terpasang atau tidak ada di PATH, jadi /worktree tidak bisa dipakai.",
+  "git is not installed or not on PATH, so -w cannot be used.": "git tidak terpasang atau tidak ada di PATH, jadi -w tidak bisa dipakai.",
+  "This folder is not a git repository, so -w cannot create a worktree.": "Folder ini bukan repository git, jadi -w tidak bisa membuat worktree.",
+  'Invalid worktree name "{name}": use letters, digits, dot, dash, or underscore (no slashes).': 'Nama worktree "{name}" tidak valid: pakai huruf, angka, titik, strip, atau garis bawah (tanpa slash).',
+  "Worktree path {path} already exists but is not a registered worktree; remove or rename it first.": "Path worktree {path} sudah ada tapi bukan worktree terdaftar; hapus atau ganti nama dulu.",
+  "Git worktrees:": "Git worktree:",
+  "Create one with: bccli -w <name>": "Buat dengan: bccli -w <nama>",
+  "Remove with: git worktree remove <path>": "Hapus dengan: git worktree remove <path>",
+  "list git worktrees; create one with bccli -w <name>": "daftar git worktree; buat dengan bccli -w <nama>",
   "No uncommitted changes.": "Tidak ada perubahan yang belum di-commit.",
   "\u2026 {n} more lines": "\u2026 {n} baris lagi",
   "New files (untracked): {files}": "File baru (belum di-track): {files}",
@@ -109,9 +105,9 @@ Usage:
   bccli login [provider]        save an API key (default: bc-cloud)
   bccli models                  list models from the active provider
   bccli provider list|add <id>|remove <id>   manage providers (custom: --url <url> [--name N] [--key-env ENV])
-  bccli mcp list|add <name>|remove <name>    manage MCP servers (catalog, or --url <url>)
+  bccli mcp list|add <name>|remove <name>|auth <name>|logout <name>    manage MCP servers (catalog, --url <url>, OAuth)
   bccli integrations             show the status of external agent integrations
-  bccli connect <agent>          opencode, aider, cline, dsh, codex, claude-code, cursor, openai-cli, openai-sdk, openai-compatible
+  bccli connect <agent>          opencode, aider, cline, dsh, codex, claude-code, cursor, openai-cli, openai-sdk, openai-compatible, openclaw, hermes
   bccli disconnect <agent>       remove an integration and restore the previous config
 
 Options:
@@ -121,6 +117,8 @@ Options:
   -r, --resume                  pick a session to continue
       --allow-all               run all tools without asking for permission
       --allowed-tools <a,b>     tools allowed without asking: bash, edit, fetch
+  -w, --worktree <name>        run in git worktree ../<repo>.worktrees/<name> (created, or reused if it exists)
+      --output-format <fmt>     text | json | stream-json for -p (machine-readable output)
       --permission-mode <mode>  default | acceptEdits | plan | allowAll
       --lang <en|id>            interface language (default: en; or BCCLI_LANG, or "language" in config)
   -v, --version                 version
@@ -132,9 +130,9 @@ Pemakaian:
   bccli login [provider]        simpan API key (default: bc-cloud)
   bccli models                  daftar model dari provider aktif
   bccli provider list|add <id>|remove <id>   kelola provider (custom: --url <url> [--name N] [--key-env ENV])
-  bccli mcp list|add <nama>|remove <nama>    kelola server MCP (katalog, atau --url <url>)
+  bccli mcp list|add <nama>|remove <nama>|auth <nama>|logout <nama>    kelola server MCP (katalog, --url <url>, OAuth)
   bccli integrations             lihat status integrasi agent eksternal
-  bccli connect <agent>          opencode, aider, cline, dsh, codex, claude-code, cursor, openai-cli, openai-sdk, openai-compatible
+  bccli connect <agent>          opencode, aider, cline, dsh, codex, claude-code, cursor, openai-cli, openai-sdk, openai-compatible, openclaw, hermes
   bccli disconnect <agent>       lepas integrasi dan pulihkan config sebelumnya
 
 Opsi:
@@ -144,17 +142,32 @@ Opsi:
   -r, --resume                  pilih sesi untuk dilanjutkan
       --allow-all               jalankan semua alat tanpa minta izin
       --allowed-tools <a,b>     alat yang boleh tanpa izin: bash, edit, fetch
+  -w, --worktree <name>        jalankan di git worktree ../<repo>.worktrees/<name> (dibuat, atau dipakai ulang jika ada)
+      --output-format <fmt>     text | json | stream-json untuk -p (output mesin)
       --permission-mode <mode>  default | acceptEdits | plan | allowAll
       --lang <en|id>            bahasa tampilan (default: en; atau BCCLI_LANG, atau "language" di config)
   -v, --version                 versi
   -h, --help                    bantuan ini`,
   "--reasoning must be one of: {levels}": "--reasoning harus salah satu dari: {levels}",
+  'networkPolicy must be "allow" or "offline".': 'networkPolicy harus "allow" atau "offline".',
+  "plugins must be an array of strings.": "plugins harus berupa array of string.",
+  "Plugin not found: {spec}": "Plugin tidak ditemukan: {spec}",
+  "Plugin failed to load: {spec}: {reason}": "Plugin gagal dimuat: {spec}: {reason}",
+  "Plugin {spec} registered a tool name that is already in use: {name}": "Plugin {spec} mendaftarkan nama tool yang sudah terpakai: {name}",
   "--permission-mode must be one of: {modes}": "--permission-mode harus salah satu dari: {modes}",
   "Plan needs approval; run with --allow-all.": "Rencana butuh persetujuan; jalankan dengan --allow-all.",
   "Step limit reached.": "Batas langkah tercapai.",
   "Needs permission for {tool}. Run with --allow-all or --allowed-tools {kind}.": "Butuh izin untuk {tool}. Jalankan dengan --allow-all atau --allowed-tools {kind}.",
   "--lang must be one of: en, id": "--lang harus salah satu dari: en, id",
+  "--output-format must be one of: {formats}": "--output-format harus salah satu dari: {formats}",
   "Invalid config: {path} ({error})": "Config tidak valid: {path} ({error})",
+  "maxSteps must be a positive number, or 0/null to disable the limit.": "maxSteps harus berupa angka positif, atau 0/null untuk menonaktifkan batas.",
+  "Hook {event} failed: {reason}": "Hook {event} gagal: {reason}",
+  "list background tasks": "daftar tugas latar belakang",
+  "Nothing to rewind.": "Tidak ada yang bisa di-rewind.",
+  "Rewound {n} turn(s): the conversation continues from before them.": "{n} giliran di-rewind: percakapan dilanjutkan dari sebelum giliran itu.",
+  "step back turns: conversation and file edits (/rewind 2)": "mundur beberapa giliran: percakapan + edit file (/rewind 2)",
+  "review a pull request (/pr <n|url|branch>)": "review pull request (/pr <n|url|branch>)",
   "Model must be in provider/model format, e.g. bc-cloud/glm-5.3-flash (got: {ref})": "Model harus berformat provider/model, contoh bc-cloud/glm-5.3-flash (dapat: {ref})",
   'Provider "{id}" is not in the config. Available: {list}': 'Provider "{id}" tidak ada di config. Tersedia: {list}',
   "No API key for {id} yet. Run `bccli login` or set the env var {env}.": "API key untuk {id} belum ada. Jalankan `bccli login` atau set env {env}.",
@@ -171,6 +184,13 @@ Opsi:
   "Usage: bccli provider {action} <id>": "Pemakaian: bccli provider {action} <id>",
   "{id} removed.": "{id} dihapus.",
   "Unknown action: {action}. Use list, add, or remove.": "Aksi tidak dikenal: {action}. Pakai list, add, atau remove.",
+  "Unknown action: {action}. Use list, add, remove, auth, or logout.": "Aksi tidak dikenal: {action}. Pakai list, add, remove, auth, atau logout.",
+  "OAuth required for {name}: run bccli mcp auth {name}": "OAuth diperlukan untuk {name}: jalankan bccli mcp auth {name}",
+  "{name} is not an installed HTTP MCP server. Add it first with: bccli mcp add {name} --url <url>": "{name} bukan server MCP HTTP yang terpasang. Tambahkan dulu: bccli mcp add {name} --url <url>",
+  "{name} authorized. Active in the next bccli session.": "{name} terautorisasi. Aktif di sesi bccli berikutnya.",
+  "OAuth login failed for {name}: {reason}": "Login OAuth gagal untuk {name}: {reason}",
+  "{name} logged out.": "{name} telah logout.",
+  "{name} has no stored OAuth tokens.": "{name} tidak menyimpan token OAuth.",
   "{id} is not a preset. For a custom provider add --url <OpenAI-compatible base URL>.": "{id} bukan preset. Untuk provider custom tambahkan --url <base URL OpenAI-compatible>.",
   "API key for {id} (leave empty if not needed): ": "API key untuk {id} (kosongkan bila tidak perlu): ",
   "{id} is ready. {n} models available.": "{id} siap. {n} model tersedia.",
@@ -195,10 +215,11 @@ Opsi:
   '-p mode needs a task, e.g. bccli -p "explain this repo"': 'Mode -p butuh tugas, contoh: bccli -p "jelaskan repo ini"',
   'Project MCP server "{name}" skipped (not approved yet; run interactive bccli once to approve it).': 'Server MCP project "{name}" dilewati (belum diizinkan; jalankan bccli interaktif sekali untuk menyetujuinya).',
   'Interactive mode needs a terminal. For scripts/CI use: bccli -p "task"': 'Mode interaktif butuh terminal. Untuk skrip/CI pakai: bccli -p "tugas"',
-  "Agent must be one of: opencode, aider, cline, deepseek-harness (dsh), cursor, openai-cli, openai-sdk, openai-compatible, codex, claude-code": "Agent harus salah satu dari: opencode, aider, cline, deepseek-harness (dsh), cursor, openai-cli, openai-sdk, openai-compatible, codex, claude-code",
+  "Agent must be one of: opencode, aider, cline, deepseek-harness (dsh), cursor, openai-cli, openai-sdk, openai-compatible, codex, claude-code, openclaw, hermes": "Agent harus salah satu dari: opencode, aider, cline, deepseek-harness (dsh), cursor, openai-cli, openai-sdk, openai-compatible, codex, claude-code, openclaw, hermes",
   "Cannot determine the home directory.": "Home directory tidak dapat ditentukan.",
   "No BotConnector API key yet. Run bccli login bc-cloud first.": "API key BotConnector belum tersedia. Jalankan bccli login bc-cloud terlebih dahulu.",
   "Could not load the BotConnector model catalog (HTTP {status}).": "Katalog model BotConnector gagal dimuat (HTTP {status}).",
+  "The BotConnector model catalog is empty; cannot configure external agents.": "Katalog model BotConnector kosong; agent eksternal tidak dapat dikonfigurasi.",
   "The OpenCode config is not valid JSON: {path}": "Config OpenCode tidak valid JSON: {path}",
   "OpenCode is connected to BotConnector ({n} models).": "OpenCode terhubung ke BotConnector ({n} model).",
   "The Aider config already has its own env-file/openai-api settings: {path}. BCCLI will not overwrite them.": "Config Aider sudah memiliki env-file/openai-api setting sendiri: {path}. BCCLI tidak akan menimpanya.",
@@ -219,6 +240,15 @@ Opsi:
   "Codex already has botconnector.config.toml. BCCLI will not overwrite it.": "Codex sudah memiliki botconnector.config.toml. BCCLI tidak akan menimpanya.",
   "Codex CLI is connected to the BotConnector Responses API.": "Codex CLI terhubung ke BotConnector Responses API.",
   "Claude Code is connected to the BotConnector Anthropic Messages compatibility API.": "Claude Code terhubung ke BotConnector Anthropic Messages compatibility API.",
+  'OpenClaw already has a provider "{id}" with a different endpoint ({base}). BCCLI will not overwrite it; disconnect or change that provider first.': 'OpenClaw sudah memiliki provider "{id}" dengan endpoint lain ({base}). BCCLI tidak akan menimpanya; disconnect/ubah provider tersebut lebih dulu.',
+  "The OpenClaw config is not valid JSON: {path}": "Config OpenClaw tidak valid JSON: {path}",
+  "OpenClaw is connected to BotConnector ({n} models; default {model}).": "OpenClaw terhubung ke BotConnector ({n} model; default {model}).",
+  "API key: env {env} (SecretRef, not stored in the config).": "API key: env {env} (SecretRef, tidak disimpan di config).",
+  "Set the default model in OpenClaw with: openclaw models set {provider}/{model}": "Atur model default di OpenClaw dengan: openclaw models set {provider}/{model}",
+  "The Hermes config is not valid YAML: {path}": "Config Hermes tidak valid YAML: {path}",
+  'Hermes already has a provider "{id}" with a different endpoint ({base}). BCCLI will not overwrite it; disconnect or change that provider first.': 'Hermes sudah memiliki provider "{id}" dengan endpoint lain ({base}). BCCLI tidak akan menimpanya; disconnect/ubah provider tersebut lebih dulu.',
+  "Hermes is connected to BotConnector ({n} models; default {model}).": "Hermes terhubung ke BotConnector ({n} model; default {model}).",
+  "API key: env {env} only (via key_env; a plaintext key in config.yaml is never written).": "API key: hanya env {env} (melalui key_env; key plaintext tidak pernah ditulis ke config.yaml).",
   "{target}: not managed by BCCLI yet.": "{target}: belum dikelola oleh BCCLI.",
   "{target}: the BotConnector integration was removed and the config restored.": "{target}: integrasi BotConnector dilepas dan config dipulihkan.",
   "Custom commands:": "Perintah custom:",
@@ -305,7 +335,9 @@ Opsi:
   "{n} characters": "{n} karakter",
   "{input} tokens in \xB7 {output} tokens out": "{input} token masuk \xB7 {output} token keluar",
   "Run: dsh web": "Jalankan: dsh web",
-  "timeout after {n} seconds": "timeout {n} detik"
+  "timeout after {n} seconds": "timeout {n} detik",
+  "Could not start MCP servers: {error}": "Tidak bisa menjalankan server MCP: {error}",
+  "Blocked: {host} resolves to a private address ({addr}). Fetching an internal host through a public DNS name is not allowed.": "Diblokir: {host} mengarah ke alamat privat ({addr}). Mengambil host internal lewat nama DNS publik tidak diizinkan."
 };
 
 // src/i18n.ts
@@ -337,108 +369,11 @@ function resolveLanguage(argv, env, fromConfig) {
   return langFromArgv(argv) ?? parseLang(env.BCCLI_LANG) ?? parseLang(fromConfig) ?? "en";
 }
 
-// src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var ConfigError = class extends Error {
-};
-var DEFAULT_CONFIG = {
-  model: "bc-cloud/glm-5.3-flash",
-  permissionMode: "default",
-  reasoning: "auto",
-  providers: Object.fromEntries(PRESETS.map((p) => [p.id, { baseURL: p.baseURL, apiKeyEnv: p.apiKeyEnv }])),
-  allow: []
-};
-function bccliHome(env = process.env) {
-  return env.BCCLI_HOME ?? join(homedir(), ".bccli");
-}
-function readJsonConfig(path) {
-  if (!existsSync(path)) return {};
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch (error) {
-    throw new ConfigError(t("Invalid config: {path} ({error})", { path, error: error.message }));
-  }
-}
-function untrustedProviders(project, known) {
-  const out = {};
-  for (const [id, provider] of Object.entries(project.providers ?? {})) {
-    if (known[id] || typeof provider?.baseURL !== "string") continue;
-    out[id] = { baseURL: provider.baseURL };
-  }
-  return out;
-}
-function loadConfig(cwd, env = process.env) {
-  const global = readJsonConfig(join(bccliHome(env), "config.json"));
-  const project = readJsonConfig(join(cwd, ".bccli", "config.json"));
-  const known = { ...DEFAULT_CONFIG.providers, ...global.providers };
-  const fromProject = untrustedProviders(project, known);
-  return {
-    model: project.model ?? global.model ?? DEFAULT_CONFIG.model,
-    permissionMode: global.permissionMode ?? DEFAULT_CONFIG.permissionMode,
-    reasoning: global.reasoning ?? DEFAULT_CONFIG.reasoning,
-    providers: { ...known, ...fromProject },
-    projectProviders: Object.keys(fromProject),
-    allow: [...global.allow ?? []]
-  };
-}
-function readCredentials(env = process.env) {
-  const path = join(bccliHome(env), "credentials");
-  if (!existsSync(path)) return {};
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function saveCredential(providerId, key, env = process.env) {
-  const home = bccliHome(env);
-  mkdirSync(home, { recursive: true });
-  const path = join(home, "credentials");
-  writeFileSync(path, JSON.stringify({ ...readCredentials(env), [providerId]: key }, null, 2), { mode: 384 });
-  chmodSync(path, 384);
-}
-function resolveModel(config, modelRef, env = process.env) {
-  const slash = modelRef.indexOf("/");
-  if (slash <= 0 || slash === modelRef.length - 1) {
-    throw new ConfigError(t("Model must be in provider/model format, e.g. bc-cloud/glm-5.3-flash (got: {ref})", { ref: modelRef }));
-  }
-  const providerId = modelRef.slice(0, slash);
-  const provider = config.providers[providerId];
-  if (!provider) {
-    throw new ConfigError(t('Provider "{id}" is not in the config. Available: {list}', { id: providerId, list: Object.keys(config.providers).join(", ") }));
-  }
-  const apiKey = (provider.apiKeyEnv ? env[provider.apiKeyEnv] : void 0) || readCredentials(env)[providerId] || void 0;
-  if (provider.apiKeyEnv && !apiKey) {
-    throw new ConfigError(t("No API key for {id} yet. Run `bccli login` or set the env var {env}.", { id: providerId, env: provider.apiKeyEnv }));
-  }
-  return { providerId, model: modelRef.slice(slash + 1), baseURL: provider.baseURL.replace(/\/+$/, ""), apiKey };
-}
-function removeCredential(providerId, env = process.env) {
-  const creds = readCredentials(env);
-  if (!(providerId in creds)) return false;
-  delete creds[providerId];
-  const path = join(bccliHome(env), "credentials");
-  writeFileSync(path, JSON.stringify(creds, null, 2), { mode: 384 });
-  chmodSync(path, 384);
-  return true;
-}
-
 export {
-  PRESETS,
   parseLang,
   setLanguage,
   getLanguage,
   locale,
   t,
-  resolveLanguage,
-  ConfigError,
-  bccliHome,
-  readJsonConfig,
-  loadConfig,
-  readCredentials,
-  saveCredential,
-  resolveModel,
-  removeCredential
+  resolveLanguage
 };