@botconnector/bccli 0.5.3 → 0.5.5

package/branding.mjs

@@ -5,9 +5,9 @@ import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, r
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { homedir } from 'node:os'
-import { BCCLI_MODEL_COMMAND } from './model-command.mjs'
 import { BCCLI_PROVIDER_COMMAND } from './provider-command.mjs'
 import { BCCLI_PROVIDER_DIALOG } from './provider-dialog.mjs'
+import { BCCLI_MODEL_DIALOG } from './model-dialog.mjs'
 
 const VERSION = '0.26.3'
 const SOURCE_HASHES = Object.freeze({
@@ -33,7 +33,7 @@ const SOURCE_HASHES = Object.freeze({
   'chunks/chunk-B3ZFUGTC.js': 'f3f57aafbaeab56ca58f5d3173751d30e5fef815aeaf8dc9b46e6ea9e85eb528',
   'chunks/chunk-GGVWG4SI.js': '945c7f4e9b3697003c165b7bc5d007c9b87140d1fad7be084d7b253d8d2b476c',
 })
-const BRAND_REVISION = 'bccli-20261031-win-bootstrap-session-v15'
+const BRAND_REVISION = 'bccli-20261031-model-picker-search-v18'
 // Deliberately not Qwen's blue→purple→rose gradient. BotConnector-facing
 // coding CLI uses a distinct teal→green→amber palette in dark/light themes.
 export const BCCLI_COLORS = Object.freeze(['#00AFA0', '#22C55E', '#EAB308'])
@@ -66,9 +66,11 @@ function replaceOnce(text, oldValue, newValue, label) {
 
 
 // Embedded slash commands are part of the upstream renderer bundle. BCCLI's
-// Gateway owns authentication, model eligibility and release management, so
-// those commands must not open arbitrary upstream provider settings or invoke
-// the upstream npm / standalone auto-updater.
+// Gateway owns authentication and release management, so those commands must
+// not open arbitrary upstream provider settings or invoke the upstream npm /
+// standalone auto-updater. /model keeps the upstream command, but its primary
+// picker is BCCLI's searchable dialog (see model-dialog.mjs); the auxiliary
+// pickers stay upstream-owned.
 export function guardUpstreamProviderCommands(text) {
   const replacements = [
     {
@@ -76,11 +78,6 @@ export function guardUpstreamProviderCommands(text) {
       detect: 'dialog:"auth"',
       code: BCCLI_PROVIDER_COMMAND,
     },
-    {
-      command: 'model',
-      detect: 'dialog:"model"',
-      code: BCCLI_MODEL_COMMAND,
-    },
     {
       command: 'settings',
       detect: 'dialog:"settings"',
@@ -202,6 +199,23 @@ function renameProductLanguage(text) {
   return out
 }
 
+// The upstream Select Model list cannot be filtered and the gateway catalog is
+// long, so the primary picker becomes BCCLI's searchable one. The auxiliary
+// pickers (fast / vision / voice / compaction / image / advisor) keep the
+// upstream implementation, which owns their eligibility and persistence rules;
+// the BCCLI component delegates to it for those modes.
+export function patchModelDialog(text) {
+  const renamed = replaceExactly(text,
+    'function ModelDialog(',
+    'function UpstreamModelDialog(',
+    1,
+    'model picker upstream rename')
+  return replaceOnce(renamed,
+    'function UpstreamModelDialog(',
+    BCCLI_MODEL_DIALOG + '\nfunction UpstreamModelDialog(',
+    'model picker BCCLI search dialog')
+}
+
 export function patchUiChunk(file, text) {
   if (file === 'chunks/chunk-Y6HHV4LC.js') {
     // Keep both context formats available and prioritize the vendor-neutral
@@ -302,6 +316,7 @@ export function patchUiChunk(file, text) {
       throw Error('BCCLI arrow-key provider dialog locator changed upstream.')
     }
     if (start >= 0) result = result.slice(0,start) + BCCLI_PROVIDER_DIALOG + result.slice(end)
+    result = patchModelDialog(result)
     return renameProductLanguage(result)
   }
   if (file === 'chunks/start-opentui-ui-Q34XCEMN.js') {

package/cli.mjs

@@ -1,13 +1,20 @@
 #!/usr/bin/env node
 import { readFileSync } from 'node:fs'
-import { DEFAULT_MODEL, assertCandidateRuntimeSupported, discoverModels, launchQwen, parseArgs, resolveQwenEntrypoint, resolveTrustedMcpConfig, selectModel } from './core.mjs'
+import { DEFAULT_MODEL, assertCandidateRuntimeSupported, discoverModels, launchQwen, parseArgs, resolveQwenEntrypoint, resolveTrustedMcpConfig, selectModel, sessionHome } from './core.mjs'
 import { prepareBrandedQwen } from './branding.mjs'
+import { readDialogSelectedModel } from './dialog-models.mjs'
 import { botConnectorCredentialStatus } from './credentials.mjs'
 import { resolveProvider, selectedProvider, providerDefinition, isConfigured } from './providers.mjs'
 import { runProviderCommand } from './provider-cli.mjs'
 import { startupMenu, autoSelectStartup, PROVIDER_SWITCH_EXIT } from './startup-menu.mjs'
 import { legacyCompatibilityMode, runLegacyCli } from './legacy-compat.mjs'
 
+// An unreadable or unsafe settings file must not block startup; the picker
+// simply falls back to the legacy active-model record.
+function dialogModel(providerId) {
+  try { return readDialogSelectedModel(sessionHome(providerId, process.env)) } catch { return undefined }
+}
+
 function help() {
   console.log([
     'BCCLI | BotConnector Coding Agent',
@@ -84,18 +91,22 @@ async function main() {
   if (!args.prompt && !process.stdin.isTTY) throw Error('Interactive mode requires a TTY; use -p "prompt".')
   const mcpConfig = resolveTrustedMcpConfig(args.mcpConfig)
   let chosen
+  let catalog
   const showPicker = args.command === 'chat' && !args.prompt && !args.model
   if (showPicker) {
     chosen = forceChoose ? undefined : await autoSelectStartup({
       ...(args.provider ? { providerId: args.provider } : {}),
+      dialogModel,
     })
     if (!chosen) chosen = await startupMenu({
       ...(args.provider ? { currentProvider: () => args.provider } : {}),
+      dialogModel,
     })
   } else {
     const providerId = args.provider ?? selectedProvider()
     const profile = resolveProvider(providerId)
     const models = await discoverModels({ key: profile.key, endpoint: profile.endpoint })
+    catalog = models
     const requested = args.model ??
       (providerId === 'botconnector' ? (process.env.BOTCONNECTOR_MODEL_ID ?? DEFAULT_MODEL) : undefined)
     if (!requested) throw Error('Use --model MODEL_ID for ' + providerId + '.')
@@ -109,15 +120,16 @@ async function main() {
     const code = await launchQwen({
       key: chosen.key, model: chosen.model, prompt: args.prompt,
       mcpConfig, entrypoint, upstream: chosen.endpoint,
-      providerId: chosen.providerId, continueSession, resumeSession,
+      providerId: chosen.providerId, continueSession, resumeSession, catalog,
     })
     if (code !== PROVIDER_SWITCH_EXIT) return code
     if (args.prompt || !process.stdin.isTTY) throw Error('Provider menu requires an interactive terminal.')
     // Older cached engine fallback only. Current /provider switches the live
     // parent proxy and model Config without exiting or exposing API keys.
     resumeSession = undefined // Native picker is used only on the first launch.
+    catalog = undefined // The next provider has its own eligible model list.
     const previousProvider = chosen.providerId
-    chosen = await startupMenu()
+    chosen = await startupMenu({ dialogModel })
     continueSession = previousProvider === chosen.providerId
   }
 }

package/core.mjs

@@ -7,12 +7,27 @@ import { dirname, join, isAbsolute } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { startGatewayProxy } from './proxy.mjs'
 import { GATEWAY } from './gateway.mjs'
-import { listProviderDefinitions } from './providers.mjs'
+import { listProviderDefinitions, providerRoot } from './providers.mjs'
 import { ensureIsolatedSessionSettings } from './session-settings.mjs'
+import { syncDialogModelCatalog } from './dialog-models.mjs'
 
 export { GATEWAY } from './gateway.mjs'
 export const DEFAULT_MODEL = 'ling-3.0-flash'
 
+// One engine home per provider keeps /model persistence provider-scoped.
+// BCCLI_PREVIEW_HOME (already the owner config/key root) also relocates the
+// engine home so isolated runs and tests never write to the real user profile.
+export function sessionHome(providerId, env = process.env) {
+  const override = typeof env.BCCLI_PREVIEW_HOME === 'string' ? env.BCCLI_PREVIEW_HOME.trim() : ''
+  if (override) {
+    if (!isAbsolute(override)) throw Error('BCCLI_PREVIEW_HOME must be absolute.')
+    return providerId === 'botconnector' ? override : join(override, 'sessions-' + providerId)
+  }
+  return providerId === 'botconnector'
+    ? join(homedir(), '.bccli-preview')
+    : join(homedir(), '.bccli-preview', 'sessions-' + providerId)
+}
+
 // Qwen Code 0.26.3 Windows tool-loop exits cleanly with Node 24.22.1
 // (GitHub Actions), but repeatedly crashes on Windows Node 24.18.0
 // with libuv UV_HANDLE_CLOSING after delivering the tool result.
@@ -210,7 +225,7 @@ export function childEnvironment(base, key, model, { endpoint = GATEWAY, home, p
   env.OPENAI_BASE_URL = endpoint
   env.OPENAI_MODEL = model
   env.QWEN_MODEL = model
-  env.QWEN_HOME = home ?? (providerId === 'botconnector' ? join(homedir(), '.bccli-preview') : join(homedir(), '.bccli-preview', 'sessions-' + providerId))
+  env.QWEN_HOME = home ?? sessionHome(providerId, env)
   env.BCCLI_ACTIVE_PROVIDER = providerId
   env.BCCLI_WEB_SEARCH_AVAILABLE = searchAvailable ? '1' : '0'
   env.CLI_TITLE = 'BCCLI - ' + process.cwd().split(/[\\/]/).filter(Boolean).at(-1)
@@ -220,8 +235,9 @@ export function childEnvironment(base, key, model, { endpoint = GATEWAY, home, p
 
 // Explicit MCP servers run local commands on startup, so they must originate
 // from a config file the user deliberately placed outside any cloned project.
-// Full engine auto-discovery is subject to upstream workspace trust.
-export function resolveTrustedMcpConfig(input, { home = join(homedir(), '.bccli-preview') } = {}) {
+// Full engine auto-discovery is subject to upstream workspace trust. The owner
+// config root follows BCCLI_PREVIEW_HOME so an isolated home is fully isolated.
+export function resolveTrustedMcpConfig(input, { home = providerRoot() } = {}) {
   if (!input) return undefined
   if (!isAbsolute(input)) throw Error('MCP config must use an absolute path.')
   let realHome, file, stats
@@ -260,7 +276,7 @@ export function resolveQwenEntrypoint() {
   return join(dirname(require.resolve('@qwen-code/qwen-code/package.json')), 'cli-entry.js')
 }
 
-export async function launchQwen({ key, model, prompt, mcpConfig, continueSession = false, resumeSession, upstream = GATEWAY, providerId = 'botconnector', env = process.env, entrypoint = resolveQwenEntrypoint(), spawnImpl = spawn, proxyFactory = startGatewayProxy }) {
+export async function launchQwen({ key, model, prompt, mcpConfig, continueSession = false, resumeSession, upstream = GATEWAY, providerId = 'botconnector', env = process.env, entrypoint = resolveQwenEntrypoint(), spawnImpl = spawn, proxyFactory = startGatewayProxy, catalog }) {
   // The real API key never enters Qwen, its tools, or any MCP child process.
   // Only this launcher retains it while the ephemeral proxy is running.
   const searchApiKey = env.BRAVE_SEARCH_API_KEY
@@ -269,6 +285,17 @@ export async function launchQwen({ key, model, prompt, mcpConfig, continueSessio
     const args = [entrypoint, ...qwenArguments(model, prompt, proxy.baseUrl, { mcpConfig, continueSession, resumeSession, projectDir: process.cwd() })]
     const childEnv = childEnvironment(env, proxy.token, model, { endpoint: proxy.baseUrl, providerId, searchAvailable: Boolean(searchApiKey?.trim()) })
     ensureIsolatedSessionSettings(childEnv.QWEN_HOME)
+    // The upstream /model picker needs the catalog in modelProviders; without
+    // it the dialog only knows the single OPENAI_MODEL route. Never block a
+    // launch on catalog failure: chat still works with the startup model.
+    if (proxyFactory === startGatewayProxy) {
+      try {
+        const dialogCatalog = catalog ?? await discoverModels({ key, endpoint: upstream })
+        syncDialogModelCatalog(childEnv.QWEN_HOME, { models: dialogCatalog, baseUrl: proxy.baseUrl })
+      } catch (error) {
+        if (env.BCCLI_DEBUG) console.error('BCCLI: model picker catalog unavailable: ' + (error instanceof Error ? error.message : 'unknown'))
+      }
+    }
     const child = spawnImpl(process.execPath, args, {
       cwd: process.cwd(), env: childEnv,
       stdio: 'inherit', windowsHide: false, shell: false,

package/dialog-models.mjs

@@ -0,0 +1,114 @@
+// The upstream /model picker lists models from settings.modelProviders. BCCLI's
+// engine can only reach the parent-owned loopback proxy, so publish the live
+// gateway catalog into the per-provider QWEN_HOME as one OpenAI-compatible
+// provider. BCCLI only supplies the eligible model set and reads back the
+// persisted selection: the primary picker is BCCLI's own searchable dialog
+// (see model-dialog.mjs), while the auxiliary pickers stay upstream-owned.
+import { lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { randomBytes } from 'node:crypto'
+import { join } from 'node:path'
+
+const MODEL_ID = /^[a-zA-Z0-9][a-zA-Z0-9._:/+-]{0,255}$/
+const LOOPBACK_ENDPOINT = /^http:\/\/127\.0\.0\.1:[0-9]{1,5}\/v1$/
+const MAX_SETTINGS_BYTES = 1024 * 1024
+
+export function buildDialogProviders(models, baseUrl) {
+  if (typeof baseUrl !== 'string' || !LOOPBACK_ENDPOINT.test(baseUrl)) {
+    throw Error('Model picker requires the local loopback provider endpoint.')
+  }
+  if (!Array.isArray(models) || models.length === 0) {
+    throw Error('Model picker requires a non-empty provider catalog.')
+  }
+  return models.map((item) => {
+    const id = item?.id
+    if (typeof id !== 'string' || !MODEL_ID.test(id)) {
+      throw Error('Invalid provider model id for the model picker.')
+    }
+    const name = typeof item?.name === 'string' && item.name.trim() ? item.name.trim().slice(0, 90) : id
+    return { id, name, baseUrl, envKey: 'OPENAI_API_KEY' }
+  })
+}
+
+// Keep unrelated settings and other configured providers byte-for-byte; only
+// the OpenAI-compatible entry is owned by the live loopback proxy.
+export function mergeDialogProviders(settings, providers) {
+  const base = settings && typeof settings === 'object' && !Array.isArray(settings) ? settings : {}
+  const existing = base.modelProviders
+  const modelProviders = existing && typeof existing === 'object' && !Array.isArray(existing) ? existing : {}
+  return { ...base, modelProviders: { ...modelProviders, openai: providers } }
+}
+
+function readSettings(home) {
+  const info = lstatSync(home)
+  if (!info.isDirectory() || info.isSymbolicLink()) {
+    throw Error('BCCLI session directory must not be a symlink.')
+  }
+  const file = join(home, 'settings.json')
+  let stats
+  try {
+    stats = lstatSync(file)
+  } catch {
+    return {}
+  }
+  if (!stats.isFile() || stats.isSymbolicLink()) {
+    throw Error('BCCLI session settings must be a regular file.')
+  }
+  if (stats.size > MAX_SETTINGS_BYTES) throw Error('BCCLI session settings are too large.')
+  const text = readFileSync(file, 'utf8').trim()
+  if (!text) return {}
+  const parsed = JSON.parse(text)
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw Error('BCCLI session settings must contain a JSON object.')
+  }
+  return parsed
+}
+
+function writeSettings(home, settings) {
+  const file = join(home, 'settings.json')
+  const tmp = file + '.' + randomBytes(8).toString('hex') + '.tmp'
+  try {
+    writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n', { flag: 'wx', encoding: 'utf8', mode: 0o600 })
+    renameSync(tmp, file)
+  } finally {
+    rmSync(tmp, { force: true })
+  }
+}
+
+// A picker selection persists model.baseUrl alongside the id. The proxy port is
+// ephemeral, so clear only an endpoint this module previously injected once the
+// loopback port changes; unrelated endpoints are never rewritten.
+function clearStalePickerEndpoint(settings, baseUrl) {
+  const injected = settings.modelProviders?.openai
+  if (!Array.isArray(injected)) return settings
+  const previous = new Set(injected
+    .map((entry) => entry?.baseUrl)
+    .filter((url) => typeof url === 'string' && LOOPBACK_ENDPOINT.test(url)))
+  const model = settings.model
+  if (!model || typeof model !== 'object' || Array.isArray(model)) return settings
+  if (typeof model.baseUrl !== 'string' || !previous.has(model.baseUrl) || model.baseUrl === baseUrl) return settings
+  return { ...settings, model: { ...model, baseUrl: '' } }
+}
+
+// Returns true only when the catalog actually changed, so a normal relaunch
+// does not touch the user's settings file.
+export function syncDialogModelCatalog(home, { models, baseUrl }) {
+  if (typeof home !== 'string' || !home.trim()) throw Error('BCCLI session home missing.')
+  const providers = buildDialogProviders(models, baseUrl)
+  mkdirSync(home, { recursive: true, mode: 0o700 })
+  const current = clearStalePickerEndpoint(readSettings(home), baseUrl)
+  const next = mergeDialogProviders(current, providers)
+  if (JSON.stringify(next) === JSON.stringify(current)) return false
+  writeSettings(home, next)
+  return true
+}
+
+// The upstream picker persists the chosen id to settings.model.name. Read it
+// back so the next launch (and the pre-launch menu) starts on the same model.
+export function readDialogSelectedModel(home) {
+  if (typeof home !== 'string' || !home.trim()) return undefined
+  const settings = readSettings(home)
+  const name = settings.model?.name
+  if (typeof name !== 'string') return undefined
+  const trimmed = name.trim()
+  return MODEL_ID.test(trimmed) ? trimmed : undefined
+}

package/model-dialog.mjs

@@ -0,0 +1,130 @@
+// BCCLI-owned model picker, injected into the locked upstream `ModelDialog`
+// slot. The upstream dialog renders one flat numbered list with no way to type
+// a name, while the gateway catalog is long; this replacement adds the same
+// search row BCCLI's provider picker already ships.
+//
+// Only the primary model goes through this picker. The auxiliary dialogs
+// (fast / vision / voice / compaction / image / advisor) keep the upstream
+// implementation, because they own per-mode eligibility and persistence rules
+// that this picker must not re-implement.
+//
+// Runtime identifiers are the aliases the surrounding engine chunk already
+// uses for this region: import_react31 for hooks, import_jsx_runtime36 for jsx.
+export const BCCLI_MODEL_DIALOG = String.raw`function BccliModelPicker(props){
+  const config=useConfig();
+  const [models,setModels]=(0,import_react31.useState)([]);
+  const [search,setSearch]=(0,import_react31.useState)("");
+  const [editing,setEditing]=(0,import_react31.useState)(false);
+  const [cursor,setCursor]=(0,import_react31.useState)(0);
+  const [message,setMessage]=(0,import_react31.useState)("");
+  const [busy,setBusy]=(0,import_react31.useState)(false);
+  const [active,setActive]=(0,import_react31.useState)(config.getModel?.()||"");
+  const base=process.env.OPENAI_BASE_URL||"";
+  const token=process.env.OPENAI_API_KEY||"";
+  const request=async(path,options={})=>{
+    if(!/^http:\/\/127\.0\.0\.1:[0-9]{1,5}\/v1$/.test(base)||!token) throw Error("Local provider session unavailable");
+    const result=await fetch(base+path,{method:options.method||"GET",
+      headers:{Authorization:"Bearer "+token,Accept:"application/json",...(options.body?{"Content-Type":"application/json"}:{})},
+      ...(options.body?{body:JSON.stringify(options.body)}:{}),
+      redirect:"error",signal:AbortSignal.timeout(12000)});
+    const json=await result.json().catch(()=>null);
+    if(!result.ok)throw Error(json?.error||"Provider request failed");
+    return json;
+  };
+  (0,import_react31.useEffect)(()=>{
+    let mounted=true;
+    request("/models").then(value=>{
+      if(!mounted)return;
+      const ids=[...new Set((Array.isArray(value?.data)?value.data:[]).map(x=>x?.id).filter(x=>typeof x==="string"))].sort();
+      setModels(ids);
+      setActive(config.getModel?.()||"");
+    }).catch(()=>{if(mounted)setMessage("Could not read the model catalog from the local BCCLI gateway.")});
+    return()=>{mounted=false};
+  },[]);
+  const needle=search.trim().toLowerCase();
+  const filtered=needle?models.filter(x=>x.toLowerCase().includes(needle)):models;
+  const count=filtered.length;
+  const at=count?Math.min(cursor,count-1):0;
+  const searchRow="🔎 Search model: "+(search||"(all)")+(editing?" █":"   [Enter to search]");
+  // Switching keeps the loopback proxy: setModel refreshes the live content
+  // generator, then the gateway records the choice for the next launch. If the
+  // record fails, the previous model is restored so the dialog never lies.
+  const choose=async(id)=>{
+    if(busy)return;
+    setBusy(true);setMessage("");
+    const previous=config.getModel?.();
+    try{
+      await config.setModel(id,{reason:"bccli-gateway-model-picker"});
+      if(config.getModel?.()!==id)throw Error("Model switch did not take effect");
+      try{
+        const providers=await request("/bccli/providers");
+        await request("/bccli/provider/switch",{method:"POST",
+          body:{action:"user-selected-provider",provider:providers.active,model:id}});
+      }catch{
+        if(previous&&previous!==id)await config.setModel(previous,{reason:"bccli-gateway-model-picker-rollback"}).catch(()=>{});
+        throw Error("Model selection was not saved");
+      }
+      setActive(id);
+      props.onClose?.();
+    }catch(error){
+      setMessage(String(error?.message||"Model selection failed"));
+    }finally{setBusy(false)}
+  };
+  useKeypress(key=>{
+    if(busy)return;
+    if(key.name==="escape"){
+      if(editing){setEditing(false);return}
+      if(search){setSearch("");setCursor(0);return}
+      props.onClose?.();return;
+    }
+    if(key.ctrl&&key.name==="f"||key.sequence==="/"&&!key.ctrl&&!key.meta){
+      setEditing(true);return;
+    }
+    if(key.name==="up"||key.ctrl&&key.name==="p"){setEditing(false);setCursor(Math.max(0,at-1));return}
+    if(key.name==="down"||key.ctrl&&key.name==="n"){setEditing(false);setCursor(Math.min(Math.max(0,count-1),at+1));return}
+    if(key.name==="backspace"||key.name==="delete"){
+      if(editing){setSearch(s=>s.slice(0,-1));setCursor(0)}
+      return;
+    }
+    if(key.ctrl&&key.name==="u"){setSearch("");setCursor(0);setEditing(true);return}
+    if(key.name==="return"){
+      const picked=filtered[at];
+      if(picked)void choose(picked);
+      return;
+    }
+    if(!key.ctrl&&!key.meta){
+      const incoming=String(key.sequence||"");
+      if(incoming&&incoming.length<=128&&/^[a-zA-Z0-9._:/+ -]+$/.test(incoming)){
+        setSearch(s=>(s+incoming).slice(0,64));setEditing(true);setCursor(0);
+      }
+    }
+  },{isActive:true});
+  const start=Math.max(0,Math.min(at-4,Math.max(0,count-10)));
+  const visible=filtered.slice(start,start+10);
+  const title="BCCLI | Select model"+(props.persistScope==="workspace"?" (this project)":props.persistScope==="user"?" (global)":"");
+  return (0,import_jsx_runtime36.jsxs)(Box_default,{borderStyle:"round",borderColor:theme?.border?.default,
+    flexDirection:"column",padding:1,width:"100%",children:[
+    (0,import_jsx_runtime36.jsx)(Text,{bold:true,children:title}),
+    (0,import_jsx_runtime36.jsx)(Text,{color:theme.text.secondary,children:models.length?
+      "Search models ("+count+"/"+models.length+") · type to filter · Esc clears the search, then closes":
+      "Loading the provider model catalog..."}),
+    (0,import_jsx_runtime36.jsx)(Text,{color:editing?theme.text.link:theme.text.secondary,children:searchRow}),
+    ...(visible.length?visible.map((label,index)=>{
+      const absolute=start+index,focused=absolute===at;
+      return (0,import_jsx_runtime36.jsx)(Box_default,{
+        children:(0,import_jsx_runtime36.jsx)(Text,{bold:focused,color:focused?theme.text.link:theme.text.primary,
+          children:(focused?"❯ ":"  ")+label+(label===active?"  [ACTIVE]":"")})},String(absolute))
+    }):[(0,import_jsx_runtime36.jsx)(Text,{color:theme.text.secondary,
+      children:models.length?"No models match the search. Backspace to adjust.":(busy?"Switching model...":"Loading...")},"empty")]),
+    (0,import_jsx_runtime36.jsx)(Text,{color:theme.text.secondary,
+      children:(count?(Math.min(start+1,count)+"-"+(start+visible.length)+" of "+count+"  |  "):"")+
+      "↑↓ navigate · Enter select · / search · Ctrl+U clear · Backspace edit · Esc close"}),
+    message?(0,import_jsx_runtime36.jsx)(Text,{color:theme.status.error,children:message}):null,
+    (0,import_jsx_runtime36.jsx)(Text,{color:theme.text.secondary,children:"Active model: "+(active||"(unknown)")})
+  ]})
+}
+function ModelDialog(props){
+  const auxiliary=props.isFastModelMode||props.isAdvisorModelMode||props.isVoiceModelMode||props.isVisionModelMode||props.isCompactionModelMode||props.isImageModelMode;
+  if(auxiliary)return (0,import_jsx_runtime36.jsx)(UpstreamModelDialog,props);
+  return (0,import_jsx_runtime36.jsx)(BccliModelPicker,props);
+}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botconnector/bccli",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "BCCLI | Full coding engine and legacy SDK with verified Apache-2.0 bundled runtime",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
     "test": "node --test test/*.test.mjs",
     "test:security": "node --test test/security-e2e.test.mjs test/proxy-mcp-e2e.test.mjs test/trusted-mcp.test.mjs test/proxy.test.mjs",
     "test:integration": "node --test test-integration/*.test.mjs",
-    "build": "node --check cli.mjs && node --check core.mjs && node --check proxy.mjs && node --check gateway.mjs && node --check branding.mjs && node --check credentials.mjs && node --check model-command.mjs && node --check providers.mjs && node --check provider-cli.mjs && node --check startup-menu.mjs",
+    "build": "node --check cli.mjs && node --check core.mjs && node --check proxy.mjs && node --check gateway.mjs && node --check branding.mjs && node --check model-dialog.mjs && node --check credentials.mjs && node --check dialog-models.mjs && node --check providers.mjs && node --check provider-cli.mjs && node --check startup-menu.mjs",
     "rebuild": "npm run build && npm test && npm pack --ignore-scripts"
   },
   "license": "Apache-2.0",
@@ -43,7 +43,8 @@
     "gateway.mjs",
     "branding.mjs",
     "credentials.mjs",
-    "model-command.mjs",
+    "dialog-models.mjs",
+    "model-dialog.mjs",
     "providers.mjs",
     "provider-cli.mjs",
     "startup-menu.mjs",
@@ -81,8 +82,8 @@
   },
   "bccliRuntimeSource": {
     "repository": "https://github.com/farijarifriyanto-debug/bccli-runtime",
-    "commit": "eb5e057b3f568e9def717cdc3d8a3b11ce82544f",
-    "release": "bccli-v0.5.3",
-    "originalSha256": "3a185b33af625ef9df3552e40a9390d4d271b0b977971433357b2f592b5553bc"
+    "commit": "5caed31a1a12a6d6257b815b3f5073f077b12716",
+    "release": "bccli-v0.5.5",
+    "originalSha256": "1fab7322f7e201aac20371c372828cfcea73acefdb2ad187d3b3143b885384a9"
   }
 }

package/provider-command.mjs

@@ -21,12 +21,18 @@ export const BCCLI_PROVIDER_COMMAND = String.raw`var authCommand={name:"provider
     if(!Array.isArray(data?.providers))return response("error","Provider list unavailable.");
     var providers=data.providers;
     var current=data.active||"(unknown)";
+    // OpenTUI renders the upstream AuthDialog for dialog:"auth", which would
+    // expose provider settings BCCLI does not own. Keep the same gateway-owned
+    // text flow there instead of opening that dialog.
+    var openTui=process.env.QWEN_TUI_RENDERER==="opentui";
+    var listText=()=>"BCCLI providers — active: "+current+"\n\n"+providers.map((p,i)=>(i+1)+". "+p.id+" — "+p.name+(p.active?" [ACTIVE]":"")+(p.configured?" [configured]":" [API key required]")).join("\n")+"\n\nChoose: /provider NUMBER or /provider NAME\nSave/replace key: /provider add NAME\nDelete saved key: /provider remove NAME\nSelect AI: /provider NAME MODEL_ID\nKeys open a hidden Windows dialog; NEVER paste keys into chat.";
     if(!params.length){
+      if(openTui)return response("info",listText());
       delete process.env.BCCLI_PROVIDER_PICKER_FOCUS;
       return {type:"dialog",dialog:"auth"};
     }
     if(params[0]==="list"){
-      return response("info","BCCLI providers — active: "+current+"\n\n"+providers.map((p,i)=>(i+1)+". "+p.id+" — "+p.name+(p.active?" [ACTIVE]":"")+(p.configured?" [configured]":" [API key required]")).join("\n")+"\n\nChoose: /provider NUMBER or /provider NAME\nSave/replace key: /provider add NAME\nDelete saved key: /provider remove NAME\nSelect AI: /provider NAME MODEL_ID\nKeys open a hidden Windows dialog; NEVER paste keys into chat.");
+      return response("info",listText());
     }
     if(params.length===1&&params[0].toLowerCase()==="add"){
       const created=await request("/bccli/provider/custom/add",{method:"POST",timeoutMs:190000,
@@ -53,7 +59,7 @@ export const BCCLI_PROVIDER_COMMAND = String.raw`var authCommand={name:"provider
       return response("error","The key operation was not confirmed.");
     }
     var id=/^[0-9]+$/.test(params[0])?providers[Number(params[0])-1]?.id:params[0].toLowerCase();
-    if(params.length===1&&providers.some(p=>p.id===id)){
+    if(params.length===1&&providers.some(p=>p.id===id)&&!openTui){
       process.env.BCCLI_PROVIDER_PICKER_FOCUS=id;
       return {type:"dialog",dialog:"auth"};
     }

package/startup-menu.mjs

@@ -14,19 +14,24 @@ export async function autoSelectStartup({
   providerId = selectedProvider(),
   configured = isConfigured,
   remembered = selectedModel,
+  dialogModel = () => undefined,
   resolve = resolveProvider,
   list = discoverModels,
   defaultModel = DEFAULT_MODEL,
   env = process.env,
 } = {}) {
   if (!configured(providerId)) return undefined
-  const requested = providerId === 'botconnector'
-    ? (env.BOTCONNECTOR_MODEL_ID || remembered(providerId) || defaultModel)
-    : remembered(providerId)
-  if (!requested) return undefined
+  // A model chosen in the upstream /model picker is persisted in the engine's
+  // per-provider settings; it wins over the older active-model file, but only
+  // when the live catalog still offers it.
+  const candidates = providerId === 'botconnector'
+    ? [env.BOTCONNECTOR_MODEL_ID, dialogModel(providerId), remembered(providerId), defaultModel]
+    : [dialogModel(providerId), remembered(providerId)]
+  if (!candidates.some(Boolean)) return undefined
   const profile = resolve(providerId)
   const models = await list({ key: profile.key, endpoint: profile.endpoint })
-  if (!models.some(item => item.id === requested)) return undefined
+  const requested = candidates.find(id => id && models.some(item => item.id === id))
+  if (!requested) return undefined
   return { providerId, model: selectModel(models, requested), key: profile.key, endpoint: profile.endpoint }
 }
 
@@ -52,6 +57,7 @@ export async function startupMenu({
   saveKey = saveProviderKey,
   use = useProvider,
   remembered = selectedModel,
+  dialogModel = () => undefined,
   saveModel = saveSelectedModel,
   resolve = resolveProvider,
   list = discoverModels,
@@ -90,7 +96,7 @@ export async function startupMenu({
   const models = await list({ key: profile.key, endpoint: profile.endpoint })
   if (!models.length) throw Error('Tidak ada model untuk provider ini.')
   const all = [...models].sort((a, b) => a.id.localeCompare(b.id))
-  const previous = remembered(providerId)
+  const previous = dialogModel(providerId) ?? remembered(providerId)
   const preferred = all.some(m => m.id === previous) ? previous :
     providerId === 'botconnector' && all.some(m => m.id === defaultModel) ? defaultModel : undefined
   let filtered = all

package/model-command.mjs

@@ -1,61 +0,0 @@
-// Generated, version-pinned Qwen slash command overlay for /model.
-// Fetches the authenticated model catalog from the existing local BotConnector
-// proxy on each invocation. Selection changes Qwen Config in the current
-// session; it never opens upstream provider settings or writes project config.
-export const BCCLI_MODEL_COMMAND = String.raw`var bccliModelLastList=[];var modelCommand={name:"model",get description(){return "Choose an AI model from the active provider"},argumentHint:"[number|model-id|search WORD|page N]",kind:"built-in",supportedModes:["interactive","non_interactive","acp"],action:__name(async(context,argumentText)=>{
-  var response=(type,content)=>({type:"message",messageType:type,content});
-  try{
-    var base=process.env.OPENAI_BASE_URL||"";
-    var key=process.env.OPENAI_API_KEY||"";
-    if(!/^http:\/\/127\.0\.0\.1:[0-9]{1,5}\/v1$/.test(base)||!key){
-      return response("error","BCCLI requires an authenticated local provider session.");
-    }
-    var result=await fetch(base+"/models",{method:"GET",headers:{Authorization:"Bearer "+key,Accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(10000)});
-    if(!result.ok)return response("error","Provider model catalog is unavailable (HTTP "+result.status+"). No provider fallback.");
-    var payload=await result.json();
-    if(!Array.isArray(payload?.data))return response("error","Invalid provider model catalog.");
-    var catalog=new Map();
-    for(var entry of payload.data){
-      if(typeof entry?.id==="string" && /^[a-zA-Z0-9][a-zA-Z0-9._:/+-]{0,255}$/.test(entry.id) && !catalog.has(entry.id)){
-        catalog.set(entry.id,{id:entry.id,name:typeof entry.name==="string"?entry.name.slice(0,90):entry.id});
-      }
-    }
-    var all=[...catalog.values()].sort((a,b)=>a.id.localeCompare(b.id));
-    if(!all.length)return response("error","No provider models available for this API key.");
-    var text=String(context.invocation?.args||argumentText||"").trim();
-    var config=context.services?.config;
-    if(!config||typeof config.setModel!=="function")return response("error","BCCLI model switch is unavailable in this session.");
-    var current=config.getModel?.()||process.env.OPENAI_MODEL||"(unknown)";
-    var list=(entries,page=1)=>{
-      bccliModelLastList=entries.map(x=>x.id);
-      var size=12;
-      var pages=Math.max(1,Math.ceil(entries.length/size));
-      if(!Number.isSafeInteger(page)||page<1||page>pages)return response("error","Invalid page. Use /model page 1 ... "+pages);
-      var start=(page-1)*size;
-      var rows=entries.slice(start,start+size).map((x,i)=>(start+i+1)+". "+x.id+(x.id===current?"  [ACTIVE]":""));
-      return response("info","Provider AI models ("+entries.length+" available; page "+page+"/"+pages+")\nActive: "+current+"\n\n"+rows.join("\n")+"\n\nUse /model NUMBER or /model MODEL_ID to switch now; /model page N; /model search KEYWORD. To manage providers and their keys in this chat, use /provider, /provider add NAME or /provider remove NAME; then /provider NAME MODEL_ID.");
-    };
-    if(!text)return list(all);
-    var page=text.match(/^page\s+([0-9]+)$/i);
-    if(page)return list(all,Number(page[1]));
-    var search=text.match(/^search\s+(.{1,80})$/i);
-    if(search)return list(all.filter(x=>x.id.toLowerCase().includes(search[1].toLowerCase())||x.name.toLowerCase().includes(search[1].toLowerCase())));
-    var item;
-    if(/^[0-9]+$/.test(text)){
-      var index=Number(text);
-      item=Number.isSafeInteger(index)&&index>=1?catalog.get(bccliModelLastList[index-1]||all[index-1]?.id):undefined;
-    }else if(/^[a-zA-Z0-9][a-zA-Z0-9._:/+-]{0,255}$/.test(text)){
-      item=catalog.get(text);
-    }
-    if(!item)return response("error","That model is not available in your active provider catalog. Run /model to view allowed models.");
-    if(item.id===current)return response("info","Already using "+item.id+" via the active provider.");
-    // Raw model IDs are supported by Config.setModel; this preserves OpenAI
-    // auth/loopback proxy instead of switching providers. It refreshes the
-    // live content generator, so the next message uses the new model.
-    await config.setModel(item.id,{reason:"bccli-gateway-model-picker"});
-    if(config.getModel?.()!==item.id)return response("error","Model switch did not take effect; previous model preserved.");
-    return response("info","Switched to "+item.id+" in the current session. Routing and billing remain with the active provider.");
-  }catch{
-    return response("error","Provider model selection failed; no upstream provider fallback was used.");
-  }
-},"action")};`