@fased/fased 0.1.54 → 0.1.56

package/dist/commands/configure.gateway-auth.js

@@ -1,8 +1,9 @@
+import { resolveFasedAgentAgentDir } from "../agents/agent-paths.js";
 import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
 import "../agents/auth-profiles.js";
 import { randomToken } from "./onboard-helpers.js";
 import { promptAuthChoiceGrouped } from "./auth-choice-prompt.js";
-import { applyModelAllowlist, applyModelFallbacksFromSelection, promptModelAllowlist } from "./model-picker.js";
+import { applyModelAllowlist, applyModelFallbacksFromSelection, applyPrimaryModel, promptModelAllowlist } from "./model-picker.js";
 import { applyAuthChoice } from "./auth-choice.apply.js";
 import { resolvePreferredProviderForAuthChoice } from "./auth-choice.preferred-provider.js";
 import "./auth-choice.js";
@@ -20,12 +21,6 @@ function sanitizeTokenValue(value) {
 	}
 	return trimmed;
 }
-const ANTHROPIC_OAUTH_MODEL_KEYS = [
-	"anthropic/claude-fable-5",
-	"anthropic/claude-opus-4-8",
-	"anthropic/claude-sonnet-5",
-	"anthropic/claude-haiku-4-5"
-];
 function buildGatewayAuthConfig(params) {
 	const allowTailscale = params.existing?.allowTailscale;
 	const base = {};
@@ -61,9 +56,10 @@ function buildGatewayAuthConfig(params) {
 	return base;
 }
 async function promptAuthConfig(cfg, runtime, prompter) {
+	const agentDir = resolveFasedAgentAgentDir();
 	const authChoice = await promptAuthChoiceGrouped({
 		prompter,
-		store: ensureAuthProfileStore(undefined, { allowKeychainPrompt: false }),
+		store: ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false }),
 		includeSkip: true
 	});
 	let next = cfg;
@@ -82,24 +78,26 @@ async function promptAuthConfig(cfg, runtime, prompter) {
 			config: next,
 			prompter,
 			runtime,
-			setDefaultModel: true
+			setDefaultModel: false,
+			agentDir
 		});
 		next = applied.config;
 	}
-	const anthropicOAuth = authChoice === "anthropic-oauth" || authChoice === "setup-token" || authChoice === "token" || authChoice === "oauth";
 	const preferredProvider = authChoice !== "custom-api-key" ? resolvePreferredProviderForAuthChoice(authChoice, { config: next }) : undefined;
 	if (authChoice !== "custom-api-key" && authChoice !== "skip") {
 		const allowlistSelection = await promptModelAllowlist({
 			config: next,
 			prompter,
-			allowedKeys: anthropicOAuth ? ANTHROPIC_OAUTH_MODEL_KEYS : undefined,
-			initialSelections: anthropicOAuth ? ["anthropic/claude-sonnet-5"] : undefined,
-			message: anthropicOAuth ? "Anthropic OAuth models" : undefined,
-			preferredProvider
+			preferredProvider,
+			agentDir
 		});
 		if (allowlistSelection.models) {
-			next = applyModelAllowlist(next, allowlistSelection.models);
-			next = applyModelFallbacksFromSelection(next, allowlistSelection.models);
+			const selectedModels = allowlistSelection.models;
+			if (selectedModels[0]) {
+				next = applyPrimaryModel(next, selectedModels[0]);
+			}
+			next = applyModelAllowlist(next, selectedModels);
+			next = applyModelFallbacksFromSelection(next, selectedModels);
 		}
 	}
 	return next;

package/dist/commands/dashboard-link.js

@@ -4,7 +4,7 @@ import { parseDurationMs } from "../cli/parse-duration.js";
 import { readConfigFileSnapshot } from "../config/io.js";
 import "../config/config.js";
 import { CONTROL_UI_LOGIN_DEFAULT_GRANT_TTL_MS, createLoginGrant, normalizePublicHost } from "../gateway/control-ui-login.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/dashboard-link.ts
@@ -12,10 +12,10 @@ const AGENT_DOMAIN_SUFFIX = ".agents.fased.app";
 function readStateGatewayToken(env = process.env) {
 	try {
 		const filePath = path.join(resolveStateDir(env), "gateway-secret");
-		if (!fs.existsSync(filePath)) {
+		if (!syncFs.existsSync(filePath)) {
 			return "";
 		}
-		return fs.readFileSync(filePath, "utf8").trim();
+		return syncFs.readFileSync(filePath, "utf8").trim();
 	} catch {
 		return "";
 	}

package/dist/commands/doctor-config-flow.js

@@ -14,8 +14,8 @@ import "../config/config.js";
 import { listTelegramAccountIds, resolveTelegramAccount } from "../telegram/accounts.js";
 import "../channels/registry.js";
 import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
-import { listInterpreterLikeSafeBins, resolveMergedSafeBinProfileFixtures } from "../infra/exec-safe-bin-runtime-policy.js";
 import { readWalletApprovalAuthSnapshot } from "../wallet/wallet-approval-auth.js";
+import { listInterpreterLikeSafeBins, resolveMergedSafeBinProfileFixtures } from "../infra/exec-safe-bin-runtime-policy.js";
 import { applyPluginAutoEnable } from "../config/plugin-auto-enable.js";
 import { isNumericTelegramUserId, normalizeTelegramAllowFromEntry } from "../channels/telegram/allow-from.js";
 import { collectProviderDangerousNameMatchingScopes } from "../config/dangerous-name-matching.js";

package/dist/commands/doctor-install.js

@@ -1,5 +1,5 @@
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/doctor-install.ts
@@ -8,7 +8,7 @@ function noteSourceInstallIssues(root) {
 		return;
 	}
 	const workspaceMarker = path.join(root, "pnpm-workspace.yaml");
-	if (!fs.existsSync(workspaceMarker)) {
+	if (!syncFs.existsSync(workspaceMarker)) {
 		return;
 	}
 	const warnings = [];
@@ -16,13 +16,13 @@ function noteSourceInstallIssues(root) {
 	const pnpmStore = path.join(nodeModules, ".pnpm");
 	const tsxBin = path.join(nodeModules, ".bin", "tsx");
 	const srcEntry = path.join(root, "src", "entry.ts");
-	if (fs.existsSync(nodeModules) && !fs.existsSync(pnpmStore)) {
+	if (syncFs.existsSync(nodeModules) && !syncFs.existsSync(pnpmStore)) {
 		warnings.push("- node_modules was not installed by pnpm (missing node_modules/.pnpm). Run: pnpm install");
 	}
-	if (fs.existsSync(path.join(root, "package-lock.json"))) {
+	if (syncFs.existsSync(path.join(root, "package-lock.json"))) {
 		warnings.push("- package-lock.json present in a pnpm workspace. If you ran npm install, remove it and reinstall with pnpm.");
 	}
-	if (fs.existsSync(srcEntry) && !fs.existsSync(tsxBin)) {
+	if (syncFs.existsSync(srcEntry) && !syncFs.existsSync(tsxBin)) {
 		warnings.push("- tsx binary is missing for source runs. Run: pnpm install");
 	}
 	if (warnings.length > 0) {

package/dist/commands/doctor-memory-search.js

@@ -5,7 +5,7 @@ import { resolveApiKeyForProvider } from "../agents/model-auth.js";
 import { resolveMemoryBackendConfig } from "../memory/backend-config.js";
 import { resolveMemorySearchConfig } from "../agents/memory-search.js";
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 
 //#region src/commands/doctor-memory-search.ts
 /**
@@ -126,7 +126,7 @@ function hasLocalEmbeddings(local) {
 	}
 	const resolved = resolveUserPath(modelPath);
 	try {
-		return fs.statSync(resolved).isFile();
+		return syncFs.statSync(resolved).isFile();
 	} catch {
 		return false;
 	}

package/dist/commands/doctor-platform-notes.js

@@ -1,6 +1,6 @@
 import { shortenHomePath } from "../utils.js";
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
@@ -17,7 +17,7 @@ async function noteMacLaunchAgentOverrides() {
 	}
 	const home = resolveHomeDir();
 	const markerCandidates = [path.join(home, ".fased", "disable-launchagent")];
-	const markerPath = markerCandidates.find((candidate) => fs.existsSync(candidate));
+	const markerPath = markerCandidates.find((candidate) => syncFs.existsSync(candidate));
 	if (!markerPath) {
 		return;
 	}

package/dist/commands/doctor-sandbox.js

@@ -3,7 +3,7 @@ import { DEFAULT_SANDBOX_BROWSER_IMAGE, DEFAULT_SANDBOX_COMMON_IMAGE, DEFAULT_SA
 import { resolveSandboxScope } from "../agents/sandbox/config.js";
 import "../agents/sandbox.js";
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/doctor-sandbox.ts
@@ -18,7 +18,7 @@ function resolveSandboxScript(scriptRel) {
 	}
 	for (const root of candidates) {
 		const scriptPath = path.join(root, scriptRel);
-		if (fs.existsSync(scriptPath)) {
+		if (syncFs.existsSync(scriptPath)) {
 			return {
 				scriptPath,
 				cwd: root

package/dist/commands/doctor-state-integrity.js

@@ -11,28 +11,28 @@ import { loadSessionStore } from "../config/sessions/store.js";
 import { ensureSessionTranscriptHeader } from "../config/sessions/transcript.js";
 import "../config/sessions.js";
 import { note } from "../terminal/note.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 //#region src/commands/doctor-state-integrity.ts
 function existsDir(dir) {
 	try {
-		return fs.existsSync(dir) && fs.statSync(dir).isDirectory();
+		return syncFs.existsSync(dir) && syncFs.statSync(dir).isDirectory();
 	} catch {
 		return false;
 	}
 }
 function existsFile(filePath) {
 	try {
-		return fs.existsSync(filePath) && fs.statSync(filePath).isFile();
+		return syncFs.existsSync(filePath) && syncFs.statSync(filePath).isFile();
 	} catch {
 		return false;
 	}
 }
 function canWriteDir(dir) {
 	try {
-		fs.accessSync(dir, fs.constants.W_OK);
+		syncFs.accessSync(dir, syncFs.constants.W_OK);
 		return true;
 	} catch {
 		return false;
@@ -40,7 +40,7 @@ function canWriteDir(dir) {
 }
 function ensureDir(dir) {
 	try {
-		fs.mkdirSync(dir, { recursive: true });
+		syncFs.mkdirSync(dir, { recursive: true });
 		return { ok: true };
 	} catch (err) {
 		return {
@@ -53,7 +53,7 @@ function dirPermissionHint(dir) {
 	const uid = typeof process.getuid === "function" ? process.getuid() : null;
 	const gid = typeof process.getgid === "function" ? process.getgid() : null;
 	try {
-		const stat = fs.statSync(dir);
+		const stat = syncFs.statSync(dir);
 		if (uid !== null && stat.uid !== uid) {
 			return `Owner mismatch (uid ${stat.uid}). Run: sudo chown -R $USER "${dir}"`;
 		}
@@ -71,7 +71,7 @@ function addUserRwx(mode) {
 }
 function countJsonlLines(filePath) {
 	try {
-		const raw = fs.readFileSync(filePath, "utf-8");
+		const raw = syncFs.readFileSync(filePath, "utf-8");
 		if (!raw) {
 			return 0;
 		}
@@ -96,7 +96,7 @@ function findOtherStateDirs(stateDir) {
 	for (const root of roots) {
 		let entries = [];
 		try {
-			entries = fs.readdirSync(root, { withFileTypes: true });
+			entries = syncFs.readdirSync(root, { withFileTypes: true });
 		} catch {
 			continue;
 		}
@@ -226,9 +226,9 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 		});
 		if (repair) {
 			try {
-				const stat = fs.statSync(stateDir);
+				const stat = syncFs.statSync(stateDir);
 				const target = addUserRwx(stat.mode);
-				fs.chmodSync(stateDir, target);
+				syncFs.chmodSync(stateDir, target);
 				changes.push(`- Repaired permissions on ${displayStateDir}`);
 			} catch (err) {
 				warnings.push(`- Failed to repair ${displayStateDir}: ${String(err)}`);
@@ -237,10 +237,10 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 	}
 	if (stateDirExists && process.platform !== "win32") {
 		try {
-			const dirLstat = fs.lstatSync(stateDir);
+			const dirLstat = syncFs.lstatSync(stateDir);
 			const isDirSymlink = dirLstat.isSymbolicLink();
-			const stat = isDirSymlink ? fs.statSync(stateDir) : dirLstat;
-			const resolvedDir = isDirSymlink ? fs.realpathSync(stateDir) : stateDir;
+			const stat = isDirSymlink ? syncFs.statSync(stateDir) : dirLstat;
+			const resolvedDir = isDirSymlink ? syncFs.realpathSync(stateDir) : stateDir;
 			const isImmutableStore = resolvedDir.startsWith("/nix/store/");
 			if (!isImmutableStore && (stat.mode & 63) !== 0) {
 				warnings.push(`- State directory permissions are too open (${displayStateDir}). Recommend chmod 700.`);
@@ -249,7 +249,7 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 					initialValue: true
 				});
 				if (tighten) {
-					fs.chmodSync(stateDir, 448);
+					syncFs.chmodSync(stateDir, 448);
 					changes.push(`- Tightened permissions on ${displayStateDir} to 700`);
 				}
 			}
@@ -259,10 +259,10 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 	}
 	if (configPath && existsFile(configPath) && process.platform !== "win32") {
 		try {
-			const configLstat = fs.lstatSync(configPath);
+			const configLstat = syncFs.lstatSync(configPath);
 			const isSymlink = configLstat.isSymbolicLink();
-			const stat = isSymlink ? fs.statSync(configPath) : configLstat;
-			const resolvedConfig = isSymlink ? fs.realpathSync(configPath) : configPath;
+			const stat = isSymlink ? syncFs.statSync(configPath) : configLstat;
+			const resolvedConfig = isSymlink ? syncFs.realpathSync(configPath) : configPath;
 			const isImmutableConfig = resolvedConfig.startsWith("/nix/store/");
 			if (!isImmutableConfig && (stat.mode & 63) !== 0) {
 				warnings.push(`- Config file is group/world readable (${displayConfigPath ?? configPath}). Recommend chmod 600.`);
@@ -271,7 +271,7 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 					initialValue: true
 				});
 				if (tighten) {
-					fs.chmodSync(configPath, 384);
+					syncFs.chmodSync(configPath, 384);
 					changes.push(`- Tightened permissions on ${displayConfigPath ?? configPath} to 600`);
 				}
 			}
@@ -330,9 +330,9 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 				});
 				if (repair) {
 					try {
-						const stat = fs.statSync(dir);
+						const stat = syncFs.statSync(dir);
 						const target = addUserRwx(stat.mode);
-						fs.chmodSync(dir, target);
+						syncFs.chmodSync(dir, target);
 						changes.push(`- Repaired permissions on ${label}: ${displayDir}`);
 					} catch (err) {
 						warnings.push(`- Failed to repair ${displayDir}: ${String(err)}`);
@@ -432,7 +432,7 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 				referencedTranscriptPaths.add(path.resolve(resolveSessionFilePath(entry.sessionId, entry, sessionPathOpts)));
 			} catch {}
 		}
-		const sessionDirEntries = fs.readdirSync(sessionsDir, { withFileTypes: true });
+		const sessionDirEntries = syncFs.readdirSync(sessionsDir, { withFileTypes: true });
 		const orphanTranscriptPaths = sessionDirEntries.filter((entry) => entry.isFile() && isPrimarySessionTranscriptFileName(entry.name)).map((entry) => path.resolve(path.join(sessionsDir, entry.name))).filter((filePath) => !referencedTranscriptPaths.has(filePath));
 		if (orphanTranscriptPaths.length > 0) {
 			warnings.push(`- Found ${orphanTranscriptPaths.length} orphan transcript file(s) in ${displaySessionsDir}. They are not referenced by sessions.json and can consume disk over time.`);
@@ -446,7 +446,7 @@ async function noteStateIntegrity(cfg, prompter, configPath) {
 				for (const orphanPath of orphanTranscriptPaths) {
 					const archivedPath = `${orphanPath}.deleted.${archivedAt}`;
 					try {
-						fs.renameSync(orphanPath, archivedPath);
+						syncFs.renameSync(orphanPath, archivedPath);
 						archived += 1;
 					} catch (err) {
 						warnings.push(`- Failed to archive orphan transcript ${shortenHomePath(orphanPath)}: ${String(err)}`);
@@ -470,7 +470,7 @@ function noteWorkspaceBackupTip(workspaceDir) {
 		return;
 	}
 	const gitMarker = path.join(workspaceDir, ".git");
-	if (fs.existsSync(gitMarker)) {
+	if (syncFs.existsSync(gitMarker)) {
 		return;
 	}
 	note([

package/dist/commands/doctor-workspace.js

@@ -1,6 +1,6 @@
 import { shortenHomePath } from "../utils.js";
 import { DEFAULT_AGENTS_FILENAME } from "../agents/workspace.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/commands/doctor-workspace.ts
@@ -16,13 +16,13 @@ async function shouldSuggestMemorySystem(workspaceDir) {
 	const memoryPaths = [path.join(workspaceDir, "MEMORY.md"), path.join(workspaceDir, "memory.md")];
 	for (const memoryPath of memoryPaths) {
 		try {
-			await fs.promises.access(memoryPath);
+			await syncFs.promises.access(memoryPath);
 			return false;
 		} catch {}
 	}
 	const agentsPath = path.join(workspaceDir, DEFAULT_AGENTS_FILENAME);
 	try {
-		const content = await fs.promises.readFile(agentsPath, "utf-8");
+		const content = await syncFs.promises.readFile(agentsPath, "utf-8");
 		if (/memory\.md/i.test(content)) {
 			return false;
 		}

package/dist/commands/doctor.js

@@ -37,7 +37,7 @@ import { maybeRepairUiProtocolFreshness } from "./doctor-ui.js";
 import { maybeOfferUpdateBeforeDoctor } from "./doctor-update.js";
 import { MEMORY_SYSTEM_PROMPT, shouldSuggestMemorySystem } from "./doctor-workspace.js";
 import { noteWorkspaceStatus } from "./doctor-workspace-status.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import { intro, outro } from "@clack/prompts";
 
 //#region src/commands/doctor.ts
@@ -83,7 +83,7 @@ async function doctorCommand(runtime = defaultRuntime, options = {}) {
 			`Fix: run ${formatCliCommand("fased configure")} and set Gateway mode (local/remote).`,
 			`Or set directly: ${formatCliCommand("fased config set gateway.mode local")}`
 		];
-		if (!fs.existsSync(configPath)) {
+		if (!syncFs.existsSync(configPath)) {
 			lines.push(`Missing config: run ${formatCliCommand("fased setup")} first.`);
 		}
 		note$1(lines.join("\n"), "Gateway");
@@ -233,7 +233,7 @@ async function doctorCommand(runtime = defaultRuntime, options = {}) {
 		await writeConfigFile(cfg);
 		logConfigUpdated(runtime);
 		const backupPath = `${CONFIG_PATH}.bak`;
-		if (fs.existsSync(backupPath)) {
+		if (syncFs.existsSync(backupPath)) {
 			runtime.log(`Backup: ${shortenHomePath(backupPath)}`);
 		}
 	} else if (configResult.hasPendingChanges) {

package/dist/commands/hosted-dashboard-probe.js

@@ -6,7 +6,7 @@ import { rawDataToString } from "../infra/ws.js";
 import { buildDeviceAuthPayload } from "../gateway/device-auth.js";
 import { PROTOCOL_VERSION } from "../gateway/protocol/schema/protocol-schemas.js";
 import "../gateway/protocol/index.js";
-import { WebSocket as WebSocket$1 } from "ws";
+import { WebSocket } from "ws";
 
 //#region src/commands/hosted-dashboard-probe.ts
 function sanitizeErrorMessage(value) {
@@ -392,7 +392,7 @@ function probeHostedWs(params) {
 			resolve(result);
 		};
 		const sendConnect = () => {
-			if (!ws || ws.readyState !== WebSocket$1.OPEN || connectSent) {
+			if (!ws || ws.readyState !== WebSocket.OPEN || connectSent) {
 				return;
 			}
 			connectSent = true;
@@ -438,7 +438,7 @@ function probeHostedWs(params) {
 			});
 		}, params.timeoutMs);
 		try {
-			ws = new WebSocket$1(params.wsUrl, {
+			ws = new WebSocket(params.wsUrl, {
 				headers: { Origin: params.origin },
 				handshakeTimeout: Math.max(1e3, Math.floor(params.timeoutMs)),
 				maxPayload: 1024 * 1024

package/dist/commands/managed-up.js

@@ -2,7 +2,7 @@ import { defaultRuntime } from "../runtime.js";
 import { readManagedFederationTokenSummary } from "../managed/federation.js";
 import { readManagedReservationSummaries } from "../managed/tunnel.js";
 import { fileURLToPath } from "node:url";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 
@@ -44,7 +44,7 @@ function resolveManagedScriptPath() {
 		candidates.push(cwdCandidate);
 	}
 	for (const candidate of candidates) {
-		if (fs.existsSync(candidate)) {
+		if (syncFs.existsSync(candidate)) {
 			return candidate;
 		}
 	}

package/dist/commands/model-picker.js

@@ -1,11 +1,11 @@
 import { resolveAgentModelPrimaryValue } from "../config/model-input.js";
 import { CLOUDFLARE_AI_GATEWAY_MODEL_REFS } from "../providers/cloudflare-ai-gateway-shared.js";
 import { HUGGINGFACE_MODEL_REFS } from "../providers/huggingface-models.js";
-import { LITELLM_MODEL_REFS } from "../providers/litellm-models.js";
 import { OPENCODE_ZEN_MODEL_REFS } from "../providers/opencode-zen-shared.js";
 import { TOGETHER_MODEL_REFS } from "../providers/together-models.js";
 import { VENICE_MODEL_REFS } from "../providers/venice-models.js";
 import { VERCEL_AI_GATEWAY_MODEL_REFS } from "../providers/vercel-ai-gateway-models.js";
+import { LITELLM_MODEL_REFS } from "../providers/litellm-models.js";
 import { BYTEPLUS_CODING_MODEL_REFS, BYTEPLUS_MODEL_REFS, COPILOT_PROXY_MODEL_REFS, GITHUB_COPILOT_MODEL_REFS, GOOGLE_API_MODEL_REFS, GOOGLE_GEMINI_CLI_MODEL_REFS, MISTRAL_MODEL_REFS, OPENAI_API_MODEL_REFS, OPENAI_SIGN_IN_MODEL_REFS, OPENROUTER_MODEL_REFS, QIANFAN_MODEL_REFS, SYNTHETIC_MODEL_REFS, VOLCENGINE_CODING_MODEL_REFS, VOLCENGINE_MODEL_REFS, XAI_MODEL_REFS, XIAOMI_MODEL_REFS, ZAI_MODEL_REFS, isStandardProviderCatalogEntry, isStandardProviderModelRef } from "../providers/registry.js";
 import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "../agents/defaults.js";
 import { ensureAuthProfileStore } from "../agents/auth-profiles/store.js";
@@ -13,8 +13,9 @@ import { listProfilesForProvider } from "../agents/auth-profiles/profiles.js";
 import "../agents/auth-profiles.js";
 import { getCustomProviderApiKey, resolveEnvApiKey } from "../agents/model-auth.js";
 import { buildAllowedModelSet, buildModelAliasIndex, modelKey, normalizeProviderId, resolveConfiguredModelRef } from "../agents/model-selection.js";
-import { buildCredentialScopedAllowedModelSet } from "../agents/model-catalog-access.js";
 import { formatModelFeatureList } from "../agents/model-metadata.js";
+import { buildCredentialScopedAllowedModelSet } from "../agents/model-catalog-access.js";
+import { resolveAuthenticatedModelCatalog } from "../agents/authenticated-model-catalog.js";
 import { loadModelCatalog } from "../agents/model-catalog.js";
 import { loadPreviewModelListSources } from "./models/list.preview-catalog.js";
 import { formatTokenK } from "./models/shared.js";
@@ -205,14 +206,32 @@ function loadModelPickerPreviewCatalog(cfg) {
 		catalogSource: "current-preview"
 	}));
 }
-async function loadModelPickerCatalog(cfg) {
+async function loadModelPickerCatalog(cfg, agentDir) {
 	const catalog = await loadModelCatalog({
 		config: cfg,
 		useCache: false,
 		includeMetadata: true
 	});
 	const models = catalog.length > 0 ? catalog : loadModelPickerPreviewCatalog(cfg);
-	return models.filter(isStandardProviderCatalogEntry);
+	const standardModels = models.filter(isStandardProviderCatalogEntry);
+	if (!agentDir) {
+		return standardModels;
+	}
+	const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
+	const authenticated = await resolveAuthenticatedModelCatalog({
+		cfg,
+		store,
+		catalog: standardModels,
+		defaultProvider: DEFAULT_PROVIDER,
+		agentDir
+	});
+	return authenticated.allowedCatalog.length > 0 ? authenticated.allowedCatalog : authenticated.usableCatalog;
+}
+async function resolveAuthenticatedDefaultModel(params) {
+	const catalog = await loadModelPickerCatalog(params.config, params.agentDir);
+	const preferredProvider = normalizeProviderId(params.preferredProvider ?? "");
+	const candidate = (preferredProvider ? catalog.find((entry) => normalizeProviderId(entry.provider) === preferredProvider) : undefined) ?? catalog[0];
+	return candidate ? modelKey(candidate.provider, candidate.id) : undefined;
 }
 async function promptManualModel(params) {
 	const modelInput = await params.prompter.text({
@@ -244,7 +263,7 @@ async function promptDefaultModel(params) {
 	const resolvedKey = modelKey(resolved.provider, resolved.model);
 	const configuredKey = configuredRaw ? resolvedKey : "";
 	const allowKeep = allowKeepRequested && !isHiddenRouterModelRef(configuredRaw);
-	const catalog = await loadModelPickerCatalog(cfg);
+	const catalog = await loadModelPickerCatalog(cfg, params.ignoreAllowlist ? undefined : params.agentDir);
 	if (catalog.length === 0) {
 		return promptManualModel({
 			prompter: params.prompter,
@@ -464,7 +483,7 @@ async function promptModelAllowlist(params) {
 		...params.initialSelections ?? []
 	]);
 	const initialKeys = allowedKeySet ? initialSeeds.filter((key) => allowedKeySet.has(key)) : initialSeeds;
-	const catalog = await loadModelPickerCatalog(cfg);
+	const catalog = await loadModelPickerCatalog(cfg, params.agentDir);
 	if (catalog.length === 0 && allowedKeys.length === 0) {
 		const raw = await params.prompter.text({
 			message: params.message ?? "Allowlist models (comma-separated provider/model; blank to keep current)",
@@ -503,7 +522,7 @@ async function promptModelAllowlist(params) {
 			hasAuth
 		});
 	}
-	const supplementalKeys = allowedKeySet ? allowedKeys : existingKeys;
+	const supplementalKeys = allowedKeySet ? allowedKeys : params.agentDir ? [] : existingKeys;
 	for (const key of supplementalKeys) {
 		if (seen.has(key)) {
 			continue;
@@ -630,4 +649,4 @@ function applyModelFallbacksFromSelection(cfg, selection) {
 }
 
 //#endregion
-export { applyModelAllowlist, applyModelFallbacksFromSelection, applyPrimaryModel, promptModelAllowlist };
+export { applyModelAllowlist, applyModelFallbacksFromSelection, applyPrimaryModel, promptModelAllowlist, resolveAuthenticatedDefaultModel };

package/dist/commands/models/list.probe.js

@@ -11,8 +11,8 @@ import { getCustomProviderApiKey, resolveEnvApiKey } from "../../agents/model-au
 import { findNormalizedProviderValue, normalizeProviderId, parseModelRef } from "../../agents/model-selection.js";
 import { resolveSessionTranscriptPath, resolveSessionTranscriptsDirForAgent } from "../../config/sessions/paths.js";
 import "../../agents/pi-embedded.js";
-import { describeFailoverError } from "../../agents/failover-error.js";
 import { loadModelCatalog } from "../../agents/model-catalog.js";
+import { describeFailoverError } from "../../agents/failover-error.js";
 import { runEmbeddedPiAgent } from "../../agents/pi-embedded-runner/run.js";
 import { redactSecrets } from "../status-all/format.js";
 import { formatMs } from "./shared.js";

package/dist/commands/models/list.registry.js

@@ -1,8 +1,12 @@
+import { DEFAULT_PROVIDER } from "../../agents/defaults.js";
 import { resolveFasedAgentAgentDir } from "../../agents/agent-paths.js";
+import { ensureAuthProfileStore } from "../../agents/auth-profiles/store.js";
+import "../../agents/auth-profiles.js";
 import { modelKey } from "../../agents/model-selection.js";
 import { ensureFasedAgentModelsJson } from "../../agents/models-config.js";
 import { discoverAuthStorage, discoverModels } from "../../agents/pi-model-discovery.js";
 import { deriveModelMetadata, formatModelFeatureList } from "../../agents/model-metadata.js";
+import { resolveAuthenticatedModelCatalog } from "../../agents/authenticated-model-catalog.js";
 import { loadModelCatalog } from "../../agents/model-catalog.js";
 import { isLocalBaseUrl } from "./shared.js";
 import { createModelListAuthIndex } from "./list.auth-index.js";
@@ -58,34 +62,26 @@ function normalizeModelListSource(model) {
 		metadata: "metadata" in model ? model.metadata : undefined
 	};
 }
-function mergeModelCatalogEntries(params) {
-	const models = params.registryModels.map((model) => normalizeModelListSource(model));
-	const seen = new Set(models.map((model) => modelKey(model.provider, model.id)));
-	for (const entry of params.catalog) {
-		const key = modelKey(entry.provider, entry.id);
-		if (seen.has(key)) {
-			continue;
-		}
-		models.push(normalizeModelListSource(entry));
-		seen.add(key);
-	}
-	return models;
-}
 async function loadModelRegistry(cfg) {
 	await ensureFasedAgentModelsJson(cfg);
 	const agentDir = resolveFasedAgentAgentDir();
 	const authStorage = discoverAuthStorage(agentDir);
 	const registry = discoverModels(authStorage, agentDir);
-	const registryModels = registry.getAll();
+	registry.getAll();
 	const catalog = await loadModelCatalog({
 		config: cfg,
 		useCache: false,
 		includeMetadata: true
 	});
-	const models = mergeModelCatalogEntries({
-		registryModels,
-		catalog
+	const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
+	const authenticated = await resolveAuthenticatedModelCatalog({
+		cfg,
+		store,
+		catalog,
+		defaultProvider: DEFAULT_PROVIDER,
+		agentDir
 	});
+	const models = authenticated.usableCatalog.map((model) => normalizeModelListSource(model));
 	let availableKeys;
 	let availabilityErrorMessage;
 	try {

package/dist/commands/models/list.status-command.js

@@ -16,12 +16,12 @@ import "../../agents/auth-profiles.js";
 import { resolveEnvApiKey } from "../../agents/model-auth.js";
 import { buildModelAliasIndex, parseModelRef, resolveConfiguredModelRef, resolveDefaultModelForAgent, resolveModelRefFromString } from "../../agents/model-selection.js";
 import { withProgressTotals } from "../../cli/progress.js";
+import { loadProviderExtensionCatalogIndex } from "../../agents/provider-extension-catalog-index.js";
+import { loadModelCatalog } from "../../agents/model-catalog.js";
 import { resolveUsageProviderId } from "../../infra/provider-usage.shared.js";
 import { formatUsageWindowSummary } from "../../infra/provider-usage.format.js";
 import { loadProviderUsageSummary } from "../../infra/provider-usage.load.js";
 import "../../infra/provider-usage.js";
-import { loadProviderExtensionCatalogIndex } from "../../agents/provider-extension-catalog-index.js";
-import { loadModelCatalog } from "../../agents/model-catalog.js";
 import { renderTable } from "../../terminal/table.js";
 import { buildModelCatalogStatus } from "../../agents/model-catalog-status.js";
 import { DEFAULT_OAUTH_WARN_MS, buildAuthHealthSummary, formatRemainingShort } from "../../agents/auth-health.js";

package/dist/commands/onboard-auth.config-core.js

@@ -1,8 +1,8 @@
 import { HUGGINGFACE_BASE_URL, HUGGINGFACE_DEFAULT_MODEL_REF, HUGGINGFACE_MODEL_CATALOG, buildHuggingfaceModelDefinition } from "../providers/huggingface-models.js";
-import { LITELLM_BASE_URL, LITELLM_DEFAULT_MODEL_ID } from "../providers/litellm-models.js";
 import { SYNTHETIC_BASE_URL, SYNTHETIC_DEFAULT_MODEL_REF, SYNTHETIC_MODEL_CATALOG, buildSyntheticModelDefinition } from "../providers/synthetic-models.js";
 import { TOGETHER_BASE_URL, TOGETHER_DEFAULT_MODEL_REF, TOGETHER_MODEL_CATALOG, buildTogetherModelDefinition } from "../providers/together-models.js";
 import { VENICE_BASE_URL, VENICE_DEFAULT_MODEL_REF, VENICE_MODEL_CATALOG, buildVeniceModelDefinition } from "../providers/venice-models.js";
+import { LITELLM_BASE_URL, LITELLM_DEFAULT_MODEL_ID } from "../providers/litellm-models.js";
 import { CHUTES_BASE_URL, CHUTES_DEFAULT_MODEL_REF, CHUTES_MODEL_CATALOG, buildChutesModelDefinition } from "../agents/chutes-models.js";
 import "../agents/huggingface-models.js";
 import "../agents/synthetic-models.js";