@getforgeai/cli 0.1.0-beta.6 → 0.1.0-beta.7

package/dist/cli.js

@@ -21,6 +21,7 @@ import { taskOpenAction } from "./commands/task-open.js";
 import { workflowOpenAction } from "./commands/workflow-open.js";
 import { vmInitAction, vmStatusAction, vmCleanupAction, vmStopAllAction, setupClaudeTokenAction, } from "./commands/vm.js";
 import { setupCodexAuthAction, setupKiloAuthAction, setupOpenCodeAuthAction, } from "./commands/auth-setup-agent.js";
+import { modelsListAction } from "./commands/models-list.js";
 const program = new Command();
 program
     .name("forge")
@@ -119,6 +120,10 @@ journalCmd
     .command("status")
     .description("Show sync status: last sync time, pending events, cursor")
     .action(() => journalStatusAction());
+program
+    .command("models [engine]")
+    .description("Show the models declared on this device and the models available for an engine (defaults to the configured agent type)")
+    .action((engine) => modelsListAction(engine));
 const configCmd = program
     .command("config")
     .description("Manage CLI configuration");
@@ -130,9 +135,9 @@ configSetCmd
     .description("Set agent type (CLAUDE_CODE, CODEX, OPENCODE or KILO)")
     .action((value) => configSetAgentTypeAction(value));
 configSetCmd
-    .command("models <engine> <models>")
-    .description("Declare the models usable on this device for an engine, comma-separated (first = default); 'none' clears")
-    .action((engine, models) => configSetModelsAction(engine, models));
+    .command("models <engineOrModels> [models]")
+    .description("Declare the usable models, comma-separated (first = default); 'none' clears. Engine optional — defaults to the configured agent type")
+    .action((engineOrModels, models) => configSetModelsAction(engineOrModels, models));
 configSetCmd
     .command("agent-slots <value>")
     .description("Set agent slots (1-20)")

package/dist/commands/config-set.d.ts

@@ -4,7 +4,7 @@ export declare function configSetAgentTypeAction(value: string): Promise<void>;
  * Declares the models usable on this device for an engine (first = default).
  * "none" clears the engine's list. Refused when the org locked the list.
  */
-export declare function configSetModelsAction(engine: string, value: string): Promise<void>;
+export declare function configSetModelsAction(engineOrModels: string, maybeModels?: string): Promise<void>;
 export declare function configSetAgentSlotsAction(value: string): Promise<void>;
 export declare function configSetOpenerAction(value: string): void;
 export declare function configGetAction(): void;

package/dist/commands/config-set.js

@@ -29,14 +29,35 @@ export async function configSetAgentTypeAction(value) {
  * Declares the models usable on this device for an engine (first = default).
  * "none" clears the engine's list. Refused when the org locked the list.
  */
-export async function configSetModelsAction(engine, value) {
-    const upper = engine.toUpperCase();
+export async function configSetModelsAction(engineOrModels, maybeModels) {
+    const config = getConfig();
+    // Engine is optional: `forge config set models sonnet,haiku` applies to the
+    // configured agent type; an explicit engine targets another engine's list.
+    let upper;
+    let value;
+    if (maybeModels === undefined) {
+        if (isAgentType(engineOrModels.toUpperCase())) {
+            console.error(chalk.red(`Missing model list. Usage: forge config set models ${engineOrModels.toUpperCase()} <m1,m2,...>`));
+            process.exitCode = 1;
+            return;
+        }
+        upper = (config.agentType ?? "CLAUDE_CODE").toUpperCase();
+        value = engineOrModels;
+    }
+    else {
+        upper = engineOrModels.toUpperCase();
+        value = maybeModels;
+        if (!isAgentType(upper)) {
+            console.error(chalk.red(`Invalid engine "${engineOrModels}". Allowed: ${AGENT_TYPE.join(", ")}`));
+            process.exitCode = 1;
+            return;
+        }
+    }
     if (!isAgentType(upper)) {
-        console.error(chalk.red(`Invalid engine "${engine}". Allowed: ${AGENT_TYPE.join(", ")}`));
+        console.error(chalk.red(`Configured agent type "${upper}" is not a valid engine.`));
         process.exitCode = 1;
         return;
     }
-    const config = getConfig();
     const lockedByOrgs = config.modelsLockedByOrgs ?? [];
     if (lockedByOrgs.length > 0) {
         console.error(chalk.red(`The model list is locked by organization(s): ${lockedByOrgs.join(", ")} — edit it from their cockpit (Settings → CLI Devices).`));

package/dist/commands/models-list.d.ts

@@ -0,0 +1,7 @@
+/**
+ * forge models [engine] — show the models declared on this device and the
+ * models available for the engine (live catalog for OpenCode/Kilo, curated
+ * suggestions for Claude Code/Codex).
+ */
+export declare function modelsListAction(engineArg?: string): Promise<void>;
+//# sourceMappingURL=models-list.d.ts.map

package/dist/commands/models-list.js

@@ -0,0 +1,57 @@
+/**
+ * forge models [engine] — show the models declared on this device and the
+ * models available for the engine (live catalog for OpenCode/Kilo, curated
+ * suggestions for Claude Code/Codex).
+ */
+import chalk from "chalk";
+import { AGENT_TYPE, KNOWN_MODEL_SUGGESTIONS, LIVE_CATALOG_ENGINES, isAgentType, } from "@getforgeai/protocol";
+import { getConfig } from "../config/config-manager.js";
+import { fetchEngineModelCatalog } from "../lib/model-catalog.js";
+import { resolveAgentType } from "../orchestrator/agent-profiles.js";
+export async function modelsListAction(engineArg) {
+    const config = getConfig();
+    const engine = engineArg
+        ? engineArg.toUpperCase()
+        : resolveAgentType(config.agentType);
+    if (!isAgentType(engine)) {
+        console.error(chalk.red(`Invalid engine "${engineArg}". Allowed: ${AGENT_TYPE.join(", ")}`));
+        process.exitCode = 1;
+        return;
+    }
+    const declared = config.availableModels?.[engine] ?? [];
+    const lockedBy = config.modelsLockedByOrgs ?? [];
+    const locked = lockedBy.length > 0;
+    const lockNote = locked
+        ? chalk.yellow(` (locked by: ${lockedBy.join(", ")})`)
+        : "";
+    console.log(chalk.bold(`Models — ${engine}`));
+    if (declared.length > 0) {
+        console.log(`  Declared on this device${lockNote}:`);
+        declared.forEach((m, i) => {
+            console.log(`    ${m}${i === 0 ? chalk.dim(" (default)") : ""}`);
+        });
+    }
+    else {
+        console.log(chalk.dim("  No models declared on this device — any demanded model makes it ineligible only if a list exists; declare one to advertise what your subscription can run.") + lockNote);
+    }
+    const live = LIVE_CATALOG_ENGINES.includes(engine);
+    console.log(live
+        ? chalk.dim(`  Listing available models via the ${engine} engine...`)
+        : chalk.dim("  Known models (curated — no headless listing for this engine):"));
+    const catalog = await fetchEngineModelCatalog(engine);
+    if (catalog.error) {
+        console.error(chalk.yellow(`  ${catalog.error}`));
+    }
+    if (catalog.models.length > 0) {
+        const suggestions = KNOWN_MODEL_SUGGESTIONS[engine];
+        for (const model of catalog.models) {
+            const note = suggestions?.find((s) => s.id === model)?.note;
+            const mark = declared.includes(model) ? chalk.green("✓ ") : "  ";
+            console.log(`  ${mark}${model}${note ? chalk.dim(` — ${note}`) : ""}`);
+        }
+    }
+    console.log(chalk.dim(locked
+        ? "\nModel lists on this device are locked by your organization — manage them from the cockpit."
+        : `\nDeclare with: forge config set models ${engine} <model1,model2,...> (first = default)`));
+}
+//# sourceMappingURL=models-list.js.map

package/dist/lib/connection-manager.js

@@ -219,6 +219,16 @@ export function establishConnections(ctx, append = false) {
         registerWorkflowStepDispatchHandler(client.socket, org.orgId, spawnerCtx);
         // Register workflow agent dismiss handler (Story 6b-10)
         registerWorkflowAgentDismissHandler(client.socket, spawnerCtx);
+        // Cockpit-initiated model catalog listing ("Fetch from device"): run the
+        // engine's own listing (OpenCode/Kilo) or answer curated suggestions.
+        client.socket.on("models:catalog:request", (payload, callback) => {
+            void (async () => {
+                const { answerCatalogRequest } = await import("./model-catalog.js");
+                callback(await answerCatalogRequest(payload));
+            })().catch(() => {
+                callback({ models: [], error: "Catalog fetch failed" });
+            });
+        });
         // Listen for server-pushed config updates (e.g., admin changed agentSlots
         // or the agent engine in the Cloud UI)
         client.socket.on("cli:config:updated", (payload) => {

package/dist/lib/model-catalog.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Model catalog discovery per engine.
+ *
+ * OpenCode and Kilo can list their real catalogs (`opencode models`,
+ * `kilo models`) — we run that inside the agent Docker image with the stored
+ * credentials, in a throwaway container. Claude Code and Codex have no
+ * headless listing; they answer from the curated KNOWN_MODEL_SUGGESTIONS.
+ *
+ * Used by `forge models` and by the cockpit's "Fetch from device" button
+ * (models:catalog:request socket event, answered via answerCatalogRequest).
+ */
+import type { AgentType } from "@getforgeai/protocol";
+export type ModelCatalogResult = {
+    models: string[];
+    /** "curated" = static suggestions; "live" = listed by the engine itself. */
+    source: "curated" | "live";
+    error?: string;
+};
+/** Strip ANSI escapes and keep plausible model-id lines. Exported for tests. */
+export declare function parseCatalogOutput(raw: string): string[];
+/**
+ * Fetch the model catalog for an engine: live from the engine when it
+ * supports listing, curated suggestions otherwise.
+ */
+export declare function fetchEngineModelCatalog(engine: AgentType): Promise<ModelCatalogResult>;
+/**
+ * Answer a cockpit models:catalog:request payload. Never throws — every
+ * failure maps to a resolved value so the socket ack callback always fires.
+ */
+export declare function answerCatalogRequest(payload: unknown): Promise<{
+    models: string[];
+    error?: string;
+}>;
+//# sourceMappingURL=model-catalog.d.ts.map

package/dist/lib/model-catalog.js

@@ -0,0 +1,210 @@
+/**
+ * Model catalog discovery per engine.
+ *
+ * OpenCode and Kilo can list their real catalogs (`opencode models`,
+ * `kilo models`) — we run that inside the agent Docker image with the stored
+ * credentials, in a throwaway container. Claude Code and Codex have no
+ * headless listing; they answer from the curated KNOWN_MODEL_SUGGESTIONS.
+ *
+ * Used by `forge models` and by the cockpit's "Fetch from device" button
+ * (models:catalog:request socket event, answered via answerCatalogRequest).
+ */
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { KNOWN_MODEL_SUGGESTIONS, LIVE_CATALOG_ENGINES, isAgentType, } from "@getforgeai/protocol";
+import { getAgentProfile } from "../orchestrator/agent-profiles.js";
+import { ensureImage, FORGEAI_IMAGE } from "../vm/image-manager.js";
+import { AGENT_API_KEY_DEFAULT_ENV, AGENT_AUTH_JSON_PATHS, loadAgentAuth, } from "../vm/agent-auth-manager.js";
+const CATALOG_TIMEOUT_MS = 45_000;
+/** Strip ANSI escapes and keep plausible model-id lines. Exported for tests. */
+export function parseCatalogOutput(raw) {
+    const seen = new Set();
+    const models = [];
+    for (const line of raw.split("\n")) {
+        // eslint-disable-next-line no-control-regex
+        const clean = line.replaceAll(/\x1b\[[0-9;]*m/g, "").trim();
+        // Model ids: single token containing a provider separator, no spaces
+        if (!clean || clean.includes(" ") || !clean.includes("/"))
+            continue;
+        if (!/^[\w.:@/-]+$/.test(clean))
+            continue;
+        if (clean.length > 120 || seen.has(clean))
+            continue;
+        seen.add(clean);
+        models.push(clean);
+    }
+    return models;
+}
+/**
+ * Best-effort teardown of the throwaway container. Killing the docker CLI
+ * client only detaches it — the container (holding credentials in env) keeps
+ * running and `--rm` never fires, so it must be removed by name.
+ */
+function forceRemoveContainer(name) {
+    const rm = spawn("docker", ["rm", "-f", name], { stdio: "ignore" });
+    rm.on("error", () => { });
+    rm.unref();
+}
+/**
+ * Run the engine's own catalog command in a throwaway agent container.
+ * Credentials travel as name-only `-e` env vars (values stay out of argv,
+ * same pattern as docker-executor's secretEnv).
+ */
+async function runLiveCatalog(engine) {
+    const auth = await loadAgentAuth(engine);
+    if (!auth) {
+        return {
+            models: [],
+            source: "live",
+            error: `No ${engine} credentials stored — run forge auth setup-${engine.toLowerCase()} first`,
+        };
+    }
+    const profile = getAgentProfile(engine);
+    const binary = profile.binary;
+    const containerEnv = { ...profile.spawnEnv };
+    let setup = "";
+    if (auth.kind === "api_key") {
+        const envVar = auth.envVar ?? AGENT_API_KEY_DEFAULT_ENV[engine];
+        containerEnv[envVar] = auth.value;
+    }
+    else {
+        const target = AGENT_AUTH_JSON_PATHS[engine];
+        const dir = target.slice(0, target.lastIndexOf("/"));
+        containerEnv.FORGE_AGENT_SECRET = auth.value;
+        setup = `mkdir -p ${dir} && printenv FORGE_AGENT_SECRET > ${target} && chmod 600 ${target} && `;
+    }
+    try {
+        await ensureImage();
+    }
+    catch (err) {
+        return {
+            models: [],
+            source: "live",
+            error: `Agent image unavailable: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    const containerName = `forge-catalog-${randomBytes(6).toString("hex")}`;
+    const script = `${setup}${binary} models`;
+    const args = [
+        "run",
+        "--rm",
+        "--name",
+        containerName,
+        "--label",
+        "forgeai.managed=true",
+        "--platform",
+        "linux/arm64",
+        ...Object.keys(containerEnv).flatMap((key) => ["-e", key]),
+        FORGEAI_IMAGE,
+        "bash",
+        "-c",
+        script,
+    ];
+    return new Promise((resolve) => {
+        const child = spawn("docker", args, {
+            env: { ...process.env, ...containerEnv },
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGKILL");
+            forceRemoveContainer(containerName);
+            resolve({
+                models: [],
+                source: "live",
+                error: `Catalog listing timed out (${CATALOG_TIMEOUT_MS / 1000}s)`,
+            });
+        }, CATALOG_TIMEOUT_MS);
+        child.stdout.on("data", (d) => {
+            stdout += d.toString();
+        });
+        child.stderr.on("data", (d) => {
+            stderr += d.toString();
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolve({
+                models: [],
+                source: "live",
+                error: err.code === "ENOENT"
+                    ? "Docker is not installed or not running on this device"
+                    : err.message,
+            });
+        });
+        child.on("exit", (code) => {
+            clearTimeout(timer);
+            if (timedOut) {
+                forceRemoveContainer(containerName);
+                return;
+            }
+            const models = parseCatalogOutput(stdout);
+            if (models.length > 0) {
+                resolve({ models, source: "live" });
+                return;
+            }
+            const cause = stderr.trim().slice(0, 200);
+            let error;
+            if (code === 0) {
+                error = "The engine returned no parsable model ids";
+            }
+            else if (code === 125) {
+                error = cause ? `Docker error: ${cause}` : "Docker error (exit 125)";
+            }
+            else if (code === 127) {
+                error = `${binary} not found in the agent image — pull the latest getforgeai/agent image`;
+            }
+            else {
+                error = `${binary} models exited with code ${code}${cause ? `: ${cause}` : ""}`;
+            }
+            resolve({ models: [], source: "live", error });
+        });
+    });
+}
+/**
+ * One catalog container per engine at a time: concurrent requests (cockpit
+ * spam, `forge models` racing a socket request) share the in-flight run.
+ */
+const inFlight = new Map();
+/**
+ * Fetch the model catalog for an engine: live from the engine when it
+ * supports listing, curated suggestions otherwise.
+ */
+export async function fetchEngineModelCatalog(engine) {
+    if (LIVE_CATALOG_ENGINES.includes(engine)) {
+        const running = inFlight.get(engine);
+        if (running)
+            return running;
+        const run = runLiveCatalog(engine).finally(() => {
+            inFlight.delete(engine);
+        });
+        inFlight.set(engine, run);
+        return run;
+    }
+    const suggestions = KNOWN_MODEL_SUGGESTIONS[engine] ?? [];
+    return { models: suggestions.map((s) => s.id), source: "curated" };
+}
+/**
+ * Answer a cockpit models:catalog:request payload. Never throws — every
+ * failure maps to a resolved value so the socket ack callback always fires.
+ */
+export async function answerCatalogRequest(payload) {
+    try {
+        const engine = payload && typeof payload === "object"
+            ? payload.engine
+            : undefined;
+        if (typeof engine !== "string" || !isAgentType(engine)) {
+            return { models: [], error: "Unknown engine" };
+        }
+        const result = await fetchEngineModelCatalog(engine);
+        return { models: result.models, error: result.error };
+    }
+    catch (err) {
+        return {
+            models: [],
+            error: err instanceof Error ? err.message : "Catalog fetch failed",
+        };
+    }
+}
+//# sourceMappingURL=model-catalog.js.map

package/dist/vm/agent-auth-manager.d.ts

@@ -24,6 +24,14 @@ export type AgentAuthPayload = {
 };
 /** Container path where each engine expects its auth.json. */
 export declare const AGENT_AUTH_JSON_PATHS: Record<AuthAgent, string>;
+/**
+ * Default provider env var when an api_key payload carries no explicit envVar.
+ * (Codex api keys go through `codex login --with-api-key`, never an env var.)
+ */
+export declare const AGENT_API_KEY_DEFAULT_ENV: {
+    readonly OPENCODE: "ANTHROPIC_API_KEY";
+    readonly KILO: "KILO_API_KEY";
+};
 /** Host path each engine's own CLI stores its auth.json at (for import). */
 export declare function getHostAuthJsonPath(agent: AuthAgent): string;
 export declare function saveAgentAuth(agent: AuthAgent, payload: AgentAuthPayload): Promise<void>;

package/dist/vm/agent-auth-manager.js

@@ -43,6 +43,14 @@ export const AGENT_AUTH_JSON_PATHS = {
     OPENCODE: "/home/agent/.local/share/opencode/auth.json",
     KILO: "/home/agent/.local/share/kilo/auth.json",
 };
+/**
+ * Default provider env var when an api_key payload carries no explicit envVar.
+ * (Codex api keys go through `codex login --with-api-key`, never an env var.)
+ */
+export const AGENT_API_KEY_DEFAULT_ENV = {
+    OPENCODE: "ANTHROPIC_API_KEY",
+    KILO: "KILO_API_KEY",
+};
 /** Host path each engine's own CLI stores its auth.json at (for import). */
 export function getHostAuthJsonPath(agent) {
     switch (agent) {

package/dist/vm/session-manager.js

@@ -24,7 +24,7 @@ import { gitCredentialConfigArgs, gitCredentialSecretEnv, } from "./git-credenti
 import { ensureImage, FORGEAI_IMAGE } from "./image-manager.js";
 import { vmLog } from "./log.js";
 import { ensureClaudeToken } from "./claude-token-manager.js";
-import { AGENT_AUTH_JSON_PATHS, loadAgentAuth, } from "./agent-auth-manager.js";
+import { AGENT_API_KEY_DEFAULT_ENV, AGENT_AUTH_JSON_PATHS, loadAgentAuth, } from "./agent-auth-manager.js";
 import { getAgentProfile, resolveAgentType, } from "../orchestrator/agent-profiles.js";
 // ---------------------------------------------------------------------------
 // Paths
@@ -361,14 +361,16 @@ export class SessionManager {
         if (agentType === "OPENCODE") {
             const auth = await this.getAgentAuth("OPENCODE");
             if (auth.kind === "api_key") {
-                return { [auth.envVar ?? "ANTHROPIC_API_KEY"]: auth.value };
+                return {
+                    [auth.envVar ?? AGENT_API_KEY_DEFAULT_ENV.OPENCODE]: auth.value,
+                };
             }
         }
         if (agentType === "KILO") {
             const auth = await this.getAgentAuth("KILO");
             if (auth.kind === "api_key") {
                 // Kilo gateway key (app.kilo.ai profile) — read at request time
-                return { [auth.envVar ?? "KILO_API_KEY"]: auth.value };
+                return { [auth.envVar ?? AGENT_API_KEY_DEFAULT_ENV.KILO]: auth.value };
             }
         }
         return {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getforgeai/cli",
-  "version": "0.1.0-beta.6",
+  "version": "0.1.0-beta.7",
   "description": "ForgeAI CLI — runs AI coding agents in local Docker containers with your own AI tokens, and connects them to the ForgeAI cockpit.",
   "license": "Apache-2.0",
   "type": "module",
@@ -47,7 +47,7 @@
     "ora": "^8.2.0",
     "socket.io-client": "^4.8.3",
     "zod": "^4.3.6",
-    "@getforgeai/protocol": "0.1.0-beta.4"
+    "@getforgeai/protocol": "0.1.0-beta.5"
   },
   "devDependencies": {
     "@types/node": "^25.0.2",