@mafdet/cli 0.3.0 → 0.4.0

package/dist/tui/banner.js

@@ -0,0 +1,97 @@
+// CLI-018 · The welcome page.
+//
+// Pure: returns the text, writes nothing. That is what lets the tests assert
+// the ASCII rule per byte instead of trusting a review.
+import { stripAnsi } from "../agent/command-policy.js";
+import { redact } from "../security/redact.js";
+import { NARROW_COLUMNS, palette } from "./theme.js";
+// Default form. Every byte is ASCII, so it survives a cp936 console.
+const WORDMARK_ASCII = [
+    " __  __    _    _____ ____  _____ _____",
+    "|  \\/  |  / \\  |  ___|  _ \\| ____|_   _|",
+    "| |\\/| | / _ \\ | |_  | | | |  _|   | |",
+    "| |  | |/ ___ \\|  _| | |_| | |___  | |",
+    "|_|  |_/_/   \\_\\_|   |____/|_____| |_|",
+];
+// Used only where the encoding is known to be UTF-8 (see theme.ts).
+const WORDMARK_UNICODE = [
+    "███╗   ███╗ █████╗ ███████╗██████╗ ███████╗████████╗",
+    "████╗ ████║██╔══██╗██╔════╝██╔══██╗██╔════╝╚══██╔══╝",
+    "██╔████╔██║███████║█████╗  ██║  ██║█████╗     ██║",
+    "██║╚██╔╝██║██╔══██║██╔══╝  ██║  ██║██╔══╝     ██║",
+    "██║ ╚═╝ ██║██║  ██║██║     ██████╔╝███████╗   ██║",
+    "╚═╝     ╚═╝╚═╝  ╚═╝╚═╝     ╚═════╝ ╚══════╝   ╚═╝",
+];
+const TIPS = [
+    "Add MAFDET.md to describe project-specific instructions",
+    "Use /model to switch verified models",
+    "Use /permissions before allowing local changes",
+    "Use /help for commands",
+];
+/**
+ * The wordmark, or a single line when the terminal is too narrow to hold it
+ * without wrapping — a wrapped wordmark looks like a rendering bug.
+ */
+export function wordmark(capabilities) {
+    const art = capabilities.unicode ? WORDMARK_UNICODE : WORDMARK_ASCII;
+    const widest = Math.max(...art.map((line) => [...line].length));
+    if (capabilities.columns < widest || capabilities.columns < NARROW_COLUMNS) {
+        return ["Mafdet CLI"];
+    }
+    return art;
+}
+/**
+ * Cut a line to the terminal width.
+ *
+ * Applied to plain text before any colour is added, because clamping a string
+ * that already contains escape sequences can slice one in half and leave the
+ * terminal wearing the style. Nothing here may overflow: a wrapped banner
+ * reads as a rendering bug.
+ */
+function clamp(text, columns) {
+    const chars = [...text];
+    if (chars.length <= columns)
+        return text;
+    if (columns <= 3)
+        return chars.slice(0, columns).join("");
+    return chars.slice(0, columns - 3).join("") + "...";
+}
+export function renderBanner(input) {
+    const styles = palette(input.capabilities);
+    const { columns } = input.capabilities;
+    const art = wordmark(input.capabilities);
+    const compact = art.length === 1;
+    const rows = art.map((text) => ({ text, style: "accent" }));
+    rows.push({ text: "", style: null });
+    rows.push({
+        text: compact ? `v${input.version}` : `Mafdet CLI v${input.version}`,
+        style: "bold",
+    });
+    // The path is filesystem-supplied text going straight to a terminal.
+    rows.push({
+        text: `Workspace: ${redact(stripAnsi(input.workspace))}`,
+        style: "dim",
+    });
+    // Tips are guidance, not decoration; they go once, on the welcome page. When
+    // they do not fit they collapse to one line, the same way the wordmark does
+    // - a truncated sentence is worse than a short one that is whole.
+    const tipRows = TIPS.map((tip, index) => ({
+        text: `  ${index + 1}. ${tip}`,
+        style: "dim",
+    }));
+    const tipsFit = tipRows.every((row) => [...row.text].length <= columns);
+    rows.push({ text: "", style: null });
+    if (tipsFit) {
+        rows.push({ text: "Tips:", style: "dim" });
+        rows.push(...tipRows);
+    }
+    else {
+        rows.push({ text: "Run /help for commands", style: "dim" });
+    }
+    rows.push({ text: "", style: null });
+    const rendered = rows.map(({ text, style }) => {
+        const fitted = clamp(text, columns);
+        return style === null || fitted === "" ? fitted : styles[style](fitted);
+    });
+    return rendered.join("\n") + "\n";
+}

package/dist/tui/input.d.ts

@@ -0,0 +1,17 @@
+import { type Key } from "./keys.js";
+export interface KeySource {
+    nextKeys(): Promise<readonly Key[] | undefined>;
+    /** Stop reading and put stdin back the way it was found. */
+    close(): void;
+}
+export interface RawStdin {
+    setRawMode?(mode: boolean): unknown;
+    resume?(): unknown;
+    pause?(): unknown;
+    setEncoding?(encoding: string): unknown;
+    on(event: string, listener: (chunk: string) => void): unknown;
+    off?(event: string, listener: (chunk: string) => void): unknown;
+    readonly isTTY?: boolean;
+}
+export declare function keyboard(stdin: RawStdin): KeySource;
+//# sourceMappingURL=input.d.ts.map

package/dist/tui/input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.d.ts","sourceRoot":"","sources":["../../src/tui/input.ts"],"names":[],"mappings":"AAQA,OAAO,EAAc,KAAK,GAAG,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,WAAW,SAAS;IACxB,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IAChD,4DAA4D;IAC5D,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACpC,MAAM,CAAC,IAAI,OAAO,CAAC;IACnB,KAAK,CAAC,IAAI,OAAO,CAAC;IAClB,WAAW,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACxC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;IAC9D,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,CA8CnD"}

package/dist/tui/input.js

@@ -0,0 +1,57 @@
+// CLI-019 · Reading the keyboard.
+//
+// A queue, not a per-prompt listener. CLI-014 lost pasted lines because
+// readline discarded what it had already buffered between questions; the same
+// shape of bug here would silently truncate a pasted API key. So every chunk
+// that arrives is decoded and kept, and a widget asking for input drains the
+// queue before it waits.
+import { decodeKeys } from "./keys.js";
+export function keyboard(stdin) {
+    const pending = [];
+    let waiting;
+    let ended = false;
+    const deliver = (keys) => {
+        if (waiting !== undefined) {
+            const resolve = waiting;
+            waiting = undefined;
+            resolve(keys);
+            return;
+        }
+        if (keys !== undefined)
+            pending.push([...keys]);
+    };
+    const onData = (chunk) => {
+        const keys = decodeKeys(chunk);
+        if (keys.length > 0)
+            deliver(keys);
+    };
+    const onEnd = () => {
+        ended = true;
+        deliver(undefined);
+    };
+    if (stdin.isTTY === true)
+        stdin.setRawMode?.(true);
+    stdin.setEncoding?.("utf8");
+    stdin.resume?.();
+    stdin.on("data", onData);
+    stdin.on("end", onEnd);
+    return {
+        async nextKeys() {
+            const queued = pending.shift();
+            if (queued !== undefined)
+                return queued;
+            if (ended)
+                return undefined;
+            return new Promise((resolve) => {
+                waiting = resolve;
+            });
+        },
+        close() {
+            stdin.off?.("data", onData);
+            stdin.off?.("end", onEnd);
+            if (stdin.isTTY === true)
+                stdin.setRawMode?.(false);
+            stdin.pause?.();
+        },
+    };
+}

package/dist/tui/interrupt.d.ts

@@ -0,0 +1,32 @@
+export type InterruptOutcome = {
+    readonly action: "cancel-operation";
+} | {
+    readonly action: "exit";
+} | {
+    readonly action: "force-exit";
+    readonly warnUnknownBilling: boolean;
+};
+export interface InterruptState {
+    /** A model request or a local command is running. */
+    readonly busy: boolean;
+    /** A cancel was already requested and has not finished unwinding. */
+    readonly cleaningUp: boolean;
+}
+/** Pure: what a Ctrl+C means right now. */
+export declare function interpretInterrupt(state: InterruptState): InterruptOutcome;
+export declare const FORCED_EXIT_NOTICE: string;
+/**
+ * Tracks whether an operation is in flight, so the interpretation above has
+ * something truthful to read.
+ */
+export declare class InterruptTracker {
+    private busy;
+    private cleaningUp;
+    begin(): void;
+    finish(): void;
+    /** Called when a cancel has been requested but has not settled yet. */
+    startCleanup(): void;
+    state(): InterruptState;
+    press(): InterruptOutcome;
+}
+//# sourceMappingURL=interrupt.d.ts.map

package/dist/tui/interrupt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interrupt.d.ts","sourceRoot":"","sources":["../../src/tui/interrupt.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,2CAA2C;AAC3C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,gBAAgB,CAM1E;AAED,eAAO,MAAM,kBAAkB,QAE0B,CAAC;AAE1D;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,UAAU,CAAS;IAE3B,KAAK,IAAI,IAAI;IAIb,MAAM,IAAI,IAAI;IAKd,uEAAuE;IACvE,YAAY,IAAI,IAAI;IAIpB,KAAK,IAAI,cAAc;IAIvB,KAAK,IAAI,gBAAgB;CAK1B"}

package/dist/tui/interrupt.js

@@ -0,0 +1,47 @@
+// CLI-021 · Two-stage Ctrl+C.
+//
+// Plan §19.7. One press while something is in flight cancels that operation
+// and waits for it to unwind; a press while idle leaves. The second press
+// during cleanup forces the local process down, and it has to say plainly that
+// the upstream may still be generating - CLI-006 established that a cancelled
+// stream produced no charge in testing but that this is an observation, not a
+// guarantee. Exiting quietly there would upgrade an observation into a promise.
+/** Pure: what a Ctrl+C means right now. */
+export function interpretInterrupt(state) {
+    if (state.cleaningUp) {
+        return { action: "force-exit", warnUnknownBilling: true };
+    }
+    if (state.busy)
+        return { action: "cancel-operation" };
+    return { action: "exit" };
+}
+export const FORCED_EXIT_NOTICE = "forced exit during cleanup - the upstream request may have completed, " +
+    "so a charge is possible; check 'mafdet account usage'";
+/**
+ * Tracks whether an operation is in flight, so the interpretation above has
+ * something truthful to read.
+ */
+export class InterruptTracker {
+    busy = false;
+    cleaningUp = false;
+    begin() {
+        this.busy = true;
+    }
+    finish() {
+        this.busy = false;
+        this.cleaningUp = false;
+    }
+    /** Called when a cancel has been requested but has not settled yet. */
+    startCleanup() {
+        this.cleaningUp = true;
+    }
+    state() {
+        return { busy: this.busy, cleaningUp: this.cleaningUp };
+    }
+    press() {
+        const outcome = interpretInterrupt(this.state());
+        if (outcome.action === "cancel-operation")
+            this.startCleanup();
+        return outcome;
+    }
+}

package/dist/tui/keys.d.ts

@@ -0,0 +1,30 @@
+export type Key = {
+    readonly kind: "up";
+} | {
+    readonly kind: "down";
+} | {
+    readonly kind: "left";
+} | {
+    readonly kind: "right";
+} | {
+    readonly kind: "enter";
+} | {
+    readonly kind: "escape";
+} | {
+    readonly kind: "backspace";
+} | {
+    readonly kind: "interrupt";
+} | {
+    readonly kind: "eof";
+} | {
+    readonly kind: "char";
+    readonly value: string;
+};
+/**
+ * Decode one chunk from a raw-mode stdin.
+ *
+ * Unrecognised control bytes are dropped rather than surfaced as characters:
+ * a stray byte must never end up inside a pasted API key.
+ */
+export declare function decodeKeys(chunk: string): Key[];
+//# sourceMappingURL=keys.d.ts.map

package/dist/tui/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/tui/keys.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,GAAG,GACX;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAStD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,CAyE/C"}

package/dist/tui/keys.js

@@ -0,0 +1,86 @@
+// CLI-019 · Turning raw terminal bytes into key events.
+//
+// Pure, and it returns an array rather than a single key, because a paste
+// arrives as one chunk containing every character at once. CLI-014 lost four
+// lines of pasted input to exactly this shape of mistake - readline dropped
+// what it had already buffered - so here the decoder is written to expect a
+// chunk and tested on one.
+const ESC = String.fromCharCode(27);
+const ARROWS = {
+    A: "up",
+    B: "down",
+    C: "right",
+    D: "left",
+};
+/**
+ * Decode one chunk from a raw-mode stdin.
+ *
+ * Unrecognised control bytes are dropped rather than surfaced as characters:
+ * a stray byte must never end up inside a pasted API key.
+ */
+export function decodeKeys(chunk) {
+    const keys = [];
+    const chars = [...chunk];
+    let i = 0;
+    while (i < chars.length) {
+        const ch = chars[i];
+        const code = ch.codePointAt(0) ?? 0;
+        // CSI sequences: ESC [ <final>. Anything else starting with ESC is
+        // treated as a bare Escape and the rest is decoded normally.
+        if (ch === ESC && chars[i + 1] === "[") {
+            const final = chars[i + 2];
+            if (final !== undefined && ARROWS[final] !== undefined) {
+                keys.push({ kind: ARROWS[final] });
+                i += 3;
+                continue;
+            }
+            // An unknown CSI: skip to its final byte (0x40-0x7e) so its parameters
+            // are not mistaken for typed characters.
+            let j = i + 2;
+            while (j < chars.length) {
+                const c = chars[j].codePointAt(0) ?? 0;
+                if (c >= 0x40 && c <= 0x7e)
+                    break;
+                j += 1;
+            }
+            i = j + 1;
+            continue;
+        }
+        if (ch === ESC) {
+            keys.push({ kind: "escape" });
+            i += 1;
+            continue;
+        }
+        if (ch === "\r" || ch === "\n") {
+            keys.push({ kind: "enter" });
+            i += 1;
+            // A CRLF pair is one Enter, not two.
+            if (ch === "\r" && chars[i] === "\n")
+                i += 1;
+            continue;
+        }
+        if (code === 0x7f || code === 0x08) {
+            keys.push({ kind: "backspace" });
+            i += 1;
+            continue;
+        }
+        if (code === 0x03) {
+            keys.push({ kind: "interrupt" });
+            i += 1;
+            continue;
+        }
+        if (code === 0x04) {
+            keys.push({ kind: "eof" });
+            i += 1;
+            continue;
+        }
+        // Remaining C0 controls carry no meaning here and are dropped.
+        if (code < 0x20) {
+            i += 1;
+            continue;
+        }
+        keys.push({ kind: "char", value: ch });
+        i += 1;
+    }
+    return keys;
+}

package/dist/tui/onboarding.d.ts

@@ -0,0 +1,28 @@
+import type { CommandIo } from "../commands/runtime.js";
+import { diagnoseKey, type KeyDiagnosis } from "./adapters/auth.js";
+import { type TerminalCapabilities } from "./theme.js";
+import { type WidgetIo } from "./widgets.js";
+export declare const KEYS_URL = "https://www.mafdet.ai/api-keys";
+export interface OnboardingResult {
+    readonly kind: "authenticated" | "cancelled";
+    /** Held by the caller for the life of the session. Never persisted. */
+    readonly apiKey?: string;
+    readonly diagnosis?: KeyDiagnosis;
+}
+export interface OnboardingOptions {
+    readonly io: WidgetIo;
+    readonly commandIo: CommandIo;
+    readonly capabilities: TerminalCapabilities;
+    /** Injected so the flow can be driven without touching the network. */
+    readonly diagnose?: typeof diagnoseKey;
+}
+type Method = "environment" | "paste" | "how-to";
+/** Which routes make sense right now, and which one to land on. */
+export declare function methodsFor(hasEnvKey: boolean): {
+    value: Method;
+    label: string;
+    detail?: string;
+}[];
+export declare function runOnboarding(options: OnboardingOptions): Promise<OnboardingResult>;
+export {};
+//# sourceMappingURL=onboarding.d.ts.map

package/dist/tui/onboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/tui/onboarding.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7D,eAAO,MAAM,QAAQ,mCAAmC,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAAC;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,WAAW,CAAC;CACxC;AAED,KAAK,MAAM,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjD,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO;WACrB,MAAM;WAAS,MAAM;aAAW,MAAM;IAkB7D;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA0D3B"}

package/dist/tui/onboarding.js

@@ -0,0 +1,117 @@
+// CLI-019 · Getting a working key, without ever writing one down.
+//
+// Only the three routes the current auth system genuinely supports are
+// offered. The plan (§19.4) is explicit that Google sign-in, browser login and
+// "save securely" must not appear as entries that do nothing - an option that
+// cannot work is worse than an option that is absent.
+import { loadConfig } from "../config/load.js";
+import { diagnoseKey } from "./adapters/auth.js";
+import { palette } from "./theme.js";
+import { select, secret } from "./widgets.js";
+export const KEYS_URL = "https://www.mafdet.ai/api-keys";
+/** Which routes make sense right now, and which one to land on. */
+export function methodsFor(hasEnvKey) {
+    const items = [];
+    if (hasEnvKey) {
+        items.push({
+            value: "environment",
+            label: "Use MAFDET_API_KEY from the environment",
+            detail: "already set in this shell",
+        });
+    }
+    items.push({
+        value: "paste",
+        label: "Paste a Mafdet API key for this session",
+        detail: "kept in memory only - not written to any file",
+    });
+    items.push({
+        value: "how-to",
+        label: "Show how to create an API key",
+    });
+    return items;
+}
+export async function runOnboarding(options) {
+    const { io, commandIo, capabilities } = options;
+    const diagnose = options.diagnose ?? diagnoseKey;
+    const { bold, dim } = palette(capabilities);
+    // Resolved the same way every other command resolves it, rather than by
+    // reading env directly: `commandIo.env` is optional, so poking at it here
+    // meant the environment entry silently vanished in production while every
+    // scripted test - which always passes an env - stayed green.
+    const envKey = loadConfig({
+        env: commandIo.env,
+        cwd: commandIo.cwd,
+        userConfigFile: commandIo.userConfigFile,
+    }).apiKey?.trim();
+    for (;;) {
+        const choice = await select(io, {
+            title: "How would you like to authenticate?",
+            items: methodsFor(envKey !== undefined && envKey.length > 0),
+        });
+        if (choice.kind === "cancelled")
+            return { kind: "cancelled" };
+        if (choice.value === "how-to") {
+            io.write(instructions(capabilities));
+            continue;
+        }
+        let candidate;
+        if (choice.value === "environment") {
+            candidate = envKey;
+        }
+        else {
+            const entered = await secret(io, {
+                prompt: "Paste your API key",
+                hint: "input is hidden; it is not saved and not added to the environment",
+            });
+            if (entered.kind === "cancelled")
+                continue;
+            candidate = entered.value?.trim();
+        }
+        if (candidate === undefined || candidate.length === 0) {
+            io.write(dim("  no key entered\n\n"));
+            continue;
+        }
+        io.write(dim("  checking the key...\n"));
+        const diagnosis = await diagnose({ apiKey: candidate, io: commandIo });
+        if (!diagnosis.ok) {
+            // Drop the reference before looping: a rejected key has no reason to
+            // stay reachable for the rest of the process.
+            candidate = undefined;
+            io.write(`  ${bold("could not use that key")}: ${diagnosis.problem}\n\n`);
+            continue;
+        }
+        io.write(summary(diagnosis, capabilities));
+        return { kind: "authenticated", apiKey: candidate, diagnosis };
+    }
+}
+function summary(diagnosis, capabilities) {
+    const { dim, bold } = palette(capabilities);
+    const lines = [
+        `  ${bold("key")}      ${diagnosis.fingerprint}`,
+        `  ${bold("models")}   ${diagnosis.modelCount} callable`,
+    ];
+    if (diagnosis.balance !== undefined) {
+        lines.push(`  ${bold("balance")}  ${diagnosis.balance}`);
+    }
+    if (diagnosis.missingAccountRead) {
+        // A missing optional scope is worth one sentence, not a failure.
+        lines.push(dim("  balance and plan need the account:read scope; model calls work without it"));
+    }
+    return lines.join("\n") + "\n\n";
+}
+function instructions(capabilities) {
+    const { bold, dim } = palette(capabilities);
+    return ([
+        "",
+        bold("  Creating an API key"),
+        "",
+        `  1. Open ${KEYS_URL}`,
+        "  2. Create a key. Tick account:read if you want balance and plan",
+        "     to show here; model calls do not need it.",
+        "  3. Copy it once - it is not shown again.",
+        "",
+        dim("  The key is sent only to Mafdet AI, over HTTPS. This CLI never"),
+        dim("  writes it to a file and never prints it in full."),
+        "",
+    ].join("\n") + "\n");
+}

package/dist/tui/picker.d.ts

@@ -0,0 +1,24 @@
+import type { ResolvedModel } from "../api/models.js";
+import type { Key } from "./keys.js";
+import { type TerminalCapabilities } from "./theme.js";
+import type { WidgetIo } from "./widgets.js";
+export interface PickResult {
+    readonly kind: "picked" | "cancelled";
+    readonly model?: ResolvedModel;
+}
+export interface PickerOptions {
+    readonly models: readonly ResolvedModel[];
+    /** Restrict to models the agent may drive. */
+    readonly agentOnly: boolean;
+    /** Pre-selected if still present in the list. */
+    readonly current?: string;
+}
+export declare function pickModel(io: WidgetIo, options: PickerOptions): Promise<PickResult>;
+/**
+ * What to say when this key can call chat models but the agent may drive none
+ * of them. Not an error: chat still works, and the reason is checkable.
+ */
+export declare function noAgentModelsNotice(chatCount: number, capabilities: TerminalCapabilities): string;
+/** Used by the picker's key handling; exported for the tests. */
+export type { Key };
+//# sourceMappingURL=picker.d.ts.map

package/dist/tui/picker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"picker.d.ts","sourceRoot":"","sources":["../../src/tui/picker.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW7C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAiHrB;AA6BD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAYR;AAED,iEAAiE;AACjE,YAAY,EAAE,GAAG,EAAE,CAAC"}