@mafdet/cli 0.3.0

package/dist/commands/account.js

@@ -0,0 +1,103 @@
+import { fetchSubscription, fetchUsage, fetchWallet } from "../api/account.js";
+import { ExitCode } from "../output/exit-codes.js";
+import { parseFormatFlags, renderJson, renderRecord, } from "../output/format.js";
+import { formatUsd } from "../output/money.js";
+import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
+const USAGE = `Usage:
+  mafdet account balance [--json]
+  mafdet account usage [--days <n>] [--json]
+  mafdet account subscription [--json]
+
+Requires an API key with the 'account:read' scope.
+`;
+export async function accountCommand(argv, io) {
+    const [subcommand, ...rest] = argv;
+    if (!["balance", "usage", "subscription"].includes(subcommand ?? "")) {
+        io.stderr(subcommand === undefined
+            ? USAGE
+            : `mafdet account: unknown subcommand '${subcommand}'\n${USAGE}`);
+        return ExitCode.Usage;
+    }
+    try {
+        const { format, rest: args } = parseFormatFlags(rest);
+        const runtime = buildRuntime(io);
+        requireApiKey(runtime.config);
+        if (subcommand === "balance") {
+            if (args.length > 0)
+                return badArg(args[0], io);
+            const wallet = await fetchWallet(runtime.accountPlane);
+            if (format === "json") {
+                io.stdout(renderJson(wallet));
+                return ExitCode.Ok;
+            }
+            io.stdout(renderRecord([
+                ["balance", formatUsd(wallet.balance_micro_usd)],
+                ["bonus", formatUsd(wallet.bonus_micro_usd)],
+                ["frozen", formatUsd(wallet.frozen_micro_usd)],
+                ["available", formatUsd(wallet.available_micro_usd)],
+            ]));
+            return ExitCode.Ok;
+        }
+        if (subcommand === "usage") {
+            const daysAt = args.indexOf("--days");
+            let days;
+            if (daysAt !== -1) {
+                const raw = args[daysAt + 1];
+                days = Number(raw);
+                if (!Number.isInteger(days) || days <= 0) {
+                    io.stderr(`mafdet account usage: --days needs a positive integer, got '${raw ?? ""}'\n`);
+                    return ExitCode.Usage;
+                }
+                args.splice(daysAt, 2);
+            }
+            if (args.length > 0)
+                return badArg(args[0], io);
+            const usage = await fetchUsage(runtime.accountPlane, days);
+            if (format === "json") {
+                io.stdout(renderJson(usage));
+                return ExitCode.Ok;
+            }
+            io.stdout(renderRecord([
+                ["window", `${usage.days} day(s), ${usage.from} -> ${usage.to}`],
+                // Throttled attempts land in the ledger with a zero charge
+                // (CLI-001), so the count and the money answer different questions.
+                [
+                    "requests",
+                    `${usage.count} (includes throttled attempts, which cost nothing)`,
+                ],
+                ["input tokens", String(usage.input_tokens)],
+                ["output tokens", String(usage.output_tokens)],
+                ["charged", formatUsd(usage.charge_micro_usd)],
+            ]));
+            return ExitCode.Ok;
+        }
+        if (args.length > 0)
+            return badArg(args[0], io);
+        const subscription = await fetchSubscription(runtime.accountPlane);
+        if (format === "json") {
+            io.stdout(renderJson(subscription));
+            return ExitCode.Ok;
+        }
+        const rows = [
+            ["plan", subscription.plan_name ?? subscription.plan_slug ?? "-"],
+            ["status", subscription.status],
+            ["renews", subscription.current_period_end ?? "-"],
+        ];
+        if (subscription.playground) {
+            const pg = subscription.playground;
+            rows.push(["playground allowance", formatUsd(pg.allowance_micro_usd)], [
+                "playground used",
+                `${formatUsd(pg.used_micro_usd)} (${pg.usage_percent}%)`,
+            ], ["playground left", formatUsd(pg.remaining_micro_usd)]);
+        }
+        io.stdout(renderRecord(rows));
+        return ExitCode.Ok;
+    }
+    catch (error) {
+        return reportError(error, io);
+    }
+}
+function badArg(arg, io) {
+    io.stderr(`mafdet account: unexpected argument '${arg}'\n${USAGE}`);
+    return ExitCode.Usage;
+}

package/dist/commands/agent.d.ts

@@ -0,0 +1,10 @@
+import { ExitCode } from "../output/exit-codes.js";
+import { type CommandIo } from "./runtime.js";
+export interface AgentIo extends CommandIo {
+    signal?: AbortSignal;
+    /** Overridden in tests; production reads the TTY. */
+    isInteractive?: boolean;
+    approver?: import("../agent/approvals.js").Approver;
+}
+export declare function agentCommand(argv: readonly string[], io: AgentIo): Promise<ExitCode>;
+//# sourceMappingURL=agent.d.ts.map

package/dist/commands/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AA6BtB,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,uBAAuB,EAAE,QAAQ,CAAC;CACrD;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,QAAQ,CAAC,CA+GnB"}

package/dist/commands/agent.js

@@ -0,0 +1,268 @@
+import { fetchAccessibleModels, fetchCatalog, intersectModels, } from "../api/models.js";
+import { approverFor } from "../agent/approvals.js";
+import { runAgent } from "../agent/loop.js";
+import { runSession } from "../agent/session.js";
+import { READ_ONLY_TOOLS } from "../agent/tools/read-only.js";
+import { COMMAND_TOOLS } from "../agent/tools/run-command.js";
+import { WRITE_TOOLS } from "../agent/tools/write.js";
+import { Workspace, WorkspaceError } from "../filesystem/workspace.js";
+import { ExitCode } from "../output/exit-codes.js";
+import { renderJson, renderRecord } from "../output/format.js";
+import { formatUsd } from "../output/money.js";
+import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
+const USAGE = `Usage:
+  mafdet agent "<goal>" [--model <id>] [--allow-write]
+                        [--allow-command "<prefix>"]... [--max-turns <n>]
+                        [--max-cost-usd <n>] [--json]
+
+Read-only by default. With --allow-write the agent may edit and create files,
+and every change is shown as a diff and confirmed before it is written. There
+is no flag that approves everything in advance, and a non-interactive run
+cannot write at all.
+`;
+const READ_ONLY_PROMPT = `You are the Mafdet CLI agent working inside a user's workspace.
+
+Use the provided tools to inspect the workspace. You cannot modify anything:
+there are no write or shell tools, so do not claim to have changed a file.
+Read before you conclude - never guess a file's contents. When you have the
+answer, reply with it directly instead of calling another tool. Be concise.`;
+const WRITE_PROMPT = `You are the Mafdet CLI agent working inside a user's workspace.
+
+Inspect with the read tools, and change files with edit_file and create_file.
+Always read a file before editing it, and quote old_text exactly as it appears,
+with enough surrounding lines to be unique - a near miss is refused rather than
+guessed at. Every change is shown to the user and applied only if they accept
+it; if one is declined, do not retry the same change. There is no shell, so do
+not claim to have run anything. Be concise.`;
+export async function agentCommand(argv, io) {
+    try {
+        const parsed = parseArgs(argv, io);
+        if (typeof parsed === "number")
+            return parsed;
+        const runtime = buildRuntime(io);
+        requireApiKey(runtime.config);
+        const model = parsed.model ?? runtime.config.model;
+        if (!model) {
+            io.stderr("mafdet agent: no model. Pass --model or set MAFDET_MODEL.\n");
+            return ExitCode.Usage;
+        }
+        const [accessible, catalog] = await Promise.all([
+            fetchAccessibleModels(runtime.dataPlane),
+            fetchCatalog(runtime.accountPlane),
+        ]);
+        const resolved = intersectModels(accessible, catalog).available.find((candidate) => candidate.modelId === model);
+        // Admission is the catalogue's call, and it fails closed: a model whose
+        // tool calling has not been verified end to end is refused rather than
+        // tried hopefully (plan §7.3, CLI-000C).
+        if (!resolved?.agentEligible) {
+            io.stderr(`mafdet agent: ${model} is not verified for tool calling, so the agent will not use it.\n` +
+                `Run 'mafdet models list --agent' to see the models that are.\n`);
+            return ExitCode.Usage;
+        }
+        const workspace = Workspace.open(io.cwd ?? process.cwd());
+        // Plan §8.1: writes need an explicit flag AND a terminal to confirm in.
+        // A pipeline that asked for --allow-write still gets read-only, because
+        // there is nobody there to see the diff.
+        const interactive = io.isInteractive ?? process.stdin.isTTY === true;
+        const mode = parsed.allowWrite && interactive ? "suggest" : "read-only";
+        if (parsed.allowWrite && !interactive) {
+            io.stderr("note: --allow-write needs an interactive terminal to confirm changes; running read-only\n");
+        }
+        io.stderr(`workspace: ${workspace.root}\nmodel: ${model} (${mode})\n`);
+        if (parsed.goal.length === 0) {
+            if (!interactive) {
+                io.stderr(`mafdet agent: no goal\n${USAGE}`);
+                return ExitCode.Usage;
+            }
+            const summary = await runSession({
+                client: runtime.dataPlane,
+                model,
+                pricing: resolved,
+                catalog,
+                systemPrompt: mode === "read-only" ? READ_ONLY_PROMPT : WRITE_PROMPT,
+                tools: buildToolset(mode, parsed.allowedCommands.length > 0),
+                toolContext: { workspace, allowedCommands: parsed.allowedCommands },
+                approver: io.approver ?? approverFor(mode, io, interactive),
+                mode,
+                allowedCommands: parsed.allowedCommands,
+                stdout: io.stdout,
+                stderr: io.stderr,
+                signal: io.signal,
+            });
+            io.stderr("\n" +
+                renderRecord([
+                    ["goals", `${summary.goals}`],
+                    ["model requests", `${summary.modelRequests}`],
+                    ["tool runs", `${summary.toolRuns}`],
+                    [
+                        "tokens",
+                        `${summary.promptTokens} in / ${summary.completionTokens} out`,
+                    ],
+                    ["cost", `~${formatUsd(summary.costMicroUsd)}`],
+                ]));
+            return ExitCode.Ok;
+        }
+        const report = await runAgent({
+            client: runtime.dataPlane,
+            model,
+            pricing: resolved,
+            goal: parsed.goal,
+            systemPrompt: mode === "read-only" ? READ_ONLY_PROMPT : WRITE_PROMPT,
+            tools: buildToolset(mode, parsed.allowedCommands.length > 0),
+            approver: io.approver ?? approverFor(mode, io, interactive),
+            toolContext: { workspace, allowedCommands: parsed.allowedCommands },
+            limits: {
+                ...(parsed.maxTurns === undefined ? {} : { maxTurns: parsed.maxTurns }),
+                ...(parsed.maxCostMicroUsd === undefined
+                    ? {}
+                    : { maxCostMicroUsd: parsed.maxCostMicroUsd }),
+            },
+            signal: io.signal,
+            onEvent: (event) => reportEvent(event, io),
+        });
+        return finish(report, parsed.json, io);
+    }
+    catch (error) {
+        if (error instanceof WorkspaceError) {
+            io.stderr(`mafdet agent: ${error.message}\n`);
+            return ExitCode.LocalDenied;
+        }
+        return reportError(error, io);
+    }
+}
+function parseArgs(argv, io) {
+    const positional = [];
+    let model;
+    let maxTurns;
+    let maxCostMicroUsd;
+    let json = false;
+    let allowWrite = false;
+    const allowedCommands = [];
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        const next = () => argv[(i += 1)];
+        if (arg === "--model")
+            model = next();
+        else if (arg === "--json")
+            json = true;
+        else if (arg === "--allow-write")
+            allowWrite = true;
+        else if (arg === "--allow-command") {
+            const entry = next();
+            if (!entry) {
+                io.stderr("mafdet agent: --allow-command needs a command prefix\n");
+                return ExitCode.Usage;
+            }
+            allowedCommands.push(entry);
+        }
+        else if (arg === "--read-only")
+            allowWrite = false;
+        else if (arg === "--max-turns") {
+            const raw = next();
+            maxTurns = Number(raw);
+            if (!Number.isInteger(maxTurns) || maxTurns <= 0) {
+                io.stderr(`mafdet agent: --max-turns needs a positive integer, got '${raw ?? ""}'\n`);
+                return ExitCode.Usage;
+            }
+        }
+        else if (arg === "--max-cost-usd") {
+            const raw = next() ?? "";
+            // Parsed as a decimal string into integer micro-USD: a float would make
+            // the ceiling itself imprecise.
+            const match = /^(\d+)(?:\.(\d{1,6}))?$/.exec(raw);
+            if (!match) {
+                io.stderr(`mafdet agent: --max-cost-usd needs a positive amount, got '${raw}'\n`);
+                return ExitCode.Usage;
+            }
+            maxCostMicroUsd =
+                BigInt(match[1]) * 1000000n + BigInt((match[2] ?? "").padEnd(6, "0"));
+            if (maxCostMicroUsd <= 0n) {
+                io.stderr("mafdet agent: --max-cost-usd must be greater than zero\n");
+                return ExitCode.Usage;
+            }
+        }
+        else if (arg.startsWith("--")) {
+            io.stderr(`mafdet agent: unknown option '${arg}'\n${USAGE}`);
+            return ExitCode.Usage;
+        }
+        else
+            positional.push(arg);
+    }
+    // No goal is not an error when there is a terminal: it starts a session.
+    const goal = positional.join(" ").trim();
+    return {
+        goal,
+        allowWrite,
+        allowedCommands,
+        model,
+        maxTurns,
+        maxCostMicroUsd,
+        json,
+    };
+}
+/**
+ * A tool the run cannot use is not offered at all. Read-only means the model
+ * never sees a write tool, and run_command appears only when the user named at
+ * least one allowed command or can approve interactively.
+ */
+function buildToolset(mode, hasAllowedCommands) {
+    if (mode === "read-only" && !hasAllowedCommands)
+        return READ_ONLY_TOOLS;
+    if (mode === "read-only")
+        return [...READ_ONLY_TOOLS, ...COMMAND_TOOLS];
+    return [...READ_ONLY_TOOLS, ...WRITE_TOOLS, ...COMMAND_TOOLS];
+}
+function reportEvent(event, io) {
+    if (event.type === "turn")
+        io.stderr(`\n[turn ${event.turn}]\n`);
+    else if (event.type === "tool") {
+        const first = event.detail.split("\n")[0].slice(0, 100);
+        io.stderr(`  ${event.ok ? "-" : "!"} ${event.name}: ${first}\n`);
+    }
+    else if (event.type === "rate_limited") {
+        io.stderr(`  rate limited, waiting ${event.waitMs}ms (attempt ${event.attempt})\n`);
+    }
+}
+/** Exit codes follow §4.5: a ceiling is 7, a cancel is 6. */
+function finish(report, json, io) {
+    if (json) {
+        io.stdout(renderJson({ ...report, costMicroUsd: report.costMicroUsd.toString() }));
+    }
+    else {
+        if (report.finalText)
+            io.stdout(`${report.finalText}\n`);
+        io.stderr("\n" +
+            renderRecord([
+                ["status", report.stopReason],
+                ["turns", `${report.turns}`],
+                ["model requests", `${report.modelRequests}`],
+                ["tool runs", `${report.toolRuns.length}`],
+                [
+                    "rate limited",
+                    `${report.rateLimitHits} (waited ${report.totalWaitMs}ms)`,
+                ],
+                [
+                    "tokens",
+                    `${report.promptTokens} in / ${report.completionTokens} out`,
+                ],
+                ["cost", `~${formatUsd(report.costMicroUsd)}`],
+            ]));
+        if (report.error)
+            io.stderr(`error: ${report.error}\n`);
+    }
+    switch (report.stopReason) {
+        case "completed":
+            return ExitCode.Ok;
+        case "cancelled":
+            return ExitCode.Cancelled;
+        case "max_turns":
+        case "timeout":
+        case "max_cost":
+            // Stopped short on purpose; the report says so rather than pretending.
+            return ExitCode.LimitReached;
+        case "rate_limited":
+            return ExitCode.Unavailable;
+        default:
+            return ExitCode.General;
+    }
+}

package/dist/commands/chat.d.ts

@@ -0,0 +1,13 @@
+import { type CatalogModel } from "../api/models.js";
+import { type StreamUsage } from "../api/sse-parser.js";
+import { ExitCode } from "../output/exit-codes.js";
+import { type CommandIo } from "./runtime.js";
+export interface ChatIo extends CommandIo {
+    /** Reads stdin when it is piped; tests inject it. */
+    readStdin?: () => Promise<string>;
+    /** Fires on Ctrl+C; tests drive it directly. */
+    signal?: AbortSignal;
+}
+export declare function chatCommand(argv: readonly string[], io: ChatIo): Promise<ExitCode>;
+export declare function estimateChargeMicroUsd(model: CatalogModel | undefined, usage: StreamUsage): bigint | undefined;
+//# sourceMappingURL=chat.d.ts.map

package/dist/commands/chat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/commands/chat.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAUtB,MAAM,WAAW,MAAO,SAAQ,SAAS;IACvC,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,gDAAgD;IAChD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAWD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAwLD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,KAAK,EAAE,WAAW,GACjB,MAAM,GAAG,SAAS,CASpB"}

package/dist/commands/chat.js

@@ -0,0 +1,191 @@
+import { readFileSync } from "node:fs";
+import { fetchCatalog } from "../api/models.js";
+import { readChatStream } from "../api/sse-parser.js";
+import { ApiError } from "../api/errors.js";
+import { ExitCode } from "../output/exit-codes.js";
+import { formatUsd } from "../output/money.js";
+import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
+const USAGE = `Usage:
+  mafdet chat [prompt] [--model <id>] [--system <file>] [--input <file>]
+              [--no-stream] [--max-tokens <n>] [--quiet]
+
+The prompt comes from an argument, from --input <file>, or from stdin when
+neither is given. Use "--input -" to force reading stdin.
+`;
+export async function chatCommand(argv, io) {
+    try {
+        const runtime = buildRuntime(io);
+        requireApiKey(runtime.config);
+        const args = await parseArgs(argv, runtime.config.model, io);
+        if (typeof args === "number")
+            return args;
+        const body = {
+            model: args.model,
+            messages: [
+                ...(args.system ? [{ role: "system", content: args.system }] : []),
+                { role: "user", content: args.prompt },
+            ],
+            stream: args.stream,
+        };
+        if (args.maxTokens !== undefined)
+            body.max_tokens = args.maxTokens;
+        // Ask for usage on the stream too, or the cost summary would be empty.
+        if (args.stream)
+            body.stream_options = { include_usage: true };
+        return args.stream
+            ? await streamChat(runtime, body, args, io)
+            : await completeChat(runtime, body, args, io);
+    }
+    catch (error) {
+        if (error instanceof ApiError && error.kind === "cancelled") {
+            io.stderr("\nmafdet: cancelled\n");
+            return ExitCode.Cancelled;
+        }
+        return reportError(error, io);
+    }
+}
+async function parseArgs(argv, configuredModel, io) {
+    const positional = [];
+    let model = configuredModel;
+    let systemFile;
+    let inputFile;
+    let stream = true;
+    let quiet = false;
+    let maxTokens;
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        const next = () => argv[(i += 1)];
+        if (arg === "--model")
+            model = next();
+        else if (arg === "--system")
+            systemFile = next();
+        else if (arg === "--input")
+            inputFile = next();
+        else if (arg === "--no-stream")
+            stream = false;
+        else if (arg === "--quiet")
+            quiet = true;
+        else if (arg === "--max-tokens") {
+            const raw = next();
+            maxTokens = Number(raw);
+            if (!Number.isInteger(maxTokens) || maxTokens <= 0) {
+                io.stderr(`mafdet chat: --max-tokens needs a positive integer, got '${raw ?? ""}'\n`);
+                return ExitCode.Usage;
+            }
+        }
+        else if (arg.startsWith("--")) {
+            io.stderr(`mafdet chat: unknown option '${arg}'\n${USAGE}`);
+            return ExitCode.Usage;
+        }
+        else
+            positional.push(arg);
+    }
+    if (!model) {
+        io.stderr("mafdet chat: no model. Pass --model, set MAFDET_MODEL, or put one in your config.\n");
+        return ExitCode.Usage;
+    }
+    // Two *explicitly chosen* sources is an error. Stdin is different: it is
+    // ambient, and it is not a TTY whenever the command runs from a script, a
+    // pipeline or CI — so treating "not a TTY" as "the user piped a prompt"
+    // would break `mafdet chat "hello"` everywhere except an interactive
+    // terminal. Stdin is read only when nothing else was given, or when asked
+    // for explicitly with `--input -`.
+    const wantsStdin = inputFile === "-";
+    if (positional.length > 0 && inputFile) {
+        io.stderr(`mafdet chat: a prompt argument and --input cannot be combined\n${USAGE}`);
+        return ExitCode.Usage;
+    }
+    const stdinAvailable = io.readStdin !== undefined && !process.stdin.isTTY;
+    const useStdin = wantsStdin || (positional.length === 0 && !inputFile && stdinAvailable);
+    if (positional.length === 0 && !inputFile && !useStdin) {
+        io.stderr(`mafdet chat: no prompt\n${USAGE}`);
+        return ExitCode.Usage;
+    }
+    if (wantsStdin && !io.readStdin) {
+        io.stderr("mafdet chat: --input - was given but stdin is not readable\n");
+        return ExitCode.Usage;
+    }
+    let prompt;
+    if (useStdin)
+        prompt = (await io.readStdin()).trim();
+    else if (positional.length > 0)
+        prompt = positional.join(" ");
+    else
+        prompt = readTextFile(inputFile, "--input");
+    if (prompt.length === 0) {
+        io.stderr("mafdet chat: the prompt is empty\n");
+        return ExitCode.Usage;
+    }
+    return {
+        prompt,
+        model,
+        system: systemFile ? readTextFile(systemFile, "--system") : undefined,
+        stream,
+        maxTokens,
+        quiet,
+    };
+}
+function readTextFile(path, flag) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw new ApiError({
+            kind: "request",
+            exitCode: ExitCode.Usage,
+            message: `${flag}: cannot read ${path}: ${error.message}`,
+        });
+    }
+}
+async function streamChat(runtime, body, args, io) {
+    const { response } = await runtime.dataPlane.postStream("/chat/completions", body, {
+        signal: io.signal,
+    });
+    // Text goes to stdout as it arrives; everything else is stderr, so
+    // `mafdet chat ... > answer.txt` captures only the answer.
+    const result = await readChatStream(response, { onText: io.stdout }, io.signal);
+    io.stdout("\n");
+    if (io.signal?.aborted) {
+        io.stderr("mafdet: cancelled - the connection was closed mid-generation\n");
+        await summarise(runtime, args, result.usage, io, { partial: true });
+        return ExitCode.Cancelled;
+    }
+    await summarise(runtime, args, result.usage, io);
+    return ExitCode.Ok;
+}
+async function completeChat(runtime, body, args, io) {
+    const { data } = await runtime.dataPlane.postJson("/chat/completions", body, { signal: io.signal });
+    io.stdout(`${data.choices?.[0]?.message?.content ?? ""}\n`);
+    await summarise(runtime, args, data.usage, io);
+    return ExitCode.Ok;
+}
+/**
+ * Tokens and money, on stderr. The charge is computed with the same arithmetic
+ * the gateway bills with — ceil per side, integer micro-USD — which CLI-000B
+ * verified against the ledger to the micro-dollar. It is still labelled as an
+ * estimate: the wallet, not the client, is the authority.
+ */
+async function summarise(runtime, args, usage, io, options = {}) {
+    if (args.quiet || !usage)
+        return;
+    let cost = "";
+    try {
+        const catalog = await fetchCatalog(runtime.accountPlane);
+        const model = catalog.find((m) => m.modelId === args.model);
+        const micros = estimateChargeMicroUsd(model, usage);
+        if (micros !== undefined)
+            cost = `, ~${formatUsd(micros)}`;
+    }
+    catch {
+        // A pricing lookup must never fail the call that already succeeded.
+    }
+    const prefix = options.partial ? "partial: " : "";
+    io.stderr(`${prefix}${usage.prompt_tokens} in / ${usage.completion_tokens} out tokens${cost}\n`);
+}
+export function estimateChargeMicroUsd(model, usage) {
+    if (!model?.inputPricePer1mMicroUsd || !model.outputPricePer1mMicroUsd)
+        return undefined;
+    const ceilDiv = (tokens, pricePer1m) => (BigInt(tokens) * BigInt(pricePer1m) + 999999n) / 1000000n;
+    return (ceilDiv(usage.prompt_tokens, model.inputPricePer1mMicroUsd) +
+        ceilDiv(usage.completion_tokens, model.outputPricePer1mMicroUsd));
+}

package/dist/commands/config.d.ts

@@ -0,0 +1,15 @@
+import { ExitCode } from "../output/exit-codes.js";
+export interface CommandIo {
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    userConfigFile?: string;
+}
+/**
+ * `config list` answers "what settings is the CLI actually using, and where
+ * did each come from" — the question a user asks when a run picks a model they
+ * did not expect. The key is only ever shown as a fingerprint.
+ */
+export declare function configCommand(argv: readonly string[], io: CommandIo): ExitCode;
+//# sourceMappingURL=config.d.ts.map

package/dist/commands/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAOnD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,QAAQ,CAwEV"}