@modelstatus/cli 0.1.81 → 0.1.83

package/README.md

@@ -29,10 +29,20 @@ Or skip install entirely and one-shot it: `npx @modelstatus/cli status`.
 
 ## Quick start
 
-### Free: offline health check
+### Free: open the dashboard
 
 ```bash
-mm status [dir]                       # if installed
+mm [dir]                              # the full TUI — inventory · scan · what's new · alerts
+```
+
+Just run `mm` (optionally on a folder) for the interactive dashboard: it scans
+locally, shows every model in use with its health, and lets you fix the dying
+ones — no account needed.
+
+### Free: a one-shot health check (great for CI / pipes)
+
+```bash
+mm status [dir]                       # quick offline check, prints + exits
 npx @modelstatus/cli status [dir]     # zero install (needs Node)
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelstatus/cli",
-  "version": "0.1.81",
+  "version": "0.1.83",
   "description": "Track which AI models you use, where, and never get surprised by a retirement. Free offline model-health for any repo (mm status), browser sign-in for cloud inventory + alerts.",
   "keywords": [
     "llm",

package/src/changelog-data.js

@@ -1,6 +1,24 @@
 /* GENERATED by scripts/gen-changelog.mjs from apps/web/lib/changelog.json — do not edit.
  * Release notes baked into the binary (in-TUI + the on-load what's-new card). */
 export const CHANGELOG = [
+  {
+    "version": "0.1.83",
+    "date": "2026-06-14",
+    "title": "Live progress on mm status",
+    "items": [
+      "`mm status` and `mm fix` now show live progress while they pull the registry and scan your repo — a cold run no longer sits silent and looks frozen.",
+      "Docs and the post-install quick start now lead with `mm` (the full dashboard); `mm status` is the quick, scriptable, no-account check that drops into CI."
+    ]
+  },
+  {
+    "version": "0.1.82",
+    "date": "2026-06-13",
+    "title": "Withdrawn models",
+    "items": [
+      "When a provider pulls a model it released (an unplanned withdrawal, not a planned retirement), it now shows a distinct ⚠ withdrawn badge — in `mm status`, the TUI, and on its model page — instead of silently becoming an unrecognized id.",
+      "If you reference a withdrawn model, you get alerted (the same as the people who saw its announcement)."
+    ]
+  },
   {
     "version": "0.1.81",
     "date": "2026-06-12",

package/src/index.js

@@ -14,7 +14,8 @@ import { redactValue } from "./redact.js";
 import { assignProjects, buildUsages } from "./upload.js";
 import { loginViaBrowser } from "./auth.js";
 import { maybeCheckForUpdate, forceUpdate } from "./updater.js";
-import { track, analyticsState } from "./telemetry.js";
+import { track, analyticsState, maybeFirstRun } from "./telemetry.js";
+import { startProgress } from "./spinner.js";
 import { BUILD_VERSION } from "./version.js";
 
 // TRUE BACKGROUND SCAN — hidden worker dispatch. MUST be the first executable
@@ -486,7 +487,7 @@ async function cmdCi(positional, flags) {
   if (flags.json) {
     console.log(JSON.stringify(report, null, 2));
   } else {
-    const ICON = { ok: "🟢", deprecating: "🟡", retiring: "🟠", retired: "🔴" };
+    const ICON = { ok: "🟢", deprecating: "🟡", retiring: "🟠", retired: "🔴", withdrawn: "⛔" };
     console.log(`LLM Status CI — scanned ${dir}  (fail-on: ${failOn})`);
     if (!findings.length) {
       console.log("✓ No deprecated, retiring, or retired AI models found.");
@@ -544,9 +545,14 @@ async function cmdFix(positional, flags) {
   const { getRegistry } = await import("./registry/fetch.js");
   const { resolveLocal, computeHealth } = await import("./registry/local.js");
   const { planFixes, applyFixes, terminalReplacement, recordFixes } = await import("./fix.js");
-  const snapshot = await getRegistry({ offline: !!flags.offline, log: (m) => process.stderr.write(`! ${m}\n`) });
+  // Same cold-start silence as `mm status`: registry download + repo walk with
+  // no feedback. Spinner is stderr-only and auto-off under --json.
+  const prog = startProgress(!flags.json, "fetching the model registry…");
+  const snapshot = await getRegistry({ offline: !!flags.offline, log: (m) => prog.log(m) });
 
+  prog.update("scanning for model references…");
   const candidates = await collectFrom(["filesystem"], { root: dir }, snapshot.detection);
+  prog.stop();
   const resolved = resolveLocal(snapshot, [...new Set(candidates.map((c) => c.model_string))]);
   const byStr = new Map(resolved.map((r) => [r.input.toLowerCase(), r]));
   const today = new Date();
@@ -688,9 +694,15 @@ async function cmdStatus(positional, flags) {
   const dir = path.resolve(positional[1] || flags.dir || ".");
   const { getRegistry } = await import("./registry/fetch.js");
   const { resolveLocal, computeHealth, dropResolvedFragments } = await import("./registry/local.js");
-  const snapshot = await getRegistry({ offline: !!flags.offline, log: (m) => process.stderr.write(`! ${m}\n`) });
+  // A cold `mm status` downloads the ~225 kB registry snapshot then walks the
+  // repo with zero output — it reads as frozen. Show live stderr progress
+  // (auto-off for --json / pipes so machine output stays byte-identical).
+  const prog = startProgress(!flags.json, "fetching the model registry…");
+  const snapshot = await getRegistry({ offline: !!flags.offline, log: (m) => prog.log(m) });
 
+  prog.update("scanning for model references…");
   let candidates = await collectFrom(parseSources(flags), scanOpts(flags, dir), snapshot.detection, explicitSources(flags));
+  prog.stop();
   const resolved = resolveLocal(snapshot, [...new Set(candidates.map((c) => c.model_string))]);
   const byStr = new Map(resolved.map((r) => [r.input.toLowerCase(), r]));
   // Suppress detector fragments of resolved aliases (see dropResolvedFragments).
@@ -709,8 +721,8 @@ async function cmdStatus(positional, flags) {
   }
 
   const today = new Date();
-  const ICON = { ok: "🟢", deprecating: "🟡", retiring: "🟠", retired: "🔴", custom: "⚪" };
-  const rank = { retired: 0, retiring: 1, deprecating: 2, ok: 3 };
+  const ICON = { ok: "🟢", deprecating: "🟡", retiring: "🟠", retired: "🔴", withdrawn: "⛔", custom: "⚪" };
+  const rank = { withdrawn: 0, retired: 0, retiring: 1, deprecating: 2, ok: 3 };
   const rows = [...known.values()]
     .map(({ model, count }) => ({ model, count, health: computeHealth(model, 90, today) }))
     .sort((a, b) => rank[a.health] - rank[b.health] || String(a.model.retires_date || "9999").localeCompare(String(b.model.retires_date || "9999")));
@@ -854,6 +866,7 @@ async function main() {
 
   // Anonymous, opt-out usage analytics (one-time disclosure, then a single
   // event per invocation). No-op without a baked key / when opted out.
+  maybeFirstRun(); // one-time cli_first_run per install (same opt-out as below)
   track("cli_command", { command: cmd || "tui" });
 
   // Explicit self-update: `mm update` (command) or `--update` (flag on any

package/src/registry/local.js

@@ -34,6 +34,10 @@ export function resolveLocal(snapshot, strings) {
 /** Mirror of the server's computeHealth for a snapshot (slug-space) model. */
 export function computeHealth(model, retiringWindowDays = 90, today = new Date()) {
   if (!model) return "custom";
+  // Withdrawn (provider pulled it) is distinct from a planned retirement and is
+  // checked first. Snapshots also stamp retires_date on withdrawn models so an
+  // OLDER binary (which doesn't know this status) falls to "retired" below.
+  if (model.status === "withdrawn") return "withdrawn";
   const ret = model.retires_date ? new Date(model.retires_date) : null;
   if (model.status === "retired" || (ret && ret <= today)) return "retired";
   if (ret) {

package/src/spinner.js

@@ -0,0 +1,45 @@
+/* Minimal dependency-free progress spinner for stderr. A silent command that
+ * spends a few seconds downloading the registry / scanning a repo reads as
+ * frozen — this gives live feedback. No-op when stderr isn't a TTY (piped, CI,
+ * --json) so machine output is never polluted. */
+
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+const CLEAR = "\r\x1b[2K"; // carriage return + clear the whole line
+
+/** Start a spinner. `active` lets callers force it off (e.g. --json). Returns
+ * { update(text), log(line), stop() }. `log` prints a line ABOVE the spinner
+ * (clears, writes, resumes) so warnings from the work aren't clobbered. */
+export function startProgress(active, text) {
+  const isTTY = !!process.stderr.isTTY;
+  if (!active || !isTTY) {
+    return { update() {}, log: (m) => process.stderr.write(`! ${m}\n`), stop() {} };
+  }
+  let i = 0;
+  let msg = text;
+  let timer = null;
+  const frame = () => process.stderr.write(`${CLEAR}${FRAMES[i = (i + 1) % FRAMES.length]} ${msg}`);
+  const start = () => {
+    frame();
+    timer = setInterval(frame, 80);
+    if (timer.unref) timer.unref(); // don't keep the process alive
+  };
+  const clear = () => {
+    if (timer) clearInterval(timer);
+    timer = null;
+    process.stderr.write(CLEAR);
+  };
+  start();
+  return {
+    update(m) {
+      msg = m;
+    },
+    log(m) {
+      clear();
+      process.stderr.write(`! ${m}\n`);
+      start();
+    },
+    stop() {
+      clear();
+    },
+  };
+}

package/src/telemetry.js

@@ -8,7 +8,8 @@
  * --define __POSTHOG_KEY__; with no key, every function here is a silent no-op. */
 import crypto from "node:crypto";
 import { loadConfig, setConfigValue } from "./config.js";
-import { BUILD_VERSION, UPDATE_CHANNEL } from "./version.js";
+import { BUILD_VERSION, UPDATE_CHANNEL, IS_SHELL_INSTALL } from "./version.js";
+import { isBrewManaged } from "./updater.js";
 
 // eslint-disable-next-line no-undef
 const POSTHOG_KEY = typeof __POSTHOG_KEY__ !== "undefined" ? __POSTHOG_KEY__ : (process.env.MM_POSTHOG_KEY || "");
@@ -20,6 +21,33 @@ const optedOut = () => {
 };
 const enabled = () => !!POSTHOG_KEY && !optedOut();
 
+/** How this CLI got onto the machine, for real-user-metrics segmentation.
+ *  - "homebrew": the binary lives under a brew prefix (shared with updater.js).
+ *  - "npm": running through Node from a node_modules tree (npm -g / npx).
+ *  - "binary": the curl|bash CDN binary (Bun-compiled, IS_SHELL_INSTALL=true) or
+ *    anything else we can't otherwise place.
+ *  Small + pure: takes its inputs so it's trivially testable. */
+export function installMethod(execPath = process.execPath, scriptPath = process.argv[1] || "") {
+  if (isBrewManaged(execPath)) return "homebrew";
+  // npm/npx run Node directly with our script under a node_modules tree; the
+  // compiled CDN binary is its own execPath and never lives under node_modules.
+  if (!IS_SHELL_INSTALL && (/node_modules/.test(scriptPath) || /node_modules/.test(execPath))) return "npm";
+  return "binary";
+}
+
+/** Properties stamped onto EVERY captured event — version/os/install method, plus
+ *  internal:true for our own dev machines (set MM_INTERNAL=1) so they can be
+ *  excluded from real-user metrics. Kept tiny + side-effect free. */
+function baseProps() {
+  const p = {
+    cli_version: BUILD_VERSION,
+    os: process.platform,
+    install_method: installMethod(),
+  };
+  if (process.env.MM_INTERNAL) p.internal = true;
+  return p;
+}
+
 let cachedId = null;
 function distinctId() {
   if (cachedId) return cachedId;
@@ -56,10 +84,9 @@ export function track(event, properties = {}) {
         distinct_id: distinctId(),
         properties: {
           $process_person_profile: false, // anonymous events, no person profiles
-          cli_version: BUILD_VERSION,
           channel: UPDATE_CHANNEL,
-          os: process.platform,
           arch: process.arch,
+          ...baseProps(), // cli_version, os, install_method, internal (every event)
           ...properties,
         },
         timestamp: new Date().toISOString(),
@@ -69,3 +96,24 @@ export function track(event, properties = {}) {
     }).catch(() => {}).finally(() => clearTimeout(timer));
   } catch { /* analytics must never break the CLI */ }
 }
+
+/** Emit a one-time `cli_first_run` event the first time the CLI runs per install.
+ *  "First run" is marked by a `firstRunAt` ISO timestamp persisted to the config
+ *  file — written on the first invocation that gets here and never re-emitted.
+ *  Honors the SAME opt-out as every other event (track() gates on enabled(): no
+ *  key, MM_NO_ANALYTICS / DO_NOT_TRACK / CI, or a persisted analyticsOptOut). The
+ *  marker is still written when opted-out so flipping analytics on later doesn't
+ *  retroactively fire a "first run". Never throws. */
+export function maybeFirstRun() {
+  try {
+    let cfg;
+    try { cfg = loadConfig(); } catch { cfg = {}; }
+    if (cfg.firstRunAt) return; // already seen this install
+    try { setConfigValue("firstRunAt", new Date().toISOString()); } catch { /* best effort */ }
+    track("cli_first_run", {
+      install_method: installMethod(),
+      cli_version: BUILD_VERSION,
+      os: process.platform,
+    });
+  } catch { /* analytics must never break the CLI */ }
+}

package/src/tui/scan-stream.js

@@ -15,7 +15,7 @@ import { resolveLocal, computeHealth, dropResolvedFragments } from "../registry/
 import { scanFilesystemStreaming } from "../sources/filesystem.js";
 import { compilePatterns } from "../detect/core.js";
 
-export const HEALTH_RANK = { retired: 0, retiring: 1, deprecating: 2, ok: 3 };
+export const HEALTH_RANK = { withdrawn: 0, retired: 0, retiring: 1, deprecating: 2, ok: 3 };
 
 // dir → { snapshot, candidates, ... } for the last completed scan THIS session.
 const SCAN_CACHE = new Map();
@@ -120,7 +120,7 @@ export function summarize(snapshot, candidates) {
 
 /** Health distribution for the status-bar legend. */
 export function countHealth(rows) {
-  const counts = { ok: 0, deprecating: 0, retiring: 0, retired: 0, custom: 0 };
+  const counts = { ok: 0, deprecating: 0, retiring: 0, retired: 0, withdrawn: 0, custom: 0 };
   for (const r of rows) counts[r.health] = (counts[r.health] || 0) + 1;
   return counts;
 }

package/src/tui/ui.js

@@ -57,6 +57,7 @@ export const HEALTH_COLOR = {
   deprecating: "#d97706",
   retiring: "#ea580c",
   retired: "#dc2626",
+  withdrawn: "#dc2626", // pulled by provider — as severe as retired
   custom: "#9ca3af",
 };
 export const HEALTH_GLYPH = {
@@ -64,6 +65,7 @@ export const HEALTH_GLYPH = {
   deprecating: GLYPH.deprecating,
   retiring: GLYPH.retiring,
   retired: GLYPH.retired,
+  withdrawn: GLYPH.warn, // ⚠ distinguishes a pull from a planned × retirement
   custom: GLYPH.custom,
 };
 export const healthColor = (hh) => HEALTH_COLOR[hh] || C.FG;
@@ -292,7 +294,7 @@ export function ListRow({ active, selected, cells, width }) {
 
 /** counts → [{text,color}] legend segments, all states in fixed order, zeros dimmed. */
 export function legendSegments(counts = {}) {
-  const order = ["ok", "deprecating", "retiring", "retired"];
+  const order = ["ok", "deprecating", "retiring", "retired", "withdrawn"];
   const segs = [];
   order.forEach((k, i) => {
     const n = counts[k] || 0;

package/src/tui/views/alerts.js

@@ -6,7 +6,7 @@ import {
 } from "../ui.js";
 
 const DELIVERY = ["immediate", "daily", "weekly"];
-const DEFAULT_EVENTS = ["model_deprecated", "model_retired", "replacement_set", "price_changed", "new_model"];
+const DEFAULT_EVENTS = ["model_deprecated", "model_retired", "model_withdrawn", "replacement_set", "price_changed", "new_model"];
 const CHANNEL_KINDS = ["slack", "discord", "teams", "webhook", "sms"];
 
 // Readable label for a rule even when it has no name (seed/sample rules do):

package/src/updater.js

@@ -127,9 +127,10 @@ function dirWritable(dir) {
 
 /** True when the running binary lives under a Homebrew prefix. Brew owns the
  * binary's lifecycle (`brew upgrade`), and silently swapping it out from under
- * brew would break its integrity tracking — so we never self-update there. */
-function isBrewManaged() {
-  const p = process.execPath;
+ * brew would break its integrity tracking — so we never self-update there.
+ * Exported so telemetry's install-method detection shares one definition. */
+export function isBrewManaged(execPath = process.execPath) {
+  const p = execPath;
   return p.includes("/Cellar/") || p.includes("/homebrew/") || p.includes("/linuxbrew/");
 }