@modelstatus/cli 0.1.86 → 0.1.88

package/README.md

@@ -75,6 +75,20 @@ place. Boundary-safe (`gpt-4` never rewrites inside `gpt-4o`), style-preserving
 it follows the chain to the first live model. In the TUI, press `f` for a
 red/green diff preview; nothing is written until you confirm.
 
+### Free: or hand the fixes to your AI coding agent
+
+```bash
+mm prompt [dir]              # print a fix-it prompt for Claude Code, Cursor, …
+mm prompt [dir] | pbcopy     # straight to your clipboard
+```
+
+Prints one self-contained prompt: every retired/retiring reference (file:line +
+the exact string in code), the chain-resolved replacement, and the rewrite
+rules. Paste it into your agent and let it do the work — unlike `mm fix`, an
+agent can also re-pin dated ids (`-20250514`), follow config indirection, and
+adjust parameters the new model needs. In the TUI, press `p` on the Here or
+Inventory tab to copy the same prompt to your clipboard.
+
 ### Sign in for cloud features
 
 ```bash
@@ -92,6 +106,7 @@ You get two binaries — `mm` (short) and `llmstatus` (descriptive). Same binary
 |---|---|
 | `mm status [dir]` | Free offline model-health check — no account |
 | `mm fix [dir]` | Rewrite dying model ids to their replacement (`--dry-run` to preview) |
+| `mm prompt [dir]` | Print a fix-it prompt for your AI coding agent (`mm prompt \| pbcopy`) |
 | `mm [dir]` | Launch the TUI on a folder (defaults to the current one) — runs locally |
 | `mm update` | Update the binary in place (Homebrew installs: `brew upgrade`) |
 | `mm login [api_key]` | Browser sign-in with polling (or paste a key) |
@@ -125,6 +140,7 @@ Secret sources shell out to your already-authenticated CLIs, run **read-only**,
 | Resolve + health locally, on-device | ✓ | ✓ |
 | Secret-source aware (`env`, `aws-secrets`, `k8s`, `helm`, `sql`) | ✓ | ✓ |
 | `mm fix` — rewrite dying ids to replacements | ✓ | ✓ |
+| `mm prompt` — fix-it prompt for your AI agent | ✓ | ✓ |
 | Cloud inventory across projects/teams | — | ✓ |
 | GitHub App: PR checks + one-click fix PRs | — | ✓ |
 | Alerts on deprecations/retirements (email/Slack/SMS) | — | ✓ |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelstatus/cli",
-  "version": "0.1.86",
+  "version": "0.1.88",
   "description": "Track which AI models you use, where, and never get surprised by a retirement. Free offline model-health for any repo (mm status), browser sign-in for cloud inventory + alerts.",
   "keywords": [
     "llm",
@@ -22,7 +22,8 @@
   ],
   "homepage": "https://llmstatus.ai",
   "bugs": {
-    "email": "it@llmstatus.ai"
+    "url": "https://github.com/randomartifact/llm-status/issues",
+    "email": "hi@llmstatus.ai"
   },
   "author": "LLM Status <it@llmstatus.ai>",
   "license": "MIT",
@@ -51,5 +52,9 @@
   },
   "devDependencies": {
     "ink-testing-library": "^4.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/randomartifact/llm-status.git"
   }
 }

package/src/api.js

@@ -1,14 +1,35 @@
 /** Thin client for the LLM Status / Model Manager public API (/api/v1). */
+
+// Per-request cap. Without one, a connection that stalls after the TCP accept
+// (captive portal, blackholing proxy) holds a command for undici's ~5-minute
+// default — or forever if the server dribbles bytes. Uploads get a longer
+// leash (big inventories on slow links). Overridable for tests.
+const timeoutMs = () => Number(process.env.MM_API_TIMEOUT_MS) || 15_000;
+const uploadTimeoutMs = () => Number(process.env.MM_API_UPLOAD_TIMEOUT_MS) || Number(process.env.MM_API_TIMEOUT_MS) || 60_000;
+
+const isTimeout = (e) => e?.name === "TimeoutError" || e?.name === "AbortError" || e?.code === "ABORT_ERR" || e?.cause?.name === "TimeoutError";
+
 export function createClient({ apiBase, apiKey }) {
-  async function req(method, pathname, body) {
-    const res = await fetch(`${apiBase}/api/v1${pathname}`, {
-      method,
-      headers: {
-        ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}),
-        ...(body ? { "content-type": "application/json" } : {}),
-      },
-      body: body ? JSON.stringify(body) : undefined,
-    });
+  async function req(method, pathname, body, { timeout = timeoutMs() } = {}) {
+    let res;
+    try {
+      res = await fetch(`${apiBase}/api/v1${pathname}`, {
+        method,
+        headers: {
+          ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}),
+          ...(body ? { "content-type": "application/json" } : {}),
+        },
+        body: body ? JSON.stringify(body) : undefined,
+        signal: AbortSignal.timeout(timeout),
+      });
+    } catch (e) {
+      if (isTimeout(e)) {
+        const err = new Error(`request timed out — check your network (${method} ${pathname} @ ${apiBase})`);
+        err.code = "ETIMEDOUT";
+        throw err;
+      }
+      throw e;
+    }
     const text = await res.text();
     let data;
     try {
@@ -18,7 +39,16 @@ export function createClient({ apiBase, apiKey }) {
     }
     if (!res.ok) {
       const msg = data?.error?.message || data?.message || `HTTP ${res.status}`;
-      const err = new Error(`${method} ${pathname} → ${msg}`);
+      // Auth failures get a re-login hint instead of a raw endpoint error —
+      // a revoked/rotated key is the most common cloud failure. 403 (valid key,
+      // insufficient scope/permissions) keeps the server's explanation.
+      const err = new Error(
+        res.status === 401
+          ? "API key invalid or expired — run `mm login` (or pass --key)"
+          : res.status === 403
+            ? `${msg} — run \`mm login\` to sign in with a different key`
+            : `${method} ${pathname} → ${msg}`,
+      );
       err.status = res.status;
       err.code = data?.error?.code;
       err.body = data;
@@ -62,7 +92,7 @@ export function createClient({ apiBase, apiKey }) {
     patchUsage: (id, body) => req("PATCH", `/usages/${id}`, body),
     deleteUsage: (id) => req("DELETE", `/usages/${id}`),
     linkUsage: (id, modelId) => req("POST", `/usages/${id}/link`, { model_id: modelId }),
-    bulkUpload: (projectId, usages) => req("POST", "/usages/bulk", { project_id: projectId, usages }),
+    bulkUpload: (projectId, usages) => req("POST", "/usages/bulk", { project_id: projectId, usages }, { timeout: uploadTimeoutMs() }),
     // Clear inventory: all usages, or `{ all: true }` to also wipe projects + rules + feed.
     clearUsages: ({ all = false, project } = {}) => req("DELETE", `/usages${qs({ all: all ? "true" : undefined, project_id: project })}`),
 

package/src/changelog-data.js

@@ -1,6 +1,31 @@
 /* GENERATED by scripts/gen-changelog.mjs from apps/web/lib/changelog.json — do not edit.
  * Release notes baked into the binary (in-TUI + the on-load what's-new card). */
 export const CHANGELOG = [
+  {
+    "version": "0.1.88",
+    "date": "2026-08-22",
+    "title": "Hand the fixes to your AI coding agent",
+    "items": [
+      "New `mm prompt [dir]`: prints one self-contained prompt describing every retired/retiring model reference in your repo (file:line, the exact string in code, the chain-resolved replacement) plus rewrite rules. Paste it into Claude Code, Cursor, or any coding agent — or pipe it straight to your clipboard: `mm prompt | pbcopy`.",
+      "Unlike `mm fix` (a mechanical in-place rewrite), an agent can also re-pin dated ids like `-20250514`, follow config indirection, and adjust parameters the new model needs — the prompt spells out those rules for it.",
+      "TUI: press `p` on the Here tab or the Inventory tab to copy the same prompt to your clipboard (with a file fallback when no clipboard tool exists). On the Inventory tab the `/` filter scopes it — search `prod`, press `p`, get a prod-only prompt.",
+      "`mm status` and `mm fix` now point at `mm prompt` when there's something an auto-rewrite can't safely touch (like version-pinned ids)."
+    ]
+  },
+  {
+    "version": "0.1.87",
+    "date": "2026-07-07",
+    "title": "Hardening pass: 40 fixes from an adversarial audit",
+    "items": [
+      "`mm fix` now writes the provider’s real model id (`gpt-5.5`), not the registry’s dash-form slug (`gpt-5-5`) — 59 of 85 replacement targets were affected. It also fixes everything the scanner detects (Bedrock ARNs, dated variants, mixed case), preserves your file’s line endings, and refuses to touch files that aren’t valid UTF-8.",
+      "The CI gate can’t pass by accident anymore: `--fail-on=retiring` (equals-style flags) now parses, a typo’d `--sources` or a path that doesn’t exist is a hard error instead of a silent green build, and withdrawn models fail the gate like retired ones. Unknown flags error out instead of being ignored.",
+      "`mm scan --dry-run` is fully local — no account needed, nothing sent anywhere.",
+      "Every network call has a timeout: a stalled CDN or API can’t hang a command for minutes. Failed self-updates back off instead of re-downloading each run, and self-update works on Windows.",
+      "Vendor CLI failures (aws, vercel, supabase…) warn instead of silently reporting a clean scan. `.github/workflows` files are scanned now, and `--vercel-project` verifies the linked project instead of relabeling output.",
+      "Telemetry no longer includes your working directory path — anonymous event names only, as documented.",
+      "TUI: long alerts lists scroll properly (keys can’t act on an off-screen rule, delete asks first), the arcade game can’t strand your terminal or undo a sign-in, and checkout polling stops when you quit."
+    ]
+  },
   {
     "version": "0.1.86",
     "date": "2026-06-16",

package/src/ci.js

@@ -9,10 +9,14 @@ import { getRegistry } from "./registry/fetch.js";
 import { resolveLocal, computeHealth } from "./registry/local.js";
 import { collectFrom } from "./sources/index.js";
 
-export const HEALTH_RANK = { ok: 0, deprecating: 1, retiring: 2, retired: 3 };
+// "withdrawn" (the provider already pulled the model) is as dead as retired —
+// same rank, mirroring tui/scan-stream.js — so it fails every threshold except
+// "none". Omitting it here once meant `undefined >= threshold` and withdrawn
+// models could NEVER fail the build.
+export const HEALTH_RANK = { ok: 0, deprecating: 1, retiring: 2, retired: 3, withdrawn: 3 };
 // `--fail-on` threshold → the minimum health rank that fails the build.
 export const FAIL_THRESHOLD = { none: 99, deprecating: 1, retiring: 2, retired: 3 };
-const BADGE = { ok: "🟢", deprecating: "🟡", retiring: "🟠", retired: "🔴" };
+const BADGE = { ok: "🟢", deprecating: "🟡", retiring: "🟠", retired: "🔴", withdrawn: "⛔" };
 
 /** Evaluate `dir` and return { findings, failing, threshold, failOn, counts, snapshot }.
  * `findings` are per-(model, location) entries with health worse than ok. */
@@ -54,7 +58,7 @@ export async function evaluateCi({ dir, sources = ["filesystem"], explicit = new
   }
   findings.sort((a, b) => HEALTH_RANK[b.health] - HEALTH_RANK[a.health] || String(a.retires || "9999").localeCompare(String(b.retires || "9999")));
 
-  const counts = { ok: 0, deprecating: 0, retiring: 0, retired: 0 };
+  const counts = { ok: 0, deprecating: 0, retiring: 0, retired: 0, withdrawn: 0 };
   for (const f of findings) counts[f.health]++;
   const failing = findings.filter((f) => HEALTH_RANK[f.health] >= threshold);
   return { snapshot, candidates, findings, failing, threshold, failOn, counts };
@@ -126,7 +130,7 @@ export function annotationLines(findings, threshold) {
 export function summaryMarkdown(findings, { failing, failOn } = {}) {
   const lines = ["## LLM Status — model lifecycle check", ""];
   if (!findings.length) {
-    lines.push("✅ No deprecated, retiring, or retired AI models found.");
+    lines.push("✅ No deprecated, retiring, retired, or withdrawn AI models found.");
     return lines.join("\n") + "\n";
   }
   const fc = failing ? failing.length : 0;

package/src/clipboard.js

@@ -0,0 +1,42 @@
+/* Deliver generated text from inside the TUI, where stdout belongs to ink:
+ * copy to the system clipboard via the platform's native tool, or — when no
+ * clipboard tool exists (headless, bare containers) — write a file and hand
+ * back its path. Best-effort and synchronous (the payloads are a few KB).
+ * MM_NO_CLIPBOARD=1 skips the copy (tests + users who hate surprise copies);
+ * MM_PROMPT_DIR redirects the fallback file (tests). */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const CANDIDATES = process.platform === "darwin"
+  ? [["pbcopy", []]]
+  : process.platform === "win32"
+    ? [["clip", []]]
+    : [["wl-copy", []], ["xclip", ["-selection", "clipboard"]], ["xsel", ["--clipboard", "--input"]]];
+
+/** True when the text landed on the system clipboard. */
+export function copyToClipboard(text) {
+  if (process.env.MM_NO_CLIPBOARD === "1") return false;
+  for (const [cmd, args] of CANDIDATES) {
+    try {
+      const r = spawnSync(cmd, args, { input: text, stdio: ["pipe", "ignore", "ignore"], timeout: 3000 });
+      if (r.status === 0) return true;
+    } catch { /* tool missing — try the next */ }
+  }
+  return false;
+}
+
+/** Clipboard first, file fallback. Returns { method: "clipboard" } or
+ * { method: "file", path } — never throws (a failed file write returns
+ * { method: "none" } so the caller can say so instead of crashing the TUI). */
+export function deliverText(text, { filename = "mm-fix-prompt.md" } = {}) {
+  if (copyToClipboard(text)) return { method: "clipboard" };
+  try {
+    const p = path.join(process.env.MM_PROMPT_DIR || os.tmpdir(), filename);
+    fs.writeFileSync(p, text);
+    return { method: "file", path: p };
+  } catch {
+    return { method: "none" };
+  }
+}

package/src/detect/core.js

@@ -16,21 +16,22 @@ function cleanGeneric(s) {
 
 /** A char is part of a model token if it's alnum or one of - _ . / : (slug-ish).
  * Mirrors the server PR scanner (apps/web/lib/github/scan-pr.ts) so the CLI and
- * the GitHub check agree on what counts as a boundary. */
-function isTokenChar(ch) {
+ * the GitHub check agree on what counts as a boundary. Exported so fix.js keeps
+ * its rewrite boundaries in lockstep with detection. */
+export function isTokenChar(ch) {
   return /[A-Za-z0-9._/:-]/.test(ch);
 }
 
 // Provider prefixes legitimately precede an id ("anthropic.claude-…", "ft:gpt-…",
 // "us.anthropic.…", "openrouter/…"), so '.' ':' '/' on the LEFT is still a boundary.
-function isPrefixSep(ch) {
+export function isPrefixSep(ch) {
   return ch === "." || ch === ":" || ch === "/";
 }
 // Known model-id SUFFIXES seen in real configs: Bedrock ':0'/'-v1', dated
 // '-20250514' snapshots, '@version'. The remainder starting with one is still a
 // boundary — so "claude-opus-4-20250514" resolves inside a Bedrock ARN, while
 // "gpt-4" still does NOT match inside "gpt-4o". Kept identical to scan-pr.ts.
-const MODEL_SUFFIX = /^(:|-v[0-9]|-[0-9]{6,}|@)/;
+export const MODEL_SUFFIX = /^(:|-v[0-9]|-[0-9]{6,}|@)/;
 
 /** True when `term` occurs in `haystack` at a model-id boundary — tolerating
  * provider prefixes + known version/region/snapshot suffixes, but NOT a plain
@@ -135,8 +136,18 @@ export function detectInLine(line, compiled) {
     re.lastIndex = 0;
     let m;
     while ((m = re.exec(line))) {
-      const cand = cleanGeneric(m[0].toLowerCase());
-      if (looksLikeModel(cand)) found.add(cand);
+      // Left boundary — same rule as matchesAtBoundary. A token char right
+      // before the match means we're inside a longer identifier ("ChatGPT-4",
+      // "ngrok-2.3.40", "my-gpt-4-deployment"), not a model id; provider
+      // prefixes ('.' ':' '/') stay legal ("openai/gpt-4", "ft:gpt-4",
+      // "anthropic.claude-…"). Hyphen/underscore-joined prefixes are treated
+      // as compound identifiers (resource/deployment names), matching the
+      // exact-string matcher. (scan-pr.ts should mirror this — see web repo.)
+      const before = m.index > 0 ? line[m.index - 1] : "";
+      if (!before || !isTokenChar(before) || isPrefixSep(before)) {
+        const cand = cleanGeneric(m[0].toLowerCase());
+        if (looksLikeModel(cand)) found.add(cand);
+      }
       if (re.lastIndex === m.index) re.lastIndex++;
     }
   }

package/src/fix-prompt.js

@@ -0,0 +1,106 @@
+/* Build a copy-paste prompt for an AI coding agent (Claude Code, Cursor, …) to
+ * fix dying model references. `mm fix` is the mechanical path — boundary-safe
+ * string swaps at known file:lines — but it deliberately skips what a dumb
+ * rewrite can't do safely: version-pinned ids, config indirection, parameter
+ * changes the new model needs. An agent CAN do those, so the prompt hands it
+ * the full picture: every dying reference (file:line + the exact string), the
+ * chain-resolved replacement, and the rewrite rules fix.js enforces.
+ *
+ * Used by `mm prompt` (stdout), the Here tab (`p`) and the Inv tab (`p`).
+ * Pure text-building — no I/O, no registry access — so every surface renders
+ * the identical prompt and tests stay hermetic.
+ */
+
+// Same severity order the TUI/status sort by: already-dead first, then aging.
+const TIER = { retired: 0, withdrawn: 0, retiring: 1, deprecating: 2 };
+
+const REFS_CAP = 100; // per model — an agent doesn't need ref #101 to get it
+
+/** One reference line: "- path:line — currently `gpt-4o`" (repo-prefixed when
+ * the ref came from another checkout, so a cross-repo inventory stays honest). */
+function refLine(r) {
+  const loc = `${r.repo ? r.repo + " · " : ""}${r.file}${r.line ? ":" + r.line : ""}`;
+  return `- ${loc}${r.matched ? ` — currently \`${r.matched}\`` : ""}`;
+}
+
+/** Dedupe a model's refs (same file:line:string appears once; at one file:line
+ * a matched string that's a substring of a sibling's is dropped — the detector
+ * can emit both "gpt-4o" and "openai/gpt-4o" for the same spot). */
+function dedupeRefs(refs) {
+  const seen = new Map();
+  for (const r of refs || []) {
+    if (!r?.file) continue;
+    const key = `${r.repo || ""}|${r.file}:${r.line ?? ""}:${(r.matched || "").toLowerCase()}`;
+    if (!seen.has(key)) seen.set(key, r);
+  }
+  const list = [...seen.values()];
+  return list.filter(
+    (r) => !list.some(
+      (q) => q !== r && q.file === r.file && q.line === r.line && (q.repo || "") === (r.repo || "")
+        && q.matched && r.matched && q.matched.toLowerCase() !== r.matched.toLowerCase()
+        && q.matched.toLowerCase().includes(r.matched.toLowerCase()),
+    ),
+  );
+}
+
+/** Human health phrase for a section header. */
+function healthPhrase(f) {
+  if (f.health === "retired") return f.retires_date ? `retired ${f.retires_date}` : "retired";
+  if (f.health === "withdrawn") return "withdrawn by the provider";
+  return `${f.health}${f.retires_date ? `, retires ${f.retires_date}` : ""}`;
+}
+
+/**
+ * Render the prompt. `findings` = [{ slug, display, health, retires_date,
+ * replacement, refs: [{ file, line, matched, repo? }] }] where `replacement`
+ * is the write-form target ("provider/canonical_id", terminalReplacement's
+ * output) or null when the registry has no successor yet. Findings with zero
+ * usable refs are dropped; returns null when nothing remains.
+ */
+export function buildFixPrompt(findings, { date = new Date() } = {}) {
+  const rows = (findings || [])
+    .map((f) => ({ ...f, refs: dedupeRefs(f.refs) }))
+    .filter((f) => f.refs.length)
+    .sort((a, b) => (TIER[a.health] ?? 3) - (TIER[b.health] ?? 3)
+      || String(a.retires_date || "9999").localeCompare(String(b.retires_date || "9999"))
+      || String(a.slug || a.display).localeCompare(String(b.slug || b.display)));
+  if (!rows.length) return null;
+
+  const day = date.toISOString().slice(0, 10);
+  const nRefs = rows.reduce((n, f) => n + f.refs.length, 0);
+  const out = [];
+  out.push("# Task: update retired / retiring AI model references");
+  out.push("");
+  out.push(`This codebase references ${rows.length === 1 ? "an AI model" : `${rows.length} AI models`} that ${rows.length === 1 ? "is" : "are"} retired or scheduled for retirement (checked against the LLM Status registry on ${day}). Update every reference listed below — ${nRefs} in total.`);
+  out.push("");
+  out.push("## Models to replace");
+
+  for (const f of rows) {
+    const name = f.display && f.display !== f.slug ? `${f.display} (\`${f.slug}\`)` : `\`${f.slug || f.display}\``;
+    out.push("");
+    out.push(`### ${name} — ${healthPhrase(f)}`);
+    if (f.replacement) {
+      const i = f.replacement.indexOf("/");
+      const bare = i >= 0 ? f.replacement.slice(i + 1) : f.replacement;
+      out.push(bare !== f.replacement
+        ? `Replace with: \`${bare}\` (provider-prefixed form: \`${f.replacement}\`).`
+        : `Replace with: \`${f.replacement}\`.`);
+    } else {
+      out.push("No registry replacement is listed yet — pick the provider's closest current successor, apply it consistently, and note the choice in your summary.");
+    }
+    out.push("References:");
+    for (const r of f.refs.slice(0, REFS_CAP)) out.push(refLine(r));
+    if (f.refs.length > REFS_CAP) out.push(`- …and ${f.refs.length - REFS_CAP} more (rewrite every occurrence of the old id, not just the lines listed)`);
+  }
+
+  out.push("");
+  out.push("## Rules");
+  out.push("");
+  out.push("1. Preserve each call site's existing style: keep a bare id bare (`claude-sonnet-4-5`) and a provider-prefixed id prefixed (`anthropic/claude-sonnet-4-5`); don't change quoting or surrounding formatting.");
+  out.push("2. Version-pinned ids (dated like `-20250514`, `@`-pins, Bedrock `-v1:0`, fine-tune `:suffix`): switch to the replacement model's own current id — pinned only if the platform requires a pin. Never graft the old model's version pin onto the new id.");
+  out.push("3. If a model id comes from a config file, env var, constant, or database row, update it at the source — not just the call sites listed above.");
+  out.push("4. Review adjacent parameters that may need adjusting for the new model (max output tokens, temperature constraints, flags the old model needed).");
+  out.push("5. When you're done, run the project's tests, then run `mm status` (the LLM Status CLI, https://llmstatus.ai) to confirm no retired or retiring references remain.");
+  out.push("");
+  return out.join("\n");
+}