@namzu/cli 2.5.0 → 2.6.1

package/dist/tui/credential-entry.js

@@ -0,0 +1,109 @@
+/**
+ * Typing a credential into a running namzu, for this session only.
+ *
+ * Someone who has just installed namzu and has no key reaches a screen that
+ * lists three sources and says "then restart namzu". That is accurate and it is
+ * a cliff: the product tells them to leave it in order to use it.
+ *
+ * ## Why session-only, stated as a decision rather than a limitation
+ *
+ * The obvious durable home is the OS keychain, and here it does not exist. The
+ * keychain helper in this package is macOS-only, and it reads and writes a
+ * DIFFERENT product's credential store — namzu borrows an OAuth token from it.
+ * Writing a namzu key into that envelope would put our secret under their name.
+ * On Windows, which is where this was asked for, there is no keychain path at
+ * all.
+ *
+ * So the durable options were a plaintext file or a per-platform credential
+ * store nobody has written. Keeping the key in memory for the session is the
+ * honest third answer: nothing lands on disk, it works everywhere, and the
+ * screen names the environment variable that makes it durable. A secret at rest
+ * should be something the operator chose, not something that arrived because
+ * they typed into a text field.
+ *
+ * Everything decidable lives here rather than in the component, because this
+ * package has no component tests and a secret is the worst thing to leave
+ * unverifiable.
+ */
+/**
+ * What a key looks like on screen. Never the key.
+ *
+ * Enough tail to tell two keys apart when you have pasted the wrong one, and
+ * never enough to reconstruct one from a screen recording or a scrollback that
+ * outlives the session. The length is not revealed either: a fixed-width mask
+ * would leak it, and key length distinguishes vendors and sometimes tiers.
+ */
+export function maskKey(key) {
+    const trimmed = key.trim();
+    if (trimmed.length === 0)
+        return '';
+    const tail = trimmed.slice(-4);
+    return trimmed.length <= 4 ? '••••' : `••••••••${tail}`;
+}
+/**
+ * Whether a typed key is worth trying at all.
+ *
+ * Deliberately shallow. Anything beyond "not empty, no whitespace, not obviously
+ * a shell fragment" is guessing at vendor formats that change, and a validator
+ * that rejects a NEW valid key format is worse than one that lets the provider
+ * answer. The provider is the authority; this only catches the paste that
+ * plainly went wrong.
+ */
+export function keyLooksUsable(key) {
+    const trimmed = key.trim();
+    if (trimmed.length === 0)
+        return { ok: false, reason: 'No key entered.' };
+    if (/\s/.test(trimmed)) {
+        return { ok: false, reason: 'That contains a space — check for a truncated or wrapped paste.' };
+    }
+    if (trimmed.startsWith('$') || trimmed.includes('=')) {
+        return {
+            ok: false,
+            // The classic: pasting `ANTHROPIC_API_KEY=sk-…` or `$MY_KEY` from a
+            // shell profile rather than the value.
+            reason: 'That looks like a shell assignment or variable. Paste the key itself.',
+        };
+    }
+    return { ok: true };
+}
+/**
+ * What namzu tells the operator it did with what they typed.
+ *
+ * Every branch says three things: that it worked or did not, that the key is
+ * held for this session only, and the environment variable that persists it.
+ * The middle one is the part a person is most likely to assume otherwise —
+ * typing a credential into an application usually means it was saved.
+ */
+export function describeDisposition(entry, verification) {
+    const persist = entry.envVars[0];
+    const durable = persist
+        ? `To keep it, set ${persist} in your shell and restart.`
+        : 'To keep it, configure the credential in your environment and restart.';
+    if (verification.kind === 'rejected') {
+        return `${entry.label} rejected that key: ${verification.reason}\nNothing was stored.`;
+    }
+    const checked = verification.kind === 'verified'
+        ? `${entry.label} accepted the key.`
+        : // Said plainly rather than implied. A driver with no cheap check
+            // cannot confirm a key without spending a turn, and claiming it is
+            // good would be inventing a verification that did not happen.
+            `Key accepted. ${entry.label} offers no way to check it without a request, so the first message will be the test.`;
+    return `${checked}\nHeld in memory for this session only — it is not written anywhere. ${durable}`;
+}
+/**
+ * The detected-provider record a typed key produces.
+ *
+ * Shaped exactly like a discovered one so every downstream path — session
+ * construction, the model picker, `/provider` — treats it identically. The only
+ * difference is `source`, so a surface can say where it came from.
+ */
+export function sessionCredential(entry, key) {
+    return {
+        entry,
+        source: { kind: 'session' },
+        apiKey: key.trim(),
+        ...(entry.defaultBaseUrl !== undefined ? { baseUrl: entry.defaultBaseUrl } : {}),
+        alternatives: [],
+    };
+}
+//# sourceMappingURL=credential-entry.js.map

package/dist/tui/credential-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-entry.js","sourceRoot":"","sources":["../../src/tui/credential-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACzE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAA;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO;YACN,EAAE,EAAE,KAAK;YACT,oEAAoE;YACpE,uCAAuC;YACvC,MAAM,EAAE,uEAAuE;SAC/E,CAAA;IACF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACpB,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAA4B,EAC5B,YAA0B;IAE1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,OAAO;QACtB,CAAC,CAAC,mBAAmB,OAAO,6BAA6B;QACzD,CAAC,CAAC,uEAAuE,CAAA;IAE1E,IAAI,YAAY,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO,GAAG,KAAK,CAAC,KAAK,uBAAuB,YAAY,CAAC,MAAM,uBAAuB,CAAA;IACvF,CAAC;IAED,MAAM,OAAO,GACZ,YAAY,CAAC,IAAI,KAAK,UAAU;QAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB;QACpC,CAAC,CAAC,iEAAiE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,iBAAiB,KAAK,CAAC,KAAK,sFAAsF,CAAA;IAErH,OAAO,GAAG,OAAO,wEAAwE,OAAO,EAAE,CAAA;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA4B,EAAE,GAAW;IAC1E,OAAO;QACN,KAAK;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE;QAClB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,YAAY,EAAE,EAAE;KAChB,CAAA;AACF,CAAC"}

package/dist/tui/model-choices.d.ts

@@ -0,0 +1,52 @@
+/**
+ * What the model step of the picker offers, and what it says about the list.
+ *
+ * Pure on purpose. The TUI has no component tests, so logic that lives inside a
+ * React component is logic nobody can check — and the owner is currently the
+ * only person able to see this screen at all. Everything decidable is decided
+ * here, and `Picker` is left as a thin caller.
+ *
+ * ## The default is always offered
+ *
+ * Every branch returns at least the provider's `defaultModel`. A screen that
+ * can end with nothing selectable is a dead end for someone who came here to
+ * get on with a task, and the default is exactly the value they would have got
+ * by not visiting this step.
+ *
+ * ## The notice says which case it is
+ *
+ * "No models" is the same words for four different facts — the driver does not
+ * implement listing, the provider publishes none, it timed out, it errored —
+ * and three of them are not "this provider has no models". The timeout matters
+ * most: the honest line is "it did not answer in time", because the operator
+ * can retry that, and cannot retry a provider that genuinely has one model.
+ */
+import type { ModelListing } from './agent.js';
+export interface ModelChoice {
+    readonly id: string;
+    readonly label: string;
+    /** Shown beside the row. `(default)` for the provider's own default. */
+    readonly note?: string;
+}
+export interface ModelStep {
+    readonly choices: readonly ModelChoice[];
+    /**
+     * Why the list is short or absent, or `null` when it is a real full list.
+     *
+     * Rendered above the choices. `null` means the list is exactly what the
+     * provider said it was, so a notice would be noise.
+     */
+    readonly notice: string | null;
+    /** Index of the row to start on: the current model, else the default. */
+    readonly initialIndex: number;
+}
+/**
+ * Build the model step for one provider.
+ *
+ * @param defaultModel The provider's own default, always offered.
+ * @param listing What asking the provider produced.
+ * @param currentModel The model in force now, if any — so re-opening the picker
+ *   starts on what is already selected rather than resetting to the default.
+ */
+export declare function modelStep(defaultModel: string, listing: ModelListing, currentModel?: string): ModelStep;
+//# sourceMappingURL=model-choices.d.ts.map

package/dist/tui/model-choices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-choices.d.ts","sourceRoot":"","sources":["../../src/tui/model-choices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAA;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACxB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,YAAY,EACrB,YAAY,CAAC,EAAE,MAAM,GACnB,SAAS,CA4CX"}

package/dist/tui/model-choices.js

@@ -0,0 +1,74 @@
+/**
+ * What the model step of the picker offers, and what it says about the list.
+ *
+ * Pure on purpose. The TUI has no component tests, so logic that lives inside a
+ * React component is logic nobody can check — and the owner is currently the
+ * only person able to see this screen at all. Everything decidable is decided
+ * here, and `Picker` is left as a thin caller.
+ *
+ * ## The default is always offered
+ *
+ * Every branch returns at least the provider's `defaultModel`. A screen that
+ * can end with nothing selectable is a dead end for someone who came here to
+ * get on with a task, and the default is exactly the value they would have got
+ * by not visiting this step.
+ *
+ * ## The notice says which case it is
+ *
+ * "No models" is the same words for four different facts — the driver does not
+ * implement listing, the provider publishes none, it timed out, it errored —
+ * and three of them are not "this provider has no models". The timeout matters
+ * most: the honest line is "it did not answer in time", because the operator
+ * can retry that, and cannot retry a provider that genuinely has one model.
+ */
+/**
+ * Build the model step for one provider.
+ *
+ * @param defaultModel The provider's own default, always offered.
+ * @param listing What asking the provider produced.
+ * @param currentModel The model in force now, if any — so re-opening the picker
+ *   starts on what is already selected rather than resetting to the default.
+ */
+export function modelStep(defaultModel, listing, currentModel) {
+    const fallback = (notice) => ({
+        choices: [{ id: defaultModel, label: defaultModel, note: '(default)' }],
+        notice,
+        initialIndex: 0,
+    });
+    if (listing.kind === 'unsupported') {
+        return fallback('This provider does not publish a model list. Showing its default.');
+    }
+    if (listing.kind === 'timeout') {
+        // Deliberately not "no models". The provider may have hundreds; it just
+        // did not answer inside 3s, and that is a retryable condition.
+        return fallback('The provider did not answer in time. Showing its default — try again to list.');
+    }
+    if (listing.kind === 'failed') {
+        return fallback(`Could not list models: ${listing.reason}. Showing the default.`);
+    }
+    if (listing.models.length === 0) {
+        return fallback('The provider returned no models. Showing its default.');
+    }
+    // A real list. Make sure the default is in it and marked, because a list
+    // that omits the value the user would otherwise get is missing the one entry
+    // they can be sure works.
+    const seen = new Set();
+    const choices = [];
+    for (const m of listing.models) {
+        if (seen.has(m.id))
+            continue;
+        seen.add(m.id);
+        choices.push({
+            id: m.id,
+            label: m.name,
+            ...(m.id === defaultModel ? { note: '(default)' } : {}),
+        });
+    }
+    if (!seen.has(defaultModel)) {
+        choices.unshift({ id: defaultModel, label: defaultModel, note: '(default)' });
+    }
+    const wanted = currentModel ?? defaultModel;
+    const idx = choices.findIndex((c) => c.id === wanted);
+    return { choices, notice: null, initialIndex: idx >= 0 ? idx : 0 };
+}
+//# sourceMappingURL=model-choices.js.map

package/dist/tui/model-choices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-choices.js","sourceRoot":"","sources":["../../src/tui/model-choices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAwBH;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACxB,YAAoB,EACpB,OAAqB,EACrB,YAAqB;IAErB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC;QAChD,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACvE,MAAM;QACN,YAAY,EAAE,CAAC;KACf,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC,mEAAmE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,wEAAwE;QACxE,+DAA+D;QAC/D,OAAO,QAAQ,CAAC,+EAA+E,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC,0BAA0B,OAAO,CAAC,MAAM,wBAAwB,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,uDAAuD,CAAC,CAAA;IACzE,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAQ;QAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACd,OAAO,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,IAAI;YACb,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,IAAI,YAAY,CAAA;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;IAErD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACnE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/cli",
-  "version": "2.5.0",
+  "version": "2.6.1",
   "description": "Operator CLI for the Namzu agent platform — namzu doctor + future commands. Dual-purpose: standalone bin (`namzu doctor`) and library (`import { runDoctor } from '@namzu/cli'`).",
   "keywords": [
     "namzu",
@@ -45,14 +45,15 @@
     "react": "^19.2.6",
     "yaml": "^2.9.0",
     "@namzu/ollama": "2.0.1",
-    "@namzu/anthropic": "3.1.1",
     "@namzu/openai": "1.1.1",
+    "@namzu/sdk": "^16.0.0",
     "@namzu/openrouter": "2.0.1",
-    "@namzu/sdk": "^15.1.0"
+    "@namzu/anthropic": "3.1.1"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
     "@types/react": "^19.2.15",
+    "ink-testing-library": "^4.0.0",
     "typescript": "^5.5.0",
     "vitest": "^3.2.6"
   },