@pixelzx/genesis 2026.6.4 → 2026.6.6

package/dist/message-action-runner-Dxv-GXkn.js

@@ -0,0 +1,2 @@
+import { n as runMessageAction, t as getToolResult } from "./message-action-runner-5Y4EFpWh.js";
+export { getToolResult, runMessageAction };

package/dist/message-actions-DtoR6Mr2.js

@@ -0,0 +1,143 @@
+import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-DPP_aYVc.js";
+import { a as createActionGate, g as readStringParam, l as jsonResult } from "./common-BtK-bRqD.js";
+import { t as resolveReactionLevel } from "./text-runtime-DuYzmNnc.js";
+import { r as resolveReactionMessageId } from "./channel-actions-JVR1YG7X.js";
+import { i as resolveSignalAccount, t as listEnabledSignalAccounts } from "./accounts-BjIbbo5F.js";
+import { n as sendReactionSignal, t as removeReactionSignal } from "./reaction-runtime-api-gua650a7.js";
+//#region extensions/signal/src/reaction-level.ts
+/**
+* Resolve the effective reaction level and its implications for Signal.
+*
+* Levels:
+* - "off": No reactions at all
+* - "ack": Only automatic ack reactions (👀 when processing), no agent reactions
+* - "minimal": Agent can react, but sparingly (default)
+* - "extensive": Agent can react liberally
+*/
+function resolveSignalReactionLevel(params) {
+	return resolveReactionLevel({
+		value: resolveSignalAccount({
+			cfg: params.cfg,
+			accountId: params.accountId
+		}).config.reactionLevel,
+		defaultLevel: "minimal",
+		invalidFallback: "minimal"
+	});
+}
+//#endregion
+//#region extensions/signal/src/message-actions.ts
+const providerId = "signal";
+const GROUP_PREFIX = "group:";
+function normalizeSignalReactionRecipient(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return trimmed;
+	const withoutSignal = trimmed.replace(/^signal:/i, "").trim();
+	if (!withoutSignal) return withoutSignal;
+	if (normalizeLowercaseStringOrEmpty(withoutSignal).startsWith("uuid:")) return withoutSignal.slice(5).trim();
+	return withoutSignal;
+}
+function resolveSignalReactionTarget(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return {};
+	const withoutSignal = trimmed.replace(/^signal:/i, "").trim();
+	if (!withoutSignal) return {};
+	if (normalizeLowercaseStringOrEmpty(withoutSignal).startsWith(GROUP_PREFIX)) {
+		const groupId = withoutSignal.slice(6).trim();
+		return groupId ? { groupId } : {};
+	}
+	return { recipient: normalizeSignalReactionRecipient(withoutSignal) };
+}
+async function mutateSignalReaction(params) {
+	const options = {
+		cfg: params.cfg,
+		accountId: params.accountId,
+		groupId: params.target.groupId,
+		targetAuthor: params.targetAuthor,
+		targetAuthorUuid: params.targetAuthorUuid
+	};
+	if (params.remove) {
+		await removeReactionSignal(params.target.recipient ?? "", params.timestamp, params.emoji, options);
+		return jsonResult({
+			ok: true,
+			removed: params.emoji
+		});
+	}
+	await sendReactionSignal(params.target.recipient ?? "", params.timestamp, params.emoji, options);
+	return jsonResult({
+		ok: true,
+		added: params.emoji
+	});
+}
+const signalMessageActions = {
+	describeMessageTool: ({ cfg, accountId }) => {
+		const configuredAccounts = accountId ? [resolveSignalAccount({
+			cfg,
+			accountId
+		})].filter((account) => account.enabled && account.configured) : listEnabledSignalAccounts(cfg).filter((account) => account.configured);
+		if (configuredAccounts.length === 0) return null;
+		const actions = new Set(["send"]);
+		if (configuredAccounts.some((account) => createActionGate(account.config.actions)("reactions"))) actions.add("react");
+		return { actions: Array.from(actions) };
+	},
+	supportsAction: ({ action }) => action !== "send",
+	handleAction: async ({ action, params, cfg, accountId, toolContext }) => {
+		if (action === "send") throw new Error("Send should be handled by outbound, not actions handler.");
+		if (action === "react") {
+			const reactionLevelInfo = resolveSignalReactionLevel({
+				cfg,
+				accountId: accountId ?? void 0
+			});
+			if (!reactionLevelInfo.agentReactionsEnabled) throw new Error(`Signal agent reactions disabled (reactionLevel="${reactionLevelInfo.level}"). Set channels.signal.reactionLevel to "minimal" or "extensive" to enable.`);
+			const actionConfig = resolveSignalAccount({
+				cfg,
+				accountId
+			}).config.actions;
+			if (!createActionGate(actionConfig)("reactions")) throw new Error("Signal reactions are disabled via actions.reactions.");
+			const target = resolveSignalReactionTarget(readStringParam(params, "recipient") ?? readStringParam(params, "to", {
+				required: true,
+				label: "recipient (UUID, phone number, or group)"
+			}));
+			if (!target.recipient && !target.groupId) throw new Error("recipient or group required");
+			const messageIdRaw = resolveReactionMessageId({
+				args: params,
+				toolContext
+			});
+			const messageId = messageIdRaw != null ? String(messageIdRaw) : void 0;
+			if (!messageId) throw new Error("messageId (timestamp) required. Provide messageId explicitly or react to the current inbound message.");
+			const targetAuthor = readStringParam(params, "targetAuthor");
+			const targetAuthorUuid = readStringParam(params, "targetAuthorUuid");
+			if (target.groupId && !targetAuthor && !targetAuthorUuid) throw new Error("targetAuthor or targetAuthorUuid required for group reactions.");
+			const emoji = readStringParam(params, "emoji", { allowEmpty: true });
+			const remove = typeof params.remove === "boolean" ? params.remove : void 0;
+			const timestamp = Number.parseInt(messageId, 10);
+			if (!Number.isFinite(timestamp)) throw new Error(`Invalid messageId: ${messageId}. Expected numeric timestamp.`);
+			if (remove) {
+				if (!emoji) throw new Error("Emoji required to remove reaction.");
+				return await mutateSignalReaction({
+					cfg,
+					accountId: accountId ?? void 0,
+					target,
+					timestamp,
+					emoji,
+					remove: true,
+					targetAuthor,
+					targetAuthorUuid
+				});
+			}
+			if (!emoji) throw new Error("Emoji required to add reaction.");
+			return await mutateSignalReaction({
+				cfg,
+				accountId: accountId ?? void 0,
+				target,
+				timestamp,
+				emoji,
+				remove: false,
+				targetAuthor,
+				targetAuthorUuid
+			});
+		}
+		throw new Error(`Action ${action} not supported for ${providerId}.`);
+	}
+};
+//#endregion
+export { resolveSignalReactionLevel as n, signalMessageActions as t };

package/dist/message.gateway.runtime-RI4cvk_E.js

@@ -0,0 +1,2 @@
+import { a as callGatewayLeastPrivilege, c as randomIdempotencyKey } from "./call-wY43fzOF.js";
+export { callGatewayLeastPrivilege, randomIdempotencyKey };

package/dist/message.gateway.runtime.js

@@ -1 +1 @@
-export * from "./message.gateway.runtime-D86fFO99.js";
+export * from "./message.gateway.runtime-RI4cvk_E.js";

package/dist/models-auth-status-DsheCXaS.js

@@ -0,0 +1,201 @@
+import { t as createSubsystemLogger } from "./subsystem-CNq69MoE.js";
+import { s as isSecretRef } from "./types.secrets-BbgGt42I.js";
+import { a as loadConfig } from "./io-B1sv_bx7.js";
+import { r as normalizeProviderId } from "./provider-id--dmcBtHB.js";
+import "./config-Cuf4dwjh.js";
+import { En as errorShape, Tn as ErrorCodes } from "./protocol-DxLbSF2J.js";
+import { n as ensureAuthProfileStore } from "./store-DTru4oXw.js";
+import { t as resolveGenesisAgentDir } from "./agent-paths-B6ef9_Hd.js";
+import "./auth-profiles-Cb6SKo5h.js";
+import { t as formatForLog } from "./ws-log-CYrDn2IR.js";
+import { n as PROVIDER_LABELS, o as resolveUsageProviderId } from "./provider-usage.shared-W6_DTJoM.js";
+import { t as loadProviderUsageSummary } from "./provider-usage.load-CmghBI0x.js";
+import { n as buildAuthHealthSummary, r as formatRemainingShort } from "./auth-health-CtK4rM9h.js";
+//#region src/gateway/server-methods/models-auth-status.ts
+const log = createSubsystemLogger("models-auth-status");
+const CACHE_TTL_MS = 6e4;
+let cached = null;
+/**
+* Invalidate the in-memory cache. Reserved for future gateway-side auth
+* mutation handlers (login, logout, token rotation) so the next read returns
+* fresh data. Today those mutations happen via the CLI and the 60s TTL plus
+* `{refresh: true}` param cover the stale-data window.
+*/
+function invalidateModelAuthStatusCache() {
+	cached = null;
+}
+function buildExpiry(remainingMs, expiresAt) {
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || typeof remainingMs !== "number") return;
+	return {
+		at: expiresAt,
+		remainingMs,
+		label: formatRemainingShort(remainingMs)
+	};
+}
+function providerDisplayName(provider) {
+	const usageId = resolveUsageProviderId(provider);
+	if (usageId && PROVIDER_LABELS[usageId]) return PROVIDER_LABELS[usageId];
+	return provider;
+}
+/**
+* Aggregate provider status from OAuth profiles only. `buildAuthHealthSummary`
+* rolls up across both OAuth and token profiles, which mis-reports providers
+* where a healthy OAuth sits alongside an expired/missing bearer token.
+* For the dashboard's OAuth-health signal, token profiles are a separate
+* concern — we want "is OAuth healthy?", not "is every credential healthy?"
+*
+* `expectsOAuth` surfaces the configured-OAuth-but-no-oauth-profile case as
+* `missing` instead of silently falling back to the provider's rollup (which
+* would report `static` if only api_key credentials exist). Without this,
+* switching a provider from api_key to oauth in config but forgetting to
+* login hides behind the residual api_key profile until runtime fails.
+*
+* Exported for direct unit testing of the rollup rules.
+*/
+function aggregateOAuthStatus(prov, now = Date.now(), expectsOAuth = false) {
+	const oauth = prov.profiles.filter((p) => p.type === "oauth");
+	if (oauth.length === 0) {
+		if (expectsOAuth) return { status: "missing" };
+		return {
+			status: prov.status,
+			expiresAt: prov.expiresAt,
+			remainingMs: prov.remainingMs
+		};
+	}
+	const statuses = new Set(oauth.map((p) => p.status));
+	let status;
+	if (statuses.has("expired") || statuses.has("missing")) status = "expired";
+	else if (statuses.has("expiring")) status = "expiring";
+	else if (statuses.has("ok")) status = "ok";
+	else if (statuses.has("static")) status = "static";
+	else {
+		Array.from(statuses)[0];
+		status = "static";
+	}
+	const expirable = oauth.map((p) => p.expiresAt).filter((v) => typeof v === "number" && Number.isFinite(v));
+	const expiresAt = expirable.length > 0 ? Math.min(...expirable) : void 0;
+	const remainingMs = expiresAt !== void 0 ? expiresAt - now : void 0;
+	return {
+		status,
+		expiresAt,
+		remainingMs
+	};
+}
+function mapProvider(prov, usageByProvider, expectsOAuthSet) {
+	const usageKey = resolveUsageProviderId(prov.provider);
+	const usage = usageKey ? usageByProvider.get(usageKey) : void 0;
+	const rollup = aggregateOAuthStatus(prov, Date.now(), expectsOAuthSet.has(prov.provider));
+	return {
+		provider: prov.provider,
+		displayName: providerDisplayName(prov.provider),
+		status: rollup.status,
+		expiry: buildExpiry(rollup.remainingMs, rollup.expiresAt),
+		profiles: prov.profiles.map((prof) => ({
+			profileId: prof.profileId,
+			type: prof.type,
+			status: prof.status,
+			expiry: buildExpiry(prof.remainingMs, prof.expiresAt)
+		})),
+		usage: usage ? {
+			windows: usage.windows,
+			plan: usage.plan
+		} : void 0
+	};
+}
+/**
+* Collect provider IDs with refreshable credentials (OAuth or bearer token)
+* so a configured-but-not-logged-in provider surfaces as `missing` rather
+* than being silently absent. API-key and AWS-SDK providers are excluded —
+* their credentials don't expire on a schedule this endpoint can meaningfully
+* monitor, and surfacing them here would flash a red alert on a healthy
+* API-key setup.
+*
+* Providers with `models.providers.<id>.apiKey` set (commonly via a
+* SecretRef env binding) are excluded from the "missing" synthesis even
+* when their `auth` mode is `oauth` or `token` — an env-backed credential
+* is already present, so flagging the dashboard as missing would cry wolf
+* for a working auth path. They can still show up with real status if the
+* profile store has an entry for them.
+*/
+function resolveConfiguredProviders(cfg) {
+	const out = /* @__PURE__ */ new Set();
+	const expectsOAuth = /* @__PURE__ */ new Set();
+	const envBacked = /* @__PURE__ */ new Set();
+	for (const [id, provider] of Object.entries(cfg.models?.providers ?? {})) {
+		const apiKey = provider?.apiKey;
+		if (!id || apiKey === void 0 || apiKey === null) continue;
+		let resolvable = false;
+		if (typeof apiKey === "string" && apiKey.length > 0) resolvable = true;
+		else if (isSecretRef(apiKey)) if (apiKey.source === "env") {
+			const envValue = process.env[apiKey.id];
+			resolvable = typeof envValue === "string" && envValue.length > 0;
+		} else resolvable = true;
+		if (resolvable) envBacked.add(normalizeProviderId(id));
+	}
+	for (const [id, provider] of Object.entries(cfg.models?.providers ?? {})) {
+		if (!id) continue;
+		const mode = provider?.auth;
+		if (mode !== "oauth" && mode !== "token") continue;
+		if (envBacked.has(normalizeProviderId(id))) continue;
+		out.add(id);
+		if (mode === "oauth") expectsOAuth.add(normalizeProviderId(id));
+	}
+	for (const profile of Object.values(cfg.auth?.profiles ?? {})) {
+		const provider = profile?.provider;
+		const mode = profile?.mode;
+		if (typeof provider !== "string" || provider.length === 0 || mode !== "oauth" && mode !== "token") continue;
+		if (envBacked.has(normalizeProviderId(provider))) continue;
+		out.add(provider);
+		if (mode === "oauth") expectsOAuth.add(normalizeProviderId(provider));
+	}
+	return {
+		providers: Array.from(out),
+		expectsOAuth
+	};
+}
+const modelsAuthStatusHandlers = { "models.authStatus": async ({ params, respond }) => {
+	const now = Date.now();
+	if (!Boolean(params?.refresh) && cached && now - cached.ts < CACHE_TTL_MS) {
+		respond(true, cached.result, void 0, { cached: true });
+		return;
+	}
+	try {
+		const cfg = loadConfig();
+		const agentDir = resolveGenesisAgentDir();
+		const store = ensureAuthProfileStore(agentDir);
+		const configured = resolveConfiguredProviders(cfg);
+		const authHealth = buildAuthHealthSummary({
+			store,
+			cfg,
+			providers: configured.providers.length > 0 ? configured.providers : void 0
+		});
+		const usageProviderIds = [...new Set(authHealth.profiles.filter((p) => p.type === "oauth" || p.type === "token").map((p) => resolveUsageProviderId(p.provider)).filter((id) => Boolean(id)))];
+		const usageByProvider = /* @__PURE__ */ new Map();
+		if (usageProviderIds.length > 0) try {
+			const usage = await loadProviderUsageSummary({
+				providers: usageProviderIds,
+				agentDir,
+				timeoutMs: 3500
+			});
+			for (const snap of usage.providers) usageByProvider.set(snap.provider, {
+				windows: snap.windows,
+				plan: snap.plan
+			});
+		} catch (err) {
+			log.debug(`usage enrichment failed (auth status still returned): providers=${usageProviderIds.join(",")} error=${formatForLog(err)}`);
+		}
+		const result = {
+			ts: now,
+			providers: authHealth.providers.map((prov) => mapProvider(prov, usageByProvider, configured.expectsOAuth))
+		};
+		cached = {
+			ts: now,
+			result
+		};
+		respond(true, result, void 0);
+	} catch (err) {
+		respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, formatForLog(err)));
+	}
+} };
+//#endregion
+export { modelsAuthStatusHandlers as n, invalidateModelAuthStatusCache as t };

package/dist/models-cli-CQQG1U-p.js

@@ -0,0 +1,219 @@
+import { n as defaultRuntime } from "./runtime-DDkDH9fa.js";
+import { t as formatDocsLink } from "./links-C1-jbHJx.js";
+import { r as theme } from "./theme-DD6pQv2_.js";
+import { n as runCommandWithRuntime, t as resolveOptionFromCommand } from "./cli-utils-C80mOHVm.js";
+import { n as modelsListCommand, t as modelsStatusCommand } from "./list-CBPrBS2u.js";
+//#region src/cli/models-cli.ts
+function runModelsCommand(action) {
+	return runCommandWithRuntime(defaultRuntime, action);
+}
+function registerModelsCli(program) {
+	const models = program.command("models").description("Model discovery, scanning, and configuration").option("--status-json", "Output JSON (alias for `models status --json`)", false).option("--status-plain", "Plain output (alias for `models status --plain`)", false).option("--agent <id>", "Agent id to inspect (overrides GENESIS_AGENT_DIR/PI_CODING_AGENT_DIR)").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/models", "genesis.pixelzx.com/docs/cli/models")}\n`);
+	models.command("list").description("List models (configured by default)").option("--all", "Show full model catalog", false).option("--local", "Filter to local models", false).option("--provider <id>", "Filter by provider id").option("--json", "Output JSON", false).option("--plain", "Plain line output", false).action(async (opts) => {
+		await runModelsCommand(async () => {
+			await modelsListCommand(opts, defaultRuntime);
+		});
+	});
+	models.command("status").description("Show configured model state").option("--json", "Output JSON", false).option("--plain", "Plain output", false).option("--check", "Exit non-zero if auth is expiring/expired (1=expired/missing, 2=expiring)", false).option("--probe", "Probe configured provider auth (live)", false).option("--probe-provider <name>", "Only probe a single provider").option("--probe-profile <id>", "Only probe specific auth profile ids (repeat or comma-separated)", (value, previous) => {
+		const next = Array.isArray(previous) ? previous : previous ? [previous] : [];
+		next.push(value);
+		return next;
+	}).option("--probe-timeout <ms>", "Per-probe timeout in ms").option("--probe-concurrency <n>", "Concurrent probes").option("--probe-max-tokens <n>", "Probe max tokens (best-effort)").option("--agent <id>", "Agent id to inspect (overrides GENESIS_AGENT_DIR/PI_CODING_AGENT_DIR)").action(async (opts, command) => {
+		const agent = resolveOptionFromCommand(command, "agent") ?? opts.agent;
+		await runModelsCommand(async () => {
+			await modelsStatusCommand({
+				json: Boolean(opts.json),
+				plain: Boolean(opts.plain),
+				check: Boolean(opts.check),
+				probe: Boolean(opts.probe),
+				probeProvider: opts.probeProvider,
+				probeProfile: opts.probeProfile,
+				probeTimeout: opts.probeTimeout,
+				probeConcurrency: opts.probeConcurrency,
+				probeMaxTokens: opts.probeMaxTokens,
+				agent
+			}, defaultRuntime);
+		});
+	});
+	models.command("set").description("Set the default model").argument("<model>", "Model id or alias").action(async (model) => {
+		await runModelsCommand(async () => {
+			const { modelsSetCommand } = await import("./set-CulOLRu9.js");
+			await modelsSetCommand(model, defaultRuntime);
+		});
+	});
+	models.command("set-image").description("Set the image model").argument("<model>", "Model id or alias").action(async (model) => {
+		await runModelsCommand(async () => {
+			const { modelsSetImageCommand } = await import("./set-image-x3Jm75SS.js");
+			await modelsSetImageCommand(model, defaultRuntime);
+		});
+	});
+	const aliases = models.command("aliases").description("Manage model aliases");
+	aliases.command("list").description("List model aliases").option("--json", "Output JSON", false).option("--plain", "Plain output", false).action(async (opts) => {
+		await runModelsCommand(async () => {
+			const { modelsAliasesListCommand } = await import("./aliases-C807OidC.js");
+			await modelsAliasesListCommand(opts, defaultRuntime);
+		});
+	});
+	aliases.command("add").description("Add or update a model alias").argument("<alias>", "Alias name").argument("<model>", "Model id or alias").action(async (alias, model) => {
+		await runModelsCommand(async () => {
+			const { modelsAliasesAddCommand } = await import("./aliases-C807OidC.js");
+			await modelsAliasesAddCommand(alias, model, defaultRuntime);
+		});
+	});
+	aliases.command("remove").description("Remove a model alias").argument("<alias>", "Alias name").action(async (alias) => {
+		await runModelsCommand(async () => {
+			const { modelsAliasesRemoveCommand } = await import("./aliases-C807OidC.js");
+			await modelsAliasesRemoveCommand(alias, defaultRuntime);
+		});
+	});
+	const fallbacks = models.command("fallbacks").description("Manage model fallback list");
+	fallbacks.command("list").description("List fallback models").option("--json", "Output JSON", false).option("--plain", "Plain output", false).action(async (opts) => {
+		await runModelsCommand(async () => {
+			const { modelsFallbacksListCommand } = await import("./fallbacks-GwVAaFt5.js");
+			await modelsFallbacksListCommand(opts, defaultRuntime);
+		});
+	});
+	fallbacks.command("add").description("Add a fallback model").argument("<model>", "Model id or alias").action(async (model) => {
+		await runModelsCommand(async () => {
+			const { modelsFallbacksAddCommand } = await import("./fallbacks-GwVAaFt5.js");
+			await modelsFallbacksAddCommand(model, defaultRuntime);
+		});
+	});
+	fallbacks.command("remove").description("Remove a fallback model").argument("<model>", "Model id or alias").action(async (model) => {
+		await runModelsCommand(async () => {
+			const { modelsFallbacksRemoveCommand } = await import("./fallbacks-GwVAaFt5.js");
+			await modelsFallbacksRemoveCommand(model, defaultRuntime);
+		});
+	});
+	fallbacks.command("clear").description("Clear all fallback models").action(async () => {
+		await runModelsCommand(async () => {
+			const { modelsFallbacksClearCommand } = await import("./fallbacks-GwVAaFt5.js");
+			await modelsFallbacksClearCommand(defaultRuntime);
+		});
+	});
+	const imageFallbacks = models.command("image-fallbacks").description("Manage image model fallback list");
+	imageFallbacks.command("list").description("List image fallback models").option("--json", "Output JSON", false).option("--plain", "Plain output", false).action(async (opts) => {
+		await runModelsCommand(async () => {
+			const { modelsImageFallbacksListCommand } = await import("./image-fallbacks-DYnqzK01.js");
+			await modelsImageFallbacksListCommand(opts, defaultRuntime);
+		});
+	});
+	imageFallbacks.command("add").description("Add an image fallback model").argument("<model>", "Model id or alias").action(async (model) => {
+		await runModelsCommand(async () => {
+			const { modelsImageFallbacksAddCommand } = await import("./image-fallbacks-DYnqzK01.js");
+			await modelsImageFallbacksAddCommand(model, defaultRuntime);
+		});
+	});
+	imageFallbacks.command("remove").description("Remove an image fallback model").argument("<model>", "Model id or alias").action(async (model) => {
+		await runModelsCommand(async () => {
+			const { modelsImageFallbacksRemoveCommand } = await import("./image-fallbacks-DYnqzK01.js");
+			await modelsImageFallbacksRemoveCommand(model, defaultRuntime);
+		});
+	});
+	imageFallbacks.command("clear").description("Clear all image fallback models").action(async () => {
+		await runModelsCommand(async () => {
+			const { modelsImageFallbacksClearCommand } = await import("./image-fallbacks-DYnqzK01.js");
+			await modelsImageFallbacksClearCommand(defaultRuntime);
+		});
+	});
+	models.command("scan").description("Scan OpenRouter free models for tools + images").option("--min-params <b>", "Minimum parameter size (billions)").option("--max-age-days <days>", "Skip models older than N days").option("--provider <name>", "Filter by provider prefix").option("--max-candidates <n>", "Max fallback candidates", "6").option("--timeout <ms>", "Per-probe timeout in ms").option("--concurrency <n>", "Probe concurrency").option("--no-probe", "Skip live probes; list free candidates only").option("--yes", "Accept defaults without prompting", false).option("--no-input", "Disable prompts (use defaults)").option("--set-default", "Set agents.defaults.model to the first selection", false).option("--set-image", "Set agents.defaults.imageModel to the first image selection", false).option("--json", "Output JSON", false).action(async (opts) => {
+		await runModelsCommand(async () => {
+			const { modelsScanCommand } = await import("./scan-TG6lVEQ2.js");
+			await modelsScanCommand(opts, defaultRuntime);
+		});
+	});
+	models.action(async (opts) => {
+		await runModelsCommand(async () => {
+			await modelsStatusCommand({
+				json: Boolean(opts?.statusJson),
+				plain: Boolean(opts?.statusPlain),
+				agent: opts?.agent
+			}, defaultRuntime);
+		});
+	});
+	const auth = models.command("auth").description("Manage model auth profiles");
+	auth.option("--agent <id>", "Agent id for auth order get/set/clear");
+	auth.action(() => {
+		auth.help();
+	});
+	auth.command("add").description("Interactive auth helper (provider auth or paste token)").action(async () => {
+		await runModelsCommand(async () => {
+			const { modelsAuthAddCommand } = await import("./auth-BT_gqC-D.js");
+			await modelsAuthAddCommand({}, defaultRuntime);
+		});
+	});
+	auth.command("login").description("Run a provider plugin auth flow (OAuth/API key)").option("--provider <id>", "Provider id registered by a plugin").option("--method <id>", "Provider auth method id").option("--set-default", "Apply the provider's default model recommendation", false).action(async (opts) => {
+		await runModelsCommand(async () => {
+			const { modelsAuthLoginCommand } = await import("./auth-BT_gqC-D.js");
+			await modelsAuthLoginCommand({
+				provider: opts.provider,
+				method: opts.method,
+				setDefault: Boolean(opts.setDefault)
+			}, defaultRuntime);
+		});
+	});
+	auth.command("setup-token").description("Run a provider CLI to create/sync a token (TTY required)").option("--provider <name>", "Provider id").option("--yes", "Skip confirmation", false).action(async (opts) => {
+		await runModelsCommand(async () => {
+			const { modelsAuthSetupTokenCommand } = await import("./auth-BT_gqC-D.js");
+			await modelsAuthSetupTokenCommand({
+				provider: opts.provider,
+				yes: Boolean(opts.yes)
+			}, defaultRuntime);
+		});
+	});
+	auth.command("paste-token").description("Paste a token into auth-profiles.json and update config").requiredOption("--provider <name>", "Provider id (e.g. anthropic)").option("--profile-id <id>", "Auth profile id (default: <provider>:manual)").option("--expires-in <duration>", "Optional expiry duration (e.g. 365d, 12h). Stored as absolute expiresAt.").action(async (opts) => {
+		await runModelsCommand(async () => {
+			const { modelsAuthPasteTokenCommand } = await import("./auth-BT_gqC-D.js");
+			await modelsAuthPasteTokenCommand({
+				provider: opts.provider,
+				profileId: opts.profileId,
+				expiresIn: opts.expiresIn
+			}, defaultRuntime);
+		});
+	});
+	auth.command("login-github-copilot").description("Login to GitHub Copilot via GitHub device flow (TTY required)").option("--yes", "Overwrite existing profile without prompting", false).action(async (opts) => {
+		await runModelsCommand(async () => {
+			const { modelsAuthLoginCommand } = await import("./auth-BT_gqC-D.js");
+			await modelsAuthLoginCommand({
+				provider: "github-copilot",
+				method: "device",
+				yes: Boolean(opts.yes)
+			}, defaultRuntime);
+		});
+	});
+	const order = auth.command("order").description("Manage per-agent auth profile order overrides");
+	order.command("get").description("Show per-agent auth order override (from auth-state.json)").requiredOption("--provider <name>", "Provider id (e.g. anthropic)").option("--agent <id>", "Agent id (default: configured default agent)").option("--json", "Output JSON", false).action(async (opts, command) => {
+		const agent = resolveOptionFromCommand(command, "agent") ?? opts.agent;
+		await runModelsCommand(async () => {
+			const { modelsAuthOrderGetCommand } = await import("./auth-order-yS8hXrXh.js");
+			await modelsAuthOrderGetCommand({
+				provider: opts.provider,
+				agent,
+				json: Boolean(opts.json)
+			}, defaultRuntime);
+		});
+	});
+	order.command("set").description("Set per-agent auth order override (writes auth-state.json)").requiredOption("--provider <name>", "Provider id (e.g. anthropic)").option("--agent <id>", "Agent id (default: configured default agent)").argument("<profileIds...>", "Auth profile ids (e.g. anthropic:default)").action(async (profileIds, opts, command) => {
+		const agent = resolveOptionFromCommand(command, "agent") ?? opts.agent;
+		await runModelsCommand(async () => {
+			const { modelsAuthOrderSetCommand } = await import("./auth-order-yS8hXrXh.js");
+			await modelsAuthOrderSetCommand({
+				provider: opts.provider,
+				agent,
+				order: profileIds
+			}, defaultRuntime);
+		});
+	});
+	order.command("clear").description("Clear per-agent auth order override (fall back to config/round-robin)").requiredOption("--provider <name>", "Provider id (e.g. anthropic)").option("--agent <id>", "Agent id (default: configured default agent)").action(async (opts, command) => {
+		const agent = resolveOptionFromCommand(command, "agent") ?? opts.agent;
+		await runModelsCommand(async () => {
+			const { modelsAuthOrderClearCommand } = await import("./auth-order-yS8hXrXh.js");
+			await modelsAuthOrderClearCommand({
+				provider: opts.provider,
+				agent
+			}, defaultRuntime);
+		});
+	});
+}
+//#endregion
+export { registerModelsCli };