@psnext/slingcli 2.5.20260607-2 → 2.5.20260615-2

package/node_modules/@earendil-works/pi-coding-agent/dist/core/extensions/runner.js

@@ -56,6 +56,34 @@ export async function emitSessionShutdownEvent(extensionRunner, event) {
     }
     return false;
 }
+export async function emitProjectTrustEvent(extensionsResult, event, ctx) {
+    const errors = [];
+    for (const ext of extensionsResult.extensions) {
+        // A single extension may register multiple handlers for the same event.
+        // The first project_trust handler that returns yes/no wins; undecided falls through.
+        const handlers = ext.handlers.get("project_trust");
+        if (!handlers || handlers.length === 0)
+            continue;
+        for (const handler of handlers) {
+            try {
+                const handlerResult = (await handler(event, ctx));
+                if (handlerResult.trusted === "undecided") {
+                    continue;
+                }
+                return { result: handlerResult, errors };
+            }
+            catch (error) {
+                errors.push({
+                    extensionPath: ext.path,
+                    event: event.type,
+                    error: error instanceof Error ? error.message : String(error),
+                    stack: error instanceof Error ? error.stack : undefined,
+                });
+            }
+        }
+    }
+    return { errors };
+}
 const noOpUIContext = {
     select: async () => undefined,
     confirm: async () => false,
@@ -99,6 +127,7 @@ export class ExtensionRunner {
     errorListeners = new Set();
     getModel = () => undefined;
     isIdleFn = () => true;
+    isProjectTrustedFn = () => true;
     getSignalFn = () => undefined;
     waitForIdleFn = async () => { };
     abortFn = () => { };
@@ -143,6 +172,7 @@ export class ExtensionRunner {
         // Context actions (required)
         this.getModel = contextActions.getModel;
         this.isIdleFn = contextActions.isIdle;
+        this.isProjectTrustedFn = contextActions.isProjectTrusted;
         this.getSignalFn = contextActions.getSignal;
         this.abortFn = contextActions.abort;
         this.hasPendingMessagesFn = contextActions.hasPendingMessages;
@@ -414,6 +444,10 @@ export class ExtensionRunner {
                 runner.assertActive();
                 return runner.isIdleFn();
             },
+            isProjectTrusted: () => {
+                runner.assertActive();
+                return runner.isProjectTrustedFn();
+            },
             get signal() {
                 runner.assertActive();
                 return runner.getSignalFn();

package/node_modules/@earendil-works/pi-coding-agent/dist/core/index.js

@@ -6,6 +6,7 @@ export { AgentSessionRuntime, createAgentSessionRuntime, } from "./agent-session
 export { createAgentSessionFromServices, createAgentSessionServices, } from "./agent-session-services.js";
 export { executeBashWithOperations } from "./bash-executor.js";
 export { createEventBus } from "./event-bus.js";
+export { areExperimentalFeaturesEnabled } from "./experimental.js";
 // Extensions system
 export { defineTool, discoverAndLoadExtensions, ExtensionRunner, } from "./extensions/index.js";
 export { createSyntheticSourceInfo } from "./source-info.js";

package/node_modules/@earendil-works/pi-coding-agent/dist/core/model-registry.js

@@ -8,11 +8,10 @@ import { join } from "path";
 import { Type } from "typebox";
 import { Compile } from "typebox/compile";
 import { getAgentDir } from "../config.js";
-import { warnDeprecation } from "../utils/deprecation.js";
 import { stripJsonComments } from "../utils/json.js";
 import { normalizePath } from "../utils/paths.js";
 import { BUILT_IN_PROVIDER_DISPLAY_NAMES } from "./provider-display-names.js";
-import { clearConfigValueCache, getConfigValueEnvVarNames, isCommandConfigValue, isConfigValueConfigured, isLegacyEnvVarNameConfigValue, resolveConfigValueOrThrow, resolveConfigValueUncached, resolveHeadersOrThrow, } from "./resolve-config-value.js";
+import { clearConfigValueCache, getConfigValueEnvVarNames, isCommandConfigValue, isConfigValueConfigured, resolveConfigValueOrThrow, resolveConfigValueUncached, resolveHeadersOrThrow, } from "./resolve-config-value.js";
 // Schema for OpenRouter routing preferences
 const PercentileCutoffsSchema = Type.Object({
     p50: Type.Optional(Type.Number()),
@@ -88,6 +87,7 @@ const OpenAICompletionsCompatSchema = Type.Object({
     supportsLongCacheRetention: Type.Optional(Type.Boolean()),
 });
 const OpenAIResponsesCompatSchema = Type.Object({
+    supportsDeveloperRole: Type.Optional(Type.Boolean()),
     sendSessionIdHeader: Type.Optional(Type.Boolean()),
     supportsLongCacheRetention: Type.Optional(Type.Boolean()),
 });
@@ -168,57 +168,6 @@ function formatValidationPath(error) {
     const path = error.instancePath.replace(/^\//, "").replace(/\//g, ".");
     return path || "root";
 }
-function migrateLegacyRegisterProviderConfigValue(providerName, field, value) {
-    if (!isLegacyEnvVarNameConfigValue(value))
-        return value;
-    warnDeprecation(`registerProvider("${providerName}") ${field} value "${value}" is treated as a legacy environment variable reference. This will no longer be detected as an environment variable reference in a future release. Pass "$${value}" instead.`);
-    return `$${value}`;
-}
-function migrateLegacyRegisterProviderHeaders(providerName, field, headers) {
-    if (!headers)
-        return undefined;
-    let migratedHeaders;
-    for (const [key, value] of Object.entries(headers)) {
-        const migratedValue = migrateLegacyRegisterProviderConfigValue(providerName, `${field} header "${key}"`, value);
-        if (migratedValue === value)
-            continue;
-        migratedHeaders ??= { ...headers };
-        migratedHeaders[key] = migratedValue;
-    }
-    return migratedHeaders ?? headers;
-}
-function migrateLegacyRegisterProviderConfigValues(providerName, config) {
-    let migratedConfig;
-    const setMigratedConfigValue = (key, value) => {
-        migratedConfig ??= { ...config };
-        migratedConfig[key] = value;
-    };
-    if (config.apiKey) {
-        const apiKey = migrateLegacyRegisterProviderConfigValue(providerName, "apiKey", config.apiKey);
-        if (apiKey !== config.apiKey) {
-            setMigratedConfigValue("apiKey", apiKey);
-        }
-    }
-    const headers = migrateLegacyRegisterProviderHeaders(providerName, "headers", config.headers);
-    if (headers !== config.headers) {
-        setMigratedConfigValue("headers", headers);
-    }
-    if (config.models) {
-        let models;
-        for (let index = 0; index < config.models.length; index++) {
-            const model = config.models[index];
-            const modelHeaders = migrateLegacyRegisterProviderHeaders(providerName, `model "${model.id}" headers`, model.headers);
-            if (modelHeaders === model.headers)
-                continue;
-            models ??= [...config.models];
-            models[index] = { ...model, headers: modelHeaders };
-        }
-        if (models) {
-            setMigratedConfigValue("models", models);
-        }
-    }
-    return migratedConfig ?? config;
-}
 function emptyCustomModelsResult(error) {
     return { models: [], overrides: new Map(), modelOverrides: new Map(), error };
 }
@@ -660,10 +609,9 @@ export class ModelRegistry {
      * If provider has oauth: registers OAuth provider for /login support.
      */
     registerProvider(providerName, config) {
-        const migratedConfig = migrateLegacyRegisterProviderConfigValues(providerName, config);
-        this.validateProviderConfig(providerName, migratedConfig);
-        this.applyProviderConfig(providerName, migratedConfig);
-        this.upsertRegisteredProvider(providerName, migratedConfig);
+        this.validateProviderConfig(providerName, config);
+        this.applyProviderConfig(providerName, config);
+        this.upsertRegisteredProvider(providerName, config);
     }
     /**
      * Unregister a previously registered provider.

package/node_modules/@earendil-works/pi-coding-agent/dist/core/model-resolver.js

@@ -267,7 +267,7 @@ export async function resolveModelScope(patterns, modelRegistry) {
  * return a thinking level from "<pattern>:<thinking>" so the caller can apply it.
  */
 export function resolveCliModel(options) {
-    const { cliProvider, cliModel, modelRegistry } = options;
+    const { cliProvider, cliModel, cliThinking, modelRegistry } = options;
     if (!cliModel) {
         return { model: undefined, warning: undefined, error: undefined };
     }
@@ -334,6 +334,25 @@ export function resolveCliModel(options) {
         allowInvalidThinkingLevelFallback: false,
     });
     if (model) {
+        // If provider inference matched an unauthenticated provider/model pair, prefer
+        // one exact raw model-id match that is authenticated. This keeps
+        // "provider/model" syntax preferred when usable, but handles models whose
+        // literal id starts with a known provider name (for example
+        // commandcode model id "xiaomi/mimo-v2.5-pro").
+        if (inferredProvider) {
+            const rawExactMatches = availableModels.filter((m) => m.id.toLowerCase() === cliModel.toLowerCase() && !modelsAreEqual(m, model));
+            if (rawExactMatches.length > 0 && !modelRegistry.hasConfiguredAuth(model)) {
+                const authenticatedRawMatches = rawExactMatches.filter((m) => modelRegistry.hasConfiguredAuth(m));
+                if (authenticatedRawMatches.length === 1) {
+                    return {
+                        model: authenticatedRawMatches[0],
+                        thinkingLevel: undefined,
+                        warning: undefined,
+                        error: undefined,
+                    };
+                }
+            }
+        }
         return { model, thinkingLevel, warning, error: undefined };
     }
     // If we inferred a provider from the slash but found no match within that provider,
@@ -360,12 +379,29 @@ export function resolveCliModel(options) {
         }
     }
     if (provider) {
-        const fallbackModel = buildFallbackModel(provider, pattern, availableModels);
+        // Parse thinking level suffix from the pattern before building the fallback model,
+        // but only when --thinking is not explicitly provided.
+        // e.g. "zai-org/GLM-5.1-FP8:high" → modelId="zai-org/GLM-5.1-FP8", fallbackThinking="high"
+        let fallbackPattern = pattern;
+        let fallbackThinking;
+        if (!cliThinking) {
+            const lastColon = pattern.lastIndexOf(":");
+            if (lastColon !== -1) {
+                const suffix = pattern.substring(lastColon + 1);
+                if (isValidThinkingLevel(suffix)) {
+                    fallbackPattern = pattern.substring(0, lastColon);
+                    fallbackThinking = suffix;
+                }
+            }
+        }
+        const fallbackModel = buildFallbackModel(provider, fallbackPattern, availableModels);
         if (fallbackModel) {
+            const requestedThinking = cliThinking ?? fallbackThinking;
+            const model = requestedThinking && requestedThinking !== "off" ? { ...fallbackModel, reasoning: true } : fallbackModel;
             const fallbackWarning = warning
-                ? `${warning} Model "${pattern}" not found for provider "${provider}". Using custom model id.`
-                : `Model "${pattern}" not found for provider "${provider}". Using custom model id.`;
-            return { model: fallbackModel, thinkingLevel: undefined, warning: fallbackWarning, error: undefined };
+                ? `${warning} Model "${fallbackPattern}" not found for provider "${provider}". Using custom model id.`
+                : `Model "${fallbackPattern}" not found for provider "${provider}". Using custom model id.`;
+            return { model, thinkingLevel: fallbackThinking, warning: fallbackWarning, error: undefined };
         }
     }
     const display = provider ? `${provider}/${pattern}` : cliModel;

package/node_modules/@earendil-works/pi-coding-agent/dist/core/package-manager.js

@@ -24,6 +24,7 @@ import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { globSync } from "glob";
 import ignore from "ignore";
 import { minimatch } from "minimatch";
+import { maxSatisfying, rcompare, satisfies, valid, validRange } from "semver";
 import { CONFIG_DIR_NAME } from "../config.js";
 import { spawnProcess, spawnProcessSync } from "../utils/child-process.js";
 import { parseGitUrl } from "../utils/git.js";
@@ -38,6 +39,12 @@ function isOfflineModeEnabled() {
         return false;
     return value === "1" || value.toLowerCase() === "true" || value.toLowerCase() === "yes";
 }
+function isExactNpmVersion(version) {
+    return valid(version ?? "") !== null;
+}
+function getNpmVersionRange(version) {
+    return version ? (validRange(version) ?? undefined) : undefined;
+}
 /**
  * Compute a numeric precedence rank for a resource based on its metadata.
  * Lower rank = higher precedence. Used to sort resolved resources so that
@@ -873,8 +880,8 @@ export class DefaultPackageManager {
             return true;
         }
         try {
-            const latestVersion = await this.getLatestNpmVersion(source.name);
-            return latestVersion !== installedVersion;
+            const targetVersion = await this.getLatestNpmVersion(source.version ? source.spec : source.name, source.range);
+            return targetVersion !== installedVersion;
         }
         catch {
             // Preserve existing update behavior when version lookup fails.
@@ -887,7 +894,7 @@ export class DefaultPackageManager {
         }
         const sourceLabel = sources.length === 1 ? sources[0].source : `${scope} npm packages`;
         const message = sources.length === 1 ? `Updating ${sources[0].source}...` : `Updating ${scope} npm packages...`;
-        const specs = sources.map((entry) => `${entry.parsed.name}@latest`);
+        const specs = sources.map((entry) => (entry.parsed.version ? entry.parsed.spec : `${entry.parsed.name}@latest`));
         await this.withProgress("update", sourceLabel, message, async () => {
             await this.installNpmBatch(specs, scope);
         });
@@ -982,8 +989,7 @@ export class DefaultPackageManager {
             };
             if (parsed.type === "npm") {
                 let installedPath = this.getNpmInstallPath(parsed, scope);
-                const needsInstall = !existsSync(installedPath) ||
-                    (parsed.pinned && !(await this.installedNpmMatchesPinnedVersion(parsed, installedPath)));
+                const needsInstall = !existsSync(installedPath) || !(await this.installedNpmMatchesConfiguredVersion(parsed, installedPath));
                 if (needsInstall) {
                     const installed = await installMissing();
                     if (!installed)
@@ -1119,7 +1125,9 @@ export class DefaultPackageManager {
                 type: "npm",
                 spec,
                 name,
-                pinned: Boolean(version),
+                version,
+                range: getNpmVersionRange(version),
+                pinned: isExactNpmVersion(version),
             };
         }
         if (isLocalPath(source)) {
@@ -1132,16 +1140,12 @@ export class DefaultPackageManager {
         }
         return { type: "local", path: source };
     }
-    async installedNpmMatchesPinnedVersion(source, installedPath) {
+    async installedNpmMatchesConfiguredVersion(source, installedPath) {
         const installedVersion = this.getInstalledNpmVersion(installedPath);
         if (!installedVersion) {
             return false;
         }
-        const { version: pinnedVersion } = this.parseNpmSpec(source.spec);
-        if (!pinnedVersion) {
-            return true;
-        }
-        return installedVersion === pinnedVersion;
+        return source.range ? satisfies(installedVersion, source.range) : true;
     }
     async npmHasAvailableUpdate(source, installedPath) {
         if (isOfflineModeEnabled()) {
@@ -1152,8 +1156,8 @@ export class DefaultPackageManager {
             return false;
         }
         try {
-            const latestVersion = await this.getLatestNpmVersion(source.name);
-            return latestVersion !== installedVersion;
+            const targetVersion = await this.getLatestNpmVersion(source.version ? source.spec : source.name, source.range);
+            return targetVersion !== installedVersion;
         }
         catch {
             return false;
@@ -1172,13 +1176,23 @@ export class DefaultPackageManager {
             return undefined;
         }
     }
-    async getLatestNpmVersion(packageName) {
+    async getLatestNpmVersion(packageSpec, range) {
         const npmCommand = this.getNpmCommand();
-        const stdout = await this.runCommandCapture(npmCommand.command, [...npmCommand.args, "view", packageName, "version", "--json"], { cwd: this.cwd, timeoutMs: NETWORK_TIMEOUT_MS });
+        const stdout = await this.runCommandCapture(npmCommand.command, [...npmCommand.args, "view", packageSpec, "version", "--json"], { cwd: this.cwd, timeoutMs: NETWORK_TIMEOUT_MS });
         const raw = stdout.trim();
         if (!raw)
             throw new Error("Empty response from npm view");
-        return JSON.parse(raw);
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "string") {
+            return parsed;
+        }
+        if (Array.isArray(parsed)) {
+            const versions = parsed.filter((value) => typeof value === "string" && value.length > 0);
+            const latest = range ? maxSatisfying(versions, range) : [...versions].sort(rcompare)[0];
+            if (latest)
+                return latest;
+        }
+        throw new Error("Unexpected response from npm view");
     }
     async gitHasAvailableUpdate(installedPath) {
         if (isOfflineModeEnabled()) {

package/node_modules/@earendil-works/pi-coding-agent/dist/core/project-trust.js

@@ -0,0 +1,58 @@
+import { emitProjectTrustEvent } from "./extensions/runner.js";
+import { getProjectTrustOptions, hasTrustRequiringProjectResources, } from "./trust-manager.js";
+function formatProjectTrustPrompt(cwd) {
+    return `Trust project folder?\n${cwd}\n\nThis allows sling to load .sling settings and resources, install missing project packages, and execute project extensions.`;
+}
+async function selectProjectTrustOption(cwd, ctx) {
+    const options = getProjectTrustOptions(cwd, { includeSessionOnly: true });
+    const selected = await ctx.ui.select(formatProjectTrustPrompt(cwd), options.map((option) => option.label));
+    return options.find((option) => option.label === selected);
+}
+function saveProjectTrustPromptResult(trustStore, result) {
+    if (result.updates.length > 0) {
+        trustStore.setMany(result.updates);
+    }
+}
+export async function resolveProjectTrusted(options) {
+    if (options.trustOverride !== undefined) {
+        return options.trustOverride;
+    }
+    if (!hasTrustRequiringProjectResources(options.cwd)) {
+        return true;
+    }
+    if (options.extensionsResult) {
+        const { result, errors } = await emitProjectTrustEvent(options.extensionsResult, { type: "project_trust", cwd: options.cwd }, options.projectTrustContext);
+        for (const error of errors) {
+            options.onExtensionError?.(`Extension "${error.extensionPath}" project_trust error: ${error.error}`);
+        }
+        if (result) {
+            const trusted = result.trusted === "yes";
+            if (result.remember === true) {
+                options.trustStore.set(options.cwd, trusted);
+            }
+            return trusted;
+        }
+    }
+    const decision = options.trustStore.get(options.cwd);
+    if (decision !== null) {
+        return decision;
+    }
+    switch (options.defaultProjectTrust ?? "ask") {
+        case "always":
+            return true;
+        case "never":
+            return false;
+        case "ask":
+            break;
+    }
+    if (!options.projectTrustContext.hasUI) {
+        return false;
+    }
+    const selected = await selectProjectTrustOption(options.cwd, options.projectTrustContext);
+    if (selected !== undefined) {
+        saveProjectTrustPromptResult(options.trustStore, selected);
+        return selected.trusted;
+    }
+    return false;
+}
+//# sourceMappingURL=project-trust.js.map

package/node_modules/@earendil-works/pi-coding-agent/dist/core/prompt-templates.js

@@ -45,40 +45,38 @@ export function parseCommandArgs(argsString) {
  * Supports:
  * - $1, $2, ... for positional args
  * - $@ and $ARGUMENTS for all args
+ * - ${N:-default} for positional arg N with default when missing/empty
  * - ${@:N} for args from Nth onwards (bash-style slicing)
  * - ${@:N:L} for L args starting from Nth
  *
- * Note: Replacement happens on the template string only. Argument values
+ * Note: Replacement happens on the template string only. Argument and default values
  * containing patterns like $1, $@, or $ARGUMENTS are NOT recursively substituted.
  */
 export function substituteArgs(content, args) {
-    let result = content;
-    // Replace $1, $2, etc. with positional args FIRST (before wildcards)
-    // This prevents wildcard replacement values containing $<digit> patterns from being re-substituted
-    result = result.replace(/\$(\d+)/g, (_, num) => {
-        const index = parseInt(num, 10) - 1;
-        return args[index] ?? "";
-    });
-    // Replace ${@:start} or ${@:start:length} with sliced args (bash-style)
-    // Process BEFORE simple $@ to avoid conflicts
-    result = result.replace(/\$\{@:(\d+)(?::(\d+))?\}/g, (_, startStr, lengthStr) => {
-        let start = parseInt(startStr, 10) - 1; // Convert to 0-indexed (user provides 1-indexed)
-        // Treat 0 as 1 (bash convention: args start at 1)
-        if (start < 0)
-            start = 0;
-        if (lengthStr) {
-            const length = parseInt(lengthStr, 10);
-            return args.slice(start, start + length).join(" ");
+    const allArgs = args.join(" ");
+    return content.replace(/\$\{(\d+):-([^}]*)\}|\$\{@:(\d+)(?::(\d+))?\}|\$(ARGUMENTS|@|\d+)/g, (_match, defaultNum, defaultValue, sliceStart, sliceLength, simple) => {
+        if (defaultNum) {
+            const index = parseInt(defaultNum, 10) - 1;
+            const value = args[index];
+            return value ? value : defaultValue;
+        }
+        if (sliceStart) {
+            let start = parseInt(sliceStart, 10) - 1; // Convert to 0-indexed (user provides 1-indexed)
+            // Treat 0 as 1 (bash convention: args start at 1)
+            if (start < 0)
+                start = 0;
+            if (sliceLength) {
+                const length = parseInt(sliceLength, 10);
+                return args.slice(start, start + length).join(" ");
+            }
+            return args.slice(start).join(" ");
+        }
+        if (simple === "ARGUMENTS" || simple === "@") {
+            return allArgs;
         }
-        return args.slice(start).join(" ");
+        const index = parseInt(simple, 10) - 1;
+        return args[index] ?? "";
     });
-    // Pre-compute all args joined (optimization)
-    const allArgs = args.join(" ");
-    // Replace $ARGUMENTS with all args joined (new syntax, aligns with Claude, Codex, OpenCode)
-    result = result.replace(/\$ARGUMENTS/g, allArgs);
-    // Replace $@ with all args joined (existing syntax)
-    result = result.replace(/\$@/g, allArgs);
-    return result;
 }
 function loadTemplateFromFile(filePath, sourceInfo) {
     try {

package/node_modules/@earendil-works/pi-coding-agent/dist/core/resolve-config-value.js

@@ -8,7 +8,6 @@ import { getShellConfig } from "../utils/shell.js";
 const commandResultCache = new Map();
 const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const ENV_VAR_NAME_PREFIX_RE = /^[A-Za-z_][A-Za-z0-9_]*/;
-const LEGACY_ENV_VAR_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
 function appendLiteral(parts, value) {
     if (!value)
         return;
@@ -114,9 +113,6 @@ export function isCommandConfigValue(config) {
 export function isConfigValueConfigured(config) {
     return getMissingConfigValueEnvVarNames(config).length === 0;
 }
-export function isLegacyEnvVarNameConfigValue(config) {
-    return LEGACY_ENV_VAR_NAME_RE.test(config);
-}
 /**
  * Resolve a config value (API key, header value, etc.) to an actual value.
  * - If starts with "!", executes the rest as a shell command and uses stdout (cached)