@selesai/code 0.13.39 → 0.14.0

package/CHANGELOG.md

@@ -4,6 +4,9 @@ All notable changes to `@selesai/code` will be documented in this file.
 
 ## [0.13.39] - 2026-10-02
 
+### Added
+- **TokenIn includes GPT-6 Luna and GPT-6.1 Sol.** The bundled catalog now exposes `tokenin/gpt-6-luna` and `tokenin/gpt-6.1-sol`, each capped at a 327,680-token context window with a 128,000-token output limit.
+
 ### Changed
 - **`/tokenin usage` shows the account balance.** It queries `/tokenin/account/me/balance` and shows available credit (plan, PAYG, debt), active plan credit used, and plan expiry; a 404 falls back to the LiteLLM `/key/info` quota view.
 - **The `researcher` subagent uses `web_explore`** from the bundled `pi-web-agent` extension instead of `pi-web-access` tools; `pi-web-agent` registers a builtin-agent augmentation so foreground `researcher` children load it.

package/dist/bun/runtime-setup.js

@@ -1,8 +1,11 @@
 import { bedrockProviderModule } from "@earendil-works/pi-ai/bedrock-provider";
 import { registerBunOAuthFlows } from "@earendil-works/pi-ai/bun-oauth";
 import { setBedrockProviderModule } from "@earendil-works/pi-ai/compat";
-import { APP_NAME } from "../config.js";
+// Bun loads .wasm imports as files: embedded in compiled executables, evaluating to a readable path.
+import quickjsWasmPath from "quickjs-wasi/quickjs.wasm";
+import { APP_NAME, setEmbeddedQuickJSWasmPath } from "../config.js";
 process.title = APP_NAME;
 process.emitWarning = (() => { });
 registerBunOAuthFlows();
 setBedrockProviderModule(bedrockProviderModule);
+setEmbeddedQuickJSWasmPath(quickjsWasmPath);

package/dist/cli/args.d.ts

@@ -3,7 +3,7 @@
  */
 import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { ExtensionFlag } from "../core/extensions/types.ts";
-import type { TuiMode } from "../core/settings-manager.ts";
+import { type TuiMode } from "../core/settings-manager.ts";
 export type Mode = "text" | "json" | "rpc";
 export interface Args {
     provider?: string;
@@ -30,6 +30,7 @@ export interface Args {
     noBuiltinTools?: boolean;
     extensions?: string[];
     noExtensions?: boolean;
+    noMcp?: boolean;
     print?: boolean;
     export?: string;
     noSkills?: boolean;
@@ -55,5 +56,6 @@ export interface Args {
     }>;
 }
 export declare function isValidThinkingLevel(level: string): level is ThinkingLevel;
+export declare function normalizeSessionName(value: string): string | undefined;
 export declare function parseArgs(args: string[]): Args;
 export declare function printHelp(extensionFlags?: ExtensionFlag[]): void;

package/dist/cli/args.js

@@ -3,10 +3,15 @@
  */
 import chalk from "chalk";
 import { APP_NAME, CONFIG_DIR_NAME, ENV_AGENT_DIR, ENV_SESSION_DIR } from "../config.js";
+import { getToolListError } from "../core/settings-manager.js";
 const VALID_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 export function isValidThinkingLevel(level) {
     return VALID_THINKING_LEVELS.includes(level);
 }
+export function normalizeSessionName(value) {
+    const name = value.trim();
+    return name.length > 0 ? name : undefined;
+}
 export function parseArgs(args) {
     const result = {
         messages: [],
@@ -33,11 +38,21 @@ export function parseArgs(args) {
         else if (arg === "--version" || arg === "-v") {
             result.version = true;
         }
-        else if (arg === "--mode" && i + 1 < args.length) {
-            const mode = args[++i];
-            if (mode === "text" || mode === "json" || mode === "rpc") {
-                result.mode = mode;
+        else if (arg === "--mode") {
+            const mode = args[i + 1];
+            if (mode === undefined || mode.startsWith("-")) {
+                result.diagnostics.push({ type: "error", message: "--mode requires text, json, or rpc" });
+                continue;
+            }
+            i++;
+            if (mode !== "text" && mode !== "json" && mode !== "rpc") {
+                result.diagnostics.push({
+                    type: "error",
+                    message: `Invalid mode "${mode}". Valid values: text, json, rpc`,
+                });
+                continue;
             }
+            result.mode = mode;
         }
         else if (arg === "--continue" || arg === "-c") {
             result.continue = true;
@@ -85,7 +100,10 @@ export function parseArgs(args) {
             result.sessionDir = args[++i];
         }
         else if (arg === "--models" && i + 1 < args.length) {
-            result.models = args[++i].split(",").map((s) => s.trim());
+            result.models = args[++i]
+                .split(",")
+                .map((s) => s.trim())
+                .filter((pattern) => pattern.length > 0);
         }
         else if (arg === "--no-tools" || arg === "-nt") {
             result.noTools = true;
@@ -94,10 +112,17 @@ export function parseArgs(args) {
             result.noBuiltinTools = true;
         }
         else if ((arg === "--tools" || arg === "-t") && i + 1 < args.length) {
-            result.tools = args[++i]
+            const tools = args[++i]
                 .split(",")
                 .map((s) => s.trim())
                 .filter((name) => name.length > 0);
+            const error = getToolListError(tools);
+            if (error) {
+                result.diagnostics.push({ type: "error", message: `${arg}: ${error}` });
+            }
+            else {
+                result.tools = tools;
+            }
         }
         else if ((arg === "--exclude-tools" || arg === "-xt") && i + 1 < args.length) {
             result.excludeTools = args[++i]
@@ -135,6 +160,9 @@ export function parseArgs(args) {
         else if (arg === "--no-extensions" || arg === "-ne") {
             result.noExtensions = true;
         }
+        else if (arg === "--no-mcp") {
+            result.noMcp = true;
+        }
         else if (arg === "--skill" && i + 1 < args.length) {
             result.skills = result.skills ?? [];
             result.skills.push(args[++i]);
@@ -147,12 +175,6 @@ export function parseArgs(args) {
             result.themes = result.themes ?? [];
             result.themes.push(args[++i]);
         }
-        else if (arg === "--no-skills" || arg === "-ns") {
-            result.noSkills = true;
-        }
-        else if (arg === "--no-prompt-templates" || arg === "-np") {
-            result.noPromptTemplates = true;
-        }
         else if (arg === "--use-theme") {
             const themeName = args[i + 1];
             if (themeName === undefined || themeName.startsWith("-")) {
@@ -163,6 +185,12 @@ export function parseArgs(args) {
                 i++;
             }
         }
+        else if (arg === "--no-skills" || arg === "-ns") {
+            result.noSkills = true;
+        }
+        else if (arg === "--no-prompt-templates" || arg === "-np") {
+            result.noPromptTemplates = true;
+        }
         else if (arg === "--no-themes") {
             result.noThemes = true;
         }
@@ -249,7 +277,7 @@ export function printHelp(extensionFlags) {
     console.log(`${chalk.bold(APP_NAME)} - AI coding assistant with read, bash, edit, write tools
 
 ${chalk.bold("Usage:")}
-  ${APP_NAME} [options] [@files...] [messages...]
+  ${APP_NAME} [options] [--] [@files...] [messages...]
 
 ${chalk.bold("Commands:")}
   ${APP_NAME} install <source> [-l]     Install extension source and add to settings
@@ -258,11 +286,12 @@ ${chalk.bold("Commands:")}
   ${APP_NAME} update [source|self|pi]   Update pi, extensions, or model catalogs
   ${APP_NAME} list                      List installed extensions from settings
   ${APP_NAME} config [-l]               Open TUI to enable/disable package resources (Tab switches scope)
-  ${APP_NAME} auth <command>            Print credentials for external clients
-  ${APP_NAME} <command> --help          Show help for install/remove/uninstall/update/list/config/auth
+  ${APP_NAME} auth <command>            Print credentials or check provider readiness
+  ${APP_NAME} mcp <command>             Check MCP servers, sign in to or out of OAuth servers
+  ${APP_NAME} <command> --help          Show help for install/remove/uninstall/update/list/config/auth/mcp
 
 ${chalk.bold("Options:")}
-  --provider <name>              Provider name (default: google)
+  --provider <name>              Provider to search for --model (requires --model)
   --model <pattern>              Model pattern or ID (supports "provider/id" and optional ":<thinking>")
   --api-key <key>                API key (defaults to env vars)
   --system-prompt <text>         System prompt (default: coding assistant prompt)
@@ -280,14 +309,16 @@ ${chalk.bold("Options:")}
   --models <patterns>            Comma-separated model patterns for Ctrl+P cycling
                                  Supports globs (anthropic/*, *sonnet*) and fuzzy matching
   --no-tools, -nt                Disable all tools by default (built-in and extension)
-  --no-builtin-tools, -nbt       Disable built-in tools and enable extension/custom tools
-  --tools, -t <tools>            Comma-separated allowlist of tool names to enable
-                                 Applies to built-in, extension, and custom tools
-  --exclude-tools, -xt <tools>   Comma-separated denylist of tool names to disable
-                                 Applies to built-in, extension, and custom tools
+  --no-builtin-tools, -nbt       Disable built-in tools by default but keep extension/custom tools enabled
+  --tools, -t <tools>            Comma-separated allowlist of tool names or patterns (*) to enable
+                                 Keeps MCP tools unless an entry starts with mcp__
+                                 Only +name/-name entries add to or remove from the defaults
+  --exclude-tools, -xt <tools>   Comma-separated denylist of tool names or patterns (*) to disable
+                                 Applies to all tools, MCP tools included
   --thinking <level>             Set thinking level: off, minimal, low, medium, high, xhigh, max
-  --extension, -e <path>         Load an extension file (can be used multiple times)
-  --no-extensions, -ne           Disable extension discovery (explicit -e paths still work)
+  --extension, -e <path>         Load an extension file or builtin:<name> (can be used multiple times)
+  --no-extensions, -ne           Disable extension discovery and built-in extensions (explicit -e paths still work)
+  --no-mcp                       Disable built-in MCP support: no servers connect and no MCP tools
   --skill <path>                 Load a skill file or directory (can be used multiple times)
   --no-skills, -ns               Disable skills discovery and loading
   --prompt-template <path>       Load a prompt template file or directory (can be used multiple times)
@@ -298,11 +329,12 @@ ${chalk.bold("Options:")}
   --no-context-files, -nc        Disable AGENTS.md and CLAUDE.md discovery and loading
   --export <file>                Export session file to HTML and exit
   --list-models [search]         List available models (with optional fuzzy search)
-  --tui-mode <mode>              TUI mode: fullscreen (default) or regular
   --verbose                      Force verbose startup (overrides quietStartup setting)
+  --tui-mode <mode>              TUI mode: fullscreen (default) or regular
   --approve, -a                  Trust project-local files for this run
   --no-approve, -na              Ignore project-local files for this run
   --offline                      Disable startup network operations (same as PI_OFFLINE=1)
+  --                             End option parsing; treat remaining arguments as messages/files
   --help, -h                     Show this help
   --version, -v                  Show version number
 
@@ -310,10 +342,10 @@ Extensions can register additional flags (e.g., --plan from plan-mode extension)
 
 ${chalk.bold("Examples:")}
   # Print a provider API key for an external client
-  ${APP_NAME} auth print-api-key --provider openai --model gpt-5.5
+  ${APP_NAME} auth print-api-key --provider openai
 
   # Print an OAuth bearer token for an external client (refreshes if expired)
-  ${APP_NAME} auth print-bearer-token --provider openai-codex --model gpt-5.5
+  ${APP_NAME} auth print-bearer-token --provider openai-codex
 
   # Interactive mode
   ${APP_NAME}
@@ -327,6 +359,9 @@ ${chalk.bold("Examples:")}
   # Non-interactive mode (process and exit)
   ${APP_NAME} -p "List all .ts files in src/"
 
+  # Prompt beginning with a dash
+  ${APP_NAME} -p -- "- Summarize these points"
+
   # Multiple messages (interactive)
   ${APP_NAME} "Read package.json" "What dependencies do we have?"
 
@@ -360,6 +395,12 @@ ${chalk.bold("Examples:")}
   # Read-only mode (no file modifications possible)
   ${APP_NAME} --tools read,grep,find,ls -p "Review the code in src/"
 
+  # Add codemode to the default tools
+  ${APP_NAME} --tools +codemode
+
+  # Codemode with only the tools of one MCP server
+  ${APP_NAME} --tools read,bash,codemode,'mcp__radius__*'
+
   # Disable one tool while keeping the rest available
   ${APP_NAME} --exclude-tools ask_question
 
@@ -386,6 +427,7 @@ ${chalk.bold("Environment Variables:")}
   XAI_API_KEY                      - xAI Grok API key
   FIREWORKS_API_KEY                - Fireworks API key
   TOGETHER_API_KEY                 - Together AI API key
+  BASETEN_API_KEY                  - Baseten API key
   OPENROUTER_API_KEY               - OpenRouter API key
   AI_GATEWAY_API_KEY               - Vercel AI Gateway API key
   ZAI_API_KEY                      - ZAI Coding Plan API key (Global)
@@ -418,12 +460,13 @@ ${chalk.bold("Environment Variables:")}
   PI_SHARE_VIEWER_URL              - Base URL for /share command (default: https://pi.dev/session/)
 
 ${chalk.bold("Built-in Tool Names:")}
-  read   - Read file contents
-  bash   - Execute bash commands
-  edit   - Edit files with find/replace
-  write  - Write files (creates/overwrites)
-  grep   - Search file contents (read-only, off by default)
-  find   - Find files by glob pattern (read-only, off by default)
-  ls     - List directory contents (read-only, off by default)
+  read       - Read file contents
+  bash       - Execute bash commands
+  powershell - Execute PowerShell commands on Windows
+  edit       - Edit files with find/replace
+  write      - Write files (creates/overwrites)
+  grep       - Search file contents (read-only, off by default)
+  find       - Find files by glob pattern (read-only, off by default)
+  ls         - List directory contents (read-only, off by default)
 `);
 }

package/dist/cli/auth-check.d.ts

@@ -0,0 +1,18 @@
+import type { CredentialStore } from "@earendil-works/pi-ai";
+import { ModelRuntime } from "../core/model-runtime.ts";
+import type { Args } from "./args.ts";
+export type AuthCheckStatus = "ready" | "not_ready" | "invalid";
+export type AuthCheckReason = "provider_not_found" | "credentials_not_configured" | "credential_not_available" | "invalid_state";
+export interface AuthCheckResult {
+    status: AuthCheckStatus;
+    provider: string;
+    reason?: AuthCheckReason;
+    authType?: "api_key" | "oauth";
+}
+export declare function checkProviderAuth(args: Args, modelRuntime: ModelRuntime, options?: {
+    refresh: boolean;
+}): Promise<AuthCheckResult>;
+export declare function getProviderCredential(providerId: string, modelRuntime: ModelRuntime, credentials: CredentialStore, options: {
+    refresh: boolean;
+}): Promise<string | undefined>;
+export declare function createAuthCheckModelRuntime(credentials: CredentialStore): Promise<ModelRuntime>;

package/dist/cli/auth-check.js

@@ -0,0 +1,49 @@
+import { resolveCliModel } from "../core/model-resolver.js";
+import { ModelRuntime } from "../core/model-runtime.js";
+import { InMemoryCodingAgentModelsStore } from "../core/models-store.js";
+import { AuthCommandError, getAuthCredential, validateAuthCommandArgs } from "./auth-command.js";
+export async function checkProviderAuth(args, modelRuntime, options = { refresh: false }) {
+    const { provider: cliProvider, model: cliModel } = validateAuthCommandArgs(args, "check");
+    let provider = cliProvider;
+    if (cliModel) {
+        const resolved = resolveCliModel({ cliProvider, cliModel, modelRuntime });
+        if (resolved.error || !resolved.model) {
+            throw new AuthCommandError(resolved.error ?? `Unable to resolve model "${cliModel}"`);
+        }
+        provider = resolved.model.provider;
+    }
+    if (!provider)
+        throw new AuthCommandError("Unable to resolve an auth provider");
+    if (modelRuntime.getError()) {
+        return { status: "invalid", provider, reason: "invalid_state" };
+    }
+    if (!modelRuntime.getProvider(provider)) {
+        return { status: "not_ready", provider, reason: "provider_not_found" };
+    }
+    try {
+        const auth = await modelRuntime.checkAuth(provider);
+        if (!auth)
+            return { status: "not_ready", provider, reason: "credentials_not_configured" };
+        if (options.refresh && !(await modelRuntime.getAuth(provider))) {
+            return { status: "not_ready", provider, reason: "credentials_not_configured" };
+        }
+        return { status: "ready", provider, authType: auth.type };
+    }
+    catch {
+        return { status: "invalid", provider, reason: "invalid_state" };
+    }
+}
+export async function getProviderCredential(providerId, modelRuntime, credentials, options) {
+    const credential = await credentials.read(providerId);
+    if (!options.refresh && credential?.type === "oauth")
+        return credential.access;
+    return getAuthCredential(await modelRuntime.getAuth(providerId));
+}
+export async function createAuthCheckModelRuntime(credentials) {
+    return ModelRuntime.create({
+        credentials,
+        modelsStore: new InMemoryCodingAgentModelsStore(),
+        allowModelNetwork: false,
+        refreshOnCreate: false,
+    });
+}

package/dist/cli/credential-print.d.ts

@@ -1,22 +1,12 @@
 import type { ModelRuntime } from "../core/model-runtime.ts";
 import type { Args } from "./args.ts";
-export type CredentialPrintKind = "api_key" | "bearer_token";
-export interface CredentialPrintCommand {
-    kind: CredentialPrintKind;
-    args: string[];
-    minExpiryMs?: number;
-}
-export declare class CredentialPrintError extends Error {
-}
-export declare function isCredentialPrintHelp(args: string[]): boolean;
-export declare function printCredentialPrintHelp(): void;
-/** Parse the auth command surface before normal startup. */
-export declare function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined;
-export declare function validateCredentialPrintArgs(args: Args): void;
+import { type AuthCommandKind } from "./auth-command.ts";
+type CredentialPrintKind = Exclude<AuthCommandKind, "check">;
 /**
- * Resolve one request credential for a specific provider/model pair.
+ * Resolve one configured provider credential.
  *
  * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists
  * OAuth credentials with less than five minutes remaining through the normal request-auth path.
  */
-export declare function resolveCredentialForPrint(args: Args, modelRuntime: ModelRuntime, kind: CredentialPrintKind, minExpiryMs?: number): Promise<string>;
+export declare function resolveCredentialForPrint(args: Args, modelRuntime: ModelRuntime, kind: CredentialPrintKind, minExpiryMs?: number, signal?: AbortSignal): Promise<string>;
+export {};

package/dist/cli/credential-print.js

@@ -1,116 +1,76 @@
 import { APP_NAME } from "../config.js";
 import { resolveCliModel } from "../core/model-resolver.js";
+import { AuthCommandError, getAuthCredential, validateAuthCommandArgs } from "./auth-command.js";
 const DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;
-export class CredentialPrintError extends Error {
-}
-export function isCredentialPrintHelp(args) {
-    return (args[0] === "auth" && (args[1] === undefined || args[1] === "help" || args[1] === "--help" || args[1] === "-h"));
-}
-export function printCredentialPrintHelp() {
-    console.log(`Usage:
-  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]
-  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]
-
-Prints the configured credential alone on stdout. Provider inference uses configured credentials; specify --provider to select explicitly. Bearer tokens have a 30-minute minimum expiry by default. --min-expiry accepts ms, s, m, or h (for example, 30m).`);
-}
-/** Parse the auth command surface before normal startup. */
-export function parseCredentialPrintCommand(args) {
-    if (args[0] !== "auth")
-        return undefined;
-    const kind = args[1] === "print-api-key" ? "api_key" : args[1] === "print-bearer-token" ? "bearer_token" : undefined;
-    if (!kind) {
-        throw new CredentialPrintError(`Unknown auth command "${args[1] ?? ""}". Use "${APP_NAME} auth print-api-key" or "${APP_NAME} auth print-bearer-token".`);
-    }
-    const commandArgs = [];
-    let minExpiryMs;
-    for (let index = 2; index < args.length; index++) {
-        if (args[index] !== "--min-expiry") {
-            commandArgs.push(args[index]);
-            continue;
-        }
-        if (kind !== "bearer_token") {
-            throw new CredentialPrintError("--min-expiry is only supported by print-bearer-token");
-        }
-        const value = args[++index];
-        const match = value ? /^(\d+)(ms|s|m|h)$/iu.exec(value) : undefined;
-        if (!match) {
-            throw new CredentialPrintError("--min-expiry must use a duration such as 30m or 1h");
-        }
-        const amount = Number(match[1]);
-        const unit = match[2];
-        minExpiryMs = amount * (unit === "ms" ? 1 : unit === "s" ? 1_000 : unit === "m" ? 60_000 : 3_600_000);
-    }
-    return minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };
-}
-export function validateCredentialPrintArgs(args) {
-    if (!args.model?.trim()) {
-        throw new CredentialPrintError("Credential printing requires --model <model>");
-    }
-    if (args.apiKey !== undefined) {
-        throw new CredentialPrintError("Credential printing reads configured credentials; --api-key is not supported");
-    }
-    if (args.messages.length > 0 || args.fileArgs.length > 0 || args.unknownFlags.size > 0) {
-        throw new CredentialPrintError("Credential printing only accepts --provider and --model");
-    }
-}
 /**
- * Resolve one request credential for a specific provider/model pair.
+ * Resolve one configured provider credential.
  *
  * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists
  * OAuth credentials with less than five minutes remaining through the normal request-auth path.
  */
-export async function resolveCredentialForPrint(args, modelRuntime, kind, minExpiryMs) {
-    validateCredentialPrintArgs(args);
-    const credentialTypes = new Map((await modelRuntime.listCredentials()).map((credential) => [credential.providerId, credential.type]));
-    const models = [];
-    if (args.provider) {
-        const resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });
-        if (resolved.error || !resolved.model) {
-            throw new CredentialPrintError(resolved.error ?? "Unable to resolve the requested provider/model");
+export async function resolveCredentialForPrint(args, modelRuntime, kind, minExpiryMs, signal) {
+    const { provider: cliProvider, model: cliModel } = validateAuthCommandArgs(args, kind);
+    const credentialTypes = new Map((await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]));
+    const providers = [];
+    if (cliProvider) {
+        const provider = modelRuntime.getProvider(cliProvider);
+        if (!provider) {
+            throw new AuthCommandError(`Unknown provider "${cliProvider}". Use --list-models to see available providers.`);
+        }
+        if (cliModel) {
+            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel, modelRuntime });
+            if (resolved.error || !resolved.model) {
+                throw new AuthCommandError(resolved.error ?? "Unable to resolve the requested provider/model");
+            }
+            providers.push({ id: provider.id, model: resolved.model });
+        }
+        else {
+            providers.push({ id: provider.id });
         }
-        models.push(resolved.model);
     }
     else {
         for (const provider of modelRuntime.getProviders()) {
             if (!credentialTypes.has(provider.id))
                 continue;
-            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });
+            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel: cliModel, modelRuntime });
             if (resolved.model && !resolved.error && !resolved.warning?.includes("Using custom model id")) {
-                models.push(resolved.model);
+                providers.push({ id: provider.id, model: resolved.model });
             }
         }
-        if (models.length === 0) {
-            throw new CredentialPrintError(`Model "${args.model}" not found. Use --list-models to see available models.`);
+        if (providers.length === 0) {
+            throw new AuthCommandError(`Model "${cliModel}" not found. Use --list-models to see available models.`);
         }
     }
     const credentials = [];
-    for (const model of models) {
-        const type = credentialTypes.get(model.provider);
+    for (const provider of providers) {
+        const type = credentialTypes.get(provider.id);
         if (kind === "api_key" && type === "oauth")
             continue;
         if (kind === "bearer_token" && type !== "oauth")
             continue;
-        const auth = await modelRuntime.getAuth(model, kind === "bearer_token"
-            ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS }
-            : undefined);
-        const authorization = Object.entries(auth?.auth.headers ?? {}).find(([name]) => name.toLowerCase() === "authorization")?.[1];
-        const bearerToken = typeof authorization === "string" ? /^Bearer\s+(.+)$/iu.exec(authorization)?.[1] : undefined;
-        const value = kind === "bearer_token" ? (auth?.auth.apiKey ?? bearerToken) : auth?.auth.apiKey;
+        const authOptions = {
+            ...(kind === "bearer_token" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),
+            signal,
+        };
+        const auth = provider.model
+            ? await modelRuntime.getAuth(provider.model, authOptions)
+            : await modelRuntime.getAuth(provider.id, authOptions);
+        const value = getAuthCredential(auth);
         if (value)
-            credentials.push({ providerId: model.provider, value });
+            credentials.push({ providerId: provider.id, value });
     }
     if (credentials.length === 1)
         return credentials[0].value;
     if (credentials.length === 0) {
-        const providerId = models[0]?.provider;
+        const providerId = providers[0]?.id;
         const type = providerId ? credentialTypes.get(providerId) : undefined;
-        if (args.provider && kind === "api_key" && type === "oauth") {
-            throw new CredentialPrintError(`Provider "${providerId}" is configured with OAuth, not an API key`);
+        if (cliProvider && kind === "api_key" && type === "oauth") {
+            throw new AuthCommandError(`Provider "${providerId}" is configured with OAuth, not an API key`);
         }
-        if (args.provider && kind === "bearer_token" && type !== "oauth") {
-            throw new CredentialPrintError(`Provider "${providerId}" is not configured with an OAuth bearer token`);
+        if (cliProvider && kind === "bearer_token" && type !== "oauth") {
+            throw new AuthCommandError(`Provider "${providerId}" is not configured with an OAuth bearer token`);
         }
-        throw new CredentialPrintError(`No usable ${kind === "api_key" ? "API key" : "OAuth bearer token"} is configured`);
+        throw new AuthCommandError(`No usable ${kind === "api_key" ? "API key" : "OAuth bearer token"} is configured`);
     }
-    throw new CredentialPrintError(`Model "${args.model}" has multiple configured providers (${credentials.map(({ providerId }) => providerId).join(", ")}). Specify --provider.`);
+    throw new AuthCommandError(`Multiple configured providers matched (${credentials.map(({ providerId }) => providerId).join(", ")}). Specify --provider.`);
 }

package/dist/cli/file-processor.d.ts

@@ -7,7 +7,7 @@ export interface ProcessedFiles {
     images: ImageContent[];
 }
 export interface ProcessFileOptions {
-    /** Whether to auto-resize images to 2000x2000 max. Default: true */
+    /** Whether to auto-resize images. Default: true */
     autoResizeImages?: boolean;
 }
 /** Process @file arguments into text content and image attachments */

package/dist/cli/file-processor.js

@@ -7,6 +7,7 @@ import { resolve } from "path";
 import { resolveReadPath } from "../core/tools/path-utils.js";
 import { processImage } from "../utils/image-process.js";
 import { detectSupportedImageMimeTypeFromFile } from "../utils/mime.js";
+import { stripBom } from "../utils/text.js";
 /** Process @file arguments into text content and image attachments */
 export async function processFileArguments(fileArgs, options) {
     const autoResizeImages = options?.autoResizeImages ?? true;
@@ -55,7 +56,7 @@ export async function processFileArguments(fileArgs, options) {
         else {
             // Handle text file
             try {
-                const content = await readFile(absolutePath, "utf-8");
+                const content = stripBom(await readFile(absolutePath, "utf-8"));
                 text += `<file name="${absolutePath}">\n${content}\n</file>\n`;
             }
             catch (error) {

package/dist/cli/list-models.d.ts

@@ -5,4 +5,4 @@ import type { ModelRuntime } from "../core/model-runtime.ts";
 /**
  * List available models, optionally filtered by search pattern
  */
-export declare function listModels(modelRuntime: ModelRuntime, searchPattern?: string): Promise<void>;
+export declare function listModels(modelRuntime: ModelRuntime, searchPattern?: string, signal?: AbortSignal): Promise<void>;

package/dist/cli/list-models.js

@@ -21,12 +21,12 @@ function formatTokenCount(count) {
 /**
  * List available models, optionally filtered by search pattern
  */
-export async function listModels(modelRuntime, searchPattern) {
+export async function listModels(modelRuntime, searchPattern, signal) {
     const loadError = modelRuntime.getError();
     if (loadError) {
         console.error(chalk.yellow(`Warning: errors loading models.json:\n${loadError}`));
     }
-    const models = [...(await modelRuntime.getAvailable())];
+    const models = [...(await modelRuntime.getAvailable(undefined, { signal }))];
     if (models.length === 0) {
         console.log(formatNoModelsAvailableMessage());
         return;