@selesai/code 0.13.40 → 0.14.3

package/dist/utils/tools-manager.d.ts

@@ -5,4 +5,9 @@ export interface ToolStatus {
     type: "info" | "warning";
     message: string;
 }
+/**
+ * Ensure a tool is available, downloading if necessary.
+ * Reports progress through `onStatus`; status messages are otherwise silent.
+ * Returns the tool path, or undefined if unavailable.
+ */
 export declare function ensureTool(tool: ManagedTool, onStatus?: (status: ToolStatus) => void): Promise<string | undefined>;

package/dist/utils/tools-manager.js

@@ -164,9 +164,7 @@ export async function getLatestVersion(repo) {
 }
 // Download a file from URL
 async function downloadFile(url, dest) {
-    const response = await fetch(url, {
-        signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
-    });
+    const response = await fetchWithRetry(url, undefined, { timeoutMs: DOWNLOAD_TIMEOUT_MS });
     if (!response.ok) {
         throw new Error(`Download failed with HTTP ${response.status}: ${url}`);
     }
@@ -370,9 +368,11 @@ const TERMUX_PACKAGES = {
     fd: "fd",
     rg: "ripgrep",
 };
-// Ensure a tool is available, downloading if necessary
-// Reports progress through `onStatus`; status messages are otherwise silent.
-// Returns the tool path, or undefined if unavailable.
+/**
+ * Ensure a tool is available, downloading if necessary.
+ * Reports progress through `onStatus`; status messages are otherwise silent.
+ * Returns the tool path, or undefined if unavailable.
+ */
 export async function ensureTool(tool, onStatus) {
     const config = TOOLS[tool];
     if (!config)

package/dist/utils/version-check.d.ts

@@ -3,16 +3,20 @@ export interface LatestPiRelease {
     packageName?: string;
     note?: string;
 }
+/** Include useful errno details hidden behind Node's generic "fetch failed" error. */
+export declare function formatVersionCheckError(error: unknown): string;
 export declare function comparePackageVersions(leftVersion: string, rightVersion: string): number | undefined;
 export declare function isNewerPackageVersion(candidateVersion: string, currentVersion: string): boolean;
 export declare function getLatestPiRelease(currentVersion: string, options?: {
     timeoutMs?: number;
+    retry?: boolean;
 }): Promise<LatestPiRelease | undefined>;
 export declare function getLatestPackageRelease(packageName: string, currentVersion: string, options?: {
     timeoutMs?: number;
 }): Promise<LatestPiRelease | undefined>;
 export declare function getLatestPiVersion(currentVersion: string, options?: {
     timeoutMs?: number;
+    retry?: boolean;
 }): Promise<string | undefined>;
 export declare function checkForNewPiVersion(currentVersion: string, packageName?: string, options?: {
     timeoutMs?: number;

package/dist/utils/version-check.js

@@ -1,9 +1,25 @@
 import { compare, valid } from "semver";
+import { fetchWithRetry } from "./management-http.js";
 import { getPiUserAgent } from "./pi-user-agent.js";
 const LATEST_VERSION_URL = "https://pi.dev/api/latest-version";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
 const DEFAULT_VERSION_CHECK_TIMEOUT_MS = 10000;
 const PACKAGE_NAME = "@selesai/code";
+/** Include useful errno details hidden behind Node's generic "fetch failed" error. */
+export function formatVersionCheckError(error) {
+    const rootMessage = error instanceof Error && error.message ? error.message : String(error);
+    const cause = error instanceof Error ? error.cause : undefined;
+    const causes = cause instanceof AggregateError ? cause.errors : cause === undefined ? [] : [cause];
+    const codes = causes
+        .map((value) => typeof value === "object" && value !== null && "code" in value && typeof value.code === "string"
+        ? value.code
+        : undefined)
+        .filter((code) => code !== undefined);
+    if (codes.length > 0)
+        return `${rootMessage} (${[...new Set(codes)].join(", ")})`;
+    const causeMessage = causes.find((value) => value instanceof Error && Boolean(value.message))?.message;
+    return causeMessage ? `${rootMessage} (cause: ${causeMessage})` : rootMessage;
+}
 export function comparePackageVersions(leftVersion, rightVersion) {
     const left = valid(leftVersion.trim());
     const right = valid(rightVersion.trim());
@@ -22,12 +38,14 @@ export function isNewerPackageVersion(candidateVersion, currentVersion) {
 export async function getLatestPiRelease(currentVersion, options = {}) {
     if (process.env.PI_OFFLINE)
         return undefined;
-    const response = await fetch(LATEST_VERSION_URL, {
+    const response = await fetchWithRetry(LATEST_VERSION_URL, {
         headers: {
             "User-Agent": getPiUserAgent(currentVersion),
             accept: "application/json",
         },
-        signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_VERSION_CHECK_TIMEOUT_MS),
+    }, {
+        maxRetries: options.retry ? 2 : 0,
+        timeoutMs: options.timeoutMs ?? DEFAULT_VERSION_CHECK_TIMEOUT_MS,
     });
     if (!response.ok)
         return undefined;

package/docs/cli-integration.md

@@ -0,0 +1,104 @@
+# CLI Integration
+
+By default, running `selesai` opens the interactive terminal interface. When input or output is piped or redirected, Selesai uses print mode instead. You can also select print, JSON, or RPC mode explicitly for scripts and applications.
+
+All four modes use the same agent, sessions, resources, and tools. The mode determines how input enters Selesai, how output is exposed, and whether the process remains available for more commands.
+
+The SDK is not a CLI mode. It embeds the agent directly in a Node.js or Bun process. See the [SDK](sdk.md) when direct TypeScript access is preferable to a process boundary.
+
+## Choose a mode
+
+| Mode | Interface | Lifetime | Use it when |
+|---|---|---|---|
+| Interactive | Terminal UI | Until the user exits | A person is working with Selesai directly |
+| Print | Final text on stdout | One invocation | A script needs the final assistant response |
+| JSON | JSONL events on stdout | One invocation | A process needs structured progress from a run |
+| RPC | JSONL commands, responses, and events | Long-lived | A process needs bidirectional control |
+
+CLI options still select the working directory, model, tools, resources, and session persistence independently of the mode. See [Command Line](cli.md) for the complete startup options.
+
+## Print to stdout
+
+Print mode runs the supplied prompts, writes the final assistant text to stdout, and exits:
+
+```bash
+selesai --print "Summarize the changes in this repository"
+```
+
+Use print mode when only the final text is needed, including command substitution, pipelines, and one-shot jobs. Intermediate events are not exposed.
+
+Print mode writes errors to stderr. A final assistant response with an `error` or `aborted` stop reason produces a nonzero exit status.
+
+When no mode is selected explicitly, non-TTY stdin or stdout also selects print mode. This allows piped input and output without adding `--print`.
+
+## Stream JSON events
+
+JSON mode writes a session header followed by agent and session events as newline-delimited JSON:
+
+```bash
+selesai --mode json "Review this repository" > events.jsonl
+```
+
+This is structured event output, not a single JSON result or a constraint on the format of the model’s response.
+
+All prompts are supplied when the process starts. The process streams events for that run and then exits; it does not accept later commands.
+
+A failed or aborted assistant response appears in the event stream but does not by itself produce a nonzero exit status. Inspect the events when success or failure matters. Selesai still exits nonzero if the invocation throws an error.
+
+Streaming `message_update` records contain deltas rather than a growing message snapshot. Assemble live output from the delta events, then replace it with the authoritative message from `message_end`.
+
+`agent_end` can be followed by automatic recovery or queued work. `agent_settled` marks the end of automatic work for the current run.
+
+Stdout is reserved for JSONL. Diagnostics and application logging are written to stderr. See [JSON Event Stream](json.md) for framing, event shapes, and reconstruction rules.
+
+## Control Selesai with RPC
+
+RPC mode keeps Selesai running while another process sends commands and receives responses and events:
+
+```bash
+selesai --mode rpc --no-session
+```
+
+Commands are JSON objects written to stdin. Responses and events are JSON objects written to stdout. Every record occupies one line.
+
+Add an `id` to commands that need correlation. The matching response repeats that ID. Events generally have no command ID because they describe session activity rather than one request.
+
+A successful `prompt` response means the prompt was accepted, queued, or handled. It does not mean the run completed. Continue consuming events through `agent_settled` when completion matters.
+
+RPC commands can change models, inspect state, manage sessions, run shell commands, and answer extension UI requests.
+
+Extension dialogs form a request-response subprotocol. Other extension UI updates are notifications that a client may display or ignore. TUI-only extension capabilities are unavailable or degraded outside interactive mode.
+
+For Node.js or TypeScript integrations, prefer `RpcClient` from `@selesai/code`. It starts a Selesai RPC child process, correlates requests, exposes typed command methods, and delivers session events to listeners.
+
+The [RPC client example](../examples/rpc-client.ts) sends one prompt, streams text and tool activity, waits for `agent_settled`, and shuts down the child process.
+
+`RpcClient.promptAndWait()` installs its event listener before sending the prompt, avoiding a race with fast completions. For separate operations, subscribe before calling `prompt()` and call `waitForIdle()` only while a run is active.
+
+The client requires a path to a runnable Selesai CLI. The repository example points at `dist/cli.js`, so the package must be built before that example runs from a checkout.
+
+If you are building a client without `RpcClient`, start with [RPC Protocol](rpc.md) and [JSON Event Stream](json.md) as the wire references.
+
+## Fork and rebrand Selesai
+
+A source fork can change the CLI name and configuration directory through `package.json`:
+
+```json
+{
+  "piConfig": {
+    "name": "my-agent",
+    "configDir": ".my-agent"
+  }
+}
+```
+
+Change the top-level `bin` field to set the executable name. These settings affect the CLI banner, configuration paths, and derived environment variable names.
+
+## Examples and references
+
+- [RPC client](../examples/rpc-client.ts): typed Node.js integration
+- [RPC extension UI](../examples/rpc-extension-ui.ts): custom terminal client with extension dialogs
+- [Command Line](cli.md): startup options and mode selection
+- [JSON Event Stream](json.md): JSON event reference
+- [RPC Protocol](rpc.md): RPC lifecycle, framing, errors, and shutdown
+- [SDK examples](../examples/sdk/): in-process TypeScript integrations

package/docs/cli.md

@@ -0,0 +1,333 @@
+<a id="cli-and-modes-reference"></a>
+
+# Command Line
+
+This page documents Selesai's built-in command-line commands and options. Run `selesai --help` or append `--help` to a command for the exact interface in your installed version. The top-level help also includes options registered by loaded extensions.
+
+```sh
+selesai [options] [--] [@files...] [messages...]
+selesai install <source> [options]
+selesai remove <source> [options]
+selesai uninstall <source> [options]
+selesai update [target] [options]
+selesai list
+selesai config [options]
+selesai auth <check|print-api-key|print-bearer-token> [options]
+selesai mcp <list|login|logout> [options]
+```
+
+<a id="modes"></a>
+
+## Invocation and output
+
+```sh
+selesai
+selesai --print "Summarize this repository"
+git diff | selesai --print "Review this change"
+selesai --mode json "Inspect this repository" > events.jsonl
+```
+
+With terminal stdin and stdout, Selesai opens the terminal UI unless `--print`, `--mode json`, or `--mode rpc` selects another interface. When either stream is redirected and neither JSON nor RPC mode is selected, Selesai uses print mode. See [CLI Integration](cli-integration.md) for choosing between interactive, print, JSON, RPC, and SDK integration.
+
+| Input | Behavior |
+|---|---|
+| `message` | Provide an initial prompt |
+| `@path` | Include a text file or image in the first prompt |
+| Piped stdin | Prepend its contents to the first prompt |
+| `--` | Stop option parsing so a prompt can begin with `-` |
+
+Selesai resolves `@path` from the current working directory. The working directory also controls project configuration, resource discovery, and session grouping.
+
+`--print` controls whether Selesai runs once and exits. `--mode` selects the output interface. `--mode text` does not force one-shot execution when stdin and stdout are terminals; use `--print` for that behavior.
+
+| Option | Behavior |
+|---|---|
+| `-p`, `--print` | Run the supplied prompts, write the final assistant text to stdout, then exit |
+| `--mode text` | Select text output; still open the terminal UI when stdin and stdout are terminals |
+| `--mode json` | Run the supplied prompts, write JSONL events to stdout, then exit |
+| `--mode rpc` | Read JSONL commands from stdin and write responses and events to stdout until shutdown |
+| `--export <input> [output]` | Export a session file to HTML and exit; derive the destination when `output` is omitted |
+
+RPC mode rejects `@file` arguments. JSON and RPC modes reserve stdout for protocol records. See [JSON Event Stream](json.md) and [RPC Protocol](rpc.md).
+
+<a id="model-options"></a>
+
+## Models
+
+```sh
+selesai --model sonnet:high
+```
+
+See [Choose a Model](models.md) for model selection and [Providers](providers.md) for credentials.
+
+- `--provider <name>`<br>
+  Restricts `--model` lookup to one provider. It requires `--model`.
+- `--model <pattern>`<br>
+  Selects by exact ID or fuzzy ID/name match. It accepts `provider/id` and an optional `:<thinking>` suffix.
+- `--api-key <key>`<br>
+  Uses a non-persistent API-key override. It requires a model selected through `--model` or `--models`.
+- `--thinking <level>`<br>
+  Sets `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, or `max`. It overrides a `--model` suffix and is clamped to the model's capabilities.
+- `--models <patterns>`<br>
+  Sets a comma-separated scope for startup and cycling. It accepts exact IDs, fuzzy matches, case-insensitive globs, and optional `:<thinking>` suffixes.
+- `--list-models [search]`<br>
+  Lists available models, optionally filtered by a fuzzy search, then exits.
+
+<a id="session-options"></a>
+
+## Sessions
+
+```sh
+selesai --continue
+```
+
+See [Sessions and Context](sessions.md) for resuming, forking, naming, and storing sessions.
+
+- `-c`, `--continue`<br>
+  Continues the most recent session for the current project.
+- `-r`, `--resume`<br>
+  Opens the session selector.
+- `--session <path|id>`<br>
+  Opens by file path, exact ID, or partial ID. Selesai searches the current project first and offers to fork a cross-project match.
+- `--session-id <id>`<br>
+  Opens the exact project session ID or creates it if absent. IDs accept letters, numbers, `.`, `_`, and `-`.
+- `--fork <path|id>`<br>
+  Forks an existing session into a new session for the current project.
+- `--session-dir <dir>`<br>
+  Overrides storage and lookup. It takes precedence over `SELESAI_CODING_AGENT_SESSION_DIR` and the `sessionDir` setting.
+- `--no-session`<br>
+  Uses an in-memory session that is not persisted.
+- `-n`, `--name <name>`<br>
+  Sets the session display name.
+
+Constraints:
+
+- Session IDs must start and end with a letter or number.
+- `--fork` cannot be combined with `--session`, `--continue`, `--resume`, or `--no-session`.
+- `--session-id` cannot be combined with `--session`, `--continue`, or `--resume`. Combine it with `--fork` to choose the new ID.
+
+<a id="tool-options"></a>
+
+## Tools
+
+```sh
+selesai --tools read,grep,find,ls --print "Review this project"
+```
+
+See [Settings](settings.md#tools-and-skills) for configuring the default tool selection.
+
+- `-t`, `--tools <list>`<br>
+  Replaces the default selection with a comma-separated allowlist of built-in, extension, or custom tools. Entries are tool names or patterns where `*` matches any characters. MCP tools are kept unless an entry starts with `mcp__` (see [MCP tools](#mcp-tools)). A list of only `+name` and `-name` entries is not an allowlist; it changes the default selection instead.
+- `-xt`, `--exclude-tools <list>`<br>
+  Disables comma-separated tool names or patterns after all other selection options, MCP tools included.
+- `-nbt`, `--no-builtin-tools`<br>
+  Disables default built-in tools while retaining extension and custom tools.
+- `-nt`, `--no-tools`<br>
+  Starts with all built-in, extension, custom, and MCP tools disabled.
+
+Selesai’s base tool defaults are `read`, `bash`, `edit`, `write`, `grep`, `find`, and `ls`. Factory CLI settings additionally enable `codemode`; SDK defaults remain the seven base tools unless configured otherwise. `--tools` with plain names replaces the whole selection, so name every tool you want. Like `defaultTools`, it also accepts a list of only `+name` and `-name` entries, which adds tools to or removes them from the default selection: `selesai --tools +tool_search,-write` keeps the other default tools, enables `tool_search`, and disables `write`. These entries take exact tool names, not `*` patterns; use `--exclude-tools` to disable tools by pattern. Plain names and `+name`/`-name` entries cannot be mixed. `/reload` enables tools newly added to `defaultTools`, but a tool removed with `-name` stays removed.
+
+<a id="mcp-tools"></a>
+
+`--tools` selects the tools declared to the model. It does not remove MCP tools, whose reach is set by their [exposure](mcp.md#control-tool-exposure): `selesai --tools read,codemode` keeps every MCP tool callable from codemode scripts. An MCP tool that no entry names or matches is never declared directly, whatever its exposure; only `tool_search`, if listed, can load it. Once an entry starts with `mcp__`, `--tools` filters MCP tools too, so this keeps only the tools of the `radius` server:
+
+```sh
+selesai --tools read,bash,codemode,'mcp__radius__*'
+```
+
+The MCP resource tools (`list_mcp_resources`, `list_mcp_resource_templates`, `read_mcp_resource`) count as MCP tools. To remove MCP tools, use `--exclude-tools 'mcp__*'` or [`--no-mcp`](#resource-options).
+
+| Built-in | Purpose |
+|---|---|
+| `read` | Read text files and supported images |
+| `bash` | Run shell commands |
+| `powershell` | Run PowerShell commands on Windows |
+| `edit` | Apply exact text replacements to an existing file |
+| `write` | Create or overwrite a file |
+| `grep` | Search file contents |
+| `find` | Find paths using glob patterns |
+| `ls` | List directory contents |
+
+Built-in extensions add two more tools. Factory CLI settings enable `codemode`; `tool_search` activates when a deferred server needs it (see [MCP](mcp.md#control-tool-exposure)). To enable them yourself, name them in `--tools` or `defaultTools`.
+
+| Built-in extension | Purpose |
+|---|---|
+| `codemode` | Run JavaScript that calls the other tools, for example in parallel with `Promise.allSettled`; only the script's output reaches the model |
+| `tool_search` | Search tools that are not declared to the model (`codemode` and `deferred` exposure, such as MCP tools) and declare the matches for the next call |
+
+### Enable codemode
+
+Factory settings already enable `codemode`. To enable it in custom settings, add it to the default tools in `~/.selesai/agent/settings.json` or a project's `.selesai/settings.json`:
+
+```json
+{
+  "defaultTools": ["+codemode"]
+}
+```
+
+This preserves the seven base tools and adds `codemode`. For one invocation, add it with `--tools`:
+
+```sh
+selesai --tools +codemode
+```
+
+Codemode is useful without MCP: scripts can run several tool calls in parallel, filter large output before it reaches the model, call classifier models such as TypeSafe's Jev through `models.classify()` (see [Classifier models](models.md#use-classifier-models)), and generate images through `models.generateImages()` (see [Image models](models.md#use-image-models)).
+
+### How codemode works
+
+Scripts run in a QuickJS sandbox and reach the other tools through `tools.<name>(args)`. [Codemode](codemode.md) describes the script API, how tools are listed and found, the `store()` and `models` globals, and the limits.
+
+### Tool search
+
+`tool_search` is off by default; enable it with `"defaultTools": ["+tool_search"]` or `--tools`. It uses the same ranking as `searchTools()` over tools that are not declared yet and declares the matches for the next model call. Loaded tools are recorded in the session like other tool changes, so they stay declared on that branch.
+
+<a id="resource-options"></a>
+
+## Resources
+
+```sh
+selesai --extension ./review.ts
+```
+
+See [Configuration](configuration.md) for conventional directories and project trust, [Settings](settings.md#resources) for configured paths, and [Selesai Packages](packages.md) for package sources.
+
+- `-e`, `--extension <path>`<br>
+  Loads an extension file or directory, or a built-in extension such as `builtin:mcp`, and is repeatable.
+- `-ne`, `--no-extensions`<br>
+  Disables discovered, configured, and built-in extensions. Explicit `-e` paths still load, so `selesai -ne -e builtin:mcp` keeps only the built-in MCP support.
+- `--no-mcp`<br>
+  Disables the built-in MCP support for this run: no servers connect, and there are no MCP tools or `/mcp`. It does not affect an extension that replaces the built-in MCP support.
+- `--skill <path>`<br>
+  Loads a skill file or directory and is repeatable.
+- `-ns`, `--no-skills`<br>
+  Disables discovered and configured skills. Explicit `--skill` paths still load.
+- `--prompt-template <path>`<br>
+  Loads a prompt-template file or directory and is repeatable.
+- `-np`, `--no-prompt-templates`<br>
+  Disables discovered and configured templates. Explicit `--prompt-template` paths still load.
+- `--theme <path>`<br>
+  Loads a theme file or directory and is repeatable.
+- `--use-theme <name[/name]>`<br>
+  Selects the initial interactive theme for this run.
+- `--no-themes`<br>
+  Disables discovered and configured themes. Explicit `--theme` paths still load.
+- `-nc`, `--no-context-files`<br>
+  Disables `AGENTS.md` and `CLAUDE.md` discovery.
+
+Resource paths apply only to the current process. Relative paths resolve from the current working directory.
+
+<a id="prompt-and-display-options"></a>
+
+## Prompts and process
+
+```sh
+selesai --append-system-prompt ./instructions.md
+```
+
+See [Configuration](configuration.md) for saved configuration, [Security](security.md#project-trust) for project trust, and [Environment Variables](environment-variables.md) for process controls.
+
+- `--system-prompt <text|path>`<br>
+  Replaces the default system prompt with text or the contents of an existing file.
+- `--append-system-prompt <text|path>`<br>
+  Appends text or an existing file to the system prompt and is repeatable.
+- `--tui-mode <mode>`<br>
+  Uses `fullscreen` (default) or `regular` terminal mode.
+- `--verbose`<br>
+  Shows verbose interactive startup information, overriding `quietStartup`.
+- `-a`, `--approve`<br>
+  Trusts project-local configuration and resources for this process.
+- `-na`, `--no-approve`<br>
+  Ignores trust-gated project-local configuration and resources for this process.
+- `--offline`<br>
+  Disables automatic network activity, including model catalog refreshes. Equivalent to `PI_OFFLINE=1`.
+- `-h`, `--help`<br>
+  Shows help, including flags registered by loaded extensions, then exits.
+- `-v`, `--version`<br>
+  Shows the Selesai version, then exits.
+
+Extensions may register additional long-form options. Unknown short options are rejected.
+
+## Package commands
+
+```sh
+selesai install npm:@scope/package
+```
+
+See [Selesai Packages](packages.md) for source formats, filtering, installation, and project scope.
+
+### Common tasks
+
+| Task | Command |
+|---|---|
+| Install a package | `selesai install <source>` |
+| List configured packages | `selesai list` |
+| Remove a package and its settings entry | `selesai remove <source>` |
+| Configure which package resources load | `selesai config` |
+
+Add `--local` or `-l` to `install`, `remove`, `uninstall`, or `config` to use project settings instead of global settings.
+
+### Update Selesai or packages
+
+Running `selesai update` without a target updates Selesai itself.
+
+| Task | Command |
+|---|---|
+| Update Selesai | `selesai update` |
+| Update all installed packages | `selesai update --extensions` |
+| Update one installed package | `selesai update <source>` |
+| Refresh model catalogs | `selesai update --models` |
+| Update Selesai and all installed packages | `selesai update --all` |
+
+Add `--force` to reinstall Selesai when the selected update includes Selesai.
+
+`selesai update` cannot update Selesai when another package manager provides it, such as Nix. Update Selesai with that package manager, through that package manager. Package and model catalog updates still work.
+
+### Aliases and command options
+
+- `selesai uninstall <source>` is an alias for `selesai remove <source>`.
+- `selesai update --self`, `selesai update self`, and `selesai update pi` are aliases for `selesai update`.
+- `selesai update --extension <source>` is an alias for `selesai update <source>`.
+- `-a`, `--approve` trusts project-local files for one command. `-na`, `--no-approve` ignores trust-gated project-local files.
+- Append `-h` or `--help` to a command for its exact usage and option constraints.
+
+## Credential commands
+
+```sh
+selesai auth check --provider openai --json
+```
+
+Authentication commands require `--provider <provider>` or `--model <model>`. See [Providers](providers.md) for supported methods.
+
+| Command | Description |
+|---|---|
+| `selesai auth check` | Print `ready`, `not_ready`, or `invalid`; exit with status `0`, `1`, or `2`, respectively |
+| `selesai auth print-api-key` | Print the resolved API key |
+| `selesai auth print-bearer-token` | Print a resolved OAuth bearer token |
+
+| Option | Applies to | Description |
+|---|---|---|
+| `--provider <provider>` | All | Resolve credentials for a provider |
+| `--model <model>` | All | Resolve credentials from a model; may be combined with `--provider` |
+| `--json` | `auth check` | Write the structured result as JSON |
+| `--credentials` | `auth check` | Emit the resolved credential when ready |
+| `--no-refresh` | `auth check` | Do not refresh expired OAuth credentials; refresh is the default |
+| `--min-expiry <duration>` | `print-bearer-token` | Require remaining token lifetime using `ms`, `s`, `m`, or `h`, such as `30m` |
+
+Credential-printing commands write secrets to stdout.
+
+## MCP commands
+
+These commands work outside a session, so agents can run them through `bash`. See [MCP Servers](mcp.md).
+
+| Command | Description |
+|---|---|
+| `selesai mcp add <server> [options] -- <command> [args...]` | Add or replace a stdio server in `mcp.json`; `--env KEY=VALUE` (repeatable) and `--cwd <dir>` set its environment and working directory. Arguments after the command are passed to it |
+| `selesai mcp add <server> [options] --url <url>` | Add or replace a streamable HTTP server; `--header KEY=VALUE` (repeatable), `--bearer-token-env-var <NAME>` (sends `Authorization: Bearer ${NAME}`), `--oauth-client-id`, `--oauth-client-secret`, `--oauth-callback-port`, and `--oauth-client-name` configure authentication |
+| `selesai mcp remove <server>` | Remove a server from `mcp.json`; stored OAuth credentials are kept |
+| `selesai mcp list [--json]` | Connect to every enabled server and print its state, tools, and errors; exit with `1` when a config entry is invalid or an enabled server is not connected |
+| `selesai mcp login <server> [--timeout <seconds>]` | Sign in to an OAuth server: open the authorization page and wait for the browser (default 300 seconds); a terminal also accepts the pasted redirect URL |
+| `selesai mcp logout <server>` | Delete the stored OAuth credentials of a server |
+
+`add` and `remove` change `~/.selesai/agent/mcp.json`, or `.selesai/mcp.json` in the current directory with `--local` (`-l`). `add` also takes `--exposure <mode>` (see [Exposure](mcp.md#control-tool-exposure)) and `--description <text>` and does not connect; run `selesai mcp list` to check the server.
+
+Project `.selesai/mcp.json` files are only read for projects that are already trusted.