@thegitai/cli 1.0.0-beta.9 → 1.0.0-preview.1

package/README.md

@@ -1,7 +1,8 @@
 # TheGitAI
 
-Interactive terminal coding agent. Talk to your repo in plain English — it
-reads code, edits files, and runs commands with your approval.
+Interactive terminal coding agent. Talk to your repo in plain English — it reads
+your code, makes edits, runs the commands a task needs, and keeps long-running
+processes going while you work, all with your approval.
 
 ## Install
 
@@ -25,6 +26,39 @@ ai --version        print the version and exit
 
 Run `ai --help` for sessions, modes, keys, and chat commands.
 
+## Visible to-do list
+
+For larger multi-step tasks, the agent keeps a compact to-do list on screen so
+you can see what it plans to do, what it is working on right now, and what is
+already done.
+
+- While the agent works, the list sits at the bottom of the live **Working**
+  area, right above where you type, and updates as steps start and finish —
+  one step in progress at a time — so it stays visible even when tool output
+  above it runs long.
+- When the turn ends, a final snapshot of the list stays readable in the
+  transcript, and the footer shows a small progress chip (e.g. `◐ 4/6 to-dos`)
+  while steps remain open.
+- The agent's current reasoning stays visible too, right below the list, in a
+  compact one-line form so it doesn't compete with the list for space.
+- The list is managed entirely by the agent; simple one-step requests skip it.
+
+## Background jobs
+
+Some commands are meant to keep running — a dev server, a file watcher, a local
+API. TheGitAI runs these as **background jobs**, so the agent can start a server,
+work against it live, and stop it when the task is done, all in one session.
+
+- Each job's block in the transcript updates on its own with a live tail of its
+  latest output, and a compact indicator keeps you aware of what's still running.
+- Type `/jobs` to open a picker: **↑ / ↓** to move, **Enter** to expand a job and
+  read its output inline, **k** to stop it, **Esc** to close.
+- `/jobs output <id>` prints a job's full output, and `/jobs kill <id>` stops one
+  by id.
+- When you end the session, TheGitAI stops its background jobs for you.
+
+Full documentation: <https://thegit.ai/docs>
+
 ## License
 
 Proprietary — see the LICENSE file included in this package. Source is

package/dist/bin/ai.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-import chalk from 'chalk';
+import chalk from '../src/colors.js';
 import { stdin as input, stdout as output } from 'node:process';
 import readline from 'node:readline/promises';
 import { ServerApi } from '../src/api/index.js';
 import { loginViaBrowser } from '../src/api/browser-login.js';
+import { isTransientNetworkError } from '../src/api/http.js';
 import { formatCliHelpText, formatInteractiveHelpText, } from '../src/help-text.js';
 import { renderMarkdownForTerminal } from '../src/markdown-renderer.js';
 import { createIndex } from '../src/project-index.js';
@@ -15,6 +16,8 @@ import { formatSessionExitNotice } from '../src/session-exit.js';
 import { formatUsageText } from '../src/usage.js';
 import { formatVersionLine } from '../src/version.js';
 import { parseArgs } from '../src/cli-args.js';
+import { getJobBufferedOutput, killBackgroundJob, killAllBackgroundJobs, listBackgroundJobs, setBackgroundJobSession, } from '../src/background-jobs.js';
+import { collectBackgroundJobUiKillMutations, collectBackgroundJobUiOutputMutations, } from '../src/tool-executor.js';
 const DEFAULT_SERVER_URL = 'https://thegit.ai';
 const { auth, chat, models, sessions } = ServerApi;
 function printUsage() {
@@ -36,9 +39,6 @@ function appendPromptHistory(prompt, env = process.env) {
 }
 async function runAuthCommand(command, args) {
     if (command === 'login') {
-        // The public CLI always authenticates against the official TheGitAI host.
-        // There is intentionally no server/website override here — internal dev
-        // uses private tooling, not a customer-visible runtime override path.
         const serverUrl = DEFAULT_SERVER_URL;
         const noBrowser = args.includes('--no-browser');
         console.log(chalk.dim(noBrowser
@@ -128,6 +128,15 @@ function modelLabel(serverModels, modelId) {
     return (serverModels.models.find((model) => model.id === modelId)?.label ??
         'Unknown model');
 }
+function formatJobElapsedMs(ms) {
+    const totalSeconds = Math.max(0, Math.floor(ms / 1000));
+    if (totalSeconds < 60)
+        return `${totalSeconds}s`;
+    const minutes = Math.floor(totalSeconds / 60);
+    if (minutes < 60)
+        return `${minutes}m${String(totalSeconds % 60).padStart(2, '0')}s`;
+    return `${Math.floor(minutes / 60)}h${String(minutes % 60).padStart(2, '0')}m`;
+}
 function makeConfirmCommand(session) {
     return async (command) => {
         console.log(chalk.bold(`\nCommand approval needed:\n${command}\n`));
@@ -239,6 +248,68 @@ async function mainInteractive({ authConfig, projectIndex, serverModels, serverS
             console.log(chalk.dim('Conversation cleared.\n'));
             continue;
         }
+        if (trimmed === '/jobs' || trimmed.startsWith('/jobs ')) {
+            const jobsArgs = trimmed.slice('/jobs'.length).trim();
+            const killMatch = jobsArgs.match(/^kill\s+(\S+)$/);
+            if (killMatch) {
+                const jobId = killMatch[1];
+                const killed = await killBackgroundJob(jobId);
+                await collectBackgroundJobUiKillMutations({
+                    session,
+                    projectIndex,
+                    jobId,
+                    result: killed,
+                });
+                if (!killed.ok) {
+                    console.log(chalk.red(killed.error ?? 'Background job kill failed.'));
+                }
+                else if (killed.alreadyFinished) {
+                    console.log(chalk.dim(`${jobId} had already finished.`));
+                }
+                continue;
+            }
+            const outputMatch = jobsArgs.match(/^output\s+(\S+)$/);
+            if (outputMatch) {
+                const jobId = outputMatch[1];
+                await collectBackgroundJobUiOutputMutations({
+                    session,
+                    projectIndex,
+                    jobId,
+                });
+                const job = listBackgroundJobs().find((candidate) => candidate.id === jobId);
+                const buffered = getJobBufferedOutput(jobId);
+                if (!job || !buffered) {
+                    console.log(chalk.red(`Unknown background job id: ${jobId}`));
+                    continue;
+                }
+                if (buffered.droppedChars > 0) {
+                    console.log(chalk.dim(`... (${buffered.droppedChars} chars of older output dropped) ...`));
+                }
+                console.log(buffered.output || chalk.dim('(no output captured)'));
+                continue;
+            }
+            if (jobsArgs) {
+                console.log(chalk.dim('Usage: /jobs — list · /jobs output <id> — full output · /jobs kill <id> — kill'));
+                continue;
+            }
+            const jobsList = listBackgroundJobs();
+            if (!jobsList.length) {
+                console.log(chalk.dim('No background jobs in this session.'));
+                continue;
+            }
+            for (const job of jobsList) {
+                const elapsed = formatJobElapsedMs((job.endedAt ?? Date.now()) - job.startedAt);
+                const stateText = job.status === 'running'
+                    ? `running · ${elapsed}`
+                    : job.status === 'killed'
+                        ? `killed · ran ${elapsed}`
+                        : job.status === 'error'
+                            ? 'failed to start'
+                            : `exited (code ${job.exitCode ?? 1}) · ran ${elapsed}`;
+                console.log(`${job.id} · ${stateText}\n    $ ${job.command}`);
+            }
+            continue;
+        }
         if (trimmed === '/resume') {
             const snapshot = await promptForResumeSession(session.rootDir, serverModels);
             if (!snapshot) {
@@ -246,6 +317,7 @@ async function mainInteractive({ authConfig, projectIndex, serverModels, serverS
                 continue;
             }
             applySessionSnapshot(session, snapshot);
+            setBackgroundJobSession(session.sessionId);
             await saveSessionBoth({ session, serverSessionClient });
             console.log(chalk.dim(`Resumed session${session.sessionName ? ` "${session.sessionName}"` : ''} (${session.sessionId})\n`));
             continue;
@@ -314,9 +386,46 @@ export async function main() {
     const rootDir = process.cwd();
     const authConfig = requireCliAuthConfig();
     const serverSessionClient = sessions.createServerSessionClient({ config: authConfig });
-    const cachedModels = models.readCachedServerModels();
-    const serverModels = await models.fetchServerModels({ config: authConfig });
-    const whoami = await auth.fetchWhoamiResponse({ config: authConfig });
+    const cachedModels = models.selectCacheForServer(models.readCachedServerModels(), authConfig.serverUrl);
+    let offlineNotice = null;
+    let serverModels;
+    try {
+        serverModels = await models.fetchServerModels({ config: authConfig });
+    }
+    catch (error) {
+        if (isTransientNetworkError(error) && cachedModels?.models.length) {
+            serverModels = { models: cachedModels.models };
+            offlineNotice = error?.message ? String(error.message) : 'network error';
+        }
+        else {
+            throw error;
+        }
+    }
+    let whoami;
+    try {
+        whoami = await auth.fetchWhoamiResponse({ config: authConfig });
+    }
+    catch (error) {
+        if (isTransientNetworkError(error)) {
+            whoami = {
+                customer: {
+                    id: '',
+                    uuid: '',
+                    email: authConfig.email,
+                    customer_type: authConfig.customerType ?? 'USER',
+                    scopes: [],
+                },
+                debugUi: { showSessionId: false },
+            };
+            offlineNotice ??= error?.message ? String(error.message) : 'network error';
+        }
+        else {
+            throw error;
+        }
+    }
+    if (offlineNotice) {
+        console.error(chalk.yellow(`⚠ Couldn't reach TheGitAI (${offlineNotice}). Starting with cached settings — it will reconnect on your next message.`));
+    }
     if (listSessions) {
         printSessionList(rootDir, listSessionMetadata(rootDir), serverModels);
         return;
@@ -377,17 +486,24 @@ export async function main() {
     }
     printStartupBanner(rootDir, modelLabel(serverModels, session.modelId), session.autoYes);
     printSessionStartup(session);
-    await mainInteractive({
-        authConfig,
-        projectIndex,
-        serverModels,
-        serverSessionClient,
-        session,
-        usageText: async () => formatUsageText(await auth.fetchWhoamiResponse({ config: authConfig })),
-        initialPrompt,
-    });
-    await saveSessionBoth({ session, serverSessionClient });
-    printSessionExit(session);
+    setBackgroundJobSession(session.sessionId);
+    try {
+        await mainInteractive({
+            authConfig,
+            projectIndex,
+            serverModels,
+            serverSessionClient,
+            session,
+            usageText: async () => formatUsageText(await auth.fetchWhoamiResponse({ config: authConfig })),
+            initialPrompt,
+        });
+        await saveSessionBoth({ session, serverSessionClient });
+        printSessionExit(session);
+    }
+    finally {
+        killAllBackgroundJobs({ sessionId: session.sessionId, remove: true });
+        setBackgroundJobSession(null);
+    }
 }
 main().catch((error) => {
     console.error(chalk.red(`\n✖ Error: ${error.message}\n`));

package/dist/parsers/NOTICE

@@ -0,0 +1,18 @@
+Tree-sitter grammar parsers
+===========================
+
+The `tree-sitter-*.wasm` files in this directory are precompiled tree-sitter
+grammar parsers, vendored so the published `@thegitai/cli` package ships local
+code intelligence without a runtime dependency. They are used unmodified, only
+as parsing inputs to the vendored web-tree-sitter runtime
+(see ../vendor/web-tree-sitter/NOTICE).
+
+Each grammar is the work of its respective tree-sitter grammar project and is
+distributed under that project's license (the tree-sitter grammars are
+MIT-licensed). Grammars included:
+
+  c, c-sharp, cpp, css, go, html, java, javascript, objc, php, python, ruby,
+  rust, tsx, typescript
+
+Upstream organization: https://github.com/tree-sitter
+Individual grammars:    https://github.com/tree-sitter/tree-sitter-<language>

package/dist/src/agent-mode.js

@@ -12,6 +12,8 @@ const PLAN_MODE_TOOL_NAMES = new Set([
     'read_document',
     'analyze_image',
     'run_command',
+    'shell_job_output',
+    'update_todos',
 ]);
 const PLAN_MODE_RUN_COMMAND_NAMES = new Set([
     'pwd',
@@ -117,6 +119,9 @@ export function buildAgentModeToolBlockedResult(mode, call) {
     }
     if (call.name !== 'run_command')
         return null;
+    if (call.args?.background === true) {
+        return buildPlanModeToolBlockedResult(call.name, PLAN_MODE_RUN_COMMAND_ACTION);
+    }
     const command = String(call.args?.command ?? call.args?.cmd ?? '');
     const reason = planModeRunCommandBlockReason(command);
     return reason ? buildPlanModeToolBlockedResult(call.name, reason) : null;

package/dist/src/api/auth.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { getClientStateDir } from '../client-state.js';
-import { ServerApiError, authorizedJson, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, } from './http.js';
+import { ServerApiError, authorizedJson, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, retryTransient, } from './http.js';
 export function getAuthConfigPath(env = process.env) {
     const configured = String(env.THEGITAI_AUTH_CONFIG ?? '').trim();
     if (configured) {
@@ -51,11 +51,11 @@ export async function fetchWhoami({ config, fetchImpl = globalThis.fetch, }) {
     return data.customer;
 }
 export async function fetchWhoamiResponse({ config, fetchImpl = globalThis.fetch, }) {
-    const data = (await authorizedJson({
+    const data = (await retryTransient(() => authorizedJson({
         config,
         path: '/v1/auth/whoami',
         fetchImpl,
-    }));
+    })));
     if (!data?.customer?.email) {
         throw new Error('Server returned an invalid whoami response.');
     }

package/dist/src/api/browser-login.js

@@ -7,15 +7,10 @@ const DEFAULT_WEBSITE_URL = 'https://thegit.ai';
 const DEFAULT_SERVER_URL = 'https://thegit.ai';
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
 function shutDownServer(server) {
-    // Drop any lingering (keep-alive) connections so the event loop empties and
-    // the CLI exits instead of hanging after a successful login.
     server.closeAllConnections?.();
     server.close();
 }
 export function resolveWebsiteUrl() {
-    // The public CLI always signs in through the official TheGitAI website. There
-    // is no override path here so the published package cannot be pointed at a
-    // clone host.
     return DEFAULT_WEBSITE_URL.replace(/\/+$/, '');
 }
 function defaultDeviceName() {
@@ -26,7 +21,6 @@ function defaultDeviceName() {
         return os.hostname();
     }
 }
-/** PKCE (RFC 7636, S256): a random verifier and its SHA-256 challenge. */
 export function generatePkce() {
     const verifier = crypto.randomBytes(32).toString('base64url');
     const challenge = crypto
@@ -77,12 +71,6 @@ async function exchangeCodeForToken({ serverUrl, code, codeVerifier, fetchImpl,
         customer,
     };
 }
-/**
- * Browser-based login. Starts a loopback server so the website can redirect the
- * one-time code back automatically; the code is then exchanged for a token
- * using the PKCE verifier. With `noBrowser`, the user pastes the code instead.
- * The CLI never sees the user's credentials.
- */
 export async function loginViaBrowser(options) {
     const serverUrl = normalizeServerUrl(options.serverUrl ?? DEFAULT_SERVER_URL);
     const websiteUrl = resolveWebsiteUrl();
@@ -97,8 +85,6 @@ export async function loginViaBrowser(options) {
             deviceName,
             paste: true,
         });
-        // Headless mode: only print the URL for the user to open on another device.
-        // Never launch a browser here — that is the whole point of --no-browser.
         onUrl(authUrl);
         if (!options.promptCode) {
             throw new Error('No way to read the authorization code in this context.');
@@ -125,8 +111,6 @@ export async function loginViaBrowser(options) {
             }
             const code = requestUrl.searchParams.get('code') ?? '';
             const returnedState = requestUrl.searchParams.get('state') ?? '';
-            // `Connection: close` plus closeAllConnections() ensures the browser's
-            // keep-alive socket is torn down so the process can exit after login.
             if (!code || returnedState !== state) {
                 res.writeHead(400, { 'content-type': 'text/html', connection: 'close' });
                 res.end(RESULT_PAGE('Login failed', 'The request could not be verified. Please run ai login again.'));

package/dist/src/api/chat.js

@@ -1,8 +1,10 @@
+import { drainBackgroundJobNotifications } from '../background-jobs.js';
 import { createPromptCheckpoint, sanitizeSessionSafetyForServer, } from '../session-safety.js';
 import { applySessionSnapshot, snapshotFromSession, } from '../session-store.js';
 import { executeLocalToolCall } from '../tool-executor.js';
 import { createTraceContext, normalizeServerUrl, readErrorResponse, } from './http.js';
 import { collectClientEnvironment } from '../client-environment.js';
+import { autoAttachImages } from '../core/image-path-extractor.js';
 export class TurnCancelledError extends Error {
     name = 'TurnCancelledError';
     constructor(message = 'Turn cancelled.') {
@@ -63,6 +65,11 @@ function snapshotForServer(session) {
     snapshot.clientState.safety = sanitizeSessionSafetyForServer(snapshot.clientState.safety);
     return snapshot;
 }
+function imageAttachmentsForServer(attachments) {
+    return (attachments ?? []).map(({ filePath, ...attachment }) => attachment.source === 'file' && filePath
+        ? { ...attachment, filePath }
+        : attachment);
+}
 function userHistoryText(entry) {
     return (entry.parts ?? [])
         .map((part) => (typeof part?.text === 'string' ? part.text : ''))
@@ -142,6 +149,35 @@ function publicStatusMessage(data) {
         return `Running ${toolName} locally...`;
     return null;
 }
+function normalizeShellJobToolCall(call) {
+    if (call.name !== 'shell_job_output' && call.name !== 'shell_job_kill') {
+        return call;
+    }
+    const args = call.args && typeof call.args === 'object' && !Array.isArray(call.args)
+        ? { ...call.args }
+        : {};
+    let changed = false;
+    if (args.job_id === undefined) {
+        const alias = args.jobId ?? args.id;
+        if (alias !== undefined) {
+            args.job_id = alias;
+            delete args.jobId;
+            delete args.id;
+            changed = true;
+        }
+    }
+    if (call.name === 'shell_job_output' && args.wait_ms === undefined) {
+        const alias = args.waitMs ?? args.wait ?? args.wait_millis;
+        if (alias !== undefined) {
+            args.wait_ms = alias;
+            delete args.waitMs;
+            delete args.wait;
+            delete args.wait_millis;
+            changed = true;
+        }
+    }
+    return changed ? { ...call, args } : call;
+}
 async function postToolResult({ config, turnId, event, result, session, fetchImpl, traceId, }) {
     const payload = {
         toolCallId: event.call.id,
@@ -182,8 +218,9 @@ async function executeAndPostToolResult({ config, projectIndex, session, event,
         }
     }
     try {
-        const rawResult = await executeLocalToolCall({ projectIndex }, session, event.call);
-        preserveCancelledTurnToolResult(session, input, event, rawResult);
+        const call = normalizeShellJobToolCall(event.call);
+        const rawResult = await executeLocalToolCall({ projectIndex }, session, call);
+        preserveCancelledTurnToolResult(session, input, { ...event, call }, rawResult);
         if (signal?.aborted) {
             throw new TurnCancelledError();
         }
@@ -285,19 +322,31 @@ async function consumeTurnStream({ response, config, projectIndex, session, inpu
     return finalResult.current;
 }
 export async function sendServerUserMessage({ config, projectIndex, session, input, imageAttachments = [], fetchImpl = globalThis.fetch, signal, }) {
+    const autoAttach = autoAttachImages(input, session.rootDir, imageAttachments);
+    const requestImageAttachments = autoAttach.attachments.length > 0
+        ? [...imageAttachments, ...autoAttach.attachments]
+        : imageAttachments;
+    const requestInputBase = autoAttach.attachments.length > 0 ? autoAttach.sanitizedInput : input;
+    const backgroundJobUpdate = drainBackgroundJobNotifications({
+        sessionId: session.sessionId,
+    });
+    for (const err of autoAttach.errors) {
+        session.onStatus(`Image: ${err}`);
+    }
     const request = {
         modelId: session.modelId,
         session: snapshotForServer(session),
-        input,
+        input: requestInputBase,
+        backgroundJobUpdate: backgroundJobUpdate || undefined,
         clientEnvironment: collectClientEnvironment({ env: session.env }),
-        imageAttachments,
+        imageAttachments: imageAttachmentsForServer(requestImageAttachments),
         maxToolSteps: session.maxToolSteps,
         autoYes: session.autoYes,
         agentMode: session.agentMode,
     };
     const trace = createTraceContext();
     const preTurnHistoryLength = session.history.length;
-    const preserveOnAbort = () => preserveCancelledTurnInput(session, input);
+    const preserveOnAbort = () => preserveCancelledTurnInput(session, requestInputBase);
     if (signal?.aborted) {
         preserveOnAbort();
     }
@@ -324,7 +373,7 @@ export async function sendServerUserMessage({ config, projectIndex, session, inp
             config,
             projectIndex,
             session,
-            input,
+            input: requestInputBase,
             fetchImpl,
             signal,
             traceId: trace.traceId,
@@ -339,16 +388,13 @@ export async function sendServerUserMessage({ config, projectIndex, session, inp
     }
     catch (error) {
         if (isTurnCancelledError(error)) {
-            preserveCancelledTurnInput(session, input);
+            preserveCancelledTurnInput(session, requestInputBase);
             throw error instanceof TurnCancelledError
                 ? error
                 : new TurnCancelledError();
         }
-        // Non-cancel failures (e.g. upstream connection errors) must not leave
-        // speculative cancelled-turn entries in history — otherwise the next
-        // request replays a malformed transcript to the server.
         session.history.length = preTurnHistoryLength;
-        preserveFailedTurnInput(session, input, error instanceof ChatTurnFailedError ? error.category : 'unknown_error');
+        preserveFailedTurnInput(session, requestInputBase, error instanceof ChatTurnFailedError ? error.category : 'unknown_error');
         throw error;
     }
     finally {

package/dist/src/api/http.js

@@ -26,6 +26,53 @@ export function createTraceContext(traceId = createTraceId()) {
         },
     };
 }
+export const REQUEST_TIMEOUT_MS = 8000;
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'ETIMEDOUT',
+    'EAI_AGAIN',
+    'ENOTFOUND',
+    'ENETUNREACH',
+    'EHOSTUNREACH',
+    'EPIPE',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_SOCKET',
+    'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT',
+]);
+export function isTransientNetworkError(error) {
+    if (error instanceof ServerApiError)
+        return false;
+    if (!error || typeof error !== 'object')
+        return false;
+    const err = error;
+    if (err.name === 'AbortError' || err.name === 'TimeoutError')
+        return true;
+    const code = err.code ?? err.cause?.code;
+    if (code) {
+        return TRANSIENT_NETWORK_CODES.has(code);
+    }
+    if (error instanceof TypeError && /fetch failed/i.test(err.message ?? '')) {
+        return true;
+    }
+    return false;
+}
+export async function retryTransient(run, { retries = 2, baseDelayMs = 400 } = {}) {
+    let attempt = 0;
+    for (;;) {
+        try {
+            return await run();
+        }
+        catch (error) {
+            if (attempt >= retries || !isTransientNetworkError(error))
+                throw error;
+            const delayMs = baseDelayMs * 2 ** attempt;
+            attempt += 1;
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+    }
+}
 export function normalizeServerUrl(serverUrl) {
     const normalized = String(serverUrl || DEFAULT_SERVER_URL)
         .trim()
@@ -53,7 +100,7 @@ export async function readErrorResponse(response, traceId = response.headers.get
     const data = await readJsonResponse(response);
     return new ServerApiError(failureMessage(data, response.status), response.status, traceId);
 }
-export async function authorizedJson({ config, path, method = 'GET', body = null, headers = {}, fetchImpl = globalThis.fetch, }) {
+export async function authorizedJson({ config, path, method = 'GET', body = null, headers = {}, fetchImpl = globalThis.fetch, timeoutMs = REQUEST_TIMEOUT_MS, }) {
     const trace = createTraceContext();
     const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}${path}`, {
         method,
@@ -64,6 +111,7 @@ export async function authorizedJson({ config, path, method = 'GET', body = null
             ...(body === null ? {} : { 'content-type': 'application/json' }),
         },
         body: body === null ? undefined : JSON.stringify(body),
+        signal: AbortSignal.timeout(timeoutMs),
     });
     const data = await readJsonResponse(response);
     if (!response.ok) {

package/dist/src/api/models.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { getClientStateDir } from '../client-state.js';
-import { ServerApiError, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, } from './http.js';
+import { REQUEST_TIMEOUT_MS, ServerApiError, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, retryTransient, } from './http.js';
 function sanitizeModelInfo(raw) {
     if (!raw || typeof raw !== 'object') {
         return null;
@@ -45,6 +45,11 @@ export function readCachedServerModels(env = process.env) {
         return null;
     }
 }
+export function selectCacheForServer(cached, serverUrl) {
+    if (!cached)
+        return null;
+    return cached.serverUrl === normalizeServerUrl(serverUrl) ? cached : null;
+}
 export function writeCachedServerModels(cache, env = process.env) {
     const filePath = getModelsCachePath(env);
     mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
@@ -54,26 +59,27 @@ export function writeCachedServerModels(cache, env = process.env) {
     });
 }
 export async function fetchServerModels({ config, fetchImpl = globalThis.fetch, }) {
-    const trace = createTraceContext();
-    const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/models`, {
-        headers: {
-            authorization: `Bearer ${config.token}`,
-            ...trace.headers,
-        },
+    return retryTransient(async () => {
+        const trace = createTraceContext();
+        const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/models`, {
+            headers: {
+                authorization: `Bearer ${config.token}`,
+                ...trace.headers,
+            },
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        const data = (await readJsonResponse(response));
+        if (!response.ok) {
+            throw new ServerApiError(failureMessage(data, response.status), response.status, trace.traceId);
+        }
+        const models = Array.isArray(data?.models)
+            ? data.models.map(sanitizeModelInfo).filter(Boolean)
+            : [];
+        if (models.length === 0) {
+            throw new Error('Server returned an invalid model list.');
+        }
+        return { models };
     });
-    const data = (await readJsonResponse(response));
-    if (!response.ok) {
-        throw new ServerApiError(failureMessage(data, response.status), response.status, trace.traceId);
-    }
-    const models = Array.isArray(data?.models)
-        ? data.models.map(sanitizeModelInfo).filter(Boolean)
-        : [];
-    if (models.length === 0) {
-        throw new Error('Server returned an invalid model list.');
-    }
-    return {
-        models,
-    };
 }
 export function selectServerModel({ requestedModelId, cached, serverModels, }) {
     const supportedIds = new Set(serverModels.models.map((model) => model.id));

package/dist/src/artifact-policy.js

@@ -154,6 +154,8 @@ const SENSITIVE_BASENAME_PATTERNS = [
     /^\.?pypirc$/i,
     /^credentials(?:\..*)?$/i,
     /^secrets?(?:\..*)?$/i,
+    /^service[-_]?account(?:\..*)?\.json$/i,
+    /^.*credentials.*\.json$/i,
 ];
 const SENSITIVE_PATH_PATTERNS = [
     /(^|[/\\])\.aws[/\\]credentials$/i,
@@ -161,6 +163,7 @@ const SENSITIVE_PATH_PATTERNS = [
     /(^|[/\\])credentials?([._-]|$)/i,
     /(^|[/\\])secrets?([._-]|$)/i,
     /(^|[/\\])private[-_]?key([._-]|$)/i,
+    /(^|[/\\])service[-_]?account/i,
     /\.(?:pem|key|p12|pfx)$/i,
 ];
 export function normalizeArtifactPath(relPath) {