@wrongstack/cli 0.295.0 → 0.296.2

package/dist/chunk-JBTFWWKV.js

@@ -0,0 +1,1325 @@
+import {
+  LOCAL_LLM_PRESETS,
+  runLiveProviderPicker
+} from "./chunk-JBSQ7ONN.js";
+import {
+  openBrowser,
+  runCodexOAuthLogin,
+  startLoopbackServer
+} from "./chunk-TADVX644.js";
+import {
+  activeLabel,
+  loadConfigProviders,
+  maskedKey,
+  mutateConfigProviders,
+  normalizeKeys,
+  nowIso,
+  writeKeysBack
+} from "./chunk-PJHET45A.js";
+
+// src/auth-menu/oauth-menu.ts
+import { color as color3 } from "@wrongstack/core/utils";
+
+// src/auth-menu/anthropic-oauth.ts
+import { createHash, randomBytes } from "node:crypto";
+import { color } from "@wrongstack/core/utils";
+import { FetchError, ParseError } from "@wrongstack/core/types";
+var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+var REDIRECT_PORT = 53692;
+var REDIRECT_HOST = "127.0.0.1";
+var REDIRECT_PATH = "/callback";
+var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}${REDIRECT_PATH}`;
+var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+var CLAUDE_PROVIDER_ID = "anthropic-oauth";
+var CLAUDE_BASE_URL = "https://api.anthropic.com";
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generatePkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function buildAuthorizeUrl(challenge, verifier) {
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLIENT_ID,
+    response_type: "code",
+    redirect_uri: REDIRECT_URI,
+    scope: SCOPES,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state: verifier
+  });
+  return `${AUTHORIZE_URL}?${params.toString()}`;
+}
+function parseAuthorizationInput(input) {
+  const value = input.trim();
+  if (!value) return {};
+  try {
+    const url = new URL(value);
+    return {
+      code: url.searchParams.get("code") ?? void 0,
+      state: url.searchParams.get("state") ?? void 0
+    };
+  } catch {
+  }
+  if (value.includes("#")) {
+    const [code, state] = value.split("#", 2);
+    return { code, state };
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    return {
+      code: params.get("code") ?? void 0,
+      state: params.get("state") ?? void 0
+    };
+  }
+  return { code: value };
+}
+async function readTokens(res, op, url) {
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new FetchError({
+      message: `Claude token ${op} failed (${res.status}): ${text || res.statusText}`,
+      status: res.status,
+      context: { provider: "anthropic-oauth", op, url }
+    });
+  }
+  const json = await res.json();
+  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+    throw new ParseError({
+      message: `Claude token ${op} response missing fields`,
+      source: "anthropic-oauth-token-response",
+      context: { op }
+    });
+  }
+  return {
+    access: json.access_token,
+    refresh: json.refresh_token,
+    expires: Date.now() + json.expires_in * 1e3
+  };
+}
+async function exchangeAuthorizationCode(code, state, verifier, signal) {
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code,
+      state,
+      redirect_uri: REDIRECT_URI,
+      code_verifier: verifier
+    }),
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4)
+  });
+  return readTokens(res, "exchange", TOKEN_URL);
+}
+async function fetchClaudeModels(accessToken, signal) {
+  try {
+    const res = await fetch(`${CLAUDE_BASE_URL}/v1/models?limit=100`, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${accessToken}`,
+        "anthropic-version": "2023-06-01",
+        "anthropic-beta": "claude-code-20250219,oauth-2025-04-20"
+      },
+      signal: AbortSignal.any([signal, AbortSignal.timeout(8e3)])
+    });
+    if (!res.ok) return [];
+    const json = await res.json();
+    const ids = (json?.data ?? []).map((m) => m.id).filter((id) => typeof id === "string" && id.startsWith("claude-"));
+    return ids;
+  } catch {
+    return [];
+  }
+}
+async function runClaudeOAuthLogin(deps, opts = {}) {
+  const providerId = opts.providerId ?? CLAUDE_PROVIDER_ID;
+  const { verifier, challenge } = generatePkce();
+  const state = verifier;
+  const authorizeUrl = buildAuthorizeUrl(challenge, verifier);
+  const osc8 = (url) => `\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\`;
+  const ac = new AbortController();
+  const onSig = () => ac.abort();
+  const external = opts.signal;
+  if (external) {
+    if (external.aborted) ac.abort();
+    else external.addEventListener("abort", () => ac.abort(), { once: true });
+  } else {
+    process.on("SIGINT", onSig);
+  }
+  const server = await startLoopbackServer(state, [REDIRECT_PORT], ac.signal, REDIRECT_PATH, REDIRECT_HOST);
+  deps.renderer.write(
+    color.bold(`
+  Sign in with Claude \u2014 ${color.cyan(providerId)}
+`) + color.dim("  Uses your Claude Pro/Max subscription (not an API key).\n") + color.amber("  \u26A0 Using a subscription outside the official Claude Code client is against\n") + color.amber("    Anthropic\u2019s Terms \u2014 your account could be rate-limited or banned.\n") + color.dim("    Sanctioned programmatic use = an API key: ") + color.bold("wstack auth anthropic") + color.dim("\n\n") + color.bold(`  ${"\u2500".repeat(56)}
+`) + color.bold("  Open this URL in your browser to sign in:\n") + color.cyan(`  ${osc8(authorizeUrl)}
+`) + color.bold(`  ${"\u2500".repeat(56)}
+
+`)
+  );
+  if (server.bound) {
+    openBrowser(authorizeUrl);
+    deps.renderer.write(
+      color.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color.dim("  (Listening on http://localhost:53692 \u2014 press Ctrl+C to cancel.)\n")
+    );
+  } else {
+    deps.renderer.write(
+      color.amber("  \u26A0 Could not start the local callback listener (port 53692 in use).\n") + color.dim("  After signing in, paste the full redirect URL (or the code) below.\n")
+    );
+  }
+  let code;
+  try {
+    if (server.bound) {
+      const got = await server.waitForCode();
+      if (ac.signal.aborted) {
+        deps.renderer.write(color.dim("  Cancelled.\n"));
+        return 1;
+      }
+      if (got) code = got.code;
+    }
+    if (!code) {
+      const input = (await deps.reader.readLine(
+        `
+  ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
+      )).trim();
+      if (input.toLowerCase() === "q" || input === "") {
+        deps.renderer.write(color.dim("  Cancelled.\n"));
+        return 1;
+      }
+      const parsed = parseAuthorizationInput(input);
+      if (parsed.state && parsed.state !== state) {
+        deps.renderer.writeError("  State mismatch \u2014 please restart the login flow.");
+        return 1;
+      }
+      code = parsed.code;
+    }
+    if (!code) {
+      deps.renderer.writeError("  No authorization code received.");
+      return 1;
+    }
+    deps.renderer.write(color.dim("\n  Exchanging authorization code for tokens...\n"));
+    const tokens = await exchangeAuthorizationCode(code, state, verifier, ac.signal);
+    const models = await fetchClaudeModels(tokens.access, ac.signal);
+    const saved = await saveClaudeTokens(deps, providerId, tokens, models);
+    if (!saved) return 1;
+    deps.renderer.write(color.green("\n  \u2713 Signed in with Claude!\n"));
+    const modelHint = models[0];
+    deps.renderer.writeInfo(
+      `  Saved as provider ${color.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
+` + (modelHint ? `  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` : `  No model list was discovered; choose a model before starting a run.
+`) + color.dim("  Tokens refresh automatically before they expire.\n")
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
+    deps.renderer.writeError(`  Login failed: ${msg}`);
+    return 1;
+  } finally {
+    server.close();
+    if (!external) process.off("SIGINT", onSig);
+  }
+}
+async function saveClaudeTokens(deps, providerId, tokens, models) {
+  const entry = {
+    label: "oauth-default",
+    apiKey: tokens.access,
+    createdAt: nowIso(),
+    authMethod: "oauth",
+    expiresAt: new Date(tokens.expires).toISOString(),
+    refreshToken: tokens.refresh,
+    tokenType: "bearer",
+    scope: SCOPES
+  };
+  try {
+    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
+      const existing = all[providerId];
+      const p = existing ? { ...existing } : { type: providerId };
+      p.family = "anthropic-oauth";
+      if (!p.baseUrl) p.baseUrl = CLAUDE_BASE_URL;
+      if (models.length > 0) p.models = models;
+      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
+      keys.push(entry);
+      writeKeysBack(p, keys);
+      p.activeKey = entry.label;
+      all[providerId] = p;
+    }, deps.profileConfigPath);
+    return true;
+  } catch (err) {
+    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
+    return false;
+  }
+}
+
+// src/auth-menu/github-copilot-oauth.ts
+import { spawn } from "node:child_process";
+import { color as color2 } from "@wrongstack/core/utils";
+import { FetchError as FetchError2, ParseError as ParseError2 } from "@wrongstack/core/types";
+import { copilotBaseUrlFromToken, refreshCopilotToken } from "@wrongstack/providers";
+var CLIENT_ID2 = "Iv1.b507a08c87ecfe98";
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var COPILOT_HEADERS = {
+  "User-Agent": "GitHubCopilotChat/0.35.0",
+  "Editor-Version": "vscode/1.107.0",
+  "Editor-Plugin-Version": "copilot-chat/0.35.0",
+  "Copilot-Integration-Id": "vscode-chat"
+};
+var COPILOT_API_VERSION = "2026-06-01";
+var COPILOT_PROVIDER_ID = "github-copilot";
+function openBrowser2(url) {
+  try {
+    const platform = process.platform;
+    const { command, args } = platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
+    const child = spawn(command, args, { stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) return reject(new DOMException("Aborted", "AbortError"));
+    const t = setTimeout(resolve, ms);
+    signal.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(t);
+        reject(new DOMException("Aborted", "AbortError"));
+      },
+      { once: true }
+    );
+  });
+}
+async function startDeviceFlow(signal) {
+  const res = await fetch(DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/x-www-form-urlencoded",
+      "user-agent": COPILOT_HEADERS["User-Agent"]
+    },
+    body: new URLSearchParams({ client_id: CLIENT_ID2, scope: "read:user" }).toString(),
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15e3)]) : AbortSignal.timeout(15e3)
+  });
+  if (!res.ok) {
+    throw new FetchError2({
+      message: `GitHub device-code request failed (${res.status})`,
+      status: res.status,
+      context: { provider: "github-copilot", op: "device-code", url: DEVICE_CODE_URL }
+    });
+  }
+  const json = await res.json();
+  if (!json?.device_code || !json.user_code || !json.verification_uri || typeof json.expires_in !== "number") {
+    throw new ParseError2({
+      message: "Invalid device-code response",
+      source: "github-copilot-device-code-response"
+    });
+  }
+  return {
+    device_code: json.device_code,
+    user_code: json.user_code,
+    verification_uri: json.verification_uri,
+    interval: json.interval ?? 5,
+    expires_in: json.expires_in
+  };
+}
+async function pollForGitHubToken(device, signal) {
+  let intervalMs = device.interval * 1e3;
+  const expiresAt = Date.now() + device.expires_in * 1e3;
+  while (Date.now() < expiresAt) {
+    await sleep(intervalMs, signal);
+    const res = await fetch(ACCESS_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded",
+        "user-agent": COPILOT_HEADERS["User-Agent"]
+      },
+      body: new URLSearchParams({
+        client_id: CLIENT_ID2,
+        device_code: device.device_code,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      }).toString(),
+      signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
+    });
+    const json = await res.json().catch(() => ({}));
+    if (json.access_token) return json.access_token;
+    if (json.error === "authorization_pending") continue;
+    if (json.error === "slow_down") {
+      intervalMs += 5e3;
+      continue;
+    }
+    throw new Error(`Device flow failed: ${json.error ?? "unknown error"}`);
+  }
+  throw new FetchError2({
+    message: "Device code expired \u2014 please restart the login.",
+    status: 408,
+    // Request Timeout
+    context: { provider: "github-copilot", op: "device-code-poll", reason: "expired" }
+  });
+}
+function isUsableCopilotChatModel(item) {
+  if (typeof item.id !== "string" || item.id.length === 0) return false;
+  const cap = item.capabilities;
+  if (cap?.type !== "chat") return false;
+  if (cap.supports?.tool_calls !== true) return false;
+  const eps = item.supported_endpoints;
+  if (Array.isArray(eps) && !eps.includes("/chat/completions")) return false;
+  if (item.policy?.state === "disabled") return false;
+  if (item.vendor === "Experimental") return false;
+  return true;
+}
+async function fetchCopilotModels(copilotToken, signal) {
+  try {
+    const base = copilotBaseUrlFromToken(copilotToken);
+    const res = await fetch(`${base}/models`, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${copilotToken}`,
+        "X-GitHub-Api-Version": COPILOT_API_VERSION,
+        ...COPILOT_HEADERS
+      },
+      signal: AbortSignal.any([signal, AbortSignal.timeout(8e3)])
+    });
+    if (!res.ok) return [];
+    const json = await res.json();
+    const data = json?.data;
+    if (!Array.isArray(data)) return [];
+    const usable = data.filter(isUsableCopilotChatModel);
+    usable.sort((a, b) => copilotModelRank(a) - copilotModelRank(b));
+    return usable.map((m) => m.id);
+  } catch {
+    return [];
+  }
+}
+function copilotModelRank(item) {
+  if (item.is_chat_default === true) return 0;
+  if (item.is_chat_fallback === true) return 1;
+  return 2;
+}
+async function runCopilotOAuthLogin(deps, opts = {}) {
+  const providerId = opts.providerId ?? COPILOT_PROVIDER_ID;
+  const ac = new AbortController();
+  const onSig = () => ac.abort();
+  const external = opts.signal;
+  if (external) {
+    if (external.aborted) ac.abort();
+    else external.addEventListener("abort", () => ac.abort(), { once: true });
+  } else {
+    process.on("SIGINT", onSig);
+  }
+  try {
+    deps.renderer.write(
+      color2.bold(`
+  Sign in with GitHub Copilot \u2014 ${color2.cyan(providerId)}
+`) + color2.dim("  Uses your GitHub Copilot subscription (not an API key).\n") + color2.amber("  \u26A0 Using Copilot outside its official editor integrations may violate\n") + color2.amber("    GitHub\u2019s Terms \u2014 your account could be rate-limited or banned.\n\n")
+    );
+    const device = await startDeviceFlow(ac.signal);
+    deps.renderer.write(
+      color2.bold(`  ${"\u2500".repeat(56)}
+`) + color2.bold("  Open this URL and enter the code:\n") + color2.cyan(`  ${device.verification_uri}
+`) + color2.bold("  Code: ") + color2.green(color2.bold(device.user_code)) + "\n" + color2.bold(`  ${"\u2500".repeat(56)}
+
+`)
+    );
+    openBrowser2(device.verification_uri);
+    deps.renderer.write(color2.dim("  Waiting for you to authorize in the browser...\n"));
+    const githubToken = await pollForGitHubToken(device, ac.signal);
+    deps.renderer.write(color2.dim("  Authorized. Fetching your Copilot token...\n"));
+    const copilot = await refreshCopilotToken(githubToken, ac.signal);
+    const models = await fetchCopilotModels(copilot.token, ac.signal);
+    const saved = await saveCopilotTokens(
+      deps,
+      providerId,
+      copilot.token,
+      githubToken,
+      copilot.expires,
+      models
+    );
+    if (!saved) return 1;
+    deps.renderer.write(color2.green("\n  \u2713 Signed in with GitHub Copilot!\n"));
+    const modelHint = models[0] ?? "gpt-4o";
+    deps.renderer.writeInfo(
+      `  Saved as provider ${color2.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
+  Use: ${color2.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` + color2.dim("  The Copilot token refreshes automatically.\n")
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
+    deps.renderer.writeError(`  Login failed: ${msg}`);
+    return 1;
+  } finally {
+    if (!external) process.off("SIGINT", onSig);
+  }
+}
+async function saveCopilotTokens(deps, providerId, copilotToken, githubToken, expires, models) {
+  const entry = {
+    label: "oauth-default",
+    apiKey: copilotToken,
+    createdAt: nowIso(),
+    authMethod: "oauth",
+    expiresAt: new Date(expires).toISOString(),
+    refreshToken: githubToken,
+    tokenType: "bearer"
+  };
+  try {
+    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
+      const existing = all[providerId];
+      const p = existing ? { ...existing } : { type: providerId };
+      p.family = "github-copilot";
+      if (!p.baseUrl) p.baseUrl = copilotBaseUrlFromToken(copilotToken);
+      if (models.length > 0) p.models = models;
+      else if (!p.models || p.models.length === 0) p.models = ["gpt-4o"];
+      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
+      keys.push(entry);
+      writeKeysBack(p, keys);
+      p.activeKey = entry.label;
+      all[providerId] = p;
+    }, deps.profileConfigPath);
+    return true;
+  } catch (err) {
+    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
+    return false;
+  }
+}
+
+// src/auth-menu/oauth-menu.ts
+function renderOAuthLoginOptions(deps, indent = "    ") {
+  deps.renderer.write(
+    `${indent}${color3.bold("OAuth login options")} ${color3.dim("(subscription sign-in)")}
+${indent}${color3.bold("chatgpt")}  ChatGPT Plus/Pro  ${color3.dim("(\u2192 openai-codex)")}
+${indent}${color3.bold("claude")}   Claude Pro/Max    ${color3.dim("(\u2192 anthropic-oauth)")}
+${indent}${color3.bold("copilot")}  GitHub Copilot    ${color3.dim("(\u2192 github-copilot)")}
+`
+  );
+}
+var OAUTH_ALIASES = {
+  chatgpt: ["chatgpt", "openai", "codex", "codex-cli", "openai-codex", "chatgpt-plus", "plus", "pro"],
+  claude: ["claude", "anthropic", "claude-pro", "claude-max", "anthropic-oauth", "max"],
+  copilot: ["copilot", "github", "gh", "github-copilot"]
+};
+var OAUTH_NUMERIC = { "1": "chatgpt", "2": "claude", "3": "copilot" };
+function resolveOAuthKind(choice, opts = {}) {
+  const pick = choice.trim().toLowerCase();
+  if (!pick) return void 0;
+  if (opts.allowNumeric !== false && OAUTH_NUMERIC[pick]) return OAUTH_NUMERIC[pick];
+  for (const [kind, aliases] of Object.entries(OAUTH_ALIASES)) {
+    if (aliases.includes(pick)) return kind;
+  }
+  return void 0;
+}
+async function runOAuthLoginChoice(deps, choice, opts = {}) {
+  const kind = resolveOAuthKind(choice, opts);
+  if (!kind) return false;
+  await runOAuthLoginKind(deps, kind);
+  return true;
+}
+async function runOAuthLoginKind(deps, kind) {
+  if (kind === "claude") return runClaudeOAuthLogin(deps);
+  if (kind === "copilot") return runCopilotOAuthLogin(deps);
+  return runCodexOAuthLogin(deps);
+}
+async function runOAuthLoginMenu(deps) {
+  deps.renderer.write(
+    `
+  ${color3.bold("Login with OAuth:")}
+` + color3.amber("  \u26A0 Subscription tokens used outside official clients may violate provider\n") + color3.amber("    Terms \u2014 your account could be rate-limited or banned. An API key is the\n") + color3.dim("    sanctioned path for programmatic use.\n") + `    ${color3.bold("1")}  ChatGPT Plus/Pro  ${color3.dim("(\u2192 openai-codex)")}
+    ${color3.bold("2")}  Claude Pro/Max    ${color3.dim("(\u2192 anthropic-oauth)")}
+    ${color3.bold("3")}  GitHub Copilot    ${color3.dim("(\u2192 github-copilot)")}
+`
+  );
+  const pick = await deps.reader.readLine(`  ${color3.amber("?")} Pick ${color3.dim("(or b to go back)")}: `);
+  await runOAuthLoginChoice(deps, pick);
+}
+
+// src/auth-menu/helpers.ts
+async function loadProviders(deps) {
+  return loadConfigProviders(deps.profileConfigPath, deps.vault, {
+    warn: (msg) => deps.renderer.writeWarning(msg),
+    profileConfigPath: deps.profileConfigPath
+  });
+}
+
+// src/auth-menu/shared.ts
+import { color as color4 } from "@wrongstack/core/utils";
+function renderProviderLine(renderer, id, cfg, idx) {
+  const keys = normalizeKeys(cfg);
+  const active = activeLabel(cfg, keys);
+  const firstKey = keys[0];
+  let summary;
+  if (keys.length === 0) {
+    summary = color4.dim("(no keys)");
+  } else if (keys.length === 1) {
+    summary = maskedKey(firstKey?.apiKey ?? "");
+  } else {
+    const activeKeyObj = active != null ? keys.find((k) => k.label === active) : void 0;
+    summary = `${color4.dim(`${keys.length} keys`)} ${color4.dim("active:")} ${color4.bold(active ?? "?")} ` + maskedKey(activeKeyObj?.apiKey ?? firstKey?.apiKey ?? "");
+  }
+  const fam = cfg.family ? color4.dim(`[${cfg.family}]`) : "";
+  const aliasHint = cfg.type && cfg.type !== id ? color4.dim(`\u2192 ${cfg.type}`) : "";
+  renderer.write(
+    `    ${color4.dim(`${idx}.`.padStart(4))} ${id.padEnd(22)} ${fam} ${aliasHint} ${summary}
+`
+  );
+}
+function renderProviderHeader(renderer, providerId, cfg) {
+  const keys = normalizeKeys(cfg);
+  const active = activeLabel(cfg, keys);
+  renderer.write(
+    `
+${color4.bold(providerId)} ${cfg.family ? color4.dim(`[${cfg.family}]`) : color4.amber("[no family]")}
+`
+  );
+  const details = [
+    color4.dim(`  type:    ${cfg.type ?? providerId}`),
+    color4.dim(`  family:  ${cfg.family ?? "(unset \u2192 resolved from models.dev when type matches)"}`),
+    color4.dim(`  baseUrl: ${cfg.baseUrl ?? "(unset \u2192 catalog default)"}`)
+  ];
+  if (cfg.envVars && cfg.envVars.length > 0) {
+    details.push(color4.dim(`  envVars: ${cfg.envVars.join(", ")}`));
+  }
+  if (cfg.models && cfg.models.length > 0) {
+    details.push(color4.dim(`  models:  ${cfg.models.join(", ")}`));
+  }
+  renderer.write(details.join("\n") + "\n");
+  if (keys.length === 0) {
+    renderer.write(color4.dim("  (no keys saved)\n"));
+  } else {
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i];
+      if (key) renderKeyLine(renderer, key, i + 1, active);
+    }
+  }
+}
+function renderKeyLine(renderer, key, idx, active) {
+  const marker = key.label === active ? color4.green("\u25CF") : color4.dim("\u25CB");
+  renderer.write(
+    `  ${color4.dim(`${idx}.`.padStart(4))} ${marker} ${key.label.padEnd(20)} ${maskedKey(key.apiKey)}  ${color4.dim(key.createdAt)}
+`
+  );
+}
+function renderActions(renderer, keysLength) {
+  renderer.write(`
+  ${color4.dim("Actions:")}
+`);
+  renderer.write(`    ${color4.bold("a")}        Add another key
+`);
+  if (keysLength > 0) {
+    renderer.write(`    ${color4.bold("u")} <n>    Update key <n>
+`);
+    renderer.write(`    ${color4.bold("d")} <n>    Delete key <n>
+`);
+    renderer.write(`    ${color4.bold("s")} <n>    Set key <n> as active
+`);
+  }
+  renderer.write(`    ${color4.bold("f")}        Edit family
+`);
+  renderer.write(`    ${color4.bold("B")}        Edit baseUrl ${color4.dim("(capital B \u2014 b is Back)")}
+`);
+  renderer.write(`    ${color4.bold("m")}        Edit visible model list
+`);
+  renderer.write(`    ${color4.bold("x")}        Remove this provider entirely
+`);
+  renderer.write(`    ${color4.bold("b")}        Back
+`);
+  renderer.write(`    ${color4.bold("q")}        Quit
+`);
+}
+function renderTopMenu(renderer, providers) {
+  renderer.write(`
+${color4.bold("WrongStack")} ${color4.dim("\u2014 API key manager")}
+
+`);
+  const ids = Object.keys(providers).sort();
+  if (ids.length === 0) {
+    renderer.write(color4.dim("  No providers configured yet.\n"));
+    renderer.write(
+      color4.dim(
+        "  Use (a) to add one from the models.dev catalog, (l) for a local server, or (c) for a custom provider.\n"
+      )
+    );
+  } else {
+    renderer.write(`  ${color4.dim("Saved providers:")}
+`);
+    let idx = 1;
+    for (const id of ids) {
+      const cfg = providers[id];
+      if (!cfg) continue;
+      renderProviderLine(renderer, id, cfg, idx);
+      idx++;
+    }
+  }
+  renderer.write(`
+  ${color4.dim("Actions:")}
+`);
+  renderer.write(`    ${color4.bold("a")}  Add a provider (from catalog)
+`);
+  renderer.write(
+    `    ${color4.bold("l")}  Add a local server ${color4.dim("(OmniRoute / Ollama / vLLM / LM Studio)")}
+`
+  );
+  renderer.write(`    ${color4.bold("c")}  Add a custom provider
+`);
+  renderer.write(
+    `    ${color4.bold("s")}  Login with OAuth ${color4.dim("(ChatGPT / Claude / Copilot)")}
+`
+  );
+  if (ids.length > 0) {
+    renderer.write(
+      `    ${color4.dim("1-")}${color4.dim(String(ids.length))}  ${color4.bold("Manage a provider")}
+`
+    );
+  }
+  renderer.write(`    ${color4.bold("q")}  Quit
+`);
+}
+async function readKeyInput(deps, intent) {
+  const key = (await deps.reader.readSecret(
+    `  ${color4.amber("?")} ${intent} ${color4.dim("(hidden, paste OK)")}: `
+  )).trim();
+  if (!key) {
+    deps.renderer.writeError("No key entered.");
+    return void 0;
+  }
+  return key;
+}
+async function confirm(deps, question) {
+  const answer = (await deps.reader.readLine(`  ${color4.amber("?")} ${question} ${color4.dim("[y/N/q]")} `)).trim().toLowerCase();
+  if (answer === "q" || answer === "quit") return null;
+  return answer === "y" || answer === "yes";
+}
+function suggestLabel(usedLabels) {
+  const candidate = "default";
+  if (!usedLabels.has(candidate)) return candidate;
+  let n = 2;
+  while (usedLabels.has(`key${n}`)) n++;
+  return `key${n}`;
+}
+function validateFamily(raw) {
+  const valid = ["anthropic", "openai", "openai-compatible", "google"];
+  return valid.includes(raw) ? raw : null;
+}
+
+// src/auth-menu/add-provider.ts
+import { atomicWrite, color as color5 } from "@wrongstack/core/utils";
+import * as fs from "node:fs/promises";
+
+// src/provider-id.ts
+function nextCustomProviderId(existing) {
+  const taken = new Set(existing);
+  let n = 1;
+  while (taken.has(`custom-${n}`)) n++;
+  return `custom-${n}`;
+}
+
+// src/auth-menu/add-provider.ts
+async function addFromCatalog(deps) {
+  let catalog = [];
+  try {
+    catalog = (await deps.modelsRegistry.listProviders()).filter((p) => p.family !== "unsupported");
+  } catch {
+    deps.renderer.writeWarning("Catalog unavailable \u2014 falling back to manual entry.\n");
+  }
+  if (catalog.length === 0) {
+    return addManualEntry(deps);
+  }
+  const saved = new Set(Object.keys(await loadProviders(deps)));
+  deps.renderer.write(
+    color5.dim(
+      `  Catalog: ${catalog.length} providers. Type to filter, \u2191/\u2193 navigate, Enter to select.
+`
+    )
+  );
+  deps.renderer.write(`  ${color5.dim("\u25C9 already saved   \u25CB no key yet")}
+
+`);
+  renderOAuthLoginOptions(deps);
+  deps.renderer.write("\n");
+  const chosen = await runLiveProviderPicker(catalog, saved);
+  if (!chosen) {
+    deps.renderer.write(
+      `
+  ${color5.dim("OAuth login options:")} ${color5.dim("chatgpt")}, ${color5.dim("claude")}, or ${color5.dim("copilot")}?
+`
+    );
+    const answer = (await deps.reader.readLine(
+      `  ${color5.amber("?")} OAuth or q to quit ${color5.dim("[chatgpt/claude/copilot]")}: `
+    )).trim();
+    if (answer && await runOAuthLoginChoice(deps, answer, { allowNumeric: false })) {
+      return true;
+    }
+    return false;
+  }
+  return addKeyForCatalogProvider(deps, chosen);
+}
+async function addKeyForCatalogProvider(deps, chosen) {
+  deps.renderer.write(
+    color5.dim(`
+  Defaults from models.dev \u2014 press Enter to keep, or type overrides.
+`)
+  );
+  const famRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Family ${color5.dim(`[${chosen.family}]`)} ${color5.dim("(q to quit)")}: `
+  )).trim();
+  if (famRaw === "q") return false;
+  let family = chosen.family;
+  if (famRaw) {
+    const validated = validateFamily(famRaw);
+    if (!validated) {
+      deps.renderer.writeError(
+        `Invalid family: "${famRaw}" (must be: anthropic, openai, openai-compatible, google).`
+      );
+      return false;
+    }
+    family = validated;
+  }
+  const baseRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Base URL ${color5.dim(`[${chosen.apiBase ?? "unset"}]`)} ${color5.dim("(q to quit)")}: `
+  )).trim();
+  if (baseRaw === "q") return false;
+  const baseUrl = baseRaw || chosen.apiBase;
+  const providersNow = await loadProviders(deps);
+  let suggestedAlias = chosen.id;
+  if (family !== chosen.family) {
+    let candidate = `${chosen.id}-${family}`;
+    let n = 2;
+    while (providersNow[candidate]) {
+      candidate = `${chosen.id}-${family}-${n}`;
+      n++;
+    }
+    suggestedAlias = candidate;
+  }
+  const aliasRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Save as alias ${color5.dim(`[${suggestedAlias}]`)} ${color5.dim("(used with --provider <alias>)")}: `
+  )).trim();
+  const alias = aliasRaw || suggestedAlias;
+  const existing = providersNow[alias];
+  if (existing) {
+    const sameFamily = (existing.family ?? chosen.family) === family;
+    const sameBase = (existing.baseUrl ?? chosen.apiBase) === baseUrl;
+    if (!sameFamily || !sameBase) {
+      deps.renderer.writeError(
+        `Alias "${alias}" already exists with different family/baseUrl.
+  Existing: family=${existing.family ?? "(unset)"}, baseUrl=${existing.baseUrl ?? "(unset)"}
+  New:      family=${family}, baseUrl=${baseUrl ?? "(unset)"}
+  Pick a different alias to keep them separate.`
+      );
+      return false;
+    }
+  }
+  return addKeyForProvider(alias, deps, {
+    type: chosen.id,
+    family,
+    baseUrl,
+    envVars: chosen.envVars
+  });
+}
+async function addCustomProvider(deps) {
+  deps.renderer.write(
+    `
+${color5.bold("Custom provider")} ${color5.dim("\u2014 for local models or proxies not in the catalog.")}
+`
+  );
+  const providersNow = await loadProviders(deps);
+  const idRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Provider id ${color5.dim('(e.g. "local-llama", "my-proxy"; blank = auto custom-N, q to quit)')}: `
+  )).trim();
+  if (idRaw === "q") return false;
+  let type = idRaw;
+  if (!type) {
+    type = nextCustomProviderId(Object.keys(providersNow));
+    deps.renderer.write(`  ${color5.dim("Using generated id:")} ${color5.bold(type)}
+`);
+  } else if (providersNow[type]) {
+    deps.renderer.writeWarning(`"${type}" already exists. Pick it from the main menu to edit.`);
+    return false;
+  }
+  const familyRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Wire family ${color5.dim("(anthropic | openai | openai-compatible | google)")} ${color5.dim("(q to quit)")}: `
+  )).trim();
+  if (familyRaw === "q") return false;
+  const family = validateFamily(familyRaw);
+  if (!family) {
+    deps.renderer.writeError(`Invalid family: "${familyRaw}"`);
+    return false;
+  }
+  const baseUrl = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Base URL ${color5.dim("(e.g. http://localhost:11434/v1, optional)")}: `
+  )).trim();
+  const modelsRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Model ids ${color5.dim("(comma-separated, optional)")}: `
+  )).trim();
+  const models = modelsRaw ? modelsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  const envVarsRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Env var names ${color5.dim("(comma-separated, optional)")}: `
+  )).trim();
+  const envVars = envVarsRaw ? envVarsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  return addKeyForProvider(type, deps, {
+    type,
+    family,
+    ...baseUrl ? { baseUrl } : {},
+    ...models ? { models } : {},
+    ...envVars ? { envVars } : {}
+  });
+}
+async function addManualEntry(deps) {
+  const pid = (await deps.reader.readLine(`  ${color5.amber("?")} Provider id ${color5.dim("[q to quit]")}: `)).trim();
+  if (!pid || pid === "q") return false;
+  const famRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Family ${color5.dim("(anthropic/openai/openai-compatible/google)")}: `
+  )).trim();
+  const family = validateFamily(famRaw);
+  if (!family) {
+    deps.renderer.writeError(`Invalid family: "${famRaw}"`);
+    return false;
+  }
+  const baseUrl = (await deps.reader.readLine(`  ${color5.amber("?")} Base URL ${color5.dim("(optional)")}: `)).trim();
+  return addKeyForProvider(pid, deps, {
+    type: pid,
+    family,
+    ...baseUrl ? { baseUrl } : {}
+  });
+}
+async function addKeyForProvider(providerId, deps, template) {
+  const providers = await loadProviders(deps);
+  const existing = providers[providerId];
+  const existingKeys = existing ? normalizeKeys(existing) : [];
+  const usedLabels = new Set(existingKeys.map((k) => k.label));
+  const label = await promptForLabel(deps, usedLabels);
+  if (!label) return false;
+  const apiKey = await readKeyInput(deps, `API key for ${providerId}/${label}`);
+  if (!apiKey) return false;
+  await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
+    const existingProv = all[providerId] ?? {
+      type: providerId,
+      ...template
+    };
+    if (!existingProv.type) existingProv.type = providerId;
+    if (!existingProv.family && template.family) {
+      existingProv.family = template.family;
+    }
+    if (!existingProv.baseUrl && template.baseUrl) {
+      existingProv.baseUrl = template.baseUrl;
+    }
+    if (!existingProv.envVars && template.envVars) {
+      existingProv.envVars = template.envVars;
+    }
+    const list = normalizeKeys(existingProv);
+    list.push({ label, apiKey, createdAt: nowIso() });
+    writeKeysBack(existingProv, list);
+    if (!existingProv.activeKey) existingProv.activeKey = label;
+    all[providerId] = existingProv;
+  }, deps.profileConfigPath);
+  deps.renderer.write(
+    `  ${color5.green("\u2713")} Saved ${color5.bold(providerId)}/${color5.bold(label)}.
+`
+  );
+  deps.renderer.write(color5.dim(`  Launch: wstack --provider ${providerId} "<task>"
+`));
+  try {
+    await adoptAsDefaultIfUnset(deps, providerId, template);
+  } catch {
+  }
+  return true;
+}
+async function resolveDefaultModelId(deps, providerId, template) {
+  if (template.models && template.models.length > 0) return template.models[0];
+  const catalogId = template.type && template.type !== providerId ? template.type : providerId;
+  const provider = await deps.modelsRegistry.getProvider(catalogId).catch(() => void 0);
+  return provider?.models?.[0]?.id;
+}
+async function adoptAsDefaultIfUnset(deps, providerId, template) {
+  const targetPath = deps.profileConfigPath;
+  let cfg = {};
+  try {
+    cfg = JSON.parse(await fs.readFile(targetPath, "utf8"));
+  } catch {
+  }
+  if (cfg["provider"] && cfg["model"]) return;
+  const modelId = await resolveDefaultModelId(deps, providerId, template);
+  if (!modelId) return;
+  cfg["provider"] = providerId;
+  cfg["model"] = modelId;
+  await atomicWrite(targetPath, JSON.stringify(cfg, null, 2), { mode: 384 });
+  deps.renderer.write(
+    `  ${color5.green("\u2713")} Set ${color5.bold(providerId)}/${color5.bold(modelId)} as the default.
+`
+  );
+}
+async function promptForLabel(deps, usedLabels) {
+  const defaultLabel = suggestLabel(usedLabels);
+  const labelRaw = (await deps.reader.readLine(
+    `  ${color5.amber("?")} Label for this key ${color5.dim(`[${defaultLabel}]`)}: `
+  )).trim();
+  const label = labelRaw || defaultLabel;
+  if (usedLabels.has(label)) {
+    deps.renderer.writeError(`Label "${label}" is already used. Use update (u) instead.`);
+    return null;
+  }
+  return label;
+}
+
+// src/auth-menu/local.ts
+import { color as color6 } from "@wrongstack/core/utils";
+import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
+import { probeLocalLlm } from "@wrongstack/runtime/probe";
+
+// src/auth-menu/auth-menu-audit.ts
+import { DefaultSecretScrubber } from "@wrongstack/core/security";
+var NOOP_AUDIT_LOGGER = {
+  emit: () => {
+  }
+};
+function decideAuthLocalEvents(opts) {
+  const events = [];
+  if (opts.probeSkip) {
+    events.push({
+      type: "auth.local.probe_skip",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      requestedShape: opts.probeSkip.shape
+    });
+  }
+  if (opts.probeFailedSave) {
+    events.push({
+      type: "auth.local.probe_failed_save",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      probeStatus: opts.probeFailedSave.status,
+      ...opts.probeFailedSave.detail !== void 0 ? { probeDetail: opts.probeFailedSave.detail } : {}
+    });
+  }
+  if (opts.newModels === null) return events;
+  const hadPriorAllowlist = opts.previousModels !== void 0 && opts.previousModels.length > 0;
+  if (hadPriorAllowlist && opts.newModels.length === 0) {
+    events.push({
+      type: "auth.local.clear",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      previousModels: opts.previousModels
+    });
+    return events;
+  }
+  if (!hadPriorAllowlist && opts.newModels.length > 0) {
+    if (opts.previousModels !== void 0) {
+      events.push({
+        type: "auth.local.undo",
+        providerId: opts.providerId,
+        baseUrl: opts.baseUrl,
+        restoredModels: [...opts.newModels]
+      });
+    } else {
+      events.push({
+        type: "auth.local.add",
+        providerId: opts.providerId,
+        baseUrl: opts.baseUrl,
+        models: [...opts.newModels],
+        ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
+      });
+    }
+    return events;
+  }
+  if (hadPriorAllowlist && opts.newModels.length > 0) {
+    events.push({
+      type: "auth.local.add",
+      providerId: opts.providerId,
+      baseUrl: opts.baseUrl,
+      models: [...opts.newModels],
+      ...opts.keyLabel !== void 0 ? { keyLabel: opts.keyLabel } : {}
+    });
+    return events;
+  }
+  return events;
+}
+
+// src/auth-menu/local.ts
+var PRESET_BY_ID = new Map(LOCAL_LLM_PRESETS.map((p) => [p.id, p]));
+async function runAuthLocal(deps, opts = {}) {
+  const scrubber = deps.secretScrubber ?? new DefaultSecretScrubber2();
+  const audit = opts.audit ?? NOOP_AUDIT_LOGGER;
+  const preset = opts.name ? PRESET_BY_ID.get(opts.name.toLowerCase()) : void 0;
+  if (opts.name && !preset) {
+    deps.renderer.writeError(
+      `Unknown local server "${opts.name}". Valid: ${LOCAL_LLM_PRESETS.map((p) => p.id).join(", ")}.`
+    );
+    return 1;
+  }
+  const chosen = preset ?? await pickLocalPreset(deps);
+  if (!chosen) {
+    return 0;
+  }
+  const baseUrl = opts.baseUrl?.trim() || chosen.defaultBaseUrl;
+  let apiKey;
+  if (opts.apiKey !== void 0) {
+    apiKey = opts.apiKey.trim() || void 0;
+  } else if (chosen.noAuth) {
+    apiKey = void 0;
+  } else if (opts.skipKey) {
+    apiKey = void 0;
+  } else {
+    apiKey = await promptOptionalKey(deps, chosen);
+  }
+  let probe;
+  let probeFailedAndSaved = false;
+  if (!opts.noProbe) {
+    probe = await probeLocalLlm({
+      baseUrl,
+      apiKey,
+      noAuth: chosen.noAuth,
+      presetLabel: chosen.label,
+      scrubber,
+      fetchImpl: opts.fetchImpl,
+      timeoutMs: opts.probeTimeoutMs
+    });
+    renderProbeResult(deps, probe);
+    if (opts.probeOnly) {
+      return 0;
+    }
+    if (!probe.ok) {
+      if (chosen.noAuth) {
+        deps.renderer.write(
+          color6.dim(
+            `  Saving ${chosen.label} anyway \u2014 keyless local gateway needs no key and discovers models when it comes up.
+`
+          )
+        );
+        probeFailedAndSaved = true;
+      } else {
+        const saveAnyway = await promptSaveAnyway(deps);
+        if (!saveAnyway) {
+          deps.renderer.write(color6.dim("  Cancelled. Nothing saved.\n"));
+          return 0;
+        }
+        probeFailedAndSaved = true;
+      }
+    }
+  }
+  const resolvedModels = resolveModelList(opts.models, probe, scrubber);
+  const label = opts.label?.trim() || "default";
+  const providers = await loadProviders(deps);
+  const existing = providers[chosen.id];
+  const previousModels = existing?.models ? [...existing.models] : existing?.models === void 0 ? void 0 : [...existing.models];
+  const usedLabels = new Set(existing ? normalizeKeys(existing).map((k) => k.label) : []);
+  let finalLabel = label;
+  if (usedLabels.has(finalLabel)) {
+    let n = 2;
+    while (usedLabels.has(`${label}-${n}`)) n++;
+    finalLabel = `${label}-${n}`;
+    deps.renderer.writeInfo(`Label collided; saving as "${finalLabel}".`);
+  }
+  try {
+    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
+      const p = all[chosen.id] ?? { type: chosen.id };
+      if (!p.type) p.type = chosen.id;
+      if (!p.family) p.family = "openai-compatible";
+      if (!p.baseUrl) p.baseUrl = baseUrl;
+      if (!p.envVars) p.envVars = [];
+      if (resolvedModels !== null) {
+        p.models = [...resolvedModels];
+      }
+      if (apiKey) {
+        const list = normalizeKeys(p);
+        list.push({ label: finalLabel, apiKey, createdAt: nowIso() });
+        writeKeysBack(p, list);
+        if (!p.activeKey) p.activeKey = finalLabel;
+      }
+      all[chosen.id] = p;
+    }, deps.profileConfigPath);
+  } catch (err) {
+    deps.renderer.writeError(`Failed to save ${chosen.id}: ${err.message}`);
+    return 1;
+  }
+  const events = decideAuthLocalEvents({
+    providerId: chosen.id,
+    baseUrl,
+    previousModels,
+    newModels: resolvedModels,
+    keyLabel: apiKey ? finalLabel : void 0,
+    probeFailedSave: probeFailedAndSaved && probe ? {
+      status: probe.status,
+      ...probe.detail !== void 0 ? { detail: probe.detail } : {}
+    } : void 0
+  });
+  for (const event of events) {
+    audit.emit(event);
+  }
+  if (apiKey) {
+    deps.renderer.write(
+      `  ${color6.green("\u2713")} Saved ${color6.bold(chosen.id)}/${color6.bold(finalLabel)} \u2192 ${color6.cyan(baseUrl)}
+`
+    );
+  } else {
+    deps.renderer.write(
+      `  ${color6.green("\u2713")} Saved ${color6.bold(chosen.id)} (no key) \u2192 ${color6.cyan(baseUrl)}
+`
+    );
+  }
+  const firstModel = resolvedModels && resolvedModels.length > 0 ? resolvedModels[0] : null;
+  const modelHint = firstModel ? color6.cyan(firstModel) : color6.dim("<model-id>");
+  deps.renderer.write(
+    color6.dim(
+      `  Launch: wstack --provider ${chosen.id} --model ${modelHint} "<task>"
+`
+    )
+  );
+  return 0;
+}
+function resolveModelList(models, probe, scrubber) {
+  if (models === void 0) return null;
+  const trimmed = models.trim();
+  if (trimmed.length === 0) return [];
+  const hasProbeIds = probe?.status === "ok" && (probe.modelIds?.length ?? 0) > 0;
+  const probeIds = hasProbeIds ? probe?.modelIds ?? [] : [];
+  if (trimmed === "first") {
+    if (probeIds.length === 0) return null;
+    return [scrubber.scrub(probeIds[0])];
+  }
+  if (/^\d+$/.test(trimmed)) {
+    if (probeIds.length === 0) return null;
+    const n = Math.min(Number.parseInt(trimmed, 10), probeIds.length);
+    return probeIds.slice(0, n).map((id) => scrubber.scrub(id));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of trimmed.split(",")) {
+    const id = scrubber.scrub(raw.trim());
+    if (id.length === 0) continue;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+  }
+  return out;
+}
+function renderProbeResult(deps, probe, opts = {}) {
+  const label = opts.presetLabel ? ` ${color6.bold(opts.presetLabel)}` : "";
+  const elapsed = probe.elapsedMs !== void 0 ? ` ${color6.dim(`(${probe.elapsedMs}ms)`)}` : "";
+  switch (probe.status) {
+    case "ok": {
+      const models = probe.modelCount !== void 0 ? color6.dim(`, ${probe.modelCount} model${probe.modelCount === 1 ? "" : "s"}`) : "";
+      deps.renderer.write(
+        `  ${color6.green("\u25CF")} ${label} health probe ok${models}${elapsed}
+`
+      );
+      break;
+    }
+    case "timeout": {
+      deps.renderer.write(
+        `  ${color6.red("\u25CF")} ${label} health probe timed out${elapsed}
+    ${color6.dim("The server did not respond within the timeout.")}
+    ${color6.dim("Is the local server running? Check the port and try again.")}
+`
+      );
+      break;
+    }
+    case "unreachable": {
+      const detail = probe.detail ? ` ${color6.dim(`(${probe.detail})`)}` : "";
+      deps.renderer.write(
+        `  ${color6.red("\u25CF")} ${label} server unreachable${detail}
+    ${color6.dim("Could not connect. Common causes:")}
+    ${color6.dim("  - The local server is not running")}
+    ${color6.dim("  - The port is blocked by a firewall")}
+    ${color6.dim("  - The base URL is wrong")}
+`
+      );
+      break;
+    }
+    case "http_error": {
+      const status = probe.httpStatus !== void 0 ? ` HTTP ${probe.httpStatus}` : "";
+      const detail = probe.detail ? ` ${color6.dim(`\u2014 ${probe.detail}`)}` : "";
+      deps.renderer.write(
+        `  ${color6.yellow("\u25CF")} ${label} health probe got${status}${detail}
+`
+      );
+      break;
+    }
+    case "invalid_response": {
+      deps.renderer.write(
+        `  ${color6.yellow("\u25CF")} ${label} health probe returned an unexpected shape
+` + (probe.detail ? `    ${color6.dim(probe.detail)}
+` : "")
+      );
+      break;
+    }
+    case "skipped": {
+      break;
+    }
+  }
+}
+async function promptSaveAnyway(deps) {
+  const answer = (await deps.reader.readLine(
+    `
+${color6.amber("?")} ${color6.bold("Save anyway?")} ${color6.dim("[y/N]")}: `
+  )).trim().toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+async function pickLocalPreset(deps) {
+  deps.renderer.write(
+    `
+${color6.bold("Local LLM servers")} ${color6.dim("\u2014 pick one to pre-fill the base URL")}
+
+`
+  );
+  let idx = 1;
+  for (const entry of LOCAL_LLM_PRESETS) {
+    const auth = entry.noAuth ? color6.dim("(no auth)") : color6.dim("(optional auth)");
+    deps.renderer.write(
+      `    ${color6.dim(`${idx}.`.padStart(4))} ${color6.bold(entry.label.padEnd(12))} ${color6.cyan(entry.defaultBaseUrl.padEnd(34))} ${auth}
+`
+    );
+    deps.renderer.write(
+      `        ${color6.dim(entry.hint)}
+`
+    );
+    idx++;
+  }
+  const answer = (await deps.reader.readLine(
+    `
+${color6.amber("?")} Pick ${color6.dim(`(1-${LOCAL_LLM_PRESETS.length}, q to quit)`)}: `
+  )).trim().toLowerCase();
+  if (!answer || answer === "q" || answer === "quit") return void 0;
+  const num = Number.parseInt(answer, 10);
+  if (!Number.isNaN(num) && num >= 1 && num <= LOCAL_LLM_PRESETS.length) {
+    return LOCAL_LLM_PRESETS[num - 1];
+  }
+  const byId = LOCAL_LLM_PRESETS.find((p) => p.id === answer);
+  if (byId) return byId;
+  deps.renderer.writeError(`Unknown selection: "${answer}"`);
+  return void 0;
+}
+async function promptOptionalKey(deps, preset) {
+  const answer = (await deps.reader.readSecret(
+    `  ${color6.amber("?")} ${color6.bold(preset.label)} API key ${color6.dim("(hidden \u2014 Enter to skip if auth is disabled on the server)")}: `
+  )).trim();
+  if (!answer) return void 0;
+  return answer;
+}
+
+export {
+  loadProviders,
+  renderProviderHeader,
+  renderActions,
+  renderTopMenu,
+  readKeyInput,
+  confirm,
+  validateFamily,
+  runClaudeOAuthLogin,
+  runCopilotOAuthLogin,
+  resolveOAuthKind,
+  runOAuthLoginKind,
+  runOAuthLoginMenu,
+  nextCustomProviderId,
+  addFromCatalog,
+  addKeyForCatalogProvider,
+  addCustomProvider,
+  addKeyForProvider,
+  runAuthLocal
+};
+//# sourceMappingURL=chunk-JBTFWWKV.js.map