@zenera/cli 1.1.27 → 1.1.29

package/dist/keys.js

@@ -1,4 +1,4 @@
-import { EXA_API_KEY_ENV } from '@zenera/neo';
+import { EXA_API_KEY_ENV, GATEWAY_KEY_ENV, GATEWAY_URL_ENV } from '@zenera/neo';
 import { chmodSync, copyFileSync, existsSync, readFileSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { isAbsolute, join, resolve } from 'node:path';
@@ -31,8 +31,15 @@ export const PROVIDERS = ['openai', 'anthropic', 'google', 'vertex', 'openrouter
  * few places that must tell them apart are made to say which they mean.
  */
 export const SERVICES = ['exa'];
+/**
+ * Somewhere every model can be reached through, with one key. Its own list for
+ * the same reason as `SERVICES`: it is neither a vendor a model comes from nor
+ * a tool, and a gateway entry only counts while the keyring is in its mode.
+ */
+export const GATEWAYS = ['bifrost'];
+export const MODES = ['direct', ...GATEWAYS];
 /** Anything the keyring can hold a credential for. */
-export const OWNERS = [...PROVIDERS, ...SERVICES];
+export const OWNERS = [...PROVIDERS, ...SERVICES, ...GATEWAYS];
 /**
  * Vertex is the odd one, and it is odd twice.
  *
@@ -115,6 +122,17 @@ export const SHAPES = {
             },
         ],
     },
+    bifrost: {
+        kind: 'gateway',
+        label: 'Bifrost',
+        forms: [
+            {
+                holds: 'secret',
+                env: GATEWAY_KEY_ENV,
+                where: 'a virtual key (sk-bf-…) from your Bifrost administrator',
+            },
+        ],
+    },
 };
 /**
  * The form a provider is usually reached by — for the questions that have to
@@ -144,6 +162,9 @@ export function isProvider(name) {
 export function isOwner(name) {
     return OWNERS.includes(name);
 }
+export function isGateway(name) {
+    return GATEWAYS.includes(name);
+}
 export function assertOwner(name) {
     if (!isOwner(name)) {
         throw usageError(`unknown provider "${name}"`, `known providers: ${OWNERS.join(', ')}`);
@@ -256,7 +277,13 @@ export class KeyStore {
         const path = paths.keys();
         assertPrivate(path);
         const file = await readJson(path, EMPTY);
-        return new KeyStore({ ...EMPTY, ...file });
+        // Fresh containers: a missing file hands back EMPTY itself, which `add` would mutate.
+        return new KeyStore({
+            ...EMPTY,
+            ...file,
+            entries: [...(file.entries ?? [])],
+            active: { ...file.active },
+        });
     }
     get entries() {
         return this.#file.entries;
@@ -311,6 +338,7 @@ export class KeyStore {
             // be a way to build the combination the service refuses.
             ...(form.holds === 'file' && meta.project ? { project: meta.project } : {}),
             ...(form.holds === 'file' && meta.location ? { location: meta.location } : {}),
+            ...(isGateway(provider) && meta.url ? { url: meta.url } : {}),
             addedAt: new Date().toISOString(),
         };
         const at = this.#file.entries.findIndex((e) => e.provider === provider && e.name === name);
@@ -352,6 +380,21 @@ export class KeyStore {
             hit.check = check;
         }
     }
+    get mode() {
+        return this.#file.mode ?? 'direct';
+    }
+    /** Refuses a gateway mode with no gateway to send anything to. */
+    setMode(mode) {
+        if (mode !== 'direct' && !this.active(mode)?.url) {
+            throw usageError(`no ${SHAPES[mode].label} key to switch to`, `add one first: zen key add ${mode} --url <gateway url>`);
+        }
+        if (mode === 'direct') {
+            delete this.#file.mode;
+        }
+        else {
+            this.#file.mode = mode;
+        }
+    }
     save() {
         ensureDir(paths.home());
         writeJson(paths.keys(), this.#file);
@@ -398,14 +441,28 @@ export class KeyStore {
      *
      * Services are included by default, because a tool reads its key from the
      * environment for exactly the same reason a model adapter does.
+     *
+     * In a gateway mode the gateway's key replaces every vendor's, so those are
+     * withheld: nothing would read them, and the sandbox would be handed keys
+     * the run never needed. In `direct` mode it is the gateway that is withheld,
+     * since its url alone is what switches the library over.
      */
     environment(only) {
         const env = {};
+        const mode = this.mode;
         for (const provider of only ?? OWNERS) {
+            const kind = SHAPES[provider].kind;
+            if (kind === 'gateway' ? provider !== mode : kind === 'model' && mode !== 'direct') {
+                continue;
+            }
             const entry = this.active(provider);
             if (!entry) {
                 continue;
             }
+            // The mode is the switch, so the url goes out even when the shell supplies the key.
+            if (entry.url && !process.env[GATEWAY_URL_ENV]) {
+                env[GATEWAY_URL_ENV] = entry.url;
+            }
             // Either variable being set means this provider is already answered
             // for, so the stored alternative must not be exported alongside it.
             if (envNames(provider).some((name) => process.env[name])) {
@@ -542,6 +599,9 @@ export function credentials() {
  * one clear error here for an obscure one on the first turn.
  */
 export function assertUsable(store) {
+    if (process.env[GATEWAY_URL_ENV]) {
+        return;
+    }
     const reachable = PROVIDERS.filter((p) => envNames(p).some((name) => process.env[name]) || store.active(p) !== undefined);
     if (reachable.length === 0) {
         throw credentialError('no credentials for any provider', 'add one with: zen key add openai');

package/dist/liveness.js

@@ -1,4 +1,4 @@
-import { createModel, EXA_BASE_URL, isUnfunded, ModelRegistry, text, vertexRoute, } from '@zenera/neo';
+import { createModel, EXA_BASE_URL, GATEWAY_KEY_HEADER, isUnfunded, ModelRegistry, text, vertexRoute, } from '@zenera/neo';
 import { envOf, SHAPES, } from "./keys.js";
 // ---------------------------------------------------------------------------
 // Liveness
@@ -201,6 +201,9 @@ export async function probe(store, entry) {
     if (shape.kind === 'service') {
         return probeService(entry.provider, store.reveal(entry));
     }
+    if (shape.kind === 'gateway') {
+        return probeGateway(entry.url, store.reveal(entry));
+    }
     const provider = entry.provider;
     const credential = store.reveal(entry);
     // What the entry holds, not what its provider usually holds: a Vertex
@@ -302,6 +305,57 @@ async function probeService(service, key) {
         return classify(err);
     }
 }
+/**
+ * Bifrost's model listing is scoped to the virtual key that asks, so it is the
+ * cheap call that looks at the key. Its refusals carry their reason as a
+ * top-level `type` beside `error.message`, and two of them are about the
+ * key's allowance rather than the key.
+ */
+async function probeGateway(url, key) {
+    const at = new Date().toISOString();
+    if (!url) {
+        return { state: 'unknown', at, detail: 'no gateway url stored with this key' };
+    }
+    try {
+        const res = await fetch(`${url.replace(/\/+$/, '')}/v1/models`, {
+            headers: { authorization: `Bearer ${key}`, [GATEWAY_KEY_HEADER]: key },
+            signal: AbortSignal.timeout(DEADLINE_MS),
+        });
+        if (res.ok) {
+            return { state: 'live', at };
+        }
+        const { type, message } = await refusal(res);
+        const detail = `${res.status} ${message}`;
+        if (res.status === 402 || type === 'budget_exceeded') {
+            return {
+                state: 'blocked',
+                at,
+                detail,
+                fix: "raise the virtual key's budget in Bifrost",
+            };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { state: 'dead', at, detail };
+        }
+        if (res.status === 404 || /<html/i.test(message)) {
+            return { state: 'unknown', at, detail, fix: 'check the url: is it the gateway root?' };
+        }
+        return { state: 'unknown', at, detail };
+    }
+    catch (err) {
+        return classify(err);
+    }
+}
+async function refusal(res) {
+    const raw = await res.text().catch(() => '');
+    try {
+        const body = JSON.parse(raw);
+        return { type: body.type, message: firstLine(body.error?.message ?? res.statusText) };
+    }
+    catch {
+        return { message: firstLine(raw || res.statusText) };
+    }
+}
 /** The vendor's own sentence about a refusal, when the body carries one. */
 async function said(res) {
     try {
@@ -389,6 +443,11 @@ const UNSERVED = [
     'no access',
 ];
 const targetId = (target) => target.kind === 'model' ? target.model.id : target.embedder.id;
+const PROBE_TOOL = {
+    name: 'noop',
+    description: 'Does nothing. Do not call it.',
+    parameters: { type: 'object', properties: {} },
+};
 /**
  * A chat model sized for a probe: 16 output tokens is enough for "ok", and
  * Anthropic requires a cap at all. Only the adapters that read `maxTokens` are
@@ -415,6 +474,10 @@ function classifyModel(err, target, ms) {
     if (err instanceof Deadline || e?.name === 'AbortError' || e?.name === 'TimeoutError') {
         return { state: 'unknown', at, detail: `no answer in ${MODEL_DEADLINE_MS / 1000}s` };
     }
+    // OpenAI refuses tools alongside reasoning on chat completions, and says so.
+    if (target.kind === 'model' && haystack.includes('/v1/responses')) {
+        return { state: 'blocked', at, detail: firstLine(message), fix: responsesApi(target) };
+    }
     if (UNSERVED.some((needle) => haystack.includes(needle))) {
         return { state: 'blocked', at, detail: firstLine(message), fix: instead(target) };
     }
@@ -438,6 +501,10 @@ function limited(target) {
     }
     return `${blame} — retry later`;
 }
+function responsesApi(target) {
+    const provider = target.ref.includes(':') ? target.ref.split(':')[0].split('/')[0] : 'openai';
+    return `use the responses API: \`api: responses\` on the model, or the ref ${provider}/responses:${targetId(target)}`;
+}
 /** The command that finds something this account can actually use. */
 function instead(target) {
     const provider = target.ref.includes(':') ? target.ref.split(':')[0] : undefined;
@@ -446,7 +513,7 @@ function instead(target) {
     }
     return provider
         ? `zen models ls ${provider}`
-        : `zen models pick --${target.kind === 'embedding' ? 'embedding' : 'chat'}`;
+        : `zen models ls --${target.kind === 'embedding' ? 'embeddings' : 'chat'}`;
 }
 /**
  * The smallest real call the model can be asked for. It costs a handful of
@@ -456,6 +523,9 @@ function instead(target) {
  * An embedding answers with its width, which is worth carrying back: a model
  * that serves the wrong number of dimensions is not interchangeable with the
  * one an index was built on.
+ *
+ * A chat model is offered one tool, because every agent run offers tools and
+ * some refusals (reasoning plus tools on chat completions) only happen then.
  */
 async function askModel(target, signal) {
     if (target.kind === 'embedding') {
@@ -465,7 +535,7 @@ async function askModel(target, signal) {
     await target.model.generate({
         system: 'Reply with the single word: ok',
         messages: [{ role: 'user', content: [text('ping')] }],
-        tools: [],
+        tools: [PROBE_TOOL],
         signal,
     });
     return undefined;

package/dist/main.js

@@ -32,7 +32,29 @@ const GLOBAL = {
     // not what it does.
     directory: { type: 'string', short: 'C' },
 };
+/**
+ * The shell's half of tab completion calls this, hidden from help. It answers
+ * before anything else, because a banner or a window title on a Tab press would
+ * be printed into the line being edited — and it never fails loudly for the
+ * same reason: no answer is a valid answer, and the shell completes files.
+ */
+async function completing(words) {
+    try {
+        const { complete, render } = await import("./completion.js");
+        const found = render(await complete(words, process.cwd()));
+        if (found) {
+            process.stdout.write(`${found}\n`);
+        }
+    }
+    catch {
+        // Nothing to offer.
+    }
+    return EXIT.ok;
+}
 async function main(argv) {
+    if (argv[0] === '__complete') {
+        return await completing(argv.slice(1));
+    }
     const parts = split(argv);
     const { rest, global } = extract(parts.after);
     let values;

package/dist/meta/model.d.ts

@@ -23,7 +23,7 @@ export interface ModelSources {
 export declare const ORDER: readonly ModelSource[];
 export declare function chooseModel(sources: ModelSources): ModelChoice | undefined;
 export declare const SOURCE_LABELS: Record<ModelSource, string>;
-/** First of each row is the default; the rest are what `--pick` offers beside it. */
+/** First of each row is the default; the rest are the next best. */
 export declare const RECOMMENDED: Partial<Record<Provider, readonly string[]>>;
 /** The recommended ref for the first provider with a key, or for `only`. */
 export declare function defaultRef(store: KeyStore, only?: Provider): string | undefined;

package/dist/meta/model.js

@@ -47,7 +47,7 @@ export const SOURCE_LABELS = {
 // error. Deep tier deliberately: this agent is pointed at the project itself,
 // and a cheap model reading a specification is a false economy.
 // ---------------------------------------------------------------------------
-/** First of each row is the default; the rest are what `--pick` offers beside it. */
+/** First of each row is the default; the rest are the next best. */
 export const RECOMMENDED = {
     openai: ['gpt-5.6-sol', 'gpt-5.6-terra'],
     anthropic: ['claude-opus-5', 'claude-sonnet-5'],

package/dist/postinstall.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=postinstall.d.ts.map

package/dist/postinstall.js

@@ -0,0 +1,10 @@
+import { autoInstall } from "./completion-install.js";
+try {
+    autoInstall();
+}
+catch (error) {
+    // Optional shell setup must not prevent installing the CLI.
+    console.error(`zen: automatic completion setup failed: ${error instanceof Error ? error.message : String(error)}`);
+    console.error('zen: run zen completion --install to retry.');
+}
+//# sourceMappingURL=postinstall.js.map

package/dist/sandbox.js

@@ -1,4 +1,4 @@
-import { DEFAULT_SANDBOX_IMAGE, SANDBOX_GROUP, SandboxPool, } from '@zenera/neo';
+import { DEFAULT_SANDBOX_IMAGE, GATEWAY_URL_ENV, SANDBOX_GROUP, SandboxPool, } from '@zenera/neo';
 import { mkdirSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import { resolveBuild } from "./image.js";
@@ -55,8 +55,9 @@ function forwarded() {
         secrets.push(cred.env);
     }
     // Not secrets, and useless without one: a service account says which
-    // project it belongs to but never which region to call.
-    for (const name of ['GOOGLE_CLOUD_PROJECT', 'GOOGLE_CLOUD_LOCATION']) {
+    // project it belongs to but never which region to call, and a gateway key
+    // says nothing of where the gateway is.
+    for (const name of ['GOOGLE_CLOUD_PROJECT', 'GOOGLE_CLOUD_LOCATION', GATEWAY_URL_ENV]) {
         const value = process.env[name];
         if (value) {
             env[name] = value;

package/dist/term.d.ts

@@ -42,6 +42,8 @@ export declare const red: (s: string) => string;
 export declare const green: (s: string) => string;
 export declare const yellow: (s: string) => string;
 export declare const cyan: (s: string) => string;
+/** A label meant to be seen first: reverse video, padded so it reads as a tag. */
+export declare const badge: (s: string) => string;
 /**
  * Whether anything should be coloured at all — `styleText`'s own answer, asked
  * by the places that write escape codes directly and so cannot inherit it.

package/dist/term.js

@@ -112,6 +112,8 @@ export const red = (s) => styleText('red', s);
 export const green = (s) => styleText('green', s);
 export const yellow = (s) => styleText('yellow', s);
 export const cyan = (s) => styleText('cyan', s);
+/** A label meant to be seen first: reverse video, padded so it reads as a tag. */
+export const badge = (s) => styleText(['inverse', 'bold'], ` ${s} `);
 /**
  * Whether anything should be coloured at all — `styleText`'s own answer, asked
  * by the places that write escape codes directly and so cannot inherit it.

package/dist/tui/links.d.ts

@@ -5,6 +5,8 @@ export interface Mounts {
     names: readonly string[];
     /** the host path an agent path names, or nothing when it is in no tree */
     resolve(path: string): string | undefined;
+    /** the host file a workspace-relative path names, only when that file exists */
+    file(path: string): string | undefined;
 }
 /** Exactly the trees the file tools reach, under the same containment rule. */
 export declare function mountsOf(files: Workspace): Mounts;

package/dist/tui/links.js

@@ -1,16 +1,22 @@
+import { statSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
 /** Exactly the trees the file tools reach, under the same containment rule. */
 export function mountsOf(files) {
     const names = [...(files.mount ? [files.mount] : []), ...files.mounts.map((m) => m.at)];
+    const resolve = (path) => {
+        try {
+            return files.within(path);
+        }
+        catch {
+            return undefined;
+        }
+    };
     return {
         names: names.sort((a, b) => b.length - a.length),
-        resolve: (path) => {
-            try {
-                return files.within(path);
-            }
-            catch {
-                return undefined;
-            }
+        resolve,
+        file: (path) => {
+            const host = resolve(path);
+            return host && statSync(host, { throwIfNoEntry: false })?.isFile() ? host : undefined;
         },
     };
 }
@@ -42,6 +48,17 @@ export function mountUrl(token, mounts) {
     const host = mounts.resolve(path);
     return host ? pathToFileURL(host).href + fragment : undefined;
 }
+/** `scripts/x.py`, `README.md` — no scheme, no leading slash, no spaces. */
+const RELATIVE = /^[\w@+-][\w.@+-]*(?:\/[\w.@+-]+)*$/;
+/** The host `file:` url of a workspace-relative path in code, when that file exists. */
+function relativeUrl(text, mounts) {
+    // Without a `.` or `/` it is an identifier, not worth a stat.
+    if (!RELATIVE.test(text) || !/[./]/.test(text)) {
+        return undefined;
+    }
+    const host = mounts.file(text);
+    return host ? pathToFileURL(host).href : undefined;
+}
 const escaped = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, (c) => `\\${c}`);
 /** Every spelling of a mounted path in running text. */
 function pattern(mounts) {
@@ -73,6 +90,13 @@ export function linkSpans(spans, mounts) {
             out.push(url ? { ...span, href: url } : span);
             continue;
         }
+        if (span.code) {
+            const url = relativeUrl(span.text, mounts);
+            if (url) {
+                out.push({ ...span, href: url });
+                continue;
+            }
+        }
         let from = 0;
         for (const { at, token } of matches(span.text, mounts)) {
             const url = mountUrl(token, mounts);

package/dist/tui/models.d.ts

@@ -1,4 +1,4 @@
-import { type Balance, type Catalog, type CatalogEntry } from '../catalog.ts';
+import { type Balance, type Catalog, type CatalogEntry, type Role } from '../catalog.ts';
 import type { Provider } from '../keys.ts';
 export interface ProviderRow {
     provider: Provider;
@@ -21,7 +21,14 @@ export interface BrowseOptions {
     providers: readonly ProviderRow[];
     /** opens straight into this provider's listing */
     initial?: Provider;
+    /** the role filter a listing opens on, when it has any such model */
+    role?: Role;
     theme?: string;
+    /** set in a gateway mode: every listing and test goes through it */
+    gateway?: {
+        name: string;
+        url: string;
+    };
     load(provider: Provider, refresh: boolean): Promise<Catalog>;
     /** what the account has left to spend, for providers that say */
     balance?(provider: Provider): Promise<Balance | undefined>;

package/dist/tui/models.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 // ---------------------------------------------------------------------------
 // zen models browse
 //
@@ -8,8 +8,8 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 //
 // Drawn on STDERR, like the banner and every other piece of narration, so the
 // one thing that reaches stdout is the ref picked at the end. That is what
-// makes `ref=$(zen models browse)` work the way `zen models pick` does: the
-// person sees the interface, the shell sees the answer.
+// makes `ref=$(zen models browse)` work: the person sees the interface, the
+// shell sees the answer.
 //
 // Nothing here knows how to list or probe a model. Both arrive as callbacks
 // from commands/models.ts, which already owns credentials and the catalog, so
@@ -44,10 +44,10 @@ function account(b, short) {
     }
     return parts.join(' · ');
 }
-function freshness(origin, fetchedAt) {
+function freshness(origin, fetchedAt, via) {
     switch (origin) {
         case 'curated':
-            return 'built-in list';
+            return via ? 'not listed yet' : 'built-in list';
         case 'stale':
             return `stale, ${ago(fetchedAt)}`;
         case 'live':
@@ -84,6 +84,13 @@ function Row({ children, ...style }) {
 function Keys({ theme, text }) {
     return _jsx(Row, { color: theme.chrome.color, children: text });
 }
+/** Rides on each screen's title row, so it costs the frame no height. */
+function Via({ gateway, theme, }) {
+    if (!gateway) {
+        return null;
+    }
+    return (_jsxs(_Fragment, { children: [_jsx(Text, { children: '   ' }), _jsx(Text, { inverse: true, bold: true, color: theme.warn, children: ` ⇄ ${gateway.name} ` }), _jsx(Text, { color: theme.chrome.color, children: ` ${gateway.url}` })] }));
+}
 function Browser({ options, theme, onPick }) {
     const { exit } = useApp();
     const { stdout } = useStdout();
@@ -103,7 +110,7 @@ function Browser({ options, theme, onPick }) {
     const [failure, setFailure] = useState();
     const [query, setQuery] = useState('');
     const [typing, setTyping] = useState(false);
-    const [role, setRole] = useState(0);
+    const [role, setRole] = useState(options.role);
     const [selected, setSelected] = useState(0);
     const [verdicts, setVerdicts] = useState(new Map());
     const [balances, setBalances] = useState(new Map());
@@ -147,7 +154,7 @@ function Browser({ options, theme, onPick }) {
         undefined,
         ...ROLES.filter((r) => catalog?.entries.some((e) => e.roles.includes(r))),
     ], [catalog]);
-    const only = present[role % present.length];
+    const only = present.includes(role) ? role : undefined;
     const rows = useMemo(() => (catalog?.entries ?? [])
         .filter((e) => matches(e, query, { roles: only ? [only] : [] }))
         .sort(byGroup), [catalog, query, only]);
@@ -159,7 +166,7 @@ function Browser({ options, theme, onPick }) {
         setScreen('models');
         setQuery('');
         setTyping(false);
-        setRole(0);
+        setRole(options.role);
         setSelected(0);
         top.current = 0;
         if (!catalogs.has(p)) {
@@ -287,7 +294,7 @@ function Browser({ options, theme, onPick }) {
             setSelected(0);
         }
         else if (key.tab) {
-            setRole((r) => (r + 1) % present.length);
+            setRole(present[(present.indexOf(only) + 1) % present.length]);
             setSelected(0);
         }
         else if ((key.return || key.rightArrow || input === 'l') && current) {
@@ -322,22 +329,22 @@ function Browser({ options, theme, onPick }) {
     const width = Math.max(20, size.columns - 1);
     if (screen === 'providers') {
         const nameW = Math.max(...options.providers.map((p) => p.provider.length)) + 2;
-        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Row, { bold: true, color: theme.accent, children: "Providers" }), _jsx(Text, { children: " " }), options.providers.map((p, i) => {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Row, { children: [_jsx(Text, { bold: true, color: theme.accent, children: "Providers" }), _jsx(Via, { gateway: options.gateway, theme: theme })] }), _jsx(Text, { children: " " }), options.providers.map((p, i) => {
                     const here = i === at;
                     const cat = catalogs.get(p.provider);
                     const count = cat?.entries.length ?? p.models;
                     const fresh = cat
-                        ? freshness(cat.origin, cat.fetchedAt)
-                        : freshness(p.origin, p.fetchedAt);
+                        ? freshness(cat.origin, cat.fetchedAt, cat.via)
+                        : freshness(p.origin, p.fetchedAt, options.gateway);
                     const b = balances.get(p.provider);
                     return (_jsxs(Row, { children: [_jsxs(Text, { color: here ? theme.accent : undefined, bold: here, children: [here ? '› ' : '  ', p.provider.padEnd(nameW)] }), p.credential ? (_jsx(Text, { color: theme.code.color, children: p.credential.padEnd(15) })) : (_jsx(Text, { color: theme.line.error.color, children: 'no credential'.padEnd(15) })), _jsxs(Text, { color: theme.chrome.color, children: [`${count} model${count === 1 ? '' : 's'}`.padEnd(13), p.credential ? fresh : `zen key add ${p.provider}`] }), b && typeof b !== 'string' ? (_jsx(Text, { color: theme.code.color, children: `   ${account(b, true)}` })) : null] }, p.provider));
                 }), _jsx(Text, { children: " " }), _jsx(Keys, { theme: theme, text: "\u2191\u2193 move \u00B7 enter open \u00B7 q quit" })] }));
     }
     if (screen === 'detail' && current) {
-        return (_jsx(Detail, { entry: current, catalog: catalog, verdict: verdicts.get(current.ref), theme: theme, width: width, rows: size.rows - 1 }));
+        return (_jsx(Detail, { entry: current, catalog: catalog, verdict: verdicts.get(current.ref), gateway: options.gateway, theme: theme, width: width, rows: size.rows - 1 }));
     }
     const header = catalog
-        ? `${provider} · ${catalog.entries.length} models · ${freshness(catalog.origin, catalog.fetchedAt)}`
+        ? `${provider} · ${catalog.entries.length} models · ${freshness(catalog.origin, catalog.fetchedAt, catalog.via)}`
         : provider;
     const withMaker = rows.some((e) => e.publisher);
     const priced = rows.some((e) => e.pricing);
@@ -381,13 +388,13 @@ function Browser({ options, theme, onPick }) {
             }) }));
     }
     const preview = current ? [current.name, current.description].filter(Boolean).join(' — ') : '';
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Row, { children: [_jsx(Text, { bold: true, color: theme.accent, children: header }), _jsxs(Text, { color: theme.chrome.color, children: ['   role: ', only ?? 'all', filter ? '   ' : ''] }), _jsx(Text, { color: theme.code.color, children: filter })] }), problem ? (_jsxs(Row, { color: theme.warn, children: ["could not be listed: ", problem.detail ?? 'no reason given'] })) : null, funds.map((line, i) => (_jsx(Row, { color: short ? theme.warn : theme.code.color, children: line }, `funds${i}`))), _jsx(Text, { children: " " }), _jsx(Row, { bold: true, color: theme.chrome.color, children: columns }), _jsx(Box, { flexDirection: "column", height: height, children: body }), _jsx(Row, { color: theme.chrome.color, children: clip(preview, width) || ' ' }), _jsx(Row, { color: theme.chrome.color, children: rows.length === 0
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Row, { children: [_jsx(Text, { bold: true, color: theme.accent, children: header }), _jsxs(Text, { color: theme.chrome.color, children: ['   role: ', only ?? 'all', filter ? '   ' : ''] }), _jsx(Text, { color: theme.code.color, children: filter }), _jsx(Via, { gateway: options.gateway, theme: theme })] }), problem ? (_jsxs(Row, { color: theme.warn, children: ["could not be listed: ", problem.detail ?? 'no reason given'] })) : null, funds.map((line, i) => (_jsx(Row, { color: short ? theme.warn : theme.code.color, children: line }, `funds${i}`))), _jsx(Text, { children: " " }), _jsx(Row, { bold: true, color: theme.chrome.color, children: columns }), _jsx(Box, { flexDirection: "column", height: height, children: body }), _jsx(Row, { color: theme.chrome.color, children: clip(preview, width) || ' ' }), _jsx(Row, { color: theme.chrome.color, children: rows.length === 0
                     ? ' '
                     : `${index + 1} of ${rows.length}${rows.length < (catalog?.entries.length ?? 0) ? ` (${catalog.entries.length} in all)` : ''}` }), _jsx(Keys, { theme: theme, text: typing
                     ? 'type to filter · enter keep · esc clear · ↑↓ move'
                     : '↑↓ · / filter · tab role · ⏎ more · t test · p pick · r reload · esc back' })] }));
 }
-function Detail({ entry, catalog, verdict, theme, width, rows }) {
+function Detail({ entry, catalog, verdict, gateway, theme, width, rows, }) {
     const facts = [];
     const add = (label, value) => {
         if (value) {
@@ -412,7 +419,7 @@ function Detail({ entry, catalog, verdict, theme, width, rows }) {
             : undefined);
     add('released', entry.created);
     add('source', entry.source === 'live' && catalog
-        ? `${entry.provider}, ${freshness(catalog.origin, catalog.fetchedAt)}`
+        ? `${catalog.via ? `${catalog.via.name} (${entry.provider})` : entry.provider}, ${freshness(catalog.origin, catalog.fetchedAt, catalog.via)}`
         : 'built-in list');
     const v = said(verdict, theme);
     const reason = verdict && verdict !== 'asking'
@@ -428,7 +435,7 @@ function Detail({ entry, catalog, verdict, theme, width, rows }) {
     // whatever is left, and is cut rather than allowed to push the keys off.
     const room = Math.max(0, rows - facts.length - 6);
     const about = entry.description ? wrap(entry.description, width - 2).slice(0, room) : [];
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Row, { bold: true, color: theme.accent, children: entry.ref }), _jsx(Text, { children: " " }), facts.map(([label, value]) => (_jsxs(Row, { children: [_jsx(Text, { color: theme.chrome.color, children: `  ${label.padEnd(12)}` }), _jsx(Text, { children: value })] }, label))), _jsxs(Row, { children: [_jsxs(Text, { color: theme.chrome.color, children: ['  ', 'asked'.padEnd(12)] }), v ? (_jsx(Text, { color: v.color, children: v.text })) : (_jsx(Text, { color: theme.chrome.color, children: "not yet \u2014 t to ask it one question" })), reason ? _jsx(Text, { color: v?.color, children: `  ${reason}` }) : null] }), about.length > 0 ? _jsx(Text, { children: " " }) : null, about.map((line, i) => (_jsx(Row, { color: theme.chrome.color, children: `  ${line}` }, i))), _jsx(Text, { children: " " }), _jsx(Keys, { theme: theme, text: "t test \u00B7 p pick (prints the ref) \u00B7 esc back \u00B7 q quit" })] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Row, { children: [_jsx(Text, { bold: true, color: theme.accent, children: entry.ref }), _jsx(Via, { gateway: gateway, theme: theme })] }), _jsx(Text, { children: " " }), facts.map(([label, value]) => (_jsxs(Row, { children: [_jsx(Text, { color: theme.chrome.color, children: `  ${label.padEnd(12)}` }), _jsx(Text, { children: value })] }, label))), _jsxs(Row, { children: [_jsxs(Text, { color: theme.chrome.color, children: ['  ', 'asked'.padEnd(12)] }), v ? (_jsx(Text, { color: v.color, children: v.text })) : (_jsx(Text, { color: theme.chrome.color, children: "not yet \u2014 t to ask it one question" })), reason ? _jsx(Text, { color: v?.color, children: `  ${reason}` }) : null] }), about.length > 0 ? _jsx(Text, { children: " " }) : null, about.map((line, i) => (_jsx(Row, { color: theme.chrome.color, children: `  ${line}` }, i))), _jsx(Text, { children: " " }), _jsx(Keys, { theme: theme, text: "t test \u00B7 p pick (prints the ref) \u00B7 esc back \u00B7 q quit" })] }));
 }
 /**
  * Runs the browser until the person picks a model or leaves. Resolves to the

package/dist/validate.js

@@ -471,13 +471,13 @@ async function askModels(targets, opts, add) {
         }
         const where = named(report);
         if (probe.check.state === 'blocked') {
-            const pick = report.role === 'embedding' ? '--embedding' : '--chat';
+            const list = report.role === 'embedding' ? '--embeddings' : '--chat';
             add({
                 severity: 'error',
                 code: `${report.role}.blocked`,
                 where,
                 message: `the credential was accepted and then refused: ${probe.check.detail ?? 'no reason given'}`,
-                fix: `${probe.check.fix ?? 'resolve it in the vendor console'}, or find one that works: zen models pick ${pick}`,
+                fix: `${probe.check.fix ?? 'resolve it in the vendor console'}, or find one that works: zen models ls ${list}`,
             });
             return;
         }