@zenera/cli 1.1.28 → 1.1.30

package/dist/keys.js

@@ -1,4 +1,4 @@
-import { EXA_API_KEY_ENV } from '@zenera/neo';
+import { EXA_API_KEY_ENV, GATEWAY_KEY_ENV, GATEWAY_URL_ENV } from '@zenera/neo';
 import { chmodSync, copyFileSync, existsSync, readFileSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { isAbsolute, join, resolve } from 'node:path';
@@ -31,8 +31,15 @@ export const PROVIDERS = ['openai', 'anthropic', 'google', 'vertex', 'openrouter
  * few places that must tell them apart are made to say which they mean.
  */
 export const SERVICES = ['exa'];
+/**
+ * Somewhere every model can be reached through, with one key. Its own list for
+ * the same reason as `SERVICES`: it is neither a vendor a model comes from nor
+ * a tool, and a gateway entry only counts while the keyring is in its mode.
+ */
+export const GATEWAYS = ['bifrost'];
+export const MODES = ['direct', ...GATEWAYS];
 /** Anything the keyring can hold a credential for. */
-export const OWNERS = [...PROVIDERS, ...SERVICES];
+export const OWNERS = [...PROVIDERS, ...SERVICES, ...GATEWAYS];
 /**
  * Vertex is the odd one, and it is odd twice.
  *
@@ -115,6 +122,17 @@ export const SHAPES = {
             },
         ],
     },
+    bifrost: {
+        kind: 'gateway',
+        label: 'Bifrost',
+        forms: [
+            {
+                holds: 'secret',
+                env: GATEWAY_KEY_ENV,
+                where: 'a virtual key (sk-bf-…) from your Bifrost administrator',
+            },
+        ],
+    },
 };
 /**
  * The form a provider is usually reached by — for the questions that have to
@@ -144,6 +162,9 @@ export function isProvider(name) {
 export function isOwner(name) {
     return OWNERS.includes(name);
 }
+export function isGateway(name) {
+    return GATEWAYS.includes(name);
+}
 export function assertOwner(name) {
     if (!isOwner(name)) {
         throw usageError(`unknown provider "${name}"`, `known providers: ${OWNERS.join(', ')}`);
@@ -256,7 +277,13 @@ export class KeyStore {
         const path = paths.keys();
         assertPrivate(path);
         const file = await readJson(path, EMPTY);
-        return new KeyStore({ ...EMPTY, ...file });
+        // Fresh containers: a missing file hands back EMPTY itself, which `add` would mutate.
+        return new KeyStore({
+            ...EMPTY,
+            ...file,
+            entries: [...(file.entries ?? [])],
+            active: { ...file.active },
+        });
     }
     get entries() {
         return this.#file.entries;
@@ -311,6 +338,7 @@ export class KeyStore {
             // be a way to build the combination the service refuses.
             ...(form.holds === 'file' && meta.project ? { project: meta.project } : {}),
             ...(form.holds === 'file' && meta.location ? { location: meta.location } : {}),
+            ...(isGateway(provider) && meta.url ? { url: meta.url } : {}),
             addedAt: new Date().toISOString(),
         };
         const at = this.#file.entries.findIndex((e) => e.provider === provider && e.name === name);
@@ -352,6 +380,25 @@ export class KeyStore {
             hit.check = check;
         }
     }
+    /** A `BIFROST_BASE_URL` in the environment wins over the keyring, as it does for the runtime. */
+    get mode() {
+        return this.modeFrom === 'env' ? 'bifrost' : (this.#file.mode ?? 'direct');
+    }
+    get modeFrom() {
+        return process.env[GATEWAY_URL_ENV]?.trim() ? 'env' : 'keyring';
+    }
+    /** Refuses a gateway mode with no gateway to send anything to. */
+    setMode(mode) {
+        if (mode !== 'direct' && !this.active(mode)?.url) {
+            throw usageError(`no ${SHAPES[mode].label} key to switch to`, `add one first: zen key add ${mode} --url <gateway url>`);
+        }
+        if (mode === 'direct') {
+            delete this.#file.mode;
+        }
+        else {
+            this.#file.mode = mode;
+        }
+    }
     save() {
         ensureDir(paths.home());
         writeJson(paths.keys(), this.#file);
@@ -398,14 +445,28 @@ export class KeyStore {
      *
      * Services are included by default, because a tool reads its key from the
      * environment for exactly the same reason a model adapter does.
+     *
+     * In a gateway mode the gateway's key replaces every vendor's, so those are
+     * withheld: nothing would read them, and the sandbox would be handed keys
+     * the run never needed. In `direct` mode it is the gateway that is withheld,
+     * since its url alone is what switches the library over.
      */
     environment(only) {
         const env = {};
+        const mode = this.mode;
         for (const provider of only ?? OWNERS) {
+            const kind = SHAPES[provider].kind;
+            if (kind === 'gateway' ? provider !== mode : kind === 'model' && mode !== 'direct') {
+                continue;
+            }
             const entry = this.active(provider);
             if (!entry) {
                 continue;
             }
+            // The mode is the switch, so the url goes out even when the shell supplies the key.
+            if (entry.url && !process.env[GATEWAY_URL_ENV]) {
+                env[GATEWAY_URL_ENV] = entry.url;
+            }
             // Either variable being set means this provider is already answered
             // for, so the stored alternative must not be exported alongside it.
             if (envNames(provider).some((name) => process.env[name])) {
@@ -542,6 +603,9 @@ export function credentials() {
  * one clear error here for an obscure one on the first turn.
  */
 export function assertUsable(store) {
+    if (process.env[GATEWAY_URL_ENV]) {
+        return;
+    }
     const reachable = PROVIDERS.filter((p) => envNames(p).some((name) => process.env[name]) || store.active(p) !== undefined);
     if (reachable.length === 0) {
         throw credentialError('no credentials for any provider', 'add one with: zen key add openai');

package/dist/liveness.js

@@ -1,4 +1,4 @@
-import { createModel, EXA_BASE_URL, isUnfunded, ModelRegistry, text, vertexRoute, } from '@zenera/neo';
+import { createModel, EXA_BASE_URL, GATEWAY_KEY_HEADER, isUnfunded, ModelRegistry, text, vertexRoute, } from '@zenera/neo';
 import { envOf, SHAPES, } from "./keys.js";
 // ---------------------------------------------------------------------------
 // Liveness
@@ -201,6 +201,9 @@ export async function probe(store, entry) {
     if (shape.kind === 'service') {
         return probeService(entry.provider, store.reveal(entry));
     }
+    if (shape.kind === 'gateway') {
+        return probeGateway(entry.url, store.reveal(entry));
+    }
     const provider = entry.provider;
     const credential = store.reveal(entry);
     // What the entry holds, not what its provider usually holds: a Vertex
@@ -302,6 +305,57 @@ async function probeService(service, key) {
         return classify(err);
     }
 }
+/**
+ * Bifrost's model listing is scoped to the virtual key that asks, so it is the
+ * cheap call that looks at the key. Its refusals carry their reason as a
+ * top-level `type` beside `error.message`, and two of them are about the
+ * key's allowance rather than the key.
+ */
+async function probeGateway(url, key) {
+    const at = new Date().toISOString();
+    if (!url) {
+        return { state: 'unknown', at, detail: 'no gateway url stored with this key' };
+    }
+    try {
+        const res = await fetch(`${url.replace(/\/+$/, '')}/v1/models`, {
+            headers: { authorization: `Bearer ${key}`, [GATEWAY_KEY_HEADER]: key },
+            signal: AbortSignal.timeout(DEADLINE_MS),
+        });
+        if (res.ok) {
+            return { state: 'live', at };
+        }
+        const { type, message } = await refusal(res);
+        const detail = `${res.status} ${message}`;
+        if (res.status === 402 || type === 'budget_exceeded') {
+            return {
+                state: 'blocked',
+                at,
+                detail,
+                fix: "raise the virtual key's budget in Bifrost",
+            };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { state: 'dead', at, detail };
+        }
+        if (res.status === 404 || /<html/i.test(message)) {
+            return { state: 'unknown', at, detail, fix: 'check the url: is it the gateway root?' };
+        }
+        return { state: 'unknown', at, detail };
+    }
+    catch (err) {
+        return classify(err);
+    }
+}
+async function refusal(res) {
+    const raw = await res.text().catch(() => '');
+    try {
+        const body = JSON.parse(raw);
+        return { type: body.type, message: firstLine(body.error?.message ?? res.statusText) };
+    }
+    catch {
+        return { message: firstLine(raw || res.statusText) };
+    }
+}
 /** The vendor's own sentence about a refusal, when the body carries one. */
 async function said(res) {
     try {
@@ -389,6 +443,11 @@ const UNSERVED = [
     'no access',
 ];
 const targetId = (target) => target.kind === 'model' ? target.model.id : target.embedder.id;
+const PROBE_TOOL = {
+    name: 'noop',
+    description: 'Does nothing. Do not call it.',
+    parameters: { type: 'object', properties: {} },
+};
 /**
  * A chat model sized for a probe: 16 output tokens is enough for "ok", and
  * Anthropic requires a cap at all. Only the adapters that read `maxTokens` are
@@ -415,6 +474,10 @@ function classifyModel(err, target, ms) {
     if (err instanceof Deadline || e?.name === 'AbortError' || e?.name === 'TimeoutError') {
         return { state: 'unknown', at, detail: `no answer in ${MODEL_DEADLINE_MS / 1000}s` };
     }
+    // OpenAI refuses tools alongside reasoning on chat completions, and says so.
+    if (target.kind === 'model' && haystack.includes('/v1/responses')) {
+        return { state: 'blocked', at, detail: firstLine(message), fix: responsesApi(target) };
+    }
     if (UNSERVED.some((needle) => haystack.includes(needle))) {
         return { state: 'blocked', at, detail: firstLine(message), fix: instead(target) };
     }
@@ -438,6 +501,10 @@ function limited(target) {
     }
     return `${blame} — retry later`;
 }
+function responsesApi(target) {
+    const provider = target.ref.includes(':') ? target.ref.split(':')[0].split('/')[0] : 'openai';
+    return `use the responses API: \`api: responses\` on the model, or the ref ${provider}/responses:${targetId(target)}`;
+}
 /** The command that finds something this account can actually use. */
 function instead(target) {
     const provider = target.ref.includes(':') ? target.ref.split(':')[0] : undefined;
@@ -446,7 +513,7 @@ function instead(target) {
     }
     return provider
         ? `zen models ls ${provider}`
-        : `zen models pick --${target.kind === 'embedding' ? 'embedding' : 'chat'}`;
+        : `zen models ls --${target.kind === 'embedding' ? 'embeddings' : 'chat'}`;
 }
 /**
  * The smallest real call the model can be asked for. It costs a handful of
@@ -456,6 +523,9 @@ function instead(target) {
  * An embedding answers with its width, which is worth carrying back: a model
  * that serves the wrong number of dimensions is not interchangeable with the
  * one an index was built on.
+ *
+ * A chat model is offered one tool, because every agent run offers tools and
+ * some refusals (reasoning plus tools on chat completions) only happen then.
  */
 async function askModel(target, signal) {
     if (target.kind === 'embedding') {
@@ -465,7 +535,7 @@ async function askModel(target, signal) {
     await target.model.generate({
         system: 'Reply with the single word: ok',
         messages: [{ role: 'user', content: [text('ping')] }],
-        tools: [],
+        tools: [PROBE_TOOL],
         signal,
     });
     return undefined;

package/dist/main.js

@@ -32,7 +32,29 @@ const GLOBAL = {
     // not what it does.
     directory: { type: 'string', short: 'C' },
 };
+/**
+ * The shell's half of tab completion calls this, hidden from help. It answers
+ * before anything else, because a banner or a window title on a Tab press would
+ * be printed into the line being edited — and it never fails loudly for the
+ * same reason: no answer is a valid answer, and the shell completes files.
+ */
+async function completing(words) {
+    try {
+        const { complete, render } = await import("./completion.js");
+        const found = render(await complete(words, process.cwd()));
+        if (found) {
+            process.stdout.write(`${found}\n`);
+        }
+    }
+    catch {
+        // Nothing to offer.
+    }
+    return EXIT.ok;
+}
 async function main(argv) {
+    if (argv[0] === '__complete') {
+        return await completing(argv.slice(1));
+    }
     const parts = split(argv);
     const { rest, global } = extract(parts.after);
     let values;

package/dist/postinstall.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=postinstall.d.ts.map

package/dist/postinstall.js

@@ -0,0 +1,10 @@
+import { autoInstall } from "./completion-install.js";
+try {
+    autoInstall();
+}
+catch (error) {
+    // Optional shell setup must not prevent installing the CLI.
+    console.error(`zen: automatic completion setup failed: ${error instanceof Error ? error.message : String(error)}`);
+    console.error('zen: run zen completion --install to retry.');
+}
+//# sourceMappingURL=postinstall.js.map

package/dist/sandbox.js

@@ -1,4 +1,4 @@
-import { DEFAULT_SANDBOX_IMAGE, SANDBOX_GROUP, SandboxPool, } from '@zenera/neo';
+import { DEFAULT_SANDBOX_IMAGE, GATEWAY_URL_ENV, SANDBOX_GROUP, SandboxPool, } from '@zenera/neo';
 import { mkdirSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import { resolveBuild } from "./image.js";
@@ -55,8 +55,9 @@ function forwarded() {
         secrets.push(cred.env);
     }
     // Not secrets, and useless without one: a service account says which
-    // project it belongs to but never which region to call.
-    for (const name of ['GOOGLE_CLOUD_PROJECT', 'GOOGLE_CLOUD_LOCATION']) {
+    // project it belongs to but never which region to call, and a gateway key
+    // says nothing of where the gateway is.
+    for (const name of ['GOOGLE_CLOUD_PROJECT', 'GOOGLE_CLOUD_LOCATION', GATEWAY_URL_ENV]) {
         const value = process.env[name];
         if (value) {
             env[name] = value;

package/dist/term.d.ts

@@ -42,6 +42,8 @@ export declare const red: (s: string) => string;
 export declare const green: (s: string) => string;
 export declare const yellow: (s: string) => string;
 export declare const cyan: (s: string) => string;
+/** A label meant to be seen first: reverse video, padded so it reads as a tag. */
+export declare const badge: (s: string) => string;
 /**
  * Whether anything should be coloured at all — `styleText`'s own answer, asked
  * by the places that write escape codes directly and so cannot inherit it.

package/dist/term.js

@@ -112,6 +112,8 @@ export const red = (s) => styleText('red', s);
 export const green = (s) => styleText('green', s);
 export const yellow = (s) => styleText('yellow', s);
 export const cyan = (s) => styleText('cyan', s);
+/** A label meant to be seen first: reverse video, padded so it reads as a tag. */
+export const badge = (s) => styleText(['inverse', 'bold'], ` ${s} `);
 /**
  * Whether anything should be coloured at all — `styleText`'s own answer, asked
  * by the places that write escape codes directly and so cannot inherit it.

package/dist/tui/links.d.ts

@@ -5,6 +5,8 @@ export interface Mounts {
     names: readonly string[];
     /** the host path an agent path names, or nothing when it is in no tree */
     resolve(path: string): string | undefined;
+    /** the host file a workspace-relative path names, only when that file exists */
+    file(path: string): string | undefined;
 }
 /** Exactly the trees the file tools reach, under the same containment rule. */
 export declare function mountsOf(files: Workspace): Mounts;

package/dist/tui/links.js

@@ -1,16 +1,22 @@
+import { statSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
 /** Exactly the trees the file tools reach, under the same containment rule. */
 export function mountsOf(files) {
     const names = [...(files.mount ? [files.mount] : []), ...files.mounts.map((m) => m.at)];
+    const resolve = (path) => {
+        try {
+            return files.within(path);
+        }
+        catch {
+            return undefined;
+        }
+    };
     return {
         names: names.sort((a, b) => b.length - a.length),
-        resolve: (path) => {
-            try {
-                return files.within(path);
-            }
-            catch {
-                return undefined;
-            }
+        resolve,
+        file: (path) => {
+            const host = resolve(path);
+            return host && statSync(host, { throwIfNoEntry: false })?.isFile() ? host : undefined;
         },
     };
 }
@@ -42,6 +48,17 @@ export function mountUrl(token, mounts) {
     const host = mounts.resolve(path);
     return host ? pathToFileURL(host).href + fragment : undefined;
 }
+/** `scripts/x.py`, `README.md` — no scheme, no leading slash, no spaces. */
+const RELATIVE = /^[\w@+-][\w.@+-]*(?:\/[\w.@+-]+)*$/;
+/** The host `file:` url of a workspace-relative path in code, when that file exists. */
+function relativeUrl(text, mounts) {
+    // Without a `.` or `/` it is an identifier, not worth a stat.
+    if (!RELATIVE.test(text) || !/[./]/.test(text)) {
+        return undefined;
+    }
+    const host = mounts.file(text);
+    return host ? pathToFileURL(host).href : undefined;
+}
 const escaped = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, (c) => `\\${c}`);
 /** Every spelling of a mounted path in running text. */
 function pattern(mounts) {
@@ -73,6 +90,13 @@ export function linkSpans(spans, mounts) {
             out.push(url ? { ...span, href: url } : span);
             continue;
         }
+        if (span.code) {
+            const url = relativeUrl(span.text, mounts);
+            if (url) {
+                out.push({ ...span, href: url });
+                continue;
+            }
+        }
         let from = 0;
         for (const { at, token } of matches(span.text, mounts)) {
             const url = mountUrl(token, mounts);

package/dist/tui/models.d.ts

@@ -24,6 +24,11 @@ export interface BrowseOptions {
     /** the role filter a listing opens on, when it has any such model */
     role?: Role;
     theme?: string;
+    /** set in a gateway mode: every listing and test goes through it */
+    gateway?: {
+        name: string;
+        url: string;
+    };
     load(provider: Provider, refresh: boolean): Promise<Catalog>;
     /** what the account has left to spend, for providers that say */
     balance?(provider: Provider): Promise<Balance | undefined>;

package/dist/tui/models.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 // ---------------------------------------------------------------------------
 // zen models browse
 //
@@ -8,8 +8,8 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 //
 // Drawn on STDERR, like the banner and every other piece of narration, so the
 // one thing that reaches stdout is the ref picked at the end. That is what
-// makes `ref=$(zen models browse)` work the way `zen models pick` does: the
-// person sees the interface, the shell sees the answer.
+// makes `ref=$(zen models browse)` work: the person sees the interface, the
+// shell sees the answer.
 //
 // Nothing here knows how to list or probe a model. Both arrive as callbacks
 // from commands/models.ts, which already owns credentials and the catalog, so
@@ -44,10 +44,10 @@ function account(b, short) {
     }
     return parts.join(' · ');
 }
-function freshness(origin, fetchedAt) {
+function freshness(origin, fetchedAt, via) {
     switch (origin) {
         case 'curated':
-            return 'built-in list';
+            return via ? 'not listed yet' : 'built-in list';
         case 'stale':
             return `stale, ${ago(fetchedAt)}`;
         case 'live':
@@ -84,6 +84,13 @@ function Row({ children, ...style }) {
 function Keys({ theme, text }) {
     return _jsx(Row, { color: theme.chrome.color, children: text });
 }
+/** Rides on each screen's title row, so it costs the frame no height. */
+function Via({ gateway, theme, }) {
+    if (!gateway) {
+        return null;
+    }
+    return (_jsxs(_Fragment, { children: [_jsx(Text, { children: '   ' }), _jsx(Text, { inverse: true, bold: true, color: theme.warn, children: ` ⇄ ${gateway.name} ` }), _jsx(Text, { color: theme.chrome.color, children: ` ${gateway.url}` })] }));
+}
 function Browser({ options, theme, onPick }) {
     const { exit } = useApp();
     const { stdout } = useStdout();
@@ -322,22 +329,22 @@ function Browser({ options, theme, onPick }) {
     const width = Math.max(20, size.columns - 1);
     if (screen === 'providers') {
         const nameW = Math.max(...options.providers.map((p) => p.provider.length)) + 2;
-        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Row, { bold: true, color: theme.accent, children: "Providers" }), _jsx(Text, { children: " " }), options.providers.map((p, i) => {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Row, { children: [_jsx(Text, { bold: true, color: theme.accent, children: "Providers" }), _jsx(Via, { gateway: options.gateway, theme: theme })] }), _jsx(Text, { children: " " }), options.providers.map((p, i) => {
                     const here = i === at;
                     const cat = catalogs.get(p.provider);
                     const count = cat?.entries.length ?? p.models;
                     const fresh = cat
-                        ? freshness(cat.origin, cat.fetchedAt)
-                        : freshness(p.origin, p.fetchedAt);
+                        ? freshness(cat.origin, cat.fetchedAt, cat.via)
+                        : freshness(p.origin, p.fetchedAt, options.gateway);
                     const b = balances.get(p.provider);
                     return (_jsxs(Row, { children: [_jsxs(Text, { color: here ? theme.accent : undefined, bold: here, children: [here ? '› ' : '  ', p.provider.padEnd(nameW)] }), p.credential ? (_jsx(Text, { color: theme.code.color, children: p.credential.padEnd(15) })) : (_jsx(Text, { color: theme.line.error.color, children: 'no credential'.padEnd(15) })), _jsxs(Text, { color: theme.chrome.color, children: [`${count} model${count === 1 ? '' : 's'}`.padEnd(13), p.credential ? fresh : `zen key add ${p.provider}`] }), b && typeof b !== 'string' ? (_jsx(Text, { color: theme.code.color, children: `   ${account(b, true)}` })) : null] }, p.provider));
                 }), _jsx(Text, { children: " " }), _jsx(Keys, { theme: theme, text: "\u2191\u2193 move \u00B7 enter open \u00B7 q quit" })] }));
     }
     if (screen === 'detail' && current) {
-        return (_jsx(Detail, { entry: current, catalog: catalog, verdict: verdicts.get(current.ref), theme: theme, width: width, rows: size.rows - 1 }));
+        return (_jsx(Detail, { entry: current, catalog: catalog, verdict: verdicts.get(current.ref), gateway: options.gateway, theme: theme, width: width, rows: size.rows - 1 }));
     }
     const header = catalog
-        ? `${provider} · ${catalog.entries.length} models · ${freshness(catalog.origin, catalog.fetchedAt)}`
+        ? `${provider} · ${catalog.entries.length} models · ${freshness(catalog.origin, catalog.fetchedAt, catalog.via)}`
         : provider;
     const withMaker = rows.some((e) => e.publisher);
     const priced = rows.some((e) => e.pricing);
@@ -381,13 +388,13 @@ function Browser({ options, theme, onPick }) {
             }) }));
     }
     const preview = current ? [current.name, current.description].filter(Boolean).join(' — ') : '';
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Row, { children: [_jsx(Text, { bold: true, color: theme.accent, children: header }), _jsxs(Text, { color: theme.chrome.color, children: ['   role: ', only ?? 'all', filter ? '   ' : ''] }), _jsx(Text, { color: theme.code.color, children: filter })] }), problem ? (_jsxs(Row, { color: theme.warn, children: ["could not be listed: ", problem.detail ?? 'no reason given'] })) : null, funds.map((line, i) => (_jsx(Row, { color: short ? theme.warn : theme.code.color, children: line }, `funds${i}`))), _jsx(Text, { children: " " }), _jsx(Row, { bold: true, color: theme.chrome.color, children: columns }), _jsx(Box, { flexDirection: "column", height: height, children: body }), _jsx(Row, { color: theme.chrome.color, children: clip(preview, width) || ' ' }), _jsx(Row, { color: theme.chrome.color, children: rows.length === 0
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Row, { children: [_jsx(Text, { bold: true, color: theme.accent, children: header }), _jsxs(Text, { color: theme.chrome.color, children: ['   role: ', only ?? 'all', filter ? '   ' : ''] }), _jsx(Text, { color: theme.code.color, children: filter }), _jsx(Via, { gateway: options.gateway, theme: theme })] }), problem ? (_jsxs(Row, { color: theme.warn, children: ["could not be listed: ", problem.detail ?? 'no reason given'] })) : null, funds.map((line, i) => (_jsx(Row, { color: short ? theme.warn : theme.code.color, children: line }, `funds${i}`))), _jsx(Text, { children: " " }), _jsx(Row, { bold: true, color: theme.chrome.color, children: columns }), _jsx(Box, { flexDirection: "column", height: height, children: body }), _jsx(Row, { color: theme.chrome.color, children: clip(preview, width) || ' ' }), _jsx(Row, { color: theme.chrome.color, children: rows.length === 0
                     ? ' '
                     : `${index + 1} of ${rows.length}${rows.length < (catalog?.entries.length ?? 0) ? ` (${catalog.entries.length} in all)` : ''}` }), _jsx(Keys, { theme: theme, text: typing
                     ? 'type to filter · enter keep · esc clear · ↑↓ move'
                     : '↑↓ · / filter · tab role · ⏎ more · t test · p pick · r reload · esc back' })] }));
 }
-function Detail({ entry, catalog, verdict, theme, width, rows }) {
+function Detail({ entry, catalog, verdict, gateway, theme, width, rows, }) {
     const facts = [];
     const add = (label, value) => {
         if (value) {
@@ -412,7 +419,7 @@ function Detail({ entry, catalog, verdict, theme, width, rows }) {
             : undefined);
     add('released', entry.created);
     add('source', entry.source === 'live' && catalog
-        ? `${entry.provider}, ${freshness(catalog.origin, catalog.fetchedAt)}`
+        ? `${catalog.via ? `${catalog.via.name} (${entry.provider})` : entry.provider}, ${freshness(catalog.origin, catalog.fetchedAt, catalog.via)}`
         : 'built-in list');
     const v = said(verdict, theme);
     const reason = verdict && verdict !== 'asking'
@@ -428,7 +435,7 @@ function Detail({ entry, catalog, verdict, theme, width, rows }) {
     // whatever is left, and is cut rather than allowed to push the keys off.
     const room = Math.max(0, rows - facts.length - 6);
     const about = entry.description ? wrap(entry.description, width - 2).slice(0, room) : [];
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Row, { bold: true, color: theme.accent, children: entry.ref }), _jsx(Text, { children: " " }), facts.map(([label, value]) => (_jsxs(Row, { children: [_jsx(Text, { color: theme.chrome.color, children: `  ${label.padEnd(12)}` }), _jsx(Text, { children: value })] }, label))), _jsxs(Row, { children: [_jsxs(Text, { color: theme.chrome.color, children: ['  ', 'asked'.padEnd(12)] }), v ? (_jsx(Text, { color: v.color, children: v.text })) : (_jsx(Text, { color: theme.chrome.color, children: "not yet \u2014 t to ask it one question" })), reason ? _jsx(Text, { color: v?.color, children: `  ${reason}` }) : null] }), about.length > 0 ? _jsx(Text, { children: " " }) : null, about.map((line, i) => (_jsx(Row, { color: theme.chrome.color, children: `  ${line}` }, i))), _jsx(Text, { children: " " }), _jsx(Keys, { theme: theme, text: "t test \u00B7 p pick (prints the ref) \u00B7 esc back \u00B7 q quit" })] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Row, { children: [_jsx(Text, { bold: true, color: theme.accent, children: entry.ref }), _jsx(Via, { gateway: gateway, theme: theme })] }), _jsx(Text, { children: " " }), facts.map(([label, value]) => (_jsxs(Row, { children: [_jsx(Text, { color: theme.chrome.color, children: `  ${label.padEnd(12)}` }), _jsx(Text, { children: value })] }, label))), _jsxs(Row, { children: [_jsxs(Text, { color: theme.chrome.color, children: ['  ', 'asked'.padEnd(12)] }), v ? (_jsx(Text, { color: v.color, children: v.text })) : (_jsx(Text, { color: theme.chrome.color, children: "not yet \u2014 t to ask it one question" })), reason ? _jsx(Text, { color: v?.color, children: `  ${reason}` }) : null] }), about.length > 0 ? _jsx(Text, { children: " " }) : null, about.map((line, i) => (_jsx(Row, { color: theme.chrome.color, children: `  ${line}` }, i))), _jsx(Text, { children: " " }), _jsx(Keys, { theme: theme, text: "t test \u00B7 p pick (prints the ref) \u00B7 esc back \u00B7 q quit" })] }));
 }
 /**
  * Runs the browser until the person picks a model or leaves. Resolves to the

package/dist/validate.js

@@ -471,13 +471,13 @@ async function askModels(targets, opts, add) {
         }
         const where = named(report);
         if (probe.check.state === 'blocked') {
-            const pick = report.role === 'embedding' ? '--embedding' : '--chat';
+            const list = report.role === 'embedding' ? '--embeddings' : '--chat';
             add({
                 severity: 'error',
                 code: `${report.role}.blocked`,
                 where,
                 message: `the credential was accepted and then refused: ${probe.check.detail ?? 'no reason given'}`,
-                fix: `${probe.check.fix ?? 'resolve it in the vendor console'}, or find one that works: zen models pick ${pick}`,
+                fix: `${probe.check.fix ?? 'resolve it in the vendor console'}, or find one that works: zen models ls ${list}`,
             });
             return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/cli",
-    "version": "1.1.28",
+    "version": "1.1.30",
     "description": "Command-line front end for @zenera/neo: agentic projects you can run, share and commit.",
     "keywords": [
         "agents",
@@ -37,6 +37,7 @@
     "files": [
         "dist",
         "!dist/**/*.map",
+        "postinstall.mjs",
         "templates"
     ],
     "engines": {
@@ -45,20 +46,21 @@
     "scripts": {
         "build": "tsc -b",
         "clean": "tsc -b --clean && rm -rf dist",
+        "postinstall": "node postinstall.mjs",
         "prepack": "tsc -b"
     },
     "dependencies": {
         "@anthropic-ai/sdk": "^0.120.0",
-        "@google/genai": "^2.18.0",
+        "@google/genai": "^2.30.0",
         "@inkjs/ui": "^2.0.0",
-        "@openrouter/sdk": "^1.2.80",
-        "@zenera/neo": "^1.1.28",
-        "@zenera/view": "^1.1.28",
+        "@openrouter/sdk": "^1.4.25",
+        "@zenera/neo": "^1.1.30",
+        "@zenera/view": "^1.1.30",
         "google-auth-library": "^10.0.0",
         "ink": "^7.1.1",
         "openai": "^6.0.0",
         "react": "^19.2.8",
-        "yaml": "^2.9.0",
+        "yaml": "^2.9.1",
         "yauzl": "^3.4.0",
         "yazl": "^3.3.1"
     },

package/postinstall.mjs

@@ -0,0 +1,7 @@
+// dist/ is absent when the workspace is installed from source (before the first build).
+import { existsSync } from 'node:fs';
+
+const entry = new URL('./dist/postinstall.js', import.meta.url);
+if (existsSync(entry)) {
+    await import(entry.href);
+}

package/templates/completions/zen.bash

@@ -0,0 +1,16 @@
+# zen completion for bash. Add to ~/.bashrc:
+#
+#     eval "$(zen completion bash)"
+#
+# Everything it offers comes from `zen __complete`; when that has nothing to
+# say, file names are completed instead (`-o default`).
+_zen() {
+    local out value
+    COMPREPLY=()
+    out=$("${COMP_WORDS[0]}" __complete "${COMP_WORDS[@]:1:COMP_CWORD}" 2>/dev/null) || return 0
+    while IFS=$'\t' read -r value _; do
+        [[ -n $value ]] && COMPREPLY+=("$value")
+    done <<< "$out"
+}
+
+complete -o default -F _zen zen zn zenera