@zenera/cli 1.1.3 → 1.1.5

package/dist/catalog.js

@@ -0,0 +1,439 @@
+// ---------------------------------------------------------------------------
+// The catalog
+//
+// What each provider will actually serve this machine, asked of the provider
+// itself and remembered on disk.
+//
+// Note what is *not* here: any judgement about which model is good. The lists
+// below are ordered by how likely a call is to succeed and how little it costs
+// to find out, not by quality — a recovery path, not a recommender. The moment
+// a file like this starts ranking intelligence it becomes a thing that has to
+// be argued about every quarter, and the argument is not what anyone came for.
+//
+// Nor is there a single hard-coded table of every model. Vendors ship models
+// faster than a release cycle, so the shipped table is a *fallback* and the
+// answer is whatever the vendor said this morning. Every row carries its own
+// `source` for exactly that reason: a curated guess must never be mistaken for
+// the vendor's own word.
+// ---------------------------------------------------------------------------
+import { join } from 'node:path';
+import { ModelRegistry } from '@zenera/neo';
+import { paths, readJson, writeJson } from "./home.js";
+import { PROVIDERS } from "./keys.js";
+import { classify } from "./liveness.js";
+/** A day. Model lists change on the scale of weeks; a stale row costs a retry. */
+export const CATALOG_TTL_MS = 24 * 60 * 60 * 1000;
+const CACHE_VERSION = 1;
+// ---------------------------------------------------------------------------
+// The fallback table
+// ---------------------------------------------------------------------------
+/**
+ * Enough to work with when the provider cannot be asked — offline, no
+ * credential, or a listing endpoint that is down. Deliberately short: this is
+ * the set worth typing, not the set that exists.
+ *
+ * Anthropic publishes no embeddings API at all, which is why it has no
+ * embedding row here and why the registry throws rather than guessing.
+ */
+export const CURATED = {
+    openai: [
+        { id: 'gpt-4o-mini', roles: ['chat'], contextLength: 128_000 },
+        { id: 'gpt-4o', roles: ['chat'], contextLength: 128_000 },
+        { id: 'text-embedding-3-small', roles: ['embedding'], dimensions: 1536 },
+        { id: 'text-embedding-3-large', roles: ['embedding'], dimensions: 3072 },
+    ],
+    anthropic: [
+        { id: 'claude-haiku-4-5', roles: ['chat'], contextLength: 200_000 },
+        { id: 'claude-sonnet-4-5', roles: ['chat'], contextLength: 200_000 },
+    ],
+    google: [
+        { id: 'gemini-2.5-flash', roles: ['chat'], contextLength: 1_048_576 },
+        { id: 'gemini-2.5-pro', roles: ['chat'], contextLength: 1_048_576 },
+        { id: 'gemini-embedding-001', roles: ['embedding'], dimensions: 3072 },
+    ],
+    vertex: [
+        { id: 'gemini-2.5-flash', roles: ['chat'], contextLength: 1_048_576 },
+        { id: 'gemini-2.5-pro', roles: ['chat'], contextLength: 1_048_576 },
+        { id: 'gemini-embedding-001', roles: ['embedding'], dimensions: 3072 },
+        { id: 'text-embedding-005', roles: ['embedding'], dimensions: 768 },
+    ],
+    openrouter: [
+        { id: 'openai/gpt-4o-mini', roles: ['chat'] },
+        { id: 'anthropic/claude-haiku-4.5', roles: ['chat'] },
+        { id: 'openai/text-embedding-3-small', roles: ['embedding'], dimensions: 1536 },
+    ],
+};
+/**
+ * The order `zen models pick` walks, per provider and per role.
+ *
+ * Cheap and fast first. `pick` exists to answer "give me something that works"
+ * in one round trip where it can, and the small models answer soonest and cost
+ * least when the answer is thrown away — which it always is.
+ */
+export const PREFERRED = {
+    openai: {
+        chat: ['gpt-4o-mini', 'gpt-4o'],
+        embedding: ['text-embedding-3-small', 'text-embedding-3-large'],
+    },
+    anthropic: {
+        chat: ['claude-haiku-4-5', 'claude-sonnet-4-5'],
+        embedding: [],
+    },
+    google: {
+        chat: ['gemini-2.5-flash', 'gemini-2.5-pro'],
+        embedding: ['gemini-embedding-001'],
+    },
+    vertex: {
+        chat: ['gemini-2.5-flash', 'gemini-2.5-pro'],
+        embedding: ['text-embedding-005', 'gemini-embedding-001'],
+    },
+    openrouter: {
+        chat: ['openai/gpt-4o-mini', 'anthropic/claude-haiku-4.5'],
+        embedding: ['openai/text-embedding-3-small'],
+    },
+};
+function curated(provider) {
+    return CURATED[provider].map((entry) => ({
+        ...entry,
+        ref: `${provider}:${entry.id}`,
+        provider,
+        source: 'curated',
+    }));
+}
+// ---------------------------------------------------------------------------
+// Vendor adapters
+//
+// Each takes the client `ModelRegistry` already built — never a direct SDK
+// import — so a missing optional dependency surfaces as the library's own
+// "run: npm i openai" rather than a stack trace from this file.
+//
+// The SDK types are described structurally and locally. Four vendors' generated
+// types would drag half of `zod` into a module whose whole job is to produce
+// one flat row shape, and every field here is one the wire format has carried
+// unchanged for years.
+// ---------------------------------------------------------------------------
+const iso = (value) => {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    // OpenAI and OpenRouter both say unix seconds; Anthropic says a timestamp.
+    const date = typeof value === 'number' ? new Date(value * 1000) : new Date(value);
+    return Number.isNaN(date.getTime()) ? undefined : date.toISOString().slice(0, 10);
+};
+/** Drops empty optionals so a cached row does not carry a dozen `undefined`s. */
+function entry(provider, row) {
+    const clean = Object.fromEntries(Object.entries(row).filter(([, v]) => v !== undefined && v !== null));
+    return { ...clean, ref: `${provider}:${row.id}`, provider, source: 'live' };
+}
+/**
+ * OpenAI's listing is three fields — id, created, owner — so the role has to be
+ * read off the id. Wrong on an id nobody has seen before, which is why the
+ * curated table is merged over the top and why `test` asks the model itself.
+ */
+function openaiRole(id) {
+    if (/moderation/.test(id)) {
+        return undefined; // not reachable through any interface this CLI has
+    }
+    if (/embedding/.test(id)) {
+        return 'embedding';
+    }
+    // `dall-e-3`, `gpt-image-1` and `chatgpt-image-latest` share only the word.
+    if (/^dall-e|image/.test(id)) {
+        return 'image';
+    }
+    if (/(whisper|tts|transcribe|realtime|audio)/.test(id)) {
+        return 'audio';
+    }
+    return 'chat';
+}
+async function fromOpenAI(client, provider) {
+    const page = await client.models.list();
+    const rows = [];
+    for await (const model of page) {
+        const role = openaiRole(model.id);
+        if (role) {
+            rows.push(entry(provider, { id: model.id, roles: [role], created: iso(model.created) }));
+        }
+    }
+    return rows;
+}
+async function fromAnthropic(client, provider) {
+    const page = await client.models.list({ limit: 1000 });
+    const rows = [];
+    for await (const model of page) {
+        // Every model Anthropic lists is a chat model. Emitting an embedding
+        // row would be inventing an endpoint that does not exist.
+        rows.push(entry(provider, {
+            id: model.id,
+            roles: ['chat'],
+            name: model.display_name,
+            created: iso(model.created_at),
+        }));
+    }
+    return rows;
+}
+/**
+ * Google returns resource names — `models/gemini-2.5-flash`, or under Vertex
+ * `publishers/google/models/…`. The native API takes the bare tail, and the
+ * bare tail is what a ref has to hold, so the prefix comes off here.
+ */
+const bareId = (name) => name.split('/').pop() ?? name;
+/**
+ * Vertex lists the whole Model Garden — `alphafold3-request`, `bart-large-cnn`,
+ * `automl-e2e` — alongside the models the GenAI API will actually serve. The
+ * garden rows are deployment recipes, not model ids: they carry no
+ * `supportedActions` and no token limits, and asking one of them a question
+ * fails in a way no error message explains.
+ *
+ * So a row with no declared actions has to earn its place on the id. Generous
+ * on purpose — a new `gemini-4` must not need a release here — and it only
+ * applies where the backend told us nothing.
+ */
+const GENERATIVE = /^(gemini|gemma|imagen|veo|text-embedding|text-multilingual|multimodalembedding|embedding)/;
+async function fromGenAI(client, provider) {
+    // `queryBase: true` is not optional: without it the SDK lists *tuned*
+    // models, and an account with none looks like an account with no models —
+    // which is precisely the confusion this command exists to end.
+    const pager = await client.models.list({
+        config: { queryBase: true, pageSize: 200 },
+    });
+    const rows = [];
+    for await (const model of pager) {
+        if (!model.name) {
+            continue;
+        }
+        const id = bareId(model.name);
+        const actions = model.supportedActions ?? [];
+        const roles = [];
+        if (actions.includes('embedContent')) {
+            roles.push('embedding');
+        }
+        if (actions.includes('generateContent') || actions.includes('streamGenerateContent')) {
+            roles.push('chat');
+        }
+        if (actions.includes('predict') && /image|imagen/.test(id)) {
+            roles.push('image');
+        }
+        if (roles.length === 0) {
+            if (!GENERATIVE.test(id)) {
+                continue;
+            }
+            roles.push(/embedding/.test(id) ? 'embedding' : 'chat');
+        }
+        rows.push(entry(provider, {
+            id,
+            roles,
+            name: model.displayName,
+            description: model.description,
+            contextLength: model.inputTokenLimit,
+            maxOutputTokens: model.outputTokenLimit,
+        }));
+    }
+    return rows;
+}
+function routerRow(provider, model, roles) {
+    const input = model.architecture?.inputModalities ?? [];
+    const params = model.supportedParameters ?? [];
+    const prompt = model.pricing?.prompt;
+    return entry(provider, {
+        id: model.id,
+        roles,
+        name: model.name,
+        description: model.description,
+        contextLength: model.contextLength ?? undefined,
+        maxOutputTokens: model.topProvider?.maxCompletionTokens ?? undefined,
+        modalities: {
+            input,
+            output: model.architecture?.outputModalities ?? [],
+        },
+        supports: {
+            tools: params.includes('tools'),
+            reasoning: params.includes('reasoning') || params.includes('include_reasoning'),
+            vision: input.includes('image'),
+        },
+        pricing: {
+            prompt,
+            completion: model.pricing?.completion,
+            // OpenRouter writes a free model's price as the string "0".
+            free: prompt !== undefined && Number(prompt) === 0,
+        },
+        created: iso(model.created),
+    });
+}
+async function walk(pages) {
+    const all = [];
+    for await (const page of pages) {
+        all.push(...(page.result?.data ?? []));
+    }
+    return all;
+}
+async function fromRouter(client, provider) {
+    const router = client;
+    // Two endpoints, because OpenRouter routes embeddings separately and the
+    // chat listing does not mention them. Asked together: one slow provider
+    // should not cost twice the wall clock.
+    //
+    // Only the chat listing is allowed to fail the whole call. The embeddings
+    // endpoint is the newer of the two and the one a gateway is most likely not
+    // to proxy, and losing every chat model over it would be a poor trade.
+    const [chat, embedding] = await Promise.all([
+        walk(await router.models.list()),
+        (async () => {
+            try {
+                return await walk(await router.embeddings.listModels());
+            }
+            catch {
+                return [];
+            }
+        })(),
+    ]);
+    const rows = chat.map((m) => routerRow(provider, m, ['chat']));
+    const seen = new Set(rows.map((r) => r.id));
+    for (const m of embedding) {
+        if (!seen.has(m.id)) {
+            rows.push(routerRow(provider, m, ['embedding']));
+        }
+    }
+    return rows;
+}
+/**
+ * Asks one provider what it serves. Throws whatever the SDK throws.
+ *
+ * `client` is a seam, not a feature: the four adapters are the part most likely
+ * to break when a vendor reshapes a payload, and they are untestable if the
+ * only way to reach them is a credential and a network. It mirrors
+ * `ProviderSpec.client`, which exists in the library for the same reason.
+ */
+export async function fetchCatalog(provider, client = new ModelRegistry().client(provider)) {
+    switch (provider) {
+        case 'openai':
+            return enrich(provider, await fromOpenAI(client, provider));
+        case 'anthropic':
+            return enrich(provider, await fromAnthropic(client, provider));
+        case 'google':
+        case 'vertex':
+            return enrich(provider, await fromGenAI(client, provider));
+        case 'openrouter':
+            return enrich(provider, await fromRouter(client, provider));
+    }
+}
+// ---------------------------------------------------------------------------
+// Enrichment and cache
+// ---------------------------------------------------------------------------
+/**
+ * A live row wins on every field it filled in, and the curated table supplies
+ * the rest. That is how `text-embedding-3-small` gets its width from here while
+ * still being reported as the vendor's own row: OpenAI's listing carries no
+ * dimensions field at all, and a blank there would send someone to the docs.
+ */
+function enrich(provider, live) {
+    const known = new Map(CURATED[provider].map((c) => [c.id, c]));
+    return live.map((row) => {
+        const extra = known.get(row.id);
+        if (!extra) {
+            return row;
+        }
+        return {
+            ...row,
+            roles: row.roles.length > 0 ? row.roles : [...extra.roles],
+            contextLength: row.contextLength ?? extra.contextLength,
+            dimensions: row.dimensions ?? extra.dimensions,
+        };
+    });
+}
+const cachePath = (provider) => join(paths.catalog(), `${provider}.json`);
+async function readCache(provider) {
+    const file = await readJson(cachePath(provider), undefined);
+    return file?.version === CACHE_VERSION && Array.isArray(file.entries) ? file : undefined;
+}
+/**
+ * The listing for one provider, from the cheapest source that can answer.
+ *
+ * Fresh cache, else the provider, else a *stale* cache, else the curated table.
+ * Stale-before-curated is the important ordering: yesterday's real answer from
+ * this account beats today's guess about accounts in general, and a listing
+ * that failed because the wifi dropped should not silently shrink someone's
+ * model list to four rows.
+ */
+export async function loadCatalog(provider, opts = {}) {
+    const cached = await readCache(provider);
+    const fresh = cached && Date.now() - new Date(cached.fetchedAt).getTime() < CATALOG_TTL_MS
+        ? cached
+        : undefined;
+    if (fresh && !opts.refresh) {
+        return { provider, entries: fresh.entries, origin: 'cache', fetchedAt: fresh.fetchedAt };
+    }
+    if (!opts.offline) {
+        try {
+            const entries = await fetchCatalog(provider);
+            const fetchedAt = new Date().toISOString();
+            writeJson(cachePath(provider), { version: CACHE_VERSION, provider, fetchedAt, entries }, 
+            // Public data, and readable so a human can look at what was cached.
+            0o644);
+            return { provider, entries, origin: 'live', fetchedAt };
+        }
+        catch (err) {
+            const problem = classify(err);
+            if (cached) {
+                return {
+                    provider,
+                    entries: cached.entries,
+                    origin: 'stale',
+                    fetchedAt: cached.fetchedAt,
+                    problem,
+                };
+            }
+            return {
+                provider,
+                entries: curated(provider),
+                origin: 'curated',
+                fetchedAt: new Date(0).toISOString(),
+                problem,
+            };
+        }
+    }
+    if (cached) {
+        return { provider, entries: cached.entries, origin: 'stale', fetchedAt: cached.fetchedAt };
+    }
+    return {
+        provider,
+        entries: curated(provider),
+        origin: 'curated',
+        fetchedAt: new Date(0).toISOString(),
+    };
+}
+/** Every provider asked at once — they are independent and mostly latency. */
+export async function loadCatalogs(providers, opts = {}) {
+    return Promise.all(providers.map((p) => loadCatalog(p, opts)));
+}
+export function matches(row, query, filters = {}) {
+    if (filters.roles?.length && !filters.roles.some((r) => row.roles.includes(r))) {
+        return false;
+    }
+    if (filters.tools && !row.supports?.tools) {
+        return false;
+    }
+    if (filters.vision && !row.supports?.vision) {
+        return false;
+    }
+    if (filters.free && !row.pricing?.free) {
+        return false;
+    }
+    if (filters.minContext !== undefined && (row.contextLength ?? 0) < filters.minContext) {
+        return false;
+    }
+    if (!query) {
+        return true;
+    }
+    // Every whitespace-separated word must appear somewhere, so `claude haiku`
+    // narrows rather than widening the way an OR would.
+    const haystack = `${row.ref} ${row.name ?? ''} ${row.description ?? ''}`.toLowerCase();
+    return query
+        .toLowerCase()
+        .split(/\s+/)
+        .filter(Boolean)
+        .every((word) => haystack.includes(word));
+}
+/** The providers a search covers when none was named. */
+export const catalogProviders = () => PROVIDERS;
+//# sourceMappingURL=catalog.js.map

package/dist/commands/check.js

@@ -2,11 +2,12 @@ import { existsSync, statSync } from 'node:fs';
 import { basename, dirname, resolve } from 'node:path';
 import { one, parse } from "../args.js";
 import { KeyStore } from "../keys.js";
+import { duration } from "../narrate.js";
 import { Registry } from "../projects.js";
 import { project as resolveProject } from "../resolve.js";
 import { bold, count, cyan, dim, green, invalidError, json, progress, red, table, usageError, write, writeAll, yellow, } from "../term.js";
 import { validateProject, } from "../validate.js";
-const USAGE = 'zen check [name|dir] [--project <name|dir>] [--no-sandbox] [--strict] [--quiet]';
+const USAGE = 'zen check [name|dir] [--project <name|dir>] [--no-sandbox] [--no-models] [--strict] [--quiet]';
 // ---------------------------------------------------------------------------
 // zen check
 //
@@ -17,15 +18,19 @@ const USAGE = 'zen check [name|dir] [--project <name|dir>] [--no-sandbox] [--str
 // stable code and a fix, and the whole thing goes to stdout — it is the answer,
 // not narration.
 //
-// Nothing is contacted or paid for. The one thing that *runs* is the sandbox:
-// the project's image is built and one command is executed in it, because a
-// Dockerfile that does not build is a broken project and nothing short of
-// building it says so. It happens against a temporary directory, the container
-// is removed on the way out, and `--no-sandbox` skips it — so the report is
-// still worth having on the machine that has no container engine at all.
+// Almost nothing is contacted or paid for. The two exceptions earn their keep.
+// The sandbox: the project's image is built and one command is executed in it,
+// because a Dockerfile that does not build is a broken project and nothing
+// short of building it says so. It happens against a temporary directory, the
+// container is removed on the way out, and `--no-sandbox` skips it. And the
+// models: each one that has a credential is asked to answer once, because a key
+// that authenticates says nothing about the id it is spent on, and a misspelt or
+// retired model is invisible to every reading of the files. That costs a few
+// tokens and `--no-models` skips it — so the report is still worth having on the
+// machine that has no container engine and no key at all.
 // ---------------------------------------------------------------------------
 export const check = {
-    summary: 'Validate agents.yaml and every file it names, and report in full.',
+    summary: 'Validate agents.yaml and every file it names, and ask its models.',
     usage: USAGE,
     details: [
         'Checks the whole project: the configuration parses and satisfies the',
@@ -35,9 +40,13 @@ export const check = {
         'on this machine.',
         '',
         'It also builds the sandbox image and runs one command in it, against a',
-        'temporary directory rather than your workspace. That is the only thing',
-        'it starts, and --no-sandbox skips it. No container engine is a warning,',
-        'not an error.',
+        'temporary directory rather than your workspace, and --no-sandbox skips',
+        'it. No container engine is a warning, not an error.',
+        '',
+        'It also asks every model it holds a credential for to answer once — a few',
+        'tokens apiece, and the only way to learn that a model id is misspelt,',
+        'retired, or not granted to this account. A refusal is an error; a model',
+        'that never answered is a warning. --no-models skips it.',
         '',
         'Unlike a run, it does not stop at the first problem — the report lists',
         'everything it found, each with a code and the fix for it.',
@@ -52,6 +61,7 @@ export const check = {
         const { values, positionals } = parse(ctx.args, {
             project: { type: 'string' },
             'no-sandbox': { type: 'boolean' },
+            'no-models': { type: 'boolean' },
             strict: { type: 'boolean' },
             quiet: { type: 'boolean' },
         }, USAGE);
@@ -78,6 +88,10 @@ export const check = {
                 enabled: !values['no-sandbox'],
                 onProgress: (what) => bar.update(dim(what)),
             },
+            models: {
+                enabled: !values['no-models'],
+                onProgress: (what) => bar.update(dim(what)),
+            },
         });
         bar.done();
         if (ctx.json) {
@@ -188,6 +202,7 @@ function render(report) {
             dim(m.provider ? `${m.provider} (${m.kind})` : red('unresolved')),
             dim(m.env ?? ''),
             credential(m.credential),
+            answer(m),
             // Nothing consumes an embedding yet, so `usedBy` would
             // always read "declared, unused" and say the wrong thing.
             dim(m.role === 'embedding'
@@ -316,6 +331,19 @@ function credential(state) {
     }
     return state === 'rejected' ? red('rejected') : dim('unchecked');
 }
+/** What the provider said when the model itself was asked, if it was. */
+function answer(m) {
+    if (!m.check) {
+        return dim('not asked');
+    }
+    if (m.check.state === 'live') {
+        return `${green('answers')} ${dim(duration(m.check.ms))}`;
+    }
+    if (m.check.state === 'blocked') {
+        return yellow('blocked');
+    }
+    return m.check.state === 'dead' ? red('refused') : yellow('no answer');
+}
 function tallyLine(report) {
     const { errors, warnings, notes } = report.counts;
     return `${count(errors, 'error')}, ${count(warnings, 'warning')}, ${count(notes, 'note')}`;

package/dist/commands/index.d.ts

@@ -2,8 +2,8 @@ import type { BannerText } from '../banner.ts';
 import type { Command } from '../command.ts';
 /**
  * Insertion order is the order help prints in, and it is deliberate: the four
- * a new user needs first, then the two about credentials and models, then the
- * two that are only ever run on purpose.
+ * a new user needs first, then the credentials-and-models pair, then the two
+ * reports on a project, then the two that are only ever run on purpose.
  */
 export declare const COMMANDS: Record<string, Command>;
 /** Names that are not listed in help but still work. */

package/dist/commands/index.js

@@ -10,8 +10,8 @@ import { sandbox } from "./sandbox.js";
 import { version } from "./version.js";
 /**
  * Insertion order is the order help prints in, and it is deliberate: the four
- * a new user needs first, then the two about credentials and models, then the
- * two that are only ever run on purpose.
+ * a new user needs first, then the credentials-and-models pair, then the two
+ * reports on a project, then the two that are only ever run on purpose.
  */
 export const COMMANDS = {
     init,
@@ -30,6 +30,7 @@ export const ALIASES = {
     ls: 'list',
     new: 'init',
     keys: 'key',
+    model: 'models',
     validate: 'check',
     doctor: 'check',
     report: 'inspect',
@@ -48,7 +49,7 @@ export const EXTERNAL = {
     rag: {
         package: '@zenera/rag',
         summary: 'Search an openapi/swagger document as a graph.',
-        usage: 'zen rag schema <index|search|show|stats> [spec...]',
+        usage: 'zen rag schema <index|search|list|grep|show|stats> [spec...]',
         install: 'npm i -g @zenera/rag',
         banner: { head: 'Zenera', accent: 'Rag', subtitle: 'Api Retrieval' },
     },

package/dist/commands/key.js

@@ -11,6 +11,7 @@ const USAGE = 'zen key <ls|add|use|check|rm|show|env> [ref] [options]';
 const MARK = {
     live: green('live'),
     dead: red('dead'),
+    blocked: yellow('blocked'),
     unknown: dim('unknown'),
 };
 function state(entry) {
@@ -179,6 +180,12 @@ const add = async (ctx, args) => {
         if (check.state === 'dead') {
             note(`${red('rejected')} ${check.detail ?? 'the provider refused this key'}`);
         }
+        else if (check.state === 'blocked') {
+            note(`${yellow('blocked')} ${check.detail ?? 'the account cannot use this key'}`);
+            if (check.fix) {
+                note(dim(`  ${check.fix}`));
+            }
+        }
     }
     store.save();
     if (ctx.json) {
@@ -256,9 +263,19 @@ const check = async (ctx, args) => {
         MARK[result.state],
         dim(result.detail ?? ''),
     ])));
+    for (const [entry, result] of checks) {
+        if (result.fix) {
+            note(dim(`${keyId(entry)}: ${result.fix}`));
+        }
+    }
     if (checks.some(([, r]) => r.state === 'dead')) {
         throw credentialError('at least one key was refused');
     }
+    // Separately, because the action is not the same one: these authenticated,
+    // and a replacement key would be refused for exactly the same reason.
+    if (checks.some(([, r]) => r.state === 'blocked')) {
+        throw credentialError('at least one key authenticated but cannot be used');
+    }
 };
 function select(store, ref) {
     const { provider, name } = parseRef(ref);
@@ -334,6 +351,7 @@ const show = async (ctx, args) => {
         ...(entry.project ? [[dim('project'), entry.project]] : []),
         ...(entry.location ? [[dim('location'), entry.location]] : []),
         [dim('state'), state(entry)],
+        ...(entry.check?.fix ? [[dim('fix'), entry.check.fix]] : []),
         [dim('added'), ago(entry.addedAt)],
     ]));
     note(dim('--reveal prints the secret itself'));

package/dist/commands/models.d.ts

@@ -1,9 +1,3 @@
 import type { Command } from '../command.ts';
-/**
- * Everything a run would resolve, resolved — and nothing called. Loading a
- * project constructs the model clients, so a config that names an impossible
- * provider or an agent that hands off to nobody fails here, in a command that
- * costs nothing, instead of three seconds into a run that costs money.
- */
 export declare const models: Command;
 //# sourceMappingURL=models.d.ts.map