bazilion 0.6.0 → 0.8.0

package/README.md

@@ -33,7 +33,7 @@ From another terminal:
 # Set up a provider (env var, or `bazilion config set` to persist it).
 export ANTHROPIC_API_KEY=sk-ant-...
 bazilion provider enable anthropic
-bazilion provider models anthropic claude-sonnet-4-6
+bazilion provider models-set anthropic claude-opus-4-8
 
 # Spawn an agent from the default profile and chat with it.
 bazilion agent spawn --profile default --name first
@@ -53,7 +53,7 @@ The web UI is bundled into the published `bazilion` package and starts with:
 bazilion dashboard
 ```
 
-For source development, clone the repo and run the daemon plus Vite dev server:
+For source development, clone the repo and run the daemon plus Vite dev server. Node 24+ and pnpm 10+ are required; if `corepack` is unavailable, install pnpm directly with `npm install -g pnpm`.
 
 ```sh
 git clone https://github.com/rullopat/bazilion
@@ -71,13 +71,13 @@ bazilion auth openai login     # browser flow on localhost:1455
 bazilion auth openai status    # check connection / token expiry
 ```
 
-After connecting, enable `openai-codex` and curate at least one model. Credentials are stored AES-256-GCM-encrypted in the daemon's `secrets` table.
+After connecting, enable `openai-codex` and curate at least one model, for example `gpt-5.3-codex-spark`. Credentials are stored AES-256-GCM-encrypted in the daemon's `secrets` table.
 
 ## What's in the box
 
 - **CLI + daemon + web UI**, spawned together via `bazilion dashboard`. The daemon binds `127.0.0.1:4321`, the web UI binds `127.0.0.1:4322`, and the daemon owns `~/.bazilion/` (SQLite DB, profiles, agents, groups, skills, logs).
 - **17 subcommand families**: `agent`, `profile`, `group`, `skill`, `provider`, `config`, `auth`, `memory`, `send`, `inbox`, `trigger`, `serve`, `doctor`, `backup`, `token`, `login`, `uninstall`.
-- **Provider support** via [pi-ai](https://www.npmjs.com/package/@earendil-works/pi-ai): Anthropic, OpenAI (key + ChatGPT OAuth), Google AI Studio + Vertex, Azure OpenAI, AWS Bedrock, Mistral, Groq, Cerebras, xAI, Z.AI, Hugging Face, OpenRouter, Vercel AI Gateway, LM Studio, Ollama.
+- **Provider support** via [pi-ai](https://www.npmjs.com/package/@earendil-works/pi-ai): Anthropic, OpenAI (key + ChatGPT OAuth), Google AI Studio + Vertex, Azure OpenAI, AWS Bedrock, Mistral, Groq, Cerebras, xAI, zAI, Hugging Face, OpenRouter, Vercel AI Gateway, Cloudflare, GitHub Copilot, DeepSeek, Fireworks, Together, Moonshot/Kimi, MiniMax, Xiaomi MiMo, Ant Ling, NVIDIA NIM, OpenCode, LM Studio, Ollama, and llama.cpp.
 - **OpenClaw-compatible skills**: drop a `SKILL.md` into `~/.bazilion/skills/<name>/`, or import in bulk via `bazilion skill import --from openclaw`.
 
 ## Uninstall

package/dist/cli.js

@@ -6,7 +6,7 @@ import { defineCommand as defineCommand23, runCommand, showUsage } from "citty";
 // package.json
 var package_default = {
   name: "bazilion",
-  version: "0.6.0",
+  version: "0.8.0",
   description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/groups/skills, and run the local daemon.",
   license: "MIT",
   repository: {
@@ -49,26 +49,26 @@ var package_default = {
     access: "public"
   },
   dependencies: {
-    "@earendil-works/pi-agent-core": "^0.77.0",
-    "@earendil-works/pi-ai": "^0.77.0",
-    "@earendil-works/pi-coding-agent": "^0.77.0",
-    "@tanstack/react-router": "1.170.16",
-    "@hono/node-server": "^2.0.4",
+    "@earendil-works/pi-agent-core": "^0.79.10",
+    "@earendil-works/pi-ai": "^0.79.10",
+    "@earendil-works/pi-coding-agent": "^0.79.10",
+    "@hono/node-server": "^2.0.6",
     "@mozilla/readability": "^0.6.0",
+    "@tanstack/react-router": "1.170.16",
     "@tobilu/qmd": "^2.5.3",
     "adm-zip": "^0.5.17",
     citty: "^0.2.2",
-    dompurify: "^3.4.7",
-    grammy: "^1.43.0",
-    hono: "^4.12.23",
+    dompurify: "^3.4.11",
+    grammy: "^1.44.0",
+    hono: "^4.12.26",
     linkedom: "^0.18.12",
-    "lucide-react": "^1.17.0",
-    playwright: "^1.60.0",
+    "lucide-react": "^1.21.0",
+    playwright: "^1.61.0",
     "qrcode-terminal": "^0.12.0",
-    react: "^19.2.6",
-    "react-dom": "^19.2.6",
-    typebox: "^1.1.39",
-    undici: "^8.3.0",
+    react: "^19.2.7",
+    "react-dom": "^19.2.7",
+    typebox: "^1.3.0",
+    undici: "^8.5.0",
     yaml: "^2.9.0"
   },
   devDependencies: {
@@ -736,15 +736,38 @@ var skillAddCmd = defineCommand({
   meta: { name: "add", description: "Attach a skill to an agent" },
   args: {
     agent: { type: "positional", required: true },
-    skill: { type: "positional", required: true }
+    skill: { type: "positional", required: true },
+    "allow-warnings": {
+      type: "boolean",
+      description: "Attach even when the static skill scan reports findings"
+    }
   },
   async run({ args }) {
     const client = createClient2();
-    const body = { skill: args.skill };
-    await client.post(`/api/agents/${args.agent}/skills`, body);
+    const body = { skill: args.skill, allowFindings: args["allow-warnings"] };
+    try {
+      await client.post(`/api/agents/${args.agent}/skills`, body);
+    } catch (err) {
+      if (err instanceof ApiClientError && err.body.code === "skill_scan_blocked") {
+        console.error(`error: ${err.body.error}`);
+        printSkillFindings(err.body.findings ?? []);
+        console.error("  hint: inspect the skill, then rerun with --allow-warnings to confirm");
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
+    }
     console.log(`attached skill ${args.skill} to ${args.agent}`);
   }
 });
+function printSkillFindings(findings) {
+  if (findings.length === 0) return;
+  console.error("scan findings:");
+  for (const f of findings) {
+    const line = f.line ? ` line ${f.line}` : "";
+    console.error(`  ${f.severity}: ${f.code}${line} - ${f.message}`);
+  }
+}
 var skillRmCmd = defineCommand({
   meta: { name: "rm", description: "Detach a skill from an agent" },
   args: {
@@ -872,8 +895,11 @@ var openaiLoginCmd = defineCommand2({
     if (status.accountId) console.log(`account: ${status.accountId}`);
     console.log(`access token expires: ${formatExpiry(status.expiresAt)}`);
     console.log("");
-    console.log(`enable the 'openai-codex' provider on /config and add at least one model`);
-    console.log("(e.g. gpt-5.3-codex, gpt-5.4, gpt-5.5) to start using it.");
+    console.log(`enable the 'openai-codex' provider on /config and save at least one model`);
+    console.log("(e.g. gpt-5.3-codex-spark, gpt-5.4, gpt-5.5) to start using it.");
+    console.log("CLI equivalent:");
+    console.log("  bazilion provider enable openai-codex");
+    console.log("  bazilion provider models-set openai-codex gpt-5.3-codex-spark");
   }
 });
 var openaiLogoutCmd = defineCommand2({
@@ -1507,7 +1533,7 @@ var doctorCommand = defineCommand7({
       check("all skills parse", false, `${r.skills.parseErrors} skill(s) have errors`);
     }
     console.log();
-    console.log("providers (at least one needed for chat)");
+    console.log("providers (enable one and save at least one model for chat)");
     if (r.providers.configured.length === 0) {
       console.log("  - no cloud providers configured");
       console.log("    (set e.g. ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY)");
@@ -1567,7 +1593,10 @@ var doctorCommand = defineCommand7({
         todo.push("  - set a cloud api key (ANTHROPIC_API_KEY / OPENAI_API_KEY / GEMINI_API_KEY)");
         todo.push("    or make sure LMStudio / Ollama is running locally");
       }
-      if (!hasProfiles) todo.push("  - create a profile: bazilion profile create <id> --model \u2026");
+      if (!hasProfiles) {
+        todo.push("  - enable a provider: bazilion provider enable <provider>");
+        todo.push("  - save a model: bazilion provider models-set <provider> <model-id>");
+      }
       if (!hasAgents) todo.push("  - spawn an agent: bazilion agent spawn --profile <id>");
       for (const line of todo) console.log(line);
     } else {
@@ -2824,6 +2853,12 @@ var serveCommand = defineCommand17({
 import { existsSync as existsSync6, readFileSync as readFileSync7, statSync } from "fs";
 import { basename as basename2, resolve as resolve2 } from "path";
 import { defineCommand as defineCommand18 } from "citty";
+function printFindings(findings, prefix = "  ") {
+  for (const f of findings) {
+    const line = f.line ? ` line ${f.line}` : "";
+    console.log(`${prefix}${f.severity}: ${f.code}${line} - ${f.message}`);
+  }
+}
 var listCmd10 = defineCommand18({
   meta: { name: "list", description: "List installed skills (or those attached to an agent)" },
   args: {
@@ -2854,6 +2889,15 @@ var listCmd10 = defineCommand18({
       s.parseError ? `(parse error: ${s.parseError})` : s.description
     ]);
     for (const line of columnize(rows)) console.log(line);
+    const flagged = skills.filter((s) => s.scanFindings && s.scanFindings.length > 0);
+    if (flagged.length > 0) {
+      console.log("");
+      console.log("scan findings:");
+      for (const s of flagged) {
+        console.log(`${s.name}:`);
+        printFindings(s.scanFindings ?? []);
+      }
+    }
   }
 });
 var importCmd = defineCommand18({
@@ -2874,19 +2918,36 @@ var importCmd = defineCommand18({
     const absFrom = resolve2(args.from);
     const isLocalZip = args.from.toLowerCase().endsWith(".zip") && existsSync6(absFrom) && statSync(absFrom).isFile();
     let result;
-    if (isLocalZip) {
-      const bytes = readFileSync7(absFrom);
-      const file = new File([bytes], basename2(absFrom), { type: "application/zip" });
-      const fd = new FormData();
-      fd.set("file", file);
-      if (args.force) fd.set("force", "true");
-      result = await client.postMultipart("/api/skills/import", fd);
-    } else {
-      const body = {
-        source: args.from,
-        force: args.force
-      };
-      result = await client.post("/api/skills/import", body);
+    try {
+      if (isLocalZip) {
+        const bytes = readFileSync7(absFrom);
+        const file = new File([bytes], basename2(absFrom), { type: "application/zip" });
+        const fd = new FormData();
+        fd.set("file", file);
+        if (args.force) fd.set("force", "true");
+        result = await client.postMultipart("/api/skills/import", fd);
+      } else {
+        const body = {
+          source: args.from,
+          force: args.force
+        };
+        result = await client.post("/api/skills/import", body);
+      }
+    } catch (err) {
+      if (err instanceof ApiClientError && err.body.code === "skill_scan_blocked") {
+        console.error(`error: ${err.body.error}`);
+        if (err.body.findings && err.body.findings.length > 0) {
+          console.error("scan findings:");
+          for (const f of err.body.findings) {
+            const line = f.line ? ` line ${f.line}` : "";
+            console.error(`  ${f.severity}: ${f.code}${line} - ${f.message}`);
+          }
+        }
+        console.error("  hint: inspect the skill, then rerun with --force to confirm");
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
     }
     if (result.imported.length === 0 && result.skipped.length === 0) {
       console.log("(nothing to import)");
@@ -2898,6 +2959,14 @@ var importCmd = defineCommand18({
     for (const s of result.skipped) {
       console.log(`skipped ${s.name}: ${s.reason}`);
     }
+    if (result.findings && Object.keys(result.findings).length > 0) {
+      console.log("");
+      console.log("confirmed scan findings:");
+      for (const [name, findings] of Object.entries(result.findings)) {
+        console.log(`${name}:`);
+        printFindings(findings);
+      }
+    }
   }
 });
 var rmCmd5 = defineCommand18({