berget 1.3.0 → 1.4.0

package/examples/install-global-security-hook.sh

@@ -0,0 +1,170 @@
+#!/bin/bash
+# Install global git security hook
+# This script sets up a global pre-push hook that runs security checks on all repositories
+
+set -e
+
+echo "🔧 Installing global git security hook..."
+
+# Create global git hooks directory
+GLOBAL_HOOKS_DIR="$HOME/.git-hooks"
+mkdir -p "$GLOBAL_HOOKS_DIR"
+
+# Create the pre-push hook
+cat > "$GLOBAL_HOOKS_DIR/pre-push" << 'EOF'
+#!/bin/bash
+# Global pre-push security hook using Berget AI
+# This hook runs automatically before every git push
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+echo -e "${BLUE}🔒 Running security check before push...${NC}"
+
+# Check if we're in a git repository
+if ! git rev-parse --git-dir > /dev/null 2>&1; then
+    echo -e "${RED}Error: Not in a git repository${NC}"
+    exit 1
+fi
+
+# Check if there are any commits to push
+if [[ -z $(git log @{u}.. --oneline 2>/dev/null) ]]; then
+    echo -e "${GREEN}✅ No new commits to push${NC}"
+    exit 0
+fi
+
+# Get the diff of commits being pushed
+DIFF=$(git diff @{u}.. 2>/dev/null || git diff HEAD~1)
+
+if [[ -z "$DIFF" ]]; then
+    echo -e "${GREEN}✅ No changes to analyze${NC}"
+    exit 0
+fi
+
+echo -e "${BLUE}Analyzing security risks in commits being pushed...${NC}"
+
+# Check if Berget CLI is available
+if ! command -v npx > /dev/null 2>&1; then
+    echo -e "${YELLOW}⚠️  npx not found. Skipping security check.${NC}"
+    echo -e "${YELLOW}Install Node.js and npm to enable security checks.${NC}"
+    exit 0
+fi
+
+# Run security analysis
+SECURITY_REPORT=$(echo "$DIFF" | npx berget chat run openai/gpt-oss "
+Analyze this git diff for security vulnerabilities using OWASP Top 20 Code Review recommendations:
+
+**OWASP Top 20 Security Categories to Check:**
+
+1. **A01 - Broken Access Control**: Authorization bypasses, privilege escalation, insecure direct object references
+2. **A02 - Cryptographic Failures**: Weak encryption, hardcoded keys, insecure random number generation, plain text storage
+3. **A03 - Injection**: SQL injection, NoSQL injection, command injection, LDAP injection, XSS
+4. **A04 - Insecure Design**: Missing security controls, threat modeling gaps, insecure architecture patterns
+5. **A05 - Security Misconfiguration**: Default credentials, unnecessary features enabled, verbose error messages
+6. **A06 - Vulnerable Components**: Outdated dependencies, known vulnerable libraries, unpatched components
+7. **A07 - Authentication Failures**: Weak passwords, session management flaws, credential stuffing vulnerabilities
+8. **A08 - Software Integrity Failures**: Unsigned code, insecure CI/CD pipelines, auto-update without verification
+9. **A09 - Logging Failures**: Insufficient logging, sensitive data in logs, log injection
+10. **A10 - Server-Side Request Forgery**: SSRF vulnerabilities, unvalidated URLs, internal service access
+
+**Additional Critical Areas:**
+11. **Input Validation**: Insufficient sanitization, buffer overflows, format string vulnerabilities
+12. **Output Encoding**: XSS prevention, content type validation, encoding bypasses
+13. **File Operations**: Path traversal, file upload vulnerabilities, insecure file permissions
+14. **Network Security**: Insecure protocols, certificate validation, CSRF protection
+15. **Session Management**: Session fixation, insecure cookies, session timeout issues
+16. **Error Handling**: Information disclosure, stack traces in production, verbose error messages
+17. **Business Logic**: Race conditions, workflow bypasses, price manipulation
+18. **API Security**: Rate limiting, input validation, authentication on all endpoints
+19. **Mobile Security**: Insecure data storage, weak encryption, certificate pinning
+20. **Cloud Security**: Misconfigured permissions, exposed storage, insecure defaults
+
+**Assessment Criteria:**
+- 🟢 SAFE: No security risks identified according to OWASP guidelines
+- 🟡 WARNING: Minor security risks that should be addressed (OWASP Medium risk)
+- 🔴 CRITICAL: Serious security risks that MUST be addressed immediately (OWASP High/Critical risk)
+
+**Required Response Format:**
+**SECURITY ASSESSMENT: [🟢/🟡/🔴] [SAFE/WARNING/CRITICAL]**
+
+**OWASP CATEGORIES AFFECTED:**
+- [List specific OWASP categories if any vulnerabilities found]
+
+**IDENTIFIED RISKS:**
+- [List specific vulnerabilities with OWASP category references]
+
+**RECOMMENDATIONS:**
+- [Concrete remediation steps following OWASP secure coding practices]
+
+**COMPLIANCE NOTES:**
+- [Any additional security considerations or compliance requirements]
+
+Diff to analyze:
+\`\`\`diff
+$DIFF
+\`\`\`
+" 2>/dev/null)
+
+if [[ $? -ne 0 ]] || [[ -z "$SECURITY_REPORT" ]]; then
+    echo -e "${YELLOW}⚠️  Security analysis failed or unavailable. Proceeding with push.${NC}"
+    echo -e "${YELLOW}Make sure you have BERGET_API_KEY set or are logged in with 'npx berget auth login'${NC}"
+    exit 0
+fi
+
+echo "$SECURITY_REPORT"
+echo ""
+
+# Extract security level from report
+if echo "$SECURITY_REPORT" | grep -q "🔴.*CRITICAL"; then
+    echo -e "${RED}❌ CRITICAL security risks identified!${NC}"
+    echo -e "${RED}Push blocked. Address security issues before pushing.${NC}"
+    echo ""
+    echo -e "${YELLOW}To bypass this check (NOT RECOMMENDED):${NC}"
+    echo -e "${YELLOW}git push --no-verify${NC}"
+    exit 1
+elif echo "$SECURITY_REPORT" | grep -q "🟡.*WARNING"; then
+    echo -e "${YELLOW}⚠️  Security warnings identified.${NC}"
+    read -p "Do you want to continue with push despite warnings? (y/N): " -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        echo -e "${YELLOW}Push cancelled. Address security issues first.${NC}"
+        echo ""
+        echo -e "${YELLOW}To bypass this check (NOT RECOMMENDED):${NC}"
+        echo -e "${YELLOW}git push --no-verify${NC}"
+        exit 1
+    fi
+elif echo "$SECURITY_REPORT" | grep -q "🟢.*SAFE"; then
+    echo -e "${GREEN}✅ No security risks identified. Safe to push!${NC}"
+else
+    echo -e "${YELLOW}⚠️  Could not determine security status. Proceeding with caution.${NC}"
+fi
+
+echo -e "${GREEN}Security check complete. Proceeding with push...${NC}"
+EOF
+
+# Make the hook executable
+chmod +x "$GLOBAL_HOOKS_DIR/pre-push"
+
+# Configure git to use the global hooks directory
+git config --global core.hooksPath "$GLOBAL_HOOKS_DIR"
+
+echo -e "${GREEN}✅ Global security hook installed successfully!${NC}"
+echo ""
+echo -e "${BLUE}The security hook will now run automatically before every 'git push' in all repositories.${NC}"
+echo ""
+echo -e "${YELLOW}Requirements:${NC}"
+echo -e "  • Node.js and npm installed"
+echo -e "  • Berget CLI configured (npx berget auth login or BERGET_API_KEY set)"
+echo ""
+echo -e "${YELLOW}To disable the hook temporarily:${NC}"
+echo -e "  git push --no-verify"
+echo ""
+echo -e "${YELLOW}To uninstall the global hook:${NC}"
+echo -e "  git config --global --unset core.hooksPath"
+echo -e "  rm -rf $GLOBAL_HOOKS_DIR"

package/examples/security-check.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# Security check for git commits using Berget AI
+# Usage: ./security-check.sh
+set -e
+
+echo "🔒 Security review of commits..."
+echo "===================================="
+
+# Check if there are staged changes
+if [[ -z $(git diff --cached) ]]; then
+    echo "No staged changes found. Run 'git add' first."
+    exit 1
+fi
+
+# Get diff for security review
+DIFF=$(git diff --cached)
+
+echo "Analyzing security risks in staged changes..."
+
+SECURITY_REPORT=$(echo "$DIFF" | npx berget chat run openai/gpt-oss "
+Analyze this git diff for security vulnerabilities using OWASP Top 20 Code Review recommendations:
+
+**OWASP Top 20 Security Categories to Check:**
+
+1. **A01 - Broken Access Control**: Authorization bypasses, privilege escalation, insecure direct object references
+2. **A02 - Cryptographic Failures**: Weak encryption, hardcoded keys, insecure random number generation, plain text storage
+3. **A03 - Injection**: SQL injection, NoSQL injection, command injection, LDAP injection, XSS
+4. **A04 - Insecure Design**: Missing security controls, threat modeling gaps, insecure architecture patterns
+5. **A05 - Security Misconfiguration**: Default credentials, unnecessary features enabled, verbose error messages
+6. **A06 - Vulnerable Components**: Outdated dependencies, known vulnerable libraries, unpatched components
+7. **A07 - Authentication Failures**: Weak passwords, session management flaws, credential stuffing vulnerabilities
+8. **A08 - Software Integrity Failures**: Unsigned code, insecure CI/CD pipelines, auto-update without verification
+9. **A09 - Logging Failures**: Insufficient logging, sensitive data in logs, log injection
+10. **A10 - Server-Side Request Forgery**: SSRF vulnerabilities, unvalidated URLs, internal service access
+
+**Additional Critical Areas:**
+11. **Input Validation**: Insufficient sanitization, buffer overflows, format string vulnerabilities
+12. **Output Encoding**: XSS prevention, content type validation, encoding bypasses
+13. **File Operations**: Path traversal, file upload vulnerabilities, insecure file permissions
+14. **Network Security**: Insecure protocols, certificate validation, CSRF protection
+15. **Session Management**: Session fixation, insecure cookies, session timeout issues
+16. **Error Handling**: Information disclosure, stack traces in production, verbose error messages
+17. **Business Logic**: Race conditions, workflow bypasses, price manipulation
+18. **API Security**: Rate limiting, input validation, authentication on all endpoints
+19. **Mobile Security**: Insecure data storage, weak encryption, certificate pinning
+20. **Cloud Security**: Misconfigured permissions, exposed storage, insecure defaults
+
+**Assessment Criteria:**
+- 🟢 SAFE: No security risks identified according to OWASP guidelines
+- 🟡 WARNING: Minor security risks that should be addressed (OWASP Medium risk)
+- 🔴 CRITICAL: Serious security risks that MUST be addressed immediately (OWASP High/Critical risk)
+
+**Required Response Format:**
+**SECURITY ASSESSMENT: [🟢/🟡/🔴] [SAFE/WARNING/CRITICAL]**
+
+**OWASP CATEGORIES AFFECTED:**
+- [List specific OWASP categories if any vulnerabilities found]
+
+**IDENTIFIED RISKS:**
+- [List specific vulnerabilities with OWASP category references]
+
+**RECOMMENDATIONS:**
+- [Concrete remediation steps following OWASP secure coding practices]
+
+**COMPLIANCE NOTES:**
+- [Any additional security considerations or compliance requirements]
+
+Diff to analyze:
+\`\`\`diff
+$DIFF
+\`\`\`
+")
+
+echo "$SECURITY_REPORT"
+echo ""
+
+# Extract security level from report
+if echo "$SECURITY_REPORT" | grep -q "🔴.*CRITICAL"; then
+    echo "❌ CRITICAL security risks identified!"
+    echo "Commit blocked. Address security issues before continuing."
+    exit 1
+elif echo "$SECURITY_REPORT" | grep -q "🟡.*WARNING"; then
+    echo "⚠️  Security warnings identified."
+    read -p "Do you want to continue with commit despite warnings? (y/N): " -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        echo "Commit cancelled. Address security issues first."
+        exit 1
+    fi
+elif echo "$SECURITY_REPORT" | grep -q "🟢.*SAFE"; then
+    echo "✅ No security risks identified. Safe to continue!"
+else
+    echo "⚠️  Could not determine security status. Review manually."
+    read -p "Do you want to continue with commit? (y/N): " -n 1 -r
+    echo
+    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        echo "Commit cancelled."
+        exit 1
+    fi
+fi
+
+echo "Security review complete. You can now run 'git commit'."

package/examples/smart-commit.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Smart commit generator using Berget AI
+# Usage: ./smart-commit.sh
+set -e
+
+# Check if there are staged changes
+if [[ -z $(git diff --cached) ]]; then
+    echo "No staged changes found. Run 'git add' first."
+    exit 1
+fi
+
+# Generate commit message
+COMMIT_MSG=$(git diff --cached | npx berget chat run openai/gpt-oss "Generate a conventional commit message for this staged diff. Reply with only the commit message, nothing else:")
+
+echo "Suggested commit message:"
+echo "  $COMMIT_MSG"
+echo
+
+read -p "Do you want to use this message? (y/N): " -n 1 -r
+echo
+if [[ $REPLY =~ ^[Yy]$ ]]; then
+    git commit -m "$COMMIT_MSG"
+    echo "✅ Commit created!"
+else
+    echo "❌ Commit cancelled"
+fi

package/package.json

@@ -1,17 +1,22 @@
 {
   "name": "berget",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "main": "dist/index.js",
   "bin": {
     "berget": "dist/index.js"
   },
   "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "start": "node --import tsx ./index.ts --local",
     "login": "node --import tsx ./index.ts --local auth login",
     "logout": "node --import tsx ./index.ts --local auth logout",
     "whoami": "node --import tsx ./index.ts --local auth whoami",
     "build": "tsc",
+    "test": "vitest",
+    "test:run": "vitest run",
     "prepublishOnly": "npm run build",
     "generate-types": "openapi-typescript https://api.berget.ai/openapi.json -o src/types/api.d.ts"
   },
@@ -19,14 +24,19 @@
   "license": "MIT",
   "description": "This is a cli command for interacting with the AI infrastructure provider Berget",
   "devDependencies": {
+    "@types/marked": "^5.0.2",
+    "@types/marked-terminal": "^6.1.1",
     "@types/node": "^20.11.20",
     "tsx": "^4.19.3",
-    "typescript": "^5.3.3"
+    "typescript": "^5.3.3",
+    "vitest": "^1.0.0"
   },
   "dependencies": {
     "chalk": "^4.1.2",
     "commander": "^12.0.0",
     "fs-extra": "^11.3.0",
+    "marked": "^9.1.6",
+    "marked-terminal": "^6.2.0",
     "open": "^9.1.0",
     "openapi-fetch": "^0.9.1",
     "openapi-typescript": "^6.7.4",

package/src/commands/chat.ts

@@ -7,6 +7,7 @@ import { ApiKeyService } from '../services/api-key-service'
 import { AuthService } from '../services/auth-service'
 import { handleError } from '../utils/error-handler'
 import { DefaultApiKeyManager } from '../utils/default-api-key'
+import { renderMarkdown, containsMarkdown } from '../utils/markdown-renderer'
 
 /**
  * Helper function to get user confirmation
@@ -36,7 +37,8 @@ export function registerChatCommands(program: Command): void {
   chat
     .command(SUBCOMMANDS.CHAT.RUN)
     .description('Run a chat session with a specified model')
-    .argument('[model]', 'Model to use (default: google/gemma-3-27b-it)')
+    .argument('[model]', 'Model to use (default: openai/gpt-oss)')
+    .argument('[message]', 'Message to send directly (skips interactive mode)')
     .option('-s, --system <message>', 'System message')
     .option('-t, --temperature <temp>', 'Temperature (0-1)', parseFloat)
     .option('-m, --max-tokens <tokens>', 'Maximum tokens to generate', parseInt)
@@ -45,8 +47,8 @@ export function registerChatCommands(program: Command): void {
       '--api-key-id <id>',
       'ID of the API key to use from your saved keys'
     )
-    .option('--stream', 'Stream the response')
-    .action(async (options) => {
+    .option('--no-stream', 'Disable streaming (streaming is enabled by default)')
+    .action(async (model, message, options) => {
       try {
         const chatService = ChatService.getInstance()
 
@@ -217,12 +219,6 @@ export function registerChatCommands(program: Command): void {
           }
         }
 
-        // Set up readline interface for user input
-        const rl = readline.createInterface({
-          input: process.stdin,
-          output: process.stdout,
-        })
-
         // Prepare messages array
         const messages: ChatMessage[] = []
 
@@ -234,6 +230,139 @@ export function registerChatCommands(program: Command): void {
           })
         }
 
+        // Check if input is being piped in
+        let inputMessage = message
+        let stdinContent = ''
+        
+        if (!process.stdin.isTTY) {
+          // Read from stdin (piped input)
+          const chunks = []
+          for await (const chunk of process.stdin) {
+            chunks.push(chunk)
+          }
+          stdinContent = Buffer.concat(chunks).toString('utf8').trim()
+        }
+
+        // Combine stdin content with message if both exist
+        if (stdinContent && message) {
+          inputMessage = `${stdinContent}\n\n${message}`
+        } else if (stdinContent && !message) {
+          inputMessage = stdinContent
+        }
+
+        // If a message is provided (either as argument, from stdin, or both), send it directly and exit
+        if (inputMessage) {
+          // Add user message
+          messages.push({
+            role: 'user',
+            content: inputMessage,
+          })
+
+          try {
+            // Call the API
+            const completionOptions: ChatCompletionOptions = {
+              model: model || 'openai/gpt-oss',
+              messages: messages,
+              temperature:
+                options.temperature !== undefined ? options.temperature : 0.7,
+              max_tokens: options.maxTokens || 4096,
+              stream: options.stream !== false
+            }
+
+            // Only add apiKey if it actually exists
+            if (apiKey) {
+              completionOptions.apiKey = apiKey
+            }
+            
+            // Add streaming support (now default)
+            if (completionOptions.stream) {
+              let assistantResponse = ''
+              
+              // Stream the response in real-time
+              completionOptions.onChunk = (chunk: any) => {
+                if (chunk.choices && chunk.choices[0] && chunk.choices[0].delta && chunk.choices[0].delta.content) {
+                  const content = chunk.choices[0].delta.content
+                  try {
+                    process.stdout.write(content)
+                  } catch (error: any) {
+                    // Handle EPIPE errors gracefully (when pipe is closed)
+                    if (error.code === 'EPIPE') {
+                      // Stop streaming if the pipe is closed
+                      return
+                    }
+                    throw error
+                  }
+                  assistantResponse += content
+                }
+              }
+              
+              try {
+                await chatService.createCompletion(completionOptions)
+              } catch (streamError) {
+                console.error(chalk.red('\nStreaming error:'), streamError)
+                
+                // Fallback to non-streaming if streaming fails
+                console.log(chalk.yellow('Falling back to non-streaming mode...'))
+                completionOptions.stream = false
+                delete completionOptions.onChunk
+                
+                const response = await chatService.createCompletion(completionOptions)
+                
+                if (response && response.choices && response.choices[0] && response.choices[0].message) {
+                  assistantResponse = response.choices[0].message.content
+                  console.log(assistantResponse)
+                }
+              }
+              console.log() // Add newline at the end
+              return
+            }
+            
+            const response = await chatService.createCompletion(
+              completionOptions
+            )
+
+            // Check if response has the expected structure
+            if (
+              !response ||
+              !response.choices ||
+              !response.choices[0] ||
+              !response.choices[0].message
+            ) {
+              console.error(
+                chalk.red('Error: Unexpected response format from API')
+              )
+              console.error(
+                chalk.red('Response:', JSON.stringify(response, null, 2))
+              )
+              throw new Error('Unexpected response format from API')
+            }
+
+            // Get assistant's response
+            const assistantMessage = response.choices[0].message.content
+
+            // Display the response
+            if (containsMarkdown(assistantMessage)) {
+              console.log(renderMarkdown(assistantMessage))
+            } else {
+              console.log(assistantMessage)
+            }
+            
+            return
+          } catch (error) {
+            console.error(chalk.red('Error: Failed to get response'))
+            if (error instanceof Error) {
+              console.error(chalk.red(error.message))
+            }
+            process.exit(1)
+          }
+        }
+
+        // Set up readline interface for user input (only for interactive mode)
+        const rl = readline.createInterface({
+          input: process.stdin,
+          output: process.stdout,
+        })
+
         console.log(chalk.cyan('Chat with Berget AI (type "exit" to quit)'))
         console.log(chalk.cyan('----------------------------------------'))
 
@@ -256,12 +385,12 @@ export function registerChatCommands(program: Command): void {
             try {
               // Call the API
               const completionOptions: ChatCompletionOptions = {
-                model: options.args?.[0] || 'google/gemma-3-27b-it',
+                model: model || 'openai/gpt-oss',
                 messages: messages,
                 temperature:
                   options.temperature !== undefined ? options.temperature : 0.7,
                 max_tokens: options.maxTokens || 4096,
-                stream: options.stream || false
+                stream: options.stream !== false
               }
 
               // Only add apiKey if it actually exists
@@ -269,20 +398,46 @@ export function registerChatCommands(program: Command): void {
                 completionOptions.apiKey = apiKey
               }
               
-              // Add streaming support
-              if (options.stream) {
+              // Add streaming support (now default)
+              if (completionOptions.stream) {
                 let assistantResponse = ''
-                process.stdout.write(chalk.blue('Assistant: '))
+                console.log(chalk.blue('Assistant: '))
                 
+                // Stream the response in real-time
                 completionOptions.onChunk = (chunk: any) => {
                   if (chunk.choices && chunk.choices[0] && chunk.choices[0].delta && chunk.choices[0].delta.content) {
                     const content = chunk.choices[0].delta.content
-                    process.stdout.write(content)
+                    try {
+                      process.stdout.write(content)
+                    } catch (error: any) {
+                      // Handle EPIPE errors gracefully (when pipe is closed)
+                      if (error.code === 'EPIPE') {
+                        // Stop streaming if the pipe is closed
+                        return
+                      }
+                      throw error
+                    }
                     assistantResponse += content
                   }
                 }
                 
-                await chatService.createCompletion(completionOptions)
+                try {
+                  await chatService.createCompletion(completionOptions)
+                } catch (streamError) {
+                  console.error(chalk.red('\nStreaming error:'), streamError)
+                  
+                  // Fallback to non-streaming if streaming fails
+                  console.log(chalk.yellow('Falling back to non-streaming mode...'))
+                  completionOptions.stream = false
+                  delete completionOptions.onChunk
+                  
+                  const response = await chatService.createCompletion(completionOptions)
+                  
+                  if (response && response.choices && response.choices[0] && response.choices[0].message) {
+                    assistantResponse = response.choices[0].message.content
+                    console.log(assistantResponse)
+                  }
+                }
                 console.log('\n')
                 
                 // Add assistant response to messages
@@ -332,7 +487,15 @@ export function registerChatCommands(program: Command): void {
               })
 
               // Display the response
-              console.log(chalk.blue('Assistant: ') + assistantMessage)
+              console.log(chalk.blue('Assistant: '))
+              
+              // Check if the response contains markdown and render it if it does
+              if (containsMarkdown(assistantMessage)) {
+                console.log(renderMarkdown(assistantMessage))
+              } else {
+                console.log(assistantMessage)
+              }
+              
               console.log() // Empty line for better readability
 
               // Continue the conversation
@@ -439,23 +602,27 @@ export function registerChatCommands(program: Command): void {
         console.log(chalk.bold('Available Chat Models:'))
         console.log(chalk.dim('─'.repeat(70)))
         console.log(
-          chalk.dim('MODEL ID'.padEnd(30)) +
-            chalk.dim('OWNER'.padEnd(25)) +
+          chalk.dim('MODEL ID'.padEnd(40)) +
             chalk.dim('CAPABILITIES')
         )
         console.log(chalk.dim('─'.repeat(70)))
 
-        models.data.forEach((model: any) => {
+        // Filter to only show active models
+        const activeModels = models.data.filter((model: any) => model.active === true);
+        
+        activeModels.forEach((model: any) => {
           const capabilities = []
           if (model.capabilities.vision) capabilities.push('vision')
           if (model.capabilities.function_calling)
             capabilities.push('function_calling')
           if (model.capabilities.json_mode) capabilities.push('json_mode')
 
+          // Format model ID in Huggingface compatible format (owner/model)
+          const modelId = `${model.owned_by.toLowerCase()}/${model.id}`.padEnd(40)
+          
           console.log(
-            model.id.padEnd(30) +
-              model.owned_by.padEnd(25) +
-              capabilities.join(', ')
+            modelId +
+            capabilities.join(', ')
           )
         })
       } catch (error) {

package/src/commands/models.ts

@@ -36,10 +36,10 @@ export function registerModelCommands(program: Command): void {
 
           console.log('Available Models:')
           console.log(
-            'ID                      OWNED BY                  CAPABILITIES'
+            'ID                                                 OWNED BY                 CAPABILITIES'
           )
           // Ensure response has the expected structure
-          const modelData = response as { data?: any[] };
+          const modelData = response as { data?: any[] }
           if (modelData.data) {
             modelData.data.forEach((model: any) => {
               const capabilities = []
@@ -49,8 +49,8 @@ export function registerModelCommands(program: Command): void {
               if (model.capabilities.json_mode) capabilities.push('json_mode')
 
               console.log(
-                `${model.id.padEnd(24)} ${model.owned_by.padEnd(
-                  25
+                `${model.root.padEnd(50)} ${model.owned_by.padEnd(
+                  24
                 )} ${capabilities.join(', ')}`
               )
             })