codelantern-agent-cli 1.0.1 → 1.0.2

package/dist/{chunk-PELESOCI.js → chunk-45FEFNMM.js}

@@ -1,5 +1,52 @@
 #!/usr/bin/env node
 
+// src/security/secrets.ts
+import path from "path";
+var SECRET_FILE_PATTERNS = [
+  /^\.env(\..+)?$/i,
+  /\.pem$/i,
+  /\.key$/i,
+  /\.pfx$/i,
+  /\.p12$/i,
+  /^id_rsa/i,
+  /^id_dsa/i,
+  /^id_ecdsa/i,
+  /^id_ed25519/i,
+  /service[_-]?account.*\.json$/i,
+  /credentials.*\.json$/i,
+  /\.keystore$/i,
+  /\.token$/i,
+  /\.secret/i
+];
+function isSecretFile(filePath) {
+  const base = path.basename(filePath);
+  return SECRET_FILE_PATTERNS.some((pattern) => pattern.test(base));
+}
+function sanitizeSecrets(text) {
+  if (!text) return text;
+  let sanitized = text;
+  sanitized = sanitized.replace(/AIza[0-9A-Za-z\-_]{30,40}/g, "AIza***********************************");
+  sanitized = sanitized.replace(/sk-(?:proj-)?[A-Za-z0-9_\-]{32,}/g, "sk-************************************");
+  sanitized = sanitized.replace(/sk-ant-[A-Za-z0-9_\-]{32,}/g, "sk-ant-********************************");
+  sanitized = sanitized.replace(/sk-or-v1-[A-Za-z0-9_\-]{32,}/g, "sk-or-v1-******************************");
+  sanitized = sanitized.replace(/ghp_[0-9a-zA-Z]{36}/g, "ghp_************************************");
+  sanitized = sanitized.replace(/github_pat_[0-9a-zA-Z_]{82}/g, "github_pat_**********************************************************************************");
+  const envKeys = [
+    process.env.GEMINI_API_KEY,
+    process.env.GOOGLE_API_KEY,
+    process.env.OPENAI_API_KEY,
+    process.env.ANTHROPIC_API_KEY,
+    process.env.OPENROUTER_API_KEY,
+    process.env.CUSTOM_API_KEY
+  ];
+  for (const envKey of envKeys) {
+    if (envKey && envKey.trim().length > 6) {
+      sanitized = sanitized.split(envKey.trim()).join("[REDACTED_API_KEY]");
+    }
+  }
+  return sanitized;
+}
+
 // src/provider/errors.ts
 import pc from "picocolors";
 var TimeoutError = class extends Error {
@@ -77,38 +124,38 @@ var LanternProviderError = class extends Error {
 function formatErrorMessage(err) {
   if (err instanceof CancelledError) {
     return pc.yellow(`
-[Cancelled] ${err.message}`);
+[Cancelled] ${sanitizeSecrets(err.message)}`);
   }
   if (err instanceof FirstTokenTimeoutError) {
     return pc.red(`
-\u23F1\uFE0F ${err.message}
-` + pc.yellow(`  Tip: Check your network connection or try lowering temperature or setting a faster model with 'lantern model set <id>'.`));
+\u23F1\uFE0F ${sanitizeSecrets(err.message)}
+`) + pc.yellow(`  Tip: Check your network connection or try switching to a faster model with '/model' or 'lantern model set <id>'.`);
   }
   if (err instanceof TimeoutError) {
     return pc.red(`
-\u23F1\uFE0F ${err.message}
-` + pc.yellow(`  Tip: You can increase the timeout limit using 'lantern config set timeoutMs 120000'.`));
+\u23F1\uFE0F ${sanitizeSecrets(err.message)}
+`) + pc.yellow(`  Tip: Check your network connection. You can increase the timeout limit using 'lantern config set timeoutMs 120000' or test provider connectivity with 'lantern providers test'.`);
   }
   if (err instanceof MissingApiKeyError) {
     return pc.red(`
-${err.message}`);
+${sanitizeSecrets(err.message)}`);
   }
   if (err instanceof RateLimitError) {
     return pc.yellow(`
-\u26A0\uFE0F ${err.message}`);
+\u26A0\uFE0F ${sanitizeSecrets(err.message)}`);
   }
   if (err instanceof AuthenticationError) {
     return pc.red(`
-\u{1F512} ${err.message}`);
+\u{1F512} ${sanitizeSecrets(err.message)}`);
   }
   if (err instanceof ModelNotFoundError) {
     return pc.red(`
-\u{1F50D} ${err.message}
-` + pc.dim(`Run 'lantern models list' to view available models for your account.`));
+\u{1F50D} ${sanitizeSecrets(err.message)}
+`) + pc.yellow(`  Tip: Run '/model' inside Lantern or 'lantern models list' to view and select available models for your account.`);
   }
   if (err instanceof Error) {
-    const msg = err.message || "";
-    if (msg.includes("API_KEY_INVALID") || msg.includes("401") || msg.includes("Incorrect API key")) {
+    const msg = sanitizeSecrets(err.message || "");
+    if (msg.includes("API_KEY_INVALID") || msg.includes("401") || msg.includes("Incorrect API key") || msg.includes("API key not valid")) {
       return pc.red(`Authentication failed: Invalid API key. Update it with 'lantern keys set <provider>'.`);
     }
     if (msg.includes("RESOURCE_EXHAUSTED") || msg.includes("429")) {
@@ -119,7 +166,7 @@ ${err.message}`);
     }
     return pc.red(`Error: ${msg}`);
   }
-  return pc.red(`An unexpected error occurred: ${String(err)}`);
+  return pc.red(`An unexpected error occurred: ${sanitizeSecrets(String(err))}`);
 }
 
 // src/provider/timeout.ts
@@ -152,15 +199,49 @@ function createLinkedAbortController(parentSignal, timeoutMs) {
   };
   return { controller, cleanup };
 }
+async function withTimeoutRace(promise, timeoutMs, operationName, signal, onTimeout) {
+  if (signal?.aborted) {
+    throw signal.reason || new CancelledError();
+  }
+  let timer = null;
+  let abortListener = null;
+  try {
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        if (onTimeout) {
+          try {
+            onTimeout();
+          } catch {
+          }
+        }
+        reject(new TimeoutError(timeoutMs, operationName));
+      }, timeoutMs);
+      if (signal) {
+        abortListener = () => {
+          if (timer) clearTimeout(timer);
+          reject(signal.reason || new CancelledError());
+        };
+        signal.addEventListener("abort", abortListener, { once: true });
+      }
+    });
+    return await Promise.race([promise, timeoutPromise]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
+    if (signal && abortListener) {
+      signal.removeEventListener("abort", abortListener);
+    }
+  }
+}
 async function* wrapStreamWithFirstTokenTimeout(stream, firstTokenTimeoutMs, provider, model, signal, onFirstToken) {
   let firstTokenReceived = false;
   const startTime = Date.now();
   let timer = null;
-  let timedOut = false;
   const timerPromise = new Promise((_, reject) => {
     timer = setTimeout(() => {
       if (!firstTokenReceived) {
-        timedOut = true;
         reject(new FirstTokenTimeoutError(firstTokenTimeoutMs, provider, model));
       }
     }, firstTokenTimeoutMs);
@@ -188,6 +269,9 @@ async function* wrapStreamWithFirstTokenTimeout(stream, firstTokenTimeoutMs, pro
           timer = null;
         }
         if (result.done) {
+          if (onFirstToken) {
+            onFirstToken(Date.now() - startTime);
+          }
           break;
         }
         firstTokenReceived = true;
@@ -348,7 +432,7 @@ function validateConfigValue(key, value) {
 
 // src/config/config.ts
 import fs from "fs";
-import path from "path";
+import path2 from "path";
 import os from "os";
 function getLanternHomeDir() {
   const customHome = process.env.CODELANTERN_HOME || process.env.LANTERN_HOME;
@@ -361,7 +445,7 @@ function getLanternHomeDir() {
     }
     return customHome;
   }
-  const defaultDir = path.join(os.homedir(), ".codelantern");
+  const defaultDir = path2.join(os.homedir(), ".codelantern");
   if (!fs.existsSync(defaultDir)) {
     try {
       fs.mkdirSync(defaultDir, { recursive: true });
@@ -371,7 +455,7 @@ function getLanternHomeDir() {
   return defaultDir;
 }
 function getConfigFilePath() {
-  return path.join(getLanternHomeDir(), "config.json");
+  return path2.join(getLanternHomeDir(), "config.json");
 }
 function loadConfig() {
   const configPath = getConfigFilePath();
@@ -435,11 +519,304 @@ function getConfigValue(key) {
   return current[key];
 }
 
+// src/security/nativeStore.ts
+import { execFileSync } from "child_process";
+import { Entry } from "@napi-rs/keyring";
+var NapiRsKeyringStore = class {
+  name;
+  constructor() {
+    this.name = this.resolveStoreName();
+  }
+  resolveStoreName() {
+    if (process.platform === "darwin") return "macOS Keychain";
+    if (process.platform === "win32") return "Windows Credential Manager";
+    if (process.platform === "linux") return "Linux Secret Service / Keyring";
+    return "OS Credential Store";
+  }
+  isAvailable() {
+    return typeof Entry === "function";
+  }
+  get(service, account) {
+    try {
+      const entry = new Entry(service, account);
+      const res = entry.getPassword();
+      return res ?? null;
+    } catch {
+      return null;
+    }
+  }
+  set(service, account, secret) {
+    try {
+      const entry = new Entry(service, account);
+      entry.setPassword(secret);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  delete(service, account) {
+    try {
+      const entry = new Entry(service, account);
+      return entry.deletePassword();
+    } catch {
+      return false;
+    }
+  }
+};
+var MacosKeychainCliStore = class {
+  name = "macOS Keychain (CLI)";
+  isAvailable() {
+    return process.platform === "darwin";
+  }
+  get(service, account) {
+    if (process.platform !== "darwin") return null;
+    try {
+      const output = execFileSync(
+        "/usr/bin/security",
+        ["find-generic-password", "-s", service, "-a", account, "-w"],
+        { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
+      );
+      return output.trim();
+    } catch {
+      return null;
+    }
+  }
+  set(service, account, secret) {
+    if (process.platform !== "darwin") return false;
+    try {
+      execFileSync(
+        "/usr/bin/security",
+        ["add-generic-password", "-U", "-s", service, "-a", account, "-w", secret],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  delete(service, account) {
+    if (process.platform !== "darwin") return false;
+    try {
+      execFileSync(
+        "/usr/bin/security",
+        ["delete-generic-password", "-s", service, "-a", account],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var WindowsCredentialManagerCliStore = class {
+  name = "Windows Credential Manager (PowerShell)";
+  isAvailable() {
+    return process.platform === "win32";
+  }
+  get(service, account) {
+    if (process.platform !== "win32") return null;
+    try {
+      const target = `${service}:${account}`;
+      const psScript = `
+        Add-Type -TypeDefinition @"
+        using System;
+        using System.Runtime.InteropServices;
+        public class WinCred {
+            [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredReadW", CharSet = CharSet.Unicode)]
+            public static extern bool CredRead(string target, int type, int reservedFlag, out IntPtr credentialPtr);
+            [DllImport("Advapi32.dll", SetLastError = true)]
+            public static extern void CredFree([In] IntPtr cred);
+            [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+            public struct CREDENTIAL {
+                public uint Flags; public uint Type; public string TargetName; public string Comment;
+                public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+                public uint CredentialBlobSize; public IntPtr CredentialBlob;
+                public uint Persist; public uint AttributeCount; public IntPtr Attributes;
+                public string TargetAlias; public string UserName;
+            }
+            public static string Read(string target) {
+                IntPtr ptr;
+                if (!CredRead(target, 1, 0, out ptr)) return null;
+                var cred = (CREDENTIAL)Marshal.PtrToStructure(ptr, typeof(CREDENTIAL));
+                byte[] bytes = new byte[cred.CredentialBlobSize];
+                Marshal.Copy(cred.CredentialBlob, bytes, 0, (int)cred.CredentialBlobSize);
+                CredFree(ptr);
+                return System.Text.Encoding.Unicode.GetString(bytes);
+            }
+        }
+"@
+        [WinCred]::Read("${target.replace(/"/g, '`"')}")
+      `;
+      const output = execFileSync(
+        "powershell.exe",
+        ["-NoProfile", "-NonInteractive", "-Command", psScript],
+        { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
+      );
+      const res = output.trim();
+      return res.length > 0 ? res : null;
+    } catch {
+      return null;
+    }
+  }
+  set(service, account, secret) {
+    if (process.platform !== "win32") return false;
+    try {
+      const target = `${service}:${account}`;
+      const psScript = `
+        Add-Type -TypeDefinition @"
+        using System;
+        using System.Runtime.InteropServices;
+        public class WinCredWrite {
+            [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredWriteW", CharSet = CharSet.Unicode)]
+            public static extern bool CredWrite([In] ref CREDENTIAL userCredential, [In] uint flags);
+            [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+            public struct CREDENTIAL {
+                public uint Flags; public uint Type; public string TargetName; public string Comment;
+                public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+                public uint CredentialBlobSize; public IntPtr CredentialBlob;
+                public uint Persist; public uint AttributeCount; public IntPtr Attributes;
+                public string TargetAlias; public string UserName;
+            }
+            public static bool Write(string target, string user, string secret) {
+                byte[] bytes = System.Text.Encoding.Unicode.GetBytes(secret);
+                IntPtr bPtr = Marshal.AllocHGlobal(bytes.Length);
+                Marshal.Copy(bytes, 0, bPtr, bytes.Length);
+                var c = new CREDENTIAL {
+                    Flags = 0, Type = 1, TargetName = target, UserName = user,
+                    CredentialBlobSize = (uint)bytes.Length, CredentialBlob = bPtr, Persist = 2
+                };
+                bool ok = CredWrite(ref c, 0);
+                Marshal.FreeHGlobal(bPtr);
+                return ok;
+            }
+        }
+"@
+        [WinCredWrite]::Write("${target.replace(/"/g, '`"')}", "${account.replace(/"/g, '`"')}", "${secret.replace(/"/g, '`"')}")
+      `;
+      execFileSync(
+        "powershell.exe",
+        ["-NoProfile", "-NonInteractive", "-Command", psScript],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  delete(service, account) {
+    if (process.platform !== "win32") return false;
+    try {
+      const target = `${service}:${account}`;
+      const psScript = `
+        Add-Type -TypeDefinition @"
+        using System;
+        using System.Runtime.InteropServices;
+        public class WinCredDel {
+            [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode)]
+            public static extern bool CredDelete(string target, int type, int reservedFlag);
+            public static bool Del(string target) { return CredDelete(target, 1, 0); }
+        }
+"@
+        [WinCredDel]::Del("${target.replace(/"/g, '`"')}")
+      `;
+      execFileSync(
+        "powershell.exe",
+        ["-NoProfile", "-NonInteractive", "-Command", psScript],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var NativeCredentialStore = class _NativeCredentialStore {
+  static instance;
+  primaryStore;
+  fallbackStore = null;
+  constructor() {
+    this.primaryStore = new NapiRsKeyringStore();
+    if (process.platform === "darwin") {
+      this.fallbackStore = new MacosKeychainCliStore();
+    } else if (process.platform === "win32") {
+      this.fallbackStore = new WindowsCredentialManagerCliStore();
+    }
+  }
+  static getInstance() {
+    if (!_NativeCredentialStore.instance) {
+      _NativeCredentialStore.instance = new _NativeCredentialStore();
+    }
+    return _NativeCredentialStore.instance;
+  }
+  getStoreName() {
+    if (process.platform === "darwin") return "macOS Keychain";
+    if (process.platform === "win32") return "Windows Credential Manager";
+    if (process.platform === "linux") return "Linux Secret Service / Keyring";
+    return "OS Credential Store";
+  }
+  isAvailable() {
+    return this.primaryStore.isAvailable() || (this.fallbackStore?.isAvailable() ?? false);
+  }
+  get(service, account) {
+    if (this.primaryStore.isAvailable()) {
+      try {
+        const val = this.primaryStore.get(service, account);
+        if (val) return val;
+      } catch {
+      }
+    }
+    if (this.fallbackStore && this.fallbackStore.isAvailable()) {
+      try {
+        return this.fallbackStore.get(service, account);
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }
+  set(service, account, secret) {
+    let succeeded = false;
+    if (this.primaryStore.isAvailable()) {
+      try {
+        succeeded = this.primaryStore.set(service, account, secret);
+      } catch {
+        succeeded = false;
+      }
+    }
+    if (!succeeded && this.fallbackStore && this.fallbackStore.isAvailable()) {
+      try {
+        succeeded = this.fallbackStore.set(service, account, secret);
+      } catch {
+        succeeded = false;
+      }
+    }
+    return succeeded;
+  }
+  delete(service, account) {
+    let deleted = false;
+    if (this.primaryStore.isAvailable()) {
+      try {
+        deleted = this.primaryStore.delete(service, account) || deleted;
+      } catch {
+      }
+    }
+    if (this.fallbackStore && this.fallbackStore.isAvailable()) {
+      try {
+        deleted = this.fallbackStore.delete(service, account) || deleted;
+      } catch {
+      }
+    }
+    return deleted;
+  }
+};
+
 // src/security/credentials.ts
 import fs2 from "fs";
-import path2 from "path";
+import path3 from "path";
 import os2 from "os";
 import crypto from "crypto";
+import readline from "readline";
+var SERVICE_NAME = "codelantern";
 var PROVIDER_ENV_VARS = {
   gemini: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
   openai: ["OPENAI_API_KEY"],
@@ -447,17 +824,20 @@ var PROVIDER_ENV_VARS = {
   openrouter: ["OPENROUTER_API_KEY"],
   custom: ["CUSTOM_API_KEY", "OPENAI_API_KEY"]
 };
-function getCredentialsFilePath() {
-  return path2.join(getLanternHomeDir(), "credentials.json");
+function getLegacyCredentialsFilePath() {
+  return path3.join(getLanternHomeDir(), "credentials.json");
+}
+function getStoreName() {
+  return NativeCredentialStore.getInstance().getStoreName();
 }
-function getMachineDerivedKey() {
+function getLegacyMachineKey() {
   const salt = `codelantern_${os2.hostname()}_${os2.userInfo().username}`;
   const secret = `${os2.homedir()}_${process.platform}_${os2.arch()}`;
   return crypto.scryptSync(secret, salt, 32);
 }
 function encryptSecret(plainText) {
   const iv = crypto.randomBytes(12);
-  const key = getMachineDerivedKey();
+  const key = getLegacyMachineKey();
   const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
   let encrypted = cipher.update(plainText, "utf8", "hex");
   encrypted += cipher.final("hex");
@@ -471,7 +851,7 @@ function decryptSecret(encryptedPayload) {
     const [ivHex, authTagHex, encryptedHex] = parts;
     const iv = Buffer.from(ivHex, "hex");
     const authTag = Buffer.from(authTagHex, "hex");
-    const key = getMachineDerivedKey();
+    const key = getLegacyMachineKey();
     const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
     decipher.setAuthTag(authTag);
     let decrypted = decipher.update(encryptedHex, "hex", "utf8");
@@ -487,85 +867,206 @@ function maskApiKey(key) {
   if (clean.length <= 8) return "********";
   return `${clean.slice(0, 4)}...${clean.slice(-4)}`;
 }
+var migrationPerformed = false;
+function migrateLegacyCredentials(force = false) {
+  if (migrationPerformed && !force) {
+    return { attempted: false, migratedProviders: [], failedProviders: [] };
+  }
+  migrationPerformed = true;
+  const legacyPath = getLegacyCredentialsFilePath();
+  if (!fs2.existsSync(legacyPath)) {
+    return { attempted: false, migratedProviders: [], failedProviders: [] };
+  }
+  const store = NativeCredentialStore.getInstance();
+  if (!store.isAvailable()) {
+    return { attempted: false, migratedProviders: [], failedProviders: [] };
+  }
+  let legacyData = {};
+  try {
+    const raw = fs2.readFileSync(legacyPath, "utf8");
+    legacyData = JSON.parse(raw);
+  } catch {
+    return { attempted: true, migratedProviders: [], failedProviders: [] };
+  }
+  const providers = Object.keys(legacyData);
+  if (providers.length === 0) {
+    try {
+      fs2.rmSync(legacyPath, { force: true });
+    } catch {
+    }
+    return { attempted: true, migratedProviders: [], failedProviders: [] };
+  }
+  const migratedProviders = [];
+  const failedProviders = [];
+  for (const provider of providers) {
+    const encrypted = legacyData[provider];
+    if (!encrypted) continue;
+    const decryptedKey = decryptSecret(encrypted);
+    if (!decryptedKey || decryptedKey.trim().length === 0) {
+      failedProviders.push(provider);
+      continue;
+    }
+    const saved = store.set(SERVICE_NAME, provider.toLowerCase(), decryptedKey.trim());
+    if (!saved) {
+      failedProviders.push(provider);
+      continue;
+    }
+    const verified = store.get(SERVICE_NAME, provider.toLowerCase());
+    if (verified !== decryptedKey.trim()) {
+      failedProviders.push(provider);
+      continue;
+    }
+    migratedProviders.push(provider);
+    delete legacyData[provider];
+    try {
+      fs2.writeFileSync(legacyPath, JSON.stringify(legacyData, null, 2), {
+        encoding: "utf8",
+        mode: 384
+      });
+    } catch {
+    }
+  }
+  if (Object.keys(legacyData).length === 0) {
+    try {
+      fs2.rmSync(legacyPath, { force: true });
+    } catch {
+    }
+  }
+  return {
+    attempted: true,
+    migratedProviders,
+    failedProviders
+  };
+}
 function getApiKey(provider) {
   const norm = provider.toLowerCase();
   const envVarNames = PROVIDER_ENV_VARS[norm] || [`${norm.toUpperCase()}_API_KEY`];
   for (const envVar of envVarNames) {
     const val = process.env[envVar];
     if (val && val.trim().length > 0) {
-      return { key: val.trim(), source: "env" };
+      return {
+        key: val.trim(),
+        source: "env",
+        sourceDescription: `env: ${envVar}`
+      };
     }
   }
-  const filePath = getCredentialsFilePath();
-  if (fs2.existsSync(filePath)) {
-    try {
-      const raw = fs2.readFileSync(filePath, "utf8");
-      const data = JSON.parse(raw);
-      if (data[norm]) {
-        const decrypted = decryptSecret(data[norm]);
-        if (decrypted) {
-          return { key: decrypted, source: "store" };
-        }
-      }
-    } catch {
-    }
+  migrateLegacyCredentials();
+  const store = NativeCredentialStore.getInstance();
+  const storedKey = store.get(SERVICE_NAME, norm);
+  if (storedKey && storedKey.trim().length > 0) {
+    return {
+      key: storedKey.trim(),
+      source: "store",
+      sourceDescription: store.getStoreName()
+    };
   }
   return { key: null };
 }
 function setApiKey(provider, apiKey) {
   const norm = provider.toLowerCase();
-  const filePath = getCredentialsFilePath();
-  let data = {};
-  if (fs2.existsSync(filePath)) {
-    try {
-      const raw = fs2.readFileSync(filePath, "utf8");
-      data = JSON.parse(raw);
-    } catch {
-      data = {};
-    }
+  const cleanKey = apiKey.trim();
+  if (!cleanKey) {
+    throw new Error("API key cannot be empty.");
+  }
+  const store = NativeCredentialStore.getInstance();
+  if (!store.isAvailable()) {
+    throw new Error(
+      `Secure OS credential store (${store.getStoreName()}) is unavailable on this system.
+Please set your key using an environment variable:
+  export ${norm.toUpperCase()}_API_KEY="your-api-key"`
+    );
   }
-  data[norm] = encryptSecret(apiKey.trim());
-  try {
-    fs2.writeFileSync(filePath, JSON.stringify(data, null, 2), {
-      encoding: "utf8",
-      mode: 384
-    });
-  } catch (err) {
-    console.error(`Warning: Failed to save credentials: ${err.message}`);
+  const ok = store.set(SERVICE_NAME, norm, cleanKey);
+  if (!ok) {
+    throw new Error(`Failed to write API key for '${provider}' to ${store.getStoreName()}.`);
+  }
+  const check = store.get(SERVICE_NAME, norm);
+  if (check !== cleanKey) {
+    throw new Error(`Verification error: Stored key for '${provider}' could not be read back from ${store.getStoreName()}.`);
   }
 }
 function removeApiKey(provider) {
   const norm = provider.toLowerCase();
-  const filePath = getCredentialsFilePath();
-  if (!fs2.existsSync(filePath)) return false;
-  try {
-    const raw = fs2.readFileSync(filePath, "utf8");
-    const data = JSON.parse(raw);
-    if (data[norm]) {
-      delete data[norm];
-      fs2.writeFileSync(filePath, JSON.stringify(data, null, 2), {
-        encoding: "utf8",
-        mode: 384
-      });
-      return true;
+  const store = NativeCredentialStore.getInstance();
+  const deletedFromStore = store.delete(SERVICE_NAME, norm);
+  const legacyPath = getLegacyCredentialsFilePath();
+  if (fs2.existsSync(legacyPath)) {
+    try {
+      const raw = fs2.readFileSync(legacyPath, "utf8");
+      const data = JSON.parse(raw);
+      if (data[norm]) {
+        delete data[norm];
+        fs2.writeFileSync(legacyPath, JSON.stringify(data, null, 2), {
+          encoding: "utf8",
+          mode: 384
+        });
+      }
+    } catch {
     }
-  } catch {
   }
-  return false;
+  return deletedFromStore;
 }
 function listConfiguredKeys() {
+  migrateLegacyCredentials();
   const providers = ["gemini", "openai", "anthropic", "openrouter", "custom"];
   const result = {};
   for (const p of providers) {
-    const { key, source } = getApiKey(p);
+    const { key, source, sourceDescription } = getApiKey(p);
     result[p] = {
       configured: Boolean(key),
       source,
+      sourceDescription: sourceDescription ? `[${sourceDescription}]` : "none",
       maskedKey: key ? maskApiKey(key) : "(not configured)"
     };
   }
   return result;
 }
+async function promptMaskedApiKey(query) {
+  const promptText = query.endsWith(": ") ? query : `${query}: `;
+  if (!process.stdin.isTTY || !process.stdin.setRawMode) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+      rl.question(promptText, (ans) => {
+        rl.close();
+        resolve(ans.trim());
+      });
+    });
+  }
+  return new Promise((resolve) => {
+    process.stdout.write(promptText);
+    const wasRaw = process.stdin.isRaw;
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    let key = "";
+    const onData = (chunk) => {
+      for (const char of chunk) {
+        if (char === "") {
+          process.stdin.setRawMode(wasRaw ?? false);
+          process.stdin.removeListener("data", onData);
+          process.stdout.write("\n");
+          process.exit(130);
+        } else if (char === "\r" || char === "\n") {
+          process.stdin.setRawMode(wasRaw ?? false);
+          process.stdin.removeListener("data", onData);
+          process.stdout.write("\n");
+          resolve(key.trim());
+          return;
+        } else if (char === "\b" || char === "\x7F") {
+          if (key.length > 0) {
+            key = key.slice(0, -1);
+            process.stdout.write("\b \b");
+          }
+        } else if (char >= " ") {
+          key += char;
+          process.stdout.write("*");
+        }
+      }
+    };
+    process.stdin.on("data", onData);
+  });
+}
 
 // src/provider/gemini.ts
 import { GoogleGenAI, Type } from "@google/genai";
@@ -586,12 +1087,15 @@ var GeminiProvider = class {
     const key = this.getApiKey();
     return key ? maskApiKey(key) : "(not configured)";
   }
-  getClient() {
+  getClient(httpOptions) {
     const key = this.getApiKey();
     if (!key) {
       throw new MissingApiKeyError("gemini", "GEMINI_API_KEY");
     }
-    return new GoogleGenAI({ apiKey: key });
+    return new GoogleGenAI({
+      apiKey: key,
+      httpOptions: httpOptions || { timeout: 3e4 }
+    });
   }
   getCapabilities(modelId) {
     const isPro = modelId.includes("pro");
@@ -605,14 +1109,29 @@ var GeminiProvider = class {
     };
   }
   async testConnection() {
+    if (!this.isConfigured()) {
+      return { success: false, latencyMs: 0, error: `Missing API key for ${this.displayName}` };
+    }
     const startTime = Date.now();
     try {
-      const client = this.getClient();
+      const client = this.getClient({ timeout: 1e4 });
       const testModel = this.defaultModel;
-      await client.models.countTokens({
+      const abortController = new AbortController();
+      const countPromise = client.models.countTokens({
         model: testModel,
-        contents: "test"
+        contents: "test",
+        config: {
+          abortSignal: abortController.signal,
+          httpOptions: { timeout: 1e4 }
+        }
       });
+      await withTimeoutRace(
+        countPromise,
+        1e4,
+        `Connection check for ${this.displayName}`,
+        abortController.signal,
+        () => abortController.abort()
+      );
       return {
         success: true,
         latencyMs: Date.now() - startTime,
@@ -622,7 +1141,7 @@ var GeminiProvider = class {
       return {
         success: false,
         latencyMs: Date.now() - startTime,
-        error: err.message || String(err)
+        error: sanitizeSecrets(err.message || String(err))
       };
     }
   }
@@ -631,8 +1150,21 @@ var GeminiProvider = class {
       return this.cachedModels;
     }
     try {
-      const client = this.getClient();
-      const pagedList = await client.models.list();
+      const client = this.getClient({ timeout: 1e4 });
+      const abortController = new AbortController();
+      const listPromise = client.models.list({
+        config: {
+          abortSignal: abortController.signal,
+          httpOptions: { timeout: 1e4 }
+        }
+      });
+      const pagedList = await withTimeoutRace(
+        listPromise,
+        1e4,
+        `Model listing for ${this.displayName}`,
+        abortController.signal,
+        () => abortController.abort()
+      );
       const models = [];
       for await (const m of pagedList) {
         const rawName = m.name || "";
@@ -679,12 +1211,26 @@ var GeminiProvider = class {
       totalMs: 0,
       toolExecutionMs: {}
     };
-    const client = this.getClient();
+    if (params.callbacks.onStateChange) {
+      params.callbacks.onStateChange("resolving_credentials");
+    }
+    if (params.signal?.aborted) {
+      throw params.signal.reason || new CancelledError();
+    }
+    const key = this.getApiKey();
+    if (!key) {
+      throw new MissingApiKeyError(this.id, "GEMINI_API_KEY");
+    }
     const contents = this.convertHistoryToContents(params.history);
     const functionDeclarations = this.convertToolsToDeclarations(params.tools);
+    const timeoutMs = params.timeoutMs || 6e4;
+    const firstTokenTimeoutMs = params.firstTokenTimeoutMs || 3e4;
+    const connectTimeoutMs = Math.min(timeoutMs, 15e3);
+    const client = this.getClient({ timeout: connectTimeoutMs });
     const config = {
       systemInstruction: params.systemInstruction,
-      temperature: params.temperature ?? (params.lowLatency ? 0.1 : 0.2)
+      temperature: params.temperature ?? (params.lowLatency ? 0.1 : 0.2),
+      httpOptions: { timeout: connectTimeoutMs }
     };
     if (params.maxOutputTokens) {
       config.maxOutputTokens = params.maxOutputTokens;
@@ -699,24 +1245,33 @@ var GeminiProvider = class {
     if (toolList.length > 0) {
       config.tools = toolList;
     }
-    const timeoutMs = params.timeoutMs || 6e4;
-    const firstTokenTimeoutMs = params.firstTokenTimeoutMs || 3e4;
     let attempts = 0;
     const maxAttempts = 3;
     let lastError = null;
     while (attempts < maxAttempts) {
       attempts++;
       const connectStart = Date.now();
+      if (params.signal?.aborted) {
+        throw params.signal.reason || new CancelledError();
+      }
       if (params.callbacks.onStateChange) {
         params.callbacks.onStateChange(attempts > 1 ? `retrying:${attempts}` : "connecting");
       }
       const { controller, cleanup } = createLinkedAbortController(params.signal, timeoutMs);
+      config.abortSignal = controller.signal;
       try {
-        const responseStream = await client.models.generateContentStream({
+        const connectionPromise = client.models.generateContentStream({
           model: params.model,
           contents,
           config
         });
+        const responseStream = await withTimeoutRace(
+          connectionPromise,
+          connectTimeoutMs,
+          `Connection to ${this.displayName} (${params.model})`,
+          controller.signal,
+          () => controller.abort(new TimeoutError(connectTimeoutMs, `Connection to ${this.displayName} (${params.model})`))
+        );
         timing.connectMs = Date.now() - connectStart;
         if (params.callbacks.onStateChange) {
           params.callbacks.onStateChange("waiting_first_token");
@@ -743,6 +1298,9 @@ var GeminiProvider = class {
         );
         const streamStart = Date.now();
         for await (const chunk of wrappedStream) {
+          if (controller.signal.aborted) {
+            throw controller.signal.reason || new CancelledError();
+          }
           if (chunk.text) {
             fullText += chunk.text;
             if (params.callbacks.onChunk) {
@@ -757,6 +1315,9 @@ var GeminiProvider = class {
                 args: fc.args || {}
               });
             }
+            if (params.callbacks.onStateChange) {
+              params.callbacks.onStateChange("streaming");
+            }
           }
           if (chunk.usageMetadata) {
             usage.promptTokens = chunk.usageMetadata.promptTokenCount ?? usage.promptTokens;
@@ -773,6 +1334,9 @@ var GeminiProvider = class {
           params.callbacks.onToolCalls(collectedToolCalls);
         }
         cleanup();
+        if (!fullText && collectedToolCalls.length === 0) {
+          fullText = `[Received empty response from ${this.displayName} (${params.model})]`;
+        }
         return {
           text: fullText,
           toolCalls: collectedToolCalls,
@@ -782,19 +1346,22 @@ var GeminiProvider = class {
       } catch (err) {
         cleanup();
         lastError = err;
-        if (params.signal?.aborted) {
+        if (params.signal?.aborted || err instanceof CancelledError) {
+          throw err instanceof CancelledError ? err : params.signal?.reason || new CancelledError();
+        }
+        if (err instanceof TimeoutError || err instanceof FirstTokenTimeoutError) {
           throw err;
         }
         const msg = String(err?.message || err);
-        if (msg.includes("API_KEY_INVALID") || msg.includes("401") || msg.includes("403")) {
-          throw new LanternProviderError(`Authentication failed: ${msg}`, 401, this.id);
+        if (msg.includes("API_KEY_INVALID") || msg.includes("API key not valid") || msg.includes("401") || msg.includes("403") || msg.includes("PERMISSION_DENIED")) {
+          throw new AuthenticationError(`Authentication failed for ${this.displayName}: Invalid or restricted API key. Please run 'lantern keys set ${this.id}' or verify GEMINI_API_KEY.`);
         }
-        if (msg.includes("NOT_FOUND") || msg.includes("models/")) {
+        if (msg.includes("NOT_FOUND") || msg.includes("not found") || msg.includes("is not supported") || msg.includes("models/")) {
           throw new ModelNotFoundError(params.model, this.displayName);
         }
-        const isRateLimit = msg.includes("429") || msg.includes("RESOURCE_EXHAUSTED");
-        const isTransient = msg.includes("503") || msg.includes("overloaded") || msg.includes("ECONNRESET") || msg.includes("ETIMEDOUT") || msg.includes("socket hang up");
-        if ((isRateLimit || isTransient) && attempts < maxAttempts) {
+        const isRateLimit = msg.includes("429") || msg.includes("RESOURCE_EXHAUSTED") || msg.includes("quota");
+        const isTransient = msg.includes("503") || msg.includes("500") || msg.includes("overloaded") || msg.includes("ECONNRESET") || msg.includes("ETIMEDOUT") || msg.includes("socket hang up") || msg.includes("fetch failed");
+        if ((isRateLimit || isTransient) && attempts < maxAttempts && !params.signal?.aborted) {
           const backoff = Math.min(1e3 * Math.pow(1.5, attempts), 3e3);
           if (params.callbacks.onStateChange) {
             params.callbacks.onStateChange(`retrying:${attempts}`);
@@ -803,12 +1370,12 @@ var GeminiProvider = class {
           continue;
         }
         if (isRateLimit) {
-          throw new RateLimitError(msg);
+          throw new RateLimitError(`Rate limit or quota reached for ${this.displayName}. Please wait a few seconds before retrying.`);
         }
-        throw new LanternProviderError(`Gemini request failed: ${msg}`, void 0, this.id);
+        throw new LanternProviderError(`Gemini request failed: ${sanitizeSecrets(msg)}`, void 0, this.id);
       }
     }
-    throw lastError instanceof Error ? lastError : new Error(String(lastError));
+    throw lastError instanceof Error ? lastError : new Error(sanitizeSecrets(String(lastError)));
   }
   convertHistoryToContents(turns) {
     const contents = [];
@@ -1092,18 +1659,25 @@ var OpenAIProvider = class {
     }
     const timeoutMs = params.timeoutMs || 6e4;
     const firstTokenTimeoutMs = params.firstTokenTimeoutMs || 3e4;
+    const connectTimeoutMs = Math.min(timeoutMs, 15e3);
+    if (params.callbacks.onStateChange) {
+      params.callbacks.onStateChange("resolving_credentials");
+    }
     let attempts = 0;
     const maxAttempts = 3;
     let lastError = null;
     while (attempts < maxAttempts) {
       attempts++;
       const connectStart = Date.now();
+      if (params.signal?.aborted) {
+        throw params.signal.reason || new CancelledError();
+      }
       if (params.callbacks.onStateChange) {
         params.callbacks.onStateChange(attempts > 1 ? `retrying:${attempts}` : "connecting");
       }
       const { controller, cleanup } = createLinkedAbortController(params.signal, timeoutMs);
       try {
-        const response = await fetch(`${this.baseUrl}/chat/completions`, {
+        const fetchPromise = fetch(`${this.baseUrl}/chat/completions`, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
@@ -1113,6 +1687,13 @@ var OpenAIProvider = class {
           body: JSON.stringify(payload),
           signal: controller.signal
         });
+        const response = await withTimeoutRace(
+          fetchPromise,
+          connectTimeoutMs,
+          `Connection to ${this.displayName} (${params.model})`,
+          controller.signal,
+          () => controller.abort(new TimeoutError(connectTimeoutMs, `Connection to ${this.displayName} (${params.model})`))
+        );
         timing.connectMs = Date.now() - connectStart;
         if (!response.ok) {
           const errorBody = await response.text();
@@ -1488,18 +2069,25 @@ var AnthropicProvider = class {
     }
     const timeoutMs = params.timeoutMs || 6e4;
     const firstTokenTimeoutMs = params.firstTokenTimeoutMs || 3e4;
+    const connectTimeoutMs = Math.min(timeoutMs, 15e3);
+    if (params.callbacks.onStateChange) {
+      params.callbacks.onStateChange("resolving_credentials");
+    }
     let attempts = 0;
     const maxAttempts = 3;
     let lastError = null;
     while (attempts < maxAttempts) {
       attempts++;
       const connectStart = Date.now();
+      if (params.signal?.aborted) {
+        throw params.signal.reason || new CancelledError();
+      }
       if (params.callbacks.onStateChange) {
         params.callbacks.onStateChange(attempts > 1 ? `retrying:${attempts}` : "connecting");
       }
       const { controller, cleanup } = createLinkedAbortController(params.signal, timeoutMs);
       try {
-        const response = await fetch(`${this.baseUrl}/messages`, {
+        const fetchPromise = fetch(`${this.baseUrl}/messages`, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
@@ -1509,6 +2097,13 @@ var AnthropicProvider = class {
           body: JSON.stringify(payload),
           signal: controller.signal
         });
+        const response = await withTimeoutRace(
+          fetchPromise,
+          connectTimeoutMs,
+          `Connection to ${this.displayName} (${params.model})`,
+          controller.signal,
+          () => controller.abort(new TimeoutError(connectTimeoutMs, `Connection to ${this.displayName} (${params.model})`))
+        );
         timing.connectMs = Date.now() - connectStart;
         if (!response.ok) {
           const errorBody = await response.text();
@@ -1775,18 +2370,29 @@ var OpenRouterProvider = class extends OpenAIProvider {
       if (res.ok) {
         const json = await res.json();
         if (Array.isArray(json?.data)) {
-          const models = json.data.slice(0, 100).map((m) => ({
-            id: m.id,
-            name: m.name || m.id,
-            provider: this.id,
-            description: m.description,
-            contextWindow: m.context_length || 128e3,
-            capabilities: this.getCapabilities(m.id),
-            pricing: m.pricing ? {
-              promptPer1k: parseFloat(m.pricing.prompt) * 1e3,
-              completionPer1k: parseFloat(m.pricing.completion) * 1e3
-            } : void 0
-          }));
+          const models = json.data.slice(0, 100).map((m) => {
+            const hasTools = Array.isArray(m.supported_parameters) ? m.supported_parameters.includes("tools") : !m.id.includes(":free") && !m.id.includes("deepseek-r1");
+            const hasVision = typeof m.architecture?.modality === "string" ? m.architecture.modality.includes("image") : m.id.includes("vision") || m.id.includes("gpt-4o") || m.id.includes("claude-3");
+            const isReasoning = m.id.includes("r1") || m.id.includes("o1") || m.id.includes("o3") || m.id.includes("reason");
+            return {
+              id: m.id,
+              name: m.name || m.id,
+              provider: this.id,
+              description: m.description,
+              contextWindow: m.context_length || 128e3,
+              capabilities: {
+                streaming: true,
+                tools: hasTools,
+                images: hasVision,
+                reasoning: isReasoning,
+                contextWindow: m.context_length || 128e3
+              },
+              pricing: m.pricing ? {
+                promptPer1k: parseFloat(m.pricing.prompt) * 1e3,
+                completionPer1k: parseFloat(m.pricing.completion) * 1e3
+              } : void 0
+            };
+          });
           return models;
         }
       }
@@ -1912,41 +2518,6 @@ var ProviderRegistry = class {
   }
 };
 
-// src/security/secrets.ts
-import path3 from "path";
-var SECRET_FILE_PATTERNS = [
-  /^\.env(\..+)?$/i,
-  /\.pem$/i,
-  /\.key$/i,
-  /\.pfx$/i,
-  /\.p12$/i,
-  /^id_rsa/i,
-  /^id_dsa/i,
-  /^id_ecdsa/i,
-  /^id_ed25519/i,
-  /service[_-]?account.*\.json$/i,
-  /credentials.*\.json$/i,
-  /\.keystore$/i,
-  /\.token$/i,
-  /\.secret/i
-];
-function isSecretFile(filePath) {
-  const base = path3.basename(filePath);
-  return SECRET_FILE_PATTERNS.some((pattern) => pattern.test(base));
-}
-function sanitizeSecrets(text) {
-  if (!text) return text;
-  let sanitized = text;
-  sanitized = sanitized.replace(/AIza[0-9A-Za-z\-_]{30,40}/g, "AIza***********************************");
-  sanitized = sanitized.replace(/ghp_[0-9a-zA-Z]{36}/g, "ghp_************************************");
-  sanitized = sanitized.replace(/github_pat_[0-9a-zA-Z_]{82}/g, "github_pat_**********************************************************************************");
-  const currentKey = process.env.GEMINI_API_KEY;
-  if (currentKey && currentKey.length > 5) {
-    sanitized = sanitized.split(currentKey).join("[REDACTED_GEMINI_API_KEY]");
-  }
-  return sanitized;
-}
-
 // src/security/sandbox.ts
 import path4 from "path";
 import fs3 from "fs";
@@ -3267,7 +3838,7 @@ var McpManager = class {
 };
 
 // src/approval/approver.ts
-import readline from "readline";
+import readline2 from "readline";
 import pc3 from "picocolors";
 var ApprovalEngine = class {
   yolo;
@@ -3331,7 +3902,7 @@ var ApprovalEngine = class {
     if (!process.stdin.isTTY) {
       return Promise.resolve("no");
     }
-    const rl = readline.createInterface({
+    const rl = readline2.createInterface({
       input: process.stdin,
       output: process.stdout
     });
@@ -3835,11 +4406,14 @@ var TerminalSpinner = class {
     }
     return this;
   }
+  resolvingCredentials(provider) {
+    return this.update(`Resolving credentials for ${pc4.cyan(provider)}...`);
+  }
   connecting(provider, model) {
     return this.update(`Connecting to ${pc4.cyan(provider)} (${pc4.bold(model)})...`);
   }
   waitingFirstToken(provider, model) {
-    return this.update(`Waiting for first token from ${pc4.cyan(provider)}...`);
+    return this.update(`Waiting for first token from ${pc4.cyan(provider)} (${pc4.bold(model)})...`);
   }
   receiving(tokensCount) {
     const suffix = tokensCount ? ` (${tokensCount} tokens)` : "...";
@@ -4035,27 +4609,28 @@ var LanternAgent = class {
           lowLatency: context.lowLatency,
           callbacks: {
             onStateChange: (state) => {
-              if (state === "connecting") {
+              if (state === "resolving_credentials") {
+                this.spinner.resolvingCredentials(provider.displayName);
+              } else if (state === "connecting") {
                 this.spinner.connecting(provider.displayName, context.model);
               } else if (state === "waiting_first_token") {
                 this.spinner.waitingFirstToken(provider.displayName, context.model);
               } else if (state.startsWith("retrying:")) {
                 const attempt = state.split(":")[1];
                 this.spinner.retrying(parseInt(attempt, 10), 3, 1500);
-              } else if (state === "streaming") {
+              } else if (state === "streaming" || state === "receiving") {
                 this.spinner.stop();
               }
             },
             onChunk: (chunk) => {
-              if (currentStepText === "") {
-                this.spinner.stop();
-              }
+              this.spinner.stop();
               currentStepText += chunk;
               if (!context.jsonOutput) {
                 process.stdout.write(chunk);
               }
             },
             onToolCalls: (calls) => {
+              this.spinner.stop();
               currentToolCalls = calls;
             },
             onUsage: (usage) => {
@@ -4240,7 +4815,148 @@ function loadAttachments(filePaths) {
   return filePaths.map((p) => loadAttachment(p));
 }
 
+// src/provider/modelClassifier.ts
+var DEFAULT_RECOMMENDED_CODING_MODELS = {
+  gemini: ["gemini-3.8-flash", "gemini-2.5-flash", "gemini-2.5-pro", "gemini-2.0-flash"],
+  openai: ["gpt-4o", "gpt-4o-mini", "o3-mini", "gpt-4-turbo"],
+  anthropic: ["claude-3-7-sonnet-20250219", "claude-3-5-sonnet-20241022", "claude-3-5-haiku-20241022"],
+  openrouter: [
+    "anthropic/claude-3.7-sonnet",
+    "anthropic/claude-3.5-sonnet",
+    "openai/gpt-4o",
+    "google/gemini-2.5-flash",
+    "meta-llama/llama-3.3-70b-instruct",
+    "deepseek/deepseek-chat"
+  ]
+};
+function classifyModel(modelId, capabilities, description) {
+  const lower = modelId.toLowerCase();
+  const desc = (description || "").toLowerCase();
+  if (lower.includes("embedding") || lower.includes("embed") || desc.includes("embedding")) {
+    return {
+      id: modelId,
+      category: "specialized",
+      specializedType: "Embedding",
+      isRecommendedForCoding: false,
+      capabilities: {
+        streaming: false,
+        tools: false,
+        images: false,
+        reasoning: false,
+        ...capabilities
+      },
+      warning: "Embeddings model: generates vector representations, not conversational text or tool calls."
+    };
+  }
+  if (lower.includes("dall-e") || lower.includes("imagen") || lower.includes("stable-diffusion") || desc.includes("image generation")) {
+    return {
+      id: modelId,
+      category: "specialized",
+      specializedType: "Image Generation",
+      isRecommendedForCoding: false,
+      capabilities: {
+        streaming: false,
+        tools: false,
+        images: false,
+        reasoning: false,
+        ...capabilities
+      },
+      warning: "Image generation model: generates graphics/images, cannot execute coding tools."
+    };
+  }
+  if (lower.includes("whisper") || lower.includes("tts") || lower.includes("speech") || lower.includes("audio") || lower.includes("realtime") || desc.includes("audio") || desc.includes("transcription")) {
+    return {
+      id: modelId,
+      category: "specialized",
+      specializedType: "Audio/Speech",
+      isRecommendedForCoding: false,
+      capabilities: {
+        streaming: Boolean(capabilities?.streaming),
+        tools: false,
+        images: false,
+        reasoning: false,
+        ...capabilities
+      },
+      warning: "Audio/Speech model: designed for audio processing, not interactive text coding."
+    };
+  }
+  if (lower.includes(":batch") || lower.includes("-batch") || desc.includes("batch only")) {
+    return {
+      id: modelId,
+      category: "specialized",
+      specializedType: "Batch Processing",
+      isRecommendedForCoding: false,
+      capabilities: {
+        streaming: false,
+        tools: Boolean(capabilities?.tools),
+        images: Boolean(capabilities?.images),
+        reasoning: Boolean(capabilities?.reasoning),
+        ...capabilities
+      },
+      warning: "Batch model: processed asynchronously in queues with high latency, not interactive."
+    };
+  }
+  if (lower.includes("moderation") || lower.includes("rerank")) {
+    return {
+      id: modelId,
+      category: "specialized",
+      specializedType: lower.includes("rerank") ? "Reranker" : "Moderation",
+      isRecommendedForCoding: false,
+      capabilities: {
+        streaming: false,
+        tools: false,
+        images: false,
+        reasoning: false,
+        ...capabilities
+      },
+      warning: "Specialized classification or reranking filter, not an interactive assistant."
+    };
+  }
+  const isKnownNonTool = lower.includes("o1-preview") || lower.includes(":free") && !lower.includes("gemini") || lower.includes("deepseek-r1") && !lower.includes("distill");
+  const toolsSupported = capabilities?.tools !== void 0 ? capabilities.tools : !isKnownNonTool;
+  const streamingSupported = capabilities?.streaming ?? true;
+  const imagesSupported = capabilities?.images ?? (lower.includes("vision") || lower.includes("gpt-4o") || lower.includes("claude-3") || lower.includes("gemini"));
+  const reasoningSupported = capabilities?.reasoning ?? (lower.includes("o1") || lower.includes("o3") || lower.includes("r1") || lower.includes("thinking"));
+  const resolvedCapabilities = {
+    streaming: streamingSupported,
+    tools: toolsSupported,
+    images: imagesSupported,
+    reasoning: reasoningSupported,
+    contextWindow: capabilities?.contextWindow || 128e3
+  };
+  if (!toolsSupported) {
+    return {
+      id: modelId,
+      category: "chat",
+      isRecommendedForCoding: false,
+      capabilities: resolvedCapabilities,
+      warning: "Chat-only model: does not support tool/function calling (cannot inspect files, apply edits, or execute commands)."
+    };
+  }
+  return {
+    id: modelId,
+    category: "coding",
+    isRecommendedForCoding: true,
+    capabilities: resolvedCapabilities
+  };
+}
+function getRecommendedCodingModels(providerId, availableModels) {
+  const norm = providerId.toLowerCase();
+  if (availableModels && availableModels.length > 0) {
+    const fromList = availableModels.filter((m) => {
+      const c = classifyModel(m.id, m.capabilities, m.description);
+      return c.category === "coding";
+    }).map((m) => m.id);
+    if (fromList.length > 0) {
+      return fromList.slice(0, 5);
+    }
+  }
+  return DEFAULT_RECOMMENDED_CODING_MODELS[norm] || ["gemini-3.8-flash", "gpt-4o", "claude-3-7-sonnet"];
+}
+
 export {
+  isSecretFile,
+  sanitizeSecrets,
   TimeoutError,
   FirstTokenTimeoutError,
   CancelledError,
@@ -4251,6 +4967,7 @@ export {
   LanternProviderError,
   formatErrorMessage,
   createLinkedAbortController,
+  withTimeoutRace,
   wrapStreamWithFirstTokenTimeout,
   DEFAULT_CONFIG,
   ALLOWED_CONFIG_KEYS,
@@ -4261,20 +4978,24 @@ export {
   saveConfig,
   setConfigValue,
   getConfigValue,
+  NativeCredentialStore,
+  SERVICE_NAME,
+  getLegacyCredentialsFilePath,
+  getStoreName,
   encryptSecret,
   decryptSecret,
   maskApiKey,
+  migrateLegacyCredentials,
   getApiKey,
   setApiKey,
   removeApiKey,
   listConfiguredKeys,
+  promptMaskedApiKey,
   GeminiProvider,
   OpenAIProvider,
   AnthropicProvider,
   OpenRouterProvider,
   ProviderRegistry,
-  isSecretFile,
-  sanitizeSecrets,
   validateWorkspacePath,
   formatTerminalDiff,
   formatNewFilePreview,
@@ -4302,6 +5023,8 @@ export {
   SkillManager,
   LanternAgent,
   loadAttachment,
-  loadAttachments
+  loadAttachments,
+  classifyModel,
+  getRecommendedCodingModels
 };
-//# sourceMappingURL=chunk-PELESOCI.js.map
+//# sourceMappingURL=chunk-45FEFNMM.js.map