codeshark-cli 0.1.1

package/dist/config.js

@@ -0,0 +1,126 @@
+import { homedir } from "node:os";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { DEFAULT_MODEL_ID, findModel, toApiSlug } from "./models.js";
+export const DEFAULT_GATEWAY_URL = "https://codeshark-gateway.ajrgp.workers.dev";
+/** Kept for backwards compatibility; the catalog in src/models.ts is canonical. */
+export const DEFAULT_MODEL = "glm-5.3-flash-thinking:free";
+/** Fallback slug for OpenRouter when the active model lives on another provider. */
+export const DEFAULT_OPENROUTER_MODEL = "z-ai/glm-5.2:free";
+export const DEFAULT_GEMINI_MODEL = "gemini-2.5-pro";
+export const GEMINI_FLASH_MODEL = "gemini-2.5-flash";
+export const DEFAULT_OLLAMA_MODEL = "qwen3-coder:30b";
+export const DEFAULT_MAX_ITERATIONS = 25;
+export function configPath() {
+    return process.env.CODESHARK_CONFIG ?? join(homedir(), ".codeshark.json");
+}
+export function loadConfig() {
+    const p = configPath();
+    try {
+        if (!existsSync(p))
+            return {};
+        const raw = readFileSync(p, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+/** Persist config, creating the directory and locking file permissions (POSIX only). */
+export function saveConfig(cfg) {
+    const p = configPath();
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", "utf8");
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        // Windows: chmod is a no-op / may throw — ignore.
+    }
+}
+/**
+ * The effective model *catalog id* (e.g. "unorouter/glm-5.3-flash-thinking").
+ * Falls back sensibly when config/env only name a provider.
+ */
+export function activeModelId(cfg) {
+    if (process.env.CODESHARK_MODEL)
+        return process.env.CODESHARK_MODEL;
+    if (cfg.model)
+        return cfg.model;
+    return DEFAULT_MODEL_ID;
+}
+/** Raw provider-API slug for the active model. */
+export function activeApiModel(cfg) {
+    return toApiSlug(activeModelId(cfg));
+}
+/** The provider implied by the active model selection (or explicit config). */
+export function activeProvider(cfg) {
+    const m = activeModelId(cfg);
+    const entry = findModel(m);
+    if (entry)
+        return entry.provider;
+    const explicit = cfg.provider;
+    if (explicit)
+        return explicit;
+    // Slug heuristics for raw slugs not in the catalog.
+    if (m.startsWith("unorouter/"))
+        return "unorouter";
+    if (m.endsWith(":free") || m.startsWith("openrouter/"))
+        return "openrouter";
+    if (m.startsWith("moonshotai/") || m.startsWith("deepseek-ai/"))
+        return "nvidia";
+    return "gateway";
+}
+/** Effective model for a provider, honoring env overrides and config. */
+export function effectiveModel(cfg, provider) {
+    if (provider === "gemini") {
+        const configured = cfg.model && !findModel(cfg.model) ? cfg.model : undefined;
+        return process.env.GEMINI_MODEL ?? configured ?? DEFAULT_GEMINI_MODEL;
+    }
+    if (provider === "ollama")
+        return process.env.CODESHARK_OLLAMA_MODEL ?? cfg.ollamaModel ?? DEFAULT_OLLAMA_MODEL;
+    const selected = findModel(activeModelId(cfg));
+    if (selected?.provider === provider)
+        return selected.model;
+    // The community gateway proxies UnoRouter/OpenRouter models, so preserve
+    // the selected model instead of silently falling back to GLM.
+    if (provider === "gateway" && (selected?.provider === "openrouter" || selected?.provider === "unorouter"))
+        return selected.model;
+    if (provider === "unorouter")
+        return process.env.UNOROUTER_MODEL ?? DEFAULT_MODEL;
+    if (provider === "openrouter")
+        return DEFAULT_OPENROUTER_MODEL;
+    if (provider === "nvidia") {
+        const raw = activeModelId(cfg);
+        if (raw.startsWith("moonshotai/") || raw.startsWith("deepseek-ai/"))
+            return raw;
+        return "moonshotai/kimi-k3";
+    }
+    return DEFAULT_MODEL;
+}
+export function envApiKey(provider) {
+    switch (provider) {
+        case "openrouter":
+            return process.env.OPENROUTER_API_KEY;
+        case "unorouter":
+            return process.env.UNOROUTER_API_KEY;
+        case "nvidia":
+            return process.env.NVIDIA_API_KEY ?? process.env.NVIDIA_NIM_API_KEY;
+        case "gemini":
+            return process.env.GEMINI_API_KEY;
+        default:
+            return undefined;
+    }
+}
+export function hasApiKey(cfg, provider) {
+    if (provider === "gateway")
+        return true;
+    if (provider === "ollama")
+        return true;
+    return Boolean(cfg[`${provider}ApiKey`]) || Boolean(envApiKey(provider));
+}
+/** Short human label for the banner's model line — just the model, no provider branding. */
+export function modelLabel(cfg) {
+    const id = activeModelId(cfg);
+    return findModel(id)?.label ?? id;
+}

package/dist/index.js

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { bold, dim, hex } from "./ansi.js";
+import { printBanner } from "./banner.js";
+import { showLoading, startThinkingSpinner } from "./loading.js";
+import { loadConfig, saveConfig } from "./config.js";
+import { readTerms } from "./terms.js";
+import { resolveClients } from "./provider/index.js";
+import { createRegistry } from "./tools/index.js";
+import { printModelInfo, startRepl, switchModel } from "./repl.js";
+import { runSetup, runSetupFlow } from "./setup.js";
+import { runAgent } from "./agent.js";
+import { errorMessage } from "./provider/types.js";
+import { launchKeysPage } from "./keysPage.js";
+import { extractFolderArg, openProjectFolder } from "./project.js";
+const require = createRequire(import.meta.url);
+const VERSION = require("../package.json").version;
+function printHelp() {
+    console.log([
+        "",
+        bold("CodeShark") + dim(` v${VERSION} — a terminal coding agent`),
+        "",
+        "  Usage:",
+        "    codeshark                  start chat in the current project folder",
+        "    codeshark <prompt…>        one-shot prompt for the current project folder",
+        "    codeshark --folder <path>  open a specific project folder first",
+        "    codeshark --folder <path> \"prompt…\"  run a prompt in that folder",
+        "    codeshark banner [--plain] print just the mascot banner",
+        "    codeshark setup            guided setup for providers / API keys",
+        "    codeshark keys             open the password-protected local key page",
+        "    codeshark model            list and switch the model catalog",
+        "    codeshark terms            read the Terms of Service",
+        "    codeshark --version        print the version",
+        "",
+        "  Zero setup: works out of the box with no API keys. Add your own key",
+        "  anytime for your own rate limits and private prompts.",
+        "",
+    ].join("\n"));
+}
+function isTTY() {
+    return Boolean(process.stdout.isTTY) && !process.env.CODESHARK_NO_BANNER;
+}
+async function runOneShot(prompt) {
+    const cfg = loadConfig();
+    const cwd = process.cwd();
+    const registry = createRegistry();
+    const clients = resolveClients(cfg, (m) => console.error(dim(m)));
+    // Show a "thinking" spinner until the first token arrives, then stream.
+    const stopThinking = startThinkingSpinner("Thinking");
+    let thinking = true;
+    const events = {
+        onText: (d) => {
+            if (thinking) {
+                thinking = false;
+                stopThinking();
+            }
+            process.stdout.write(d);
+        },
+    };
+    try {
+        const result = await runAgent(prompt, { clients, registry, cwd }, events);
+        if (thinking) {
+            thinking = false;
+            stopThinking();
+        }
+        if (result.streamedText) {
+            if (!result.streamedText.endsWith("\n"))
+                process.stdout.write("\n");
+        }
+        else {
+            process.stdout.write(result.text.endsWith("\n") ? result.text : result.text + "\n");
+        }
+    }
+    catch (e) {
+        if (thinking)
+            stopThinking();
+        console.error(hex("#f87171", `✗ ${errorMessage(e)}`));
+        process.exitCode = 1;
+    }
+}
+async function main() {
+    const parsed = extractFolderArg(process.argv.slice(2));
+    const args = parsed.args;
+    const [command, ...rest] = args;
+    // These informational commands do not touch a project and work anywhere.
+    if (command === "--version" || command === "-v") {
+        console.log(VERSION);
+        return;
+    }
+    if (command === "--help" || command === "-h" || command === "help") {
+        printHelp();
+        return;
+    }
+    if (command === "banner") {
+        printBanner({ plain: rest[0] === "--plain" });
+        return;
+    }
+    if (command === "terms") {
+        console.log(readTerms());
+        return;
+    }
+    // Every operational command is explicitly project-scoped. Requiring the
+    // folder argument makes it impossible to start the agent in the wrong place.
+    if (!parsed.folder) {
+        throw new Error("CodeShark needs a project folder. Open your project in a terminal, then run `codeshark --folder .` (or pass its full path).");
+    }
+    const projectFolder = openProjectFolder(parsed.folder);
+    switch (command) {
+        case "setup":
+            await runSetup();
+            return;
+        case "keys": {
+            const url = await launchKeysPage();
+            console.log(`CodeShark key vault: ${url}`);
+            console.log("Keep this terminal open while using the page. Press Ctrl+C to stop it.");
+            await new Promise(() => { });
+            return;
+        }
+        case "model": {
+            // `codeshark model` lists the catalog; `codeshark model <name>` switches.
+            if (rest.length) {
+                switchModel(rest.join(" "));
+                return;
+            }
+            printModelInfo();
+            return;
+        }
+        case "chat":
+            break;
+        default:
+            if (command !== undefined && !command.startsWith("-")) {
+                await runOneShot(args.join(" "));
+                return;
+            }
+            break;
+    }
+    // Interactive mode.
+    const cfg = loadConfig();
+    const cwd = projectFolder;
+    if (isTTY()) {
+        // One-time Terms of Service acceptance before anything else runs.
+        if (!cfg.termsAccepted) {
+            const rl = createInterface({ input, output });
+            const answer = (await rl.question("  CodeShark is provided as-is with no warranty. By continuing you agree to the Terms of Service — type `codeshark terms` to read them. Continue? [y/N]: "))
+                .trim()
+                .toLowerCase();
+            rl.close();
+            if (answer !== "y" && answer !== "yes") {
+                console.log(dim("  Terms not accepted — nothing was changed. Run `codeshark terms` to read them."));
+                return;
+            }
+            cfg.termsAccepted = true;
+            saveConfig(cfg);
+            console.log("");
+        }
+        // First run: let the user pick between the shared gateway, their own
+        // API key (recommended), or local Ollama — the same flow as `codeshark setup`.
+        const hasProviderSetup = Boolean(cfg.provider) ||
+            Boolean(cfg.unorouterApiKey || cfg.openrouterApiKey || cfg.nvidiaApiKey || cfg.geminiApiKey) ||
+            Boolean(process.env.UNOROUTER_API_KEY ||
+                process.env.OPENROUTER_API_KEY ||
+                process.env.NVIDIA_API_KEY ||
+                process.env.GEMINI_API_KEY);
+        if (!hasProviderSetup) {
+            const rl = createInterface({ input, output });
+            await runSetupFlow(cfg, rl, { title: "🦈  Welcome to CodeShark" });
+            rl.close();
+            console.log("");
+        }
+        // The REPL prints the input instructions once after the banner. Keeping
+        // them out of the banner avoids the duplicated startup line. The loading
+        // screen types itself out with a spinner, then hands off to the REPL.
+        printBanner();
+        await showLoading([
+            "Opening project folder",
+            "Loading model catalog",
+            "Starting the agent",
+        ]);
+        console.log("");
+    }
+    const registry = createRegistry();
+    const getClients = () => resolveClients(loadConfig());
+    await startRepl({ cwd, registry, getClients });
+}
+main().catch((e) => {
+    console.error(hex("#f87171", `✗ ${errorMessage(e)}`));
+    process.exit(1);
+});

package/dist/keysPage.js

@@ -0,0 +1,233 @@
+import { createServer } from "node:http";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { exec } from "node:child_process";
+import { configPath, loadConfig, saveConfig } from "./config.js";
+const DEFAULT_PORT = 4317;
+const SESSION_TTL_MS = 30 * 60 * 1000;
+const MAX_BODY_BYTES = 32_000;
+let pageServer;
+let pageUrl;
+let authFilePath;
+const sessions = new Map();
+function authPath() {
+    return process.env.CODESHARK_AUTH ?? join(dirname(configPath()), ".codeshark-auth.json");
+}
+function readAuth() {
+    const p = authPath();
+    authFilePath = p;
+    try {
+        if (!existsSync(p))
+            return undefined;
+        return JSON.parse(readFileSync(p, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function saveAuth(password) {
+    const salt = randomBytes(16).toString("hex");
+    const passwordHash = scryptSync(password, salt, 32).toString("hex");
+    const p = authPath();
+    authFilePath = p;
+    writeFileSync(p, JSON.stringify({ salt, passwordHash }, null, 2) + "\n", "utf8");
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        // Windows permissions are controlled by the user account.
+    }
+}
+function validPassword(password) {
+    const auth = readAuth();
+    if (!auth)
+        return false;
+    try {
+        const actual = scryptSync(password, auth.salt, 32);
+        const expected = Buffer.from(auth.passwordHash, "hex");
+        return actual.length === expected.length && timingSafeEqual(actual, expected);
+    }
+    catch {
+        return false;
+    }
+}
+function htmlEscape(value) {
+    return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function mask(value) {
+    if (!value)
+        return "";
+    if (value.length <= 8)
+        return "•".repeat(value.length);
+    return `${value.slice(0, 5)}${"•".repeat(Math.min(16, value.length - 8))}${value.slice(-3)}`;
+}
+function cookieValue(req, name) {
+    const cookies = req.headers.cookie?.split(";").map((x) => x.trim()) ?? [];
+    const found = cookies.find((x) => x.startsWith(`${name}=`));
+    return found ? decodeURIComponent(found.slice(name.length + 1)) : undefined;
+}
+function currentSession(req) {
+    const token = cookieValue(req, "codeshark_session");
+    const session = token ? sessions.get(token) : undefined;
+    if (!session || session.expiresAt < Date.now()) {
+        if (token)
+            sessions.delete(token);
+        return undefined;
+    }
+    return session;
+}
+function send(res, status, body, headers = {}) {
+    res.writeHead(status, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        ...headers,
+    });
+    res.end(body);
+}
+function redirect(res, location, cookie) {
+    res.writeHead(303, {
+        location,
+        "cache-control": "no-store",
+        ...(cookie ? { "set-cookie": cookie } : {}),
+    });
+    res.end();
+}
+function page(title, body) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${htmlEscape(title)} · CodeShark</title>
+<style>
+:root{color-scheme:dark;font-family:ui-monospace,SFMono-Regular,Consolas,monospace;background:#101318;color:#e7edf3}
+body{max-width:760px;margin:0 auto;padding:42px 22px}h1{font-size:25px;margin:0 0 8px;color:#8fc5ed}h2{font-size:16px;margin-top:30px;color:#d96b43}p,.hint{color:#98a6b3;line-height:1.55}.card{background:#191f27;border:1px solid #2e3a45;border-radius:12px;padding:20px;margin:18px 0}label{display:block;color:#c6d3de;margin:15px 0 7px}input{box-sizing:border-box;width:100%;padding:12px;border-radius:7px;border:1px solid #40505d;background:#0d1117;color:#fff;font:inherit}button{margin-top:18px;padding:11px 16px;border:0;border-radius:7px;background:#4b9bd1;color:#07111a;font:inherit;font-weight:700;cursor:pointer}button.danger{background:#7d3941;color:#fff}.key{font-size:13px;word-break:break-all;color:#c6e3f8}.warning{border-left:3px solid #d96b43;padding-left:12px}.small{font-size:12px;color:#778896}a{color:#8fc5ed}
+</style></head><body>${body}</body></html>`;
+}
+function loginPage(message = "") {
+    const auth = readAuth();
+    if (!auth) {
+        return page("Create local password", `<h1>🦈 CodeShark key vault</h1><p>Set a local password before viewing API keys. This password is stored as a one-way hash and never leaves this computer.</p>${message ? `<p class="warning">${htmlEscape(message)}</p>` : ""}<div class="card"><form method="post" action="/setup"><label for="password">Create password</label><input id="password" name="password" type="password" minlength="8" required autofocus><label for="confirm">Confirm password</label><input id="confirm" name="confirm" type="password" minlength="8" required><button>Protect my keys</button></form></div><p class="small">The page only listens on 127.0.0.1. Do not expose this port publicly.</p>`);
+    }
+    return page("Unlock key vault", `<h1>🦈 CodeShark key vault</h1><p>Enter your local password to view or edit saved provider keys.</p>${message ? `<p class="warning">${htmlEscape(message)}</p>` : ""}<div class="card"><form method="post" action="/login"><input type="hidden" name="csrf" value="${htmlEscape(randomBytes(16).toString("hex"))}"><label for="password">Password</label><input id="password" name="password" type="password" required autofocus><button>Unlock</button></form></div><p class="small">Forgot the password? Delete ${htmlEscape(authFilePath ?? authPath())} to reset local protection.</p>`);
+}
+function vaultPage(session) {
+    const cfg = loadConfig();
+    const secretInput = (id, label, placeholder) => `<label for="${id}">${label}</label><input id="${id}" name="${id}" type="password" value="" placeholder="${placeholder}" autocomplete="new-password" spellcheck="false"><label class="small"><input type="checkbox" name="clear_${id}" value="1" style="width:auto;margin-right:8px"> Clear this saved key</label>`;
+    return page("API keys", `<h1>🦈 CodeShark key vault</h1><p>Unlocked locally. Values are saved to <code>${htmlEscape(configPath())}</code>. Keep this page on your own computer.</p><div class="card"><form method="post" action="/save"><input type="hidden" name="csrf" value="${htmlEscape(session.csrf)}"><h2>Provider keys</h2>${secretInput("unorouterApiKey", "UnoRouter API key", "paste a replacement (shown once)…")}${secretInput("openrouterApiKey", "OpenRouter API key", "paste a replacement: sk-or-v1-…")}${secretInput("nvidiaApiKey", "NVIDIA NIM API key", "paste a replacement: nvapi-…")}${secretInput("geminiApiKey", "Google Gemini API key", "paste a replacement: AIza…")}<p class="small">Saved keys are never placed in this page's HTML. Leave a field blank to keep its current value, or check Clear to remove it.</p><button>Save keys</button></form></div><div class="card"><h2>Current status</h2><p class="key">UnoRouter: ${htmlEscape(mask(cfg.unorouterApiKey) || "not set")}</p><p class="key">OpenRouter: ${htmlEscape(mask(cfg.openrouterApiKey) || "not set")}</p><p class="key">NVIDIA: ${htmlEscape(mask(cfg.nvidiaApiKey) || "not set")}</p><p class="key">Gemini: ${htmlEscape(mask(cfg.geminiApiKey) || "not set")}</p><p class="hint">Your keys are never printed to the terminal by CodeShark.</p><form method="post" action="/logout"><input type="hidden" name="csrf" value="${htmlEscape(session.csrf)}"><button class="danger">Lock vault</button></form></div>`);
+}
+function parseBody(req) {
+    return new Promise((resolve, reject) => {
+        let body = "";
+        req.on("data", (chunk) => {
+            body += chunk.toString("utf8");
+            if (body.length > MAX_BODY_BYTES) {
+                reject(new Error("request too large"));
+                req.destroy();
+            }
+        });
+        req.on("end", () => {
+            const params = new URLSearchParams(body);
+            resolve(Object.fromEntries(params.entries()));
+        });
+        req.on("error", reject);
+    });
+}
+function isValidSessionRequest(req, body, session) {
+    return Boolean(session && body.csrf && body.csrf === session.csrf);
+}
+async function handle(req, res) {
+    const method = req.method ?? "GET";
+    const path = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+    const session = currentSession(req);
+    if (method === "GET" && path === "/") {
+        send(res, 200, session ? vaultPage(session) : loginPage());
+        return;
+    }
+    if (method === "POST" && path === "/setup") {
+        const body = await parseBody(req);
+        if (readAuth()) {
+            send(res, 403, loginPage("A password already exists. Unlock the vault instead."));
+            return;
+        }
+        if (!body.password || body.password.length < 8 || body.password !== body.confirm) {
+            send(res, 400, loginPage("Passwords must match and be at least 8 characters."));
+            return;
+        }
+        saveAuth(body.password);
+        return redirect(res, "/");
+    }
+    if (method === "POST" && path === "/login") {
+        const body = await parseBody(req);
+        if (!validPassword(body.password ?? "")) {
+            send(res, 401, loginPage("Incorrect password."));
+            return;
+        }
+        const token = randomBytes(32).toString("hex");
+        const newSession = { token, csrf: randomBytes(24).toString("hex"), expiresAt: Date.now() + SESSION_TTL_MS };
+        sessions.set(token, newSession);
+        return redirect(res, "/", `codeshark_session=${encodeURIComponent(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=1800`);
+    }
+    if (method === "POST" && path === "/save") {
+        const body = await parseBody(req);
+        if (!isValidSessionRequest(req, body, session)) {
+            send(res, 403, loginPage("Your session expired. Unlock the vault again."));
+            return;
+        }
+        const cfg = loadConfig();
+        for (const field of ["unorouterApiKey", "openrouterApiKey", "nvidiaApiKey", "geminiApiKey"]) {
+            const value = body[field]?.trim();
+            if (body[`clear_${field}`] === "1")
+                delete cfg[field];
+            else if (value)
+                cfg[field] = value;
+            // A blank field preserves the existing secret instead of deleting it.
+        }
+        saveConfig(cfg);
+        return redirect(res, "/");
+    }
+    if (method === "POST" && path === "/logout") {
+        const body = await parseBody(req);
+        if (isValidSessionRequest(req, body, session)) {
+            sessions.delete(session.token);
+            return redirect(res, "/", "codeshark_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0");
+        }
+        send(res, 403, loginPage("Your session expired."));
+        return;
+    }
+    send(res, 404, page("Not found", "<h1>404</h1><p>That CodeShark vault page does not exist.</p>"));
+}
+function openBrowser(url) {
+    if (process.env.CODESHARK_NO_BROWSER)
+        return;
+    const command = process.platform === "win32" ? `cmd /c start "" "${url}"` : process.platform === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+    exec(command, () => { });
+}
+export async function launchKeysPage(port = DEFAULT_PORT) {
+    if (pageServer && pageUrl) {
+        openBrowser(pageUrl);
+        return pageUrl;
+    }
+    pageServer = createServer((req, res) => {
+        void handle(req, res).catch(() => send(res, 400, page("Error", "<h1>Bad request</h1>")));
+    });
+    await new Promise((resolve, reject) => {
+        pageServer.once("error", reject);
+        pageServer.listen(port, "127.0.0.1", () => resolve());
+    });
+    const address = pageServer.address();
+    const actualPort = typeof address === "object" && address ? address.port : port;
+    pageUrl = `http://127.0.0.1:${actualPort}`;
+    openBrowser(pageUrl);
+    return pageUrl;
+}
+export function closeKeysPage() {
+    if (pageServer)
+        pageServer.close();
+    pageServer = undefined;
+    pageUrl = undefined;
+    sessions.clear();
+}
+export function keyVaultPath() {
+    return authPath();
+}

package/dist/loading.js

@@ -0,0 +1,63 @@
+import { dim, hex } from "./ansi.js";
+/**
+ * Startup animation helpers: a typewriter-style loading screen and a
+ * "thinking" spinner. Zero dependencies; both degrade to static output
+ * when stdout is not a TTY (pipes, CI, tests).
+ */
+// Braille dots look great in Windows Terminal and modern terminals;
+// legacy consoles get the classic -\|/ frames.
+const FRAMES = process.platform === "win32" && !process.env.WT_SESSION
+    ? ["-", "\\", "|", "/"]
+    : ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+const ACCENT = "#8ba3ba";
+const OK = "#4ade80";
+const TICK_MS = 14; // per typed character
+const DONE_MS = 130; // hold the check before the next step
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function canAnimate() {
+    return Boolean(process.stdout.isTTY) && !process.env.CODESHARK_NO_LOADING;
+}
+/**
+ * Startup loading screen. Each step's text types itself out character by
+ * character ("a", "am", "ame", …) while a spinner cycles beside it, then
+ * locks in with a green ✓ before the next step begins. Non-TTY output
+ * prints the steps instantly.
+ */
+export async function showLoading(steps) {
+    if (!canAnimate()) {
+        for (const step of steps)
+            console.log(dim(`  ${step}`));
+        return;
+    }
+    const write = (line) => process.stdout.write(`\r\u001b[2K${line}`);
+    for (const step of steps) {
+        let frame = 0;
+        for (let i = 0; i <= step.length; i++) {
+            const f = FRAMES[frame % FRAMES.length];
+            write(`  ${hex(ACCENT, f)} ${step.slice(0, i)}`);
+            frame++;
+            await sleep(TICK_MS);
+        }
+        write(`  ${hex(OK, "✓")} ${step}`);
+        await sleep(DONE_MS);
+    }
+    process.stdout.write("\n");
+}
+/**
+ * A "thinking" spinner on a single line. Returns a stop function that
+ * clears the line — call it as soon as the first token arrives.
+ */
+export function startThinkingSpinner(label) {
+    if (!canAnimate())
+        return () => { };
+    let frame = 0;
+    process.stdout.write(`\r\u001b[2K  ${hex(ACCENT, FRAMES[0])} ${label}`);
+    const timer = setInterval(() => {
+        frame = (frame + 1) % FRAMES.length;
+        process.stdout.write(`\r\u001b[2K  ${hex(ACCENT, FRAMES[frame])} ${label}`);
+    }, 80);
+    return () => {
+        clearInterval(timer);
+        process.stdout.write("\r\u001b[2K");
+    };
+}

package/dist/models.js

@@ -0,0 +1,54 @@
+export const MODELS = [
+    {
+        id: "unorouter/gpt-5.6-sol",
+        label: "Chat-GPT 5.6 Sol",
+        provider: "unorouter",
+        model: "gpt-5.6-sol:free",
+        context: "400K",
+        notes: "OpenAI's frontier reasoning model.",
+    },
+    {
+        id: "unorouter/deepseek-v4-flash",
+        label: "DeepSeek-V4 Flash",
+        provider: "unorouter",
+        model: "deepseek-v4-flash-0731:free",
+        context: "256K",
+        notes: "DeepSeek's fast flash model, strong at code.",
+    },
+    {
+        id: "unorouter/glm-5.3-flash-thinking",
+        label: "GLM 5.3 Flash Thinking",
+        provider: "unorouter",
+        model: "glm-5.3-flash-thinking:free",
+        context: "1M",
+        notes: "Zhipu's reasoning coder with 1M context — the default.",
+    },
+    {
+        id: "unorouter/kimi-k3",
+        label: "Kimi-K3",
+        provider: "unorouter",
+        model: "kimi-k3:free",
+        context: "256K",
+        notes: "Moonshot's flagship coding model.",
+    },
+    {
+        id: "unorouter/gemini-3.6-flash",
+        label: "Gemini 3.6 Flash",
+        provider: "unorouter",
+        model: "gemini-3.6-flash:free",
+        context: "1M",
+        notes: "Google's fast flash model with a huge 1M context.",
+    },
+];
+export const DEFAULT_MODEL_ID = "unorouter/glm-5.3-flash-thinking";
+export function listModels() {
+    return [...MODELS];
+}
+export function findModel(idOrSlug) {
+    const s = idOrSlug.trim();
+    return MODELS.find((m) => m.id === s || m.model === s);
+}
+/** Map a catalog id (or raw slug) to the raw slug the provider API expects. */
+export function toApiSlug(idOrSlug) {
+    return findModel(idOrSlug)?.model ?? idOrSlug;
+}