dsh-packycode-api 1.3.3 → 1.3.5

package/SECURITY.md

@@ -13,12 +13,21 @@
 - Balance requests carry a timeout (`AbortSignal.timeout`) and `redirect: 'error'`, and go only to the configured hosts plus the PackyAPI fallback host.
 - Model traffic goes to the configured model host through the plugin's pi-ai adapter. Protocol-specific compatibility headers are applied host-side; credentials remain scoped to the selected plugin key.
 
-## Native Claude requests
+## Claude requests
 
-- Claude uses the plugin's HTTP Messages route. The plugin has no Claude CLI runner, installer, delegation tool or local MCP bridge. Existing standalone Claude Code installations and configuration are untouched.
-- The compatibility headers and session metadata do not load a CLI login or external configuration. Bearer authentication uses only the plugin's selected conversation key; images keep their separate credential record.
-- DSH owns tool execution, permissions, plan mode, attachments and history. Wire tool aliases are restored only for tools offered on that request; unknown aliases are not decoded into host tools. Saved images from older CLI-backed sessions remain readable without executing their old tools.
-- Captured client-policy refusals do not disable keys or switch providers. The specific pre-stream anomalies covered by the native transport may replay the exact bytes and credential once; ordinary policy refusals, HTTP 429 and accepted streams are excluded. Cancellation aborts the replay.
+- Claude requests use one of two transports, chosen by the request key's PackyCode groups (or the user's pin): keys in `cc` send them through this device's official Claude Code CLI; every other key uses the plugin's HTTP Messages route. Both carry the same payload; neither has any fallback to the other, to another provider, or to another credential.
+- The HTTP route's compatibility headers and session metadata do not load a CLI login or external configuration. Bearer authentication uses only the plugin's selected conversation key; images keep their separate credential record.
+- DSH owns tool execution, permissions, plan mode, attachments and history on both routes. Wire tool aliases are restored only for tools offered on that request; unknown aliases are not decoded into host tools. Saved images from older CLI-backed sessions remain readable without executing their old tools.
+- Captured client-policy refusals do not disable keys or switch providers or transports. The specific pre-stream anomalies covered by the HTTP route may replay the exact bytes and credential once; ordinary policy refusals, HTTP 429 and accepted streams are excluded. Cancellation aborts the replay.
+
+## The Claude Code CLI transport
+
+- The CLI is a transport, not an agent: it runs with all of its own tools disabled (`--tools ""`), so it cannot read, write or execute anything itself. The tools it can see are the ones DSH offered for that request, served by an MCP bridge; every call is answered with the result DSH produced after running the tool under its own permissions and sandbox.
+- The bridge is a per-process Streamable HTTP server bound to `127.0.0.1` on a random port. It requires a random 256-bit capability on every request, rejects foreign `Host` and `Origin` headers, and closes with its process. The capability lives only in an owner-only (`0600`) config file inside an owner-only run directory under the CLI home; it never appears in a command line.
+- The CLI runs with an isolated config home (`~/.dsh/packycode-claude-cli`), `--setting-sources ""`, `--strict-mcp-config`, `--disable-slash-commands`, `--no-session-persistence`, and CLAUDE.md, auto-memory, auto-update, telemetry and non-essential traffic disabled. Inherited `ANTHROPIC_*`, `CLAUDE_*`, `MCP_*`, `DISABLE_*` and `ENABLE_*` variables are removed, so the user's own Claude Code login, API key, base URL, model and settings never reach it.
+- The request key reaches the child only as `ANTHROPIC_AUTH_TOKEN` in its environment, with the endpoint as `ANTHROPIC_BASE_URL`; it is never written to a file, an argument, a transcript or a log. The DSH system prompt and the conversation transcript the CLI resumes are written to that owner-only run directory and removed when the process ends; directories left by a crashed host are removed after a day.
+- The CLI's own retries, model fallback, refusal fallback and compaction are disabled: one DSH step is one API request, and retries follow DSH's policy. Processes are stopped on cancellation, after 20 idle minutes, beyond eight live conversations, and when the plugin unloads.
+- Installing the CLI from the settings panel runs `npm install -g @anthropic-ai/claude-code` with constant arguments; on Windows the npm launcher is resolved to the program it forwards to, so no shell parses user text.
 
 ## Reporting
 

package/compatibility.json

@@ -1,13 +1,15 @@
 {
-  "latestTested": "0.1.5-rc.2",
+  "latestTested": "0.2.1-rc.2",
   "acceptedRuntimeRange": ">=0.1.5-rc.1 <0.3.0-0",
   "supported": [
     "0.1.5-rc.2",
-    "0.2.0-rc.2"
+    "0.2.0-rc.2",
+    "0.2.1-rc.2"
   ],
-  "piAi": "0.85.1",
+  "piAi": "1.1.0",
   "validation": {
     "0.1.5-rc.2": "36 offline tests against the published host packages: the key ring (add/select/disable/rotate/enable/remove and a hand-edited record), balance parsing and host fallback with a fake fetch, failure classification against the gateway's real Chinese wording (including that a raw 403 quota message must not read as auth), the catalog contract (protocol, base URL, and vendor effort levels per model), the stream guard (terminal events, pre-chunk throws, and that a mid-stream failure never blames a key), and the real PiAiAdapter resolving every advertised model and preparing its call without reading a credential or opening a stream. Live check against the gateway: balance read (account and per-key), one answer from each of the three models over its own protocol, a rotation rehearsal where an invalid key was disabled and the next attempt answered with the real key, and the host adapter classifying a rejected key as AUTH.",
-    "0.2.0-rc.2": "Declared in the accepted range; checked against the bundled 0.2.0-rc.2 host packages, not yet in a live boot on this line. Present and used: llm.registerAdapter (fiber-scoped, duplicates refused), llm.registerConfigurableProviders, credential records (credentials-local keeps records in memory, updated on modifyRecord and by a file watcher), connection.rpc.handle, client slots, web.registerSearchProvider with web.searchProviders, loader.entries(), profileContext.patchPath, hmr.runExclusive (refuses nested transactions), and the SettingsForms service: settings.update(rowId, patch) for volatile Config fields, settings.configure, and loader/volatile-update. settings.installSection does NOT exist on this line (an earlier note said it did), so the host overrides (apiHost/statusHost, not volatile) are read-only here while the volatile web search preference is writable."
+    "0.2.0-rc.2": "Declared in the accepted range; checked against the bundled 0.2.0-rc.2 host packages, not yet in a live boot on this line. Present and used: llm.registerAdapter (fiber-scoped, duplicates refused), llm.registerConfigurableProviders, credential records (credentials-local keeps records in memory, updated on modifyRecord and by a file watcher), connection.rpc.handle, client slots, web.registerSearchProvider with web.searchProviders, loader.entries(), profileContext.patchPath, hmr.runExclusive (refuses nested transactions), and the SettingsForms service: settings.update(rowId, patch) for volatile Config fields, settings.configure, and loader/volatile-update. settings.installSection does NOT exist on this line (an earlier note said it did), so the host overrides (apiHost/statusHost, not volatile) are read-only here while the volatile web search preference is writable.",
+    "0.2.1-rc.2": "The development host since 2026-10-17: devDependencies pin the packages DeepSeek Harness 0.2.1-rc.2 ships (dsh-* 0.2.1-rc.2, cordis 4.0.5, schemastery 3.18.5, pi-ai 1.1.0), and the client and connection tests also run on 0.2.0-rc.2 through the host-v020 fixture. Before the switch the whole suite also passed against the packages extracted from the desktop app's app.asar. What changed for this plugin: PiAiAdapter.listModels resolves the key first and lists nothing on MISSING_CREDENTIAL; pi-ai 1.x Models folds systemPrompt and tools into a leading system message (toolsAdded) before the provider sees a request; dsh-tools runs PTC programs on ptcRuntime with workingDirectory; Connection admission asks browser auth for authenticateApi; credential-record changes refresh the browser's model catalog. Through the real host adapter, request bodies matched the pi-ai 0.85 baseline for 9 of 10 models (deepseek-flash's tool loses strict: false) and only SDK version headers differ. Not yet checked live or in a running DSH."
   }
 }

package/lib/client.js

@@ -122,6 +122,45 @@ window.__ModuleLoader__.load({
 			groupsMiss: "不可用",
 			groupsPartial: "部分",
 			groupsStale: "分组为上次读取的结果",
+			keyClaudeCli: "Claude 经官方 CLI",
+			keyClaudeHttp: "Claude 经 HTTP",
+			keyClaudeCliHint: "分组 {groups} 只接受官方 Claude Code 客户端，这个 Key 的 Claude 请求由本机 Claude Code CLI 发出。",
+			keyClaudeHttpHint: "这个 Key 的 Claude 请求走插件内置的 HTTP 通道。",
+			cliTitle: "Claude Code CLI",
+			cliIntro: "cc 分组只接受官方 Claude Code 客户端，这些 Key 的 Claude 请求由本机的 Claude Code CLI 发出；cc-sale、cc-expensive、claude-officially 等分组继续走插件内置的 HTTP 通道。通道由 Key 所在的分组决定。两种通道都由 DSH 执行工具、审批权限、计划模式、附件和历史，体验一致，CLI 只负责把请求发给 PackyCode。",
+			cliProcesses: "运行中的 CLI 会话 {live} 个 · 已启动 {opened} 次 · 续接 {continued} 次",
+			cliChecking: "正在检测本机的 Claude Code CLI…",
+			cliInstalled: "已安装",
+			cliVersion: "版本",
+			cliPath: "位置",
+			cliRecheck: "重新检测",
+			cliMissing: "未检测到 Claude Code CLI",
+			cliMissingHint: "cc 分组的 Key 需要它才能使用 Claude 模型（claude-opus-5-5、claude-sonnet-5-5、claude-haiku-5-5）。其它分组和其它模型不受影响。",
+			cliConfiguredMissing: "设置里指定的 CLI 路径不存在：{path}",
+			cliBroken: "找到了 CLI，但无法运行",
+			cliInstall: "安装 Claude Code CLI",
+			cliReinstall: "重新安装",
+			cliInstalling: "正在安装…（通常需要一两分钟，请勿关闭 DSH）",
+			cliInstallCommand: "将在本机执行：{command}（需要 Node.js 18 或更高版本）",
+			cliInstallSucceeded: "安装完成。",
+			cliInstallFailed: "安装失败",
+			cliNpmMissing: "没有找到 npm。请先从 https://nodejs.org 安装 Node.js（18 或更高版本），然后再点安装。",
+			cliPermission: "npm 没有权限写入全局目录。请在终端执行 sudo {command}，或把 npm 的全局目录改到用户目录后重试。",
+			cliPermissionWindows: "npm 没有权限写入全局目录。请以管理员身份打开终端执行 {command}，然后点「重新检测」。",
+			cliNetwork: "下载失败，请检查网络或 npm 镜像设置后重试。",
+			cliTimeout: "安装超时，请检查网络后重试。",
+			cliNotFoundAfterInstall: "npm 显示安装完成，但仍找不到 claude 命令。请在终端执行 claude --version 确认，然后点「重新检测」。",
+			cliWindowsNote: "Windows 上 Claude Code 还需要 Git for Windows（https://git-scm.com/downloads/win）。",
+			cliOutdated: "Claude Code CLI 版本过低",
+			cliOutdatedHint: "插件需要 {minVersion} 或更新版本。更新前，cc 分组 Key 的 Claude 请求无法发出；其它分组和其它模型不受影响。",
+			cliUpdate: "更新 Claude Code CLI",
+			cliUpdating: "正在更新…（通常需要一两分钟，请勿关闭 DSH）",
+			cliUpdateCommand: "将在本机执行：{command}",
+			cliUpdateSucceeded: "已更新到 {version}。",
+			cliUpdateFailed: "更新失败",
+			cliUpdateNotInstalled: "没有找到要更新的 CLI，请点「重新检测」。",
+			cliUpdateStillOutdated: "更新命令已执行，但版本仍低于 {minVersion}。请在终端执行 {command}，看它给出的提示（例如用 Homebrew 安装的要执行 brew upgrade claude-code），然后点「重新检测」。",
+			cliUpdateBroken: "更新后 CLI 无法运行。请点「重新安装」，或在终端执行 {command}。",
 			modelsTitle: "显示的模型",
 			modelsIntro: "切换模型时只显示已勾选的 PackyCode 模型，默认全选。修改后立即生效；已有会话仍可继续使用原模型。",
 			modelsChecking: "正在读取模型设置…",
@@ -295,6 +334,45 @@ window.__ModuleLoader__.load({
 			groupsMiss: "Not",
 			groupsPartial: "partly",
 			groupsStale: "groups from the last read",
+			keyClaudeCli: "Claude via official CLI",
+			keyClaudeHttp: "Claude via HTTP",
+			keyClaudeCliHint: "Group {groups} only serves the official Claude Code client, so this key's Claude requests are sent by this device's Claude Code CLI.",
+			keyClaudeHttpHint: "This key's Claude requests use the plugin's built-in HTTP route.",
+			cliTitle: "Claude Code CLI",
+			cliIntro: "The cc group only serves the official Claude Code client, so Claude requests on cc keys go through this device's Claude Code CLI; cc-sale, cc-expensive, claude-officially and other groups keep the built-in HTTP route. The key's groups decide the route. Either way DSH runs the tools, permissions, plan mode, attachments and history the same; the CLI only carries the request to PackyCode.",
+			cliProcesses: "{live} CLI session(s) running · started {opened} · continued {continued}",
+			cliChecking: "Checking this device for the Claude Code CLI…",
+			cliInstalled: "Installed",
+			cliVersion: "Version",
+			cliPath: "Location",
+			cliRecheck: "Check again",
+			cliMissing: "Claude Code CLI not found",
+			cliMissingHint: "Keys in the cc group need it to use the Claude models (claude-opus-5-5, claude-sonnet-5-5, claude-haiku-5-5). Other groups and models are unaffected.",
+			cliConfiguredMissing: "The CLI path set in settings does not exist: {path}",
+			cliBroken: "The CLI was found but could not run",
+			cliInstall: "Install Claude Code CLI",
+			cliReinstall: "Reinstall",
+			cliInstalling: "Installing… (usually a minute or two; keep DSH open)",
+			cliInstallCommand: "Runs on this device: {command} (requires Node.js 18 or later)",
+			cliInstallSucceeded: "Installed.",
+			cliInstallFailed: "Install failed",
+			cliNpmMissing: "npm was not found. Install Node.js 18 or later from https://nodejs.org, then click Install again.",
+			cliPermission: "npm cannot write its global directory. Run sudo {command} in a terminal, or point npm’s global prefix at a folder you own, then retry.",
+			cliPermissionWindows: "npm cannot write its global directory. Open a terminal as administrator, run {command}, then click Check again.",
+			cliNetwork: "The download failed. Check your network or npm registry settings and retry.",
+			cliTimeout: "The install timed out. Check your network and retry.",
+			cliNotFoundAfterInstall: "npm reported success, but the claude command still cannot be found. Run claude --version in a terminal, then click Check again.",
+			cliWindowsNote: "On Windows, Claude Code also needs Git for Windows (https://git-scm.com/downloads/win).",
+			cliOutdated: "Claude Code CLI is too old",
+			cliOutdatedHint: "The plugin needs {minVersion} or later. Until it is updated, Claude requests on cc keys cannot be sent; other groups and models are unaffected.",
+			cliUpdate: "Update Claude Code CLI",
+			cliUpdating: "Updating… (usually a minute or two; keep DSH open)",
+			cliUpdateCommand: "Runs on this device: {command}",
+			cliUpdateSucceeded: "Updated to {version}.",
+			cliUpdateFailed: "Update failed",
+			cliUpdateNotInstalled: "No CLI was found to update. Click Check again.",
+			cliUpdateStillOutdated: "The update ran, but the version is still below {minVersion}. Run {command} in a terminal and follow what it says (for a Homebrew install, brew upgrade claude-code), then click Check again.",
+			cliUpdateBroken: "The CLI no longer runs after the update. Click Reinstall, or run {command} in a terminal.",
 			advanced: "Advanced: endpoints",
 			apiHost: "Model endpoint",
 			statusHost: "Balance endpoint",
@@ -1796,6 +1874,13 @@ window.__ModuleLoader__.load({
 		const INVITE_URL = "https://www.packyapi.ai/register?aff=Im3l";
 		/** How long after a search change the panel re-reads what DSH applied (the patch hot-reloads). */
 		const SEARCH_SETTLE_MS = 1500;
+		/** While the CLI installs, the panel polls its status this often. */
+		const INSTALL_POLL_MS = 2e3;
+		const CLAUDE_MODELS = [
+			"claude-opus-5-5",
+			"claude-sonnet-5-5",
+			"claude-haiku-5-5"
+		];
 		const OWN_SEARCH_IDS = {
 			auto: "packycode-api-auto",
 			packycode: "packycode-api"
@@ -1932,12 +2017,31 @@ window.__ModuleLoader__.load({
 						]
 					}, family.name))
 				}),
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ClaudeRoute, {
+					group,
+					t
+				}),
 				group.stale !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 					className: "pkc-meta",
 					children: t("groupsStale")
 				})
 			] });
 		}
+		/** Which transport this key's Claude requests take, when the key reaches Claude. */
+		function ClaudeRoute({ group, t }) {
+			const route = group.claudeTransport;
+			if (route === void 0 || !CLAUDE_MODELS.some((id) => group.coverage?.[id] === true)) return null;
+			const hint = route.transport === "cli" ? fill(t("keyClaudeCliHint"), { groups: (route.groups ?? []).join(" / ") || "cc" }) : t("keyClaudeHttpHint");
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "pkc-groups",
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: "pkc-chip",
+					"data-tone": route.transport === "cli" ? "info" : "neutral",
+					title: hint,
+					children: route.transport === "cli" ? t("keyClaudeCli") : t("keyClaudeHttp")
+				})
+			});
+		}
 		function KeyRow({ entry, row, group, descriptions, groupsLoading, busy, rename, onAction, t }) {
 			const editing = rename.renaming?.id === entry.id;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -2479,6 +2583,232 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		const INSTALL_FAILURES = {
+			"npm-missing": () => "cliNpmMissing",
+			permission: (cli) => cli.platform === "win32" ? "cliPermissionWindows" : "cliPermission",
+			network: () => "cliNetwork",
+			timeout: () => "cliTimeout",
+			"not-found-after-install": () => "cliNotFoundAfterInstall",
+			"not-installed": () => "cliUpdateNotInstalled",
+			"still-outdated": () => "cliUpdateStillOutdated",
+			"broken-after-update": () => "cliUpdateBroken"
+		};
+		/** The sentence explaining a failed install or update, by the code the host classified. */
+		function installFailure(cli, t) {
+			const key = INSTALL_FAILURES[cli.install?.code]?.(cli);
+			const command = cli.install?.action === "update" ? cli.updateCommand : cli.command;
+			return key === void 0 ? void 0 : fill(t(key), {
+				command: command ?? "",
+				minVersion: cli.minVersion ?? ""
+			});
+		}
+		/**
+		* Whether this device has the Claude Code CLI that Claude requests on cc
+		* keys go through: an installer without one, an updater for one too old.
+		*/
+		function ClaudeCliCard({ call, t }) {
+			const [cli, setCli] = react.useState();
+			const [checking, setChecking] = react.useState(false);
+			const [error, setError] = react.useState();
+			const check = react.useCallback((force = false) => {
+				setChecking(true);
+				setError(void 0);
+				return call("claude-cli/status", { force }).then(setCli).catch((failure) => setError(clearMessage(failure))).finally(() => setChecking(false));
+			}, [call]);
+			react.useEffect(() => {
+				check(false);
+			}, [check]);
+			const running = cli?.install?.state === "running";
+			react.useEffect(() => {
+				if (!running) return void 0;
+				let live = true;
+				const timer = window.setInterval(() => {
+					call("claude-cli/status").then((value) => {
+						if (live) setCli(value);
+					}).catch(() => void 0);
+				}, INSTALL_POLL_MS);
+				return () => {
+					live = false;
+					window.clearInterval(timer);
+				};
+			}, [call, running]);
+			const install = () => {
+				setError(void 0);
+				call("claude-cli/install").then(setCli).catch((failure) => setError(clearMessage(failure)));
+			};
+			const update = () => {
+				setError(void 0);
+				call("claude-cli/update").then(setCli).catch((failure) => setError(clearMessage(failure)));
+			};
+			const usable = cli?.installed === true && cli.version !== void 0;
+			const outdated = usable && cli.outdated === true;
+			const action = cli?.install?.action ?? "install";
+			const failed = cli?.install?.state === "failed";
+			const failure = cli === void 0 ? void 0 : installFailure(cli, t);
+			const processes = cli?.processes;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(Card, {
+				title: t("cliTitle"),
+				aside: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
+					disabled: checking || running,
+					onClick: () => check(true),
+					children: checking ? t("refreshing") : t("cliRecheck")
+				}),
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "pkc-note",
+						children: t("cliIntro")
+					}),
+					cli === void 0 && error === void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "pkc-note",
+						children: t("cliChecking")
+					}),
+					usable && !outdated && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "pkc-status",
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "pkc-dot",
+									"data-tone": "success"
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("cliInstalled") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("b", { children: `${t("cliVersion")} ${cli.version}` })
+							]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+							className: "pkc-meta",
+							children: [
+								t("cliPath"),
+								" ",
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "pkc-mono",
+									children: cli.path
+								})
+							]
+						}),
+						processes !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "pkc-meta",
+							children: fill(t("cliProcesses"), processes)
+						}),
+						cli.install?.state === "succeeded" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "pkc-note",
+							children: action === "update" ? fill(t("cliUpdateSucceeded"), { version: cli.install.to ?? cli.version }) : t("cliInstallSucceeded")
+						})
+					] }),
+					outdated && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "pkc-callout",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "pkc-status",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "pkc-dot",
+										"data-tone": "warn"
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("b", { children: t("cliOutdated") }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: `${t("cliVersion")} ${cli.version}` })
+								]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "pkc-meta",
+								children: [
+									t("cliPath"),
+									" ",
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "pkc-mono",
+										children: cli.path
+									})
+								]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "pkc-note",
+								children: fill(t("cliOutdatedHint"), { minVersion: cli.minVersion ?? "" })
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "pkc-split",
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
+									variant: "primary",
+									size: "md",
+									disabled: running || checking,
+									onClick: update,
+									children: running && action === "update" ? t("cliUpdating") : t("cliUpdate")
+								})
+							}),
+							cli.updateCommand !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "pkc-note",
+								children: fill(t("cliUpdateCommand"), { command: cli.updateCommand })
+							})
+						]
+					}),
+					failed && action === "update" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "pkc-error",
+						children: failure === void 0 ? t("cliUpdateFailed") : `${t("cliUpdateFailed")} · ${failure}`
+					}), cli.install.detail !== void 0 && cli.install.detail !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
+						className: "pkc-detail",
+						children: cli.install.detail
+					})] }),
+					cli !== void 0 && !usable && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "pkc-callout",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "pkc-status",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "pkc-dot",
+									"data-tone": cli.installed ? "danger" : "warn"
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("b", { children: cli.installed ? t("cliBroken") : t("cliMissing") })]
+							}),
+							cli.installed && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "pkc-meta",
+								children: [
+									t("cliPath"),
+									" ",
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "pkc-mono",
+										children: cli.path
+									})
+								]
+							}), cli.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
+								className: "pkc-detail",
+								children: cli.error
+							})] }),
+							cli.configuredPath !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "pkc-note",
+								children: fill(t("cliConfiguredMissing"), { path: cli.configuredPath })
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "pkc-note",
+								children: t("cliMissingHint")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "pkc-split",
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
+									variant: "primary",
+									size: "md",
+									disabled: running || checking,
+									onClick: install,
+									children: running && action === "install" ? t("cliInstalling") : cli.installed ? t("cliReinstall") : t("cliInstall")
+								})
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+								className: "pkc-note",
+								children: [fill(t("cliInstallCommand"), { command: cli.command ?? "" }), cli.platform === "win32" && ` ${t("cliWindowsNote")}`]
+							})
+						]
+					}),
+					failed && action === "install" && !usable && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "pkc-error",
+						children: failure === void 0 ? t("cliInstallFailed") : `${t("cliInstallFailed")} · ${failure}`
+					}), cli.install.detail !== void 0 && cli.install.detail !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
+						className: "pkc-detail",
+						children: cli.install.detail
+					})] }),
+					error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "pkc-error",
+						role: "alert",
+						children: `${t("error")}: ${error}`
+					})
+				]
+			});
+		}
 		/** A release-age wait can end tomorrow, so the date is part of the time. */
 		function readDateTime(ms) {
 			try {
@@ -2657,6 +2987,10 @@ window.__ModuleLoader__.load({
 						call,
 						t
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ClaudeCliCard, {
+						call,
+						t
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelsCard, {
 						call,
 						t