faberwright 0.4.0 → 0.4.2

package/dist/onboard.js

@@ -3,13 +3,15 @@ import { select, readSecret } from "./prompt.js";
 import { vendors, modelsForRoute, baseUrlFor, getRoute, DEFAULT_REGION, } from "./routes.js";
 import * as fs from "node:fs";
 import { loadSettings, saveSettings, settingsPath } from "./settings.js";
-import { credentialSource, saveCredential, maskCredential, credentialsPath, looksLikeKey, } from "./credentials.js";
+import { credentialSource, saveCredential, maskCredential, credentialsPath, looksLikeKey, deleteCredential, } from "./credentials.js";
 /** First run = no settings file yet. */
 /** Where a credential comes from, so setup can point people at the right page. */
 const KEY_SOURCE = {
     ANTHROPIC_API_KEY: "https://console.anthropic.com/settings/keys",
     OPENAI_API_KEY: "https://platform.openai.com/api-keys",
     BEDROCK_API_KEY: "the AWS console (Bedrock → API keys)",
+    AZURE_OPENAI_API_KEY: "the Azure portal (your OpenAI resource → Keys and Endpoint)",
+    AZURE_FOUNDRY_API_KEY: "the Azure portal (your Foundry resource → Keys and Endpoint)",
 };
 export function needsOnboarding() {
     return !hasAnySettingsFile();
@@ -33,8 +35,12 @@ export async function setupComplete(cfg) {
     if (!route.implemented) {
         return { complete: false, missing: `${route.label} isn't wired up yet`, fix: "/route" };
     }
-    if (!cfg.model)
+    // Not merely "is it set": an interrupted prompt used to store control
+    // characters, which are non-empty and so passed every naive check.
+    // eslint-disable-next-line no-control-regex
+    if (!cfg.model || !cfg.model.trim() || /[\x00-\x1f]/.test(cfg.model)) {
         return { complete: false, missing: "no model chosen", fix: "/model" };
+    }
     if (route.needsBaseUrl && !cfg.baseUrl) {
         return { complete: false, missing: "no endpoint URL for this route", fix: "/route" };
     }
@@ -87,6 +93,40 @@ async function readKey(rl, envName, promptText) {
     }
     return key;
 }
+/**
+ * Read a plain answer, treating an interrupt as cancellation.
+ *
+ * A raw readline prompt collects Ctrl-C as the character \x03 rather than
+ * aborting, so pressing it during the region or model question stored control
+ * characters as the answer — and since they aren't empty, every completeness
+ * check passed and the profile was saved as valid.
+ */
+async function askText(rl, prompt) {
+    let raw;
+    try {
+        raw = await rl.question(prompt);
+    }
+    catch {
+        return undefined;
+    }
+    // Ctrl-C is the only thing that means "stop". Everything else that isn't
+    // printable is terminal noise: a paste arrives wrapped in bracketed-paste
+    // markers, so rejecting all control characters made pasting an answer
+    // abort setup — which is exactly what someone does with a resource name.
+    // eslint-disable-next-line no-control-regex
+    if (/[\x03\x04]/.test(raw))
+        return undefined;
+    const cleaned = raw
+        // eslint-disable-next-line no-control-regex
+        .replace(/\x1b\[20[01]~/g, "")
+        // eslint-disable-next-line no-control-regex
+        .replace(/\x1b\[[0-9;]*[A-Za-z~]/g, "")
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\x00-\x1f\x7f]/g, "");
+    return cleaned.trim();
+}
+/** Exposed for tests: paste handling here decides whether setup can finish. */
+export const __askTextForTest = askText;
 /**
  * Walk vendor -> route -> region/endpoint -> model. Returns the profile it
  * saved so the caller can report what still needs doing (e.g. an unset key).
@@ -124,7 +164,32 @@ export async function ensureCredential(rl, route, profile) {
         return {};
     const found = credentialSource(route.keyEnv);
     if (found?.from === "store") {
-        console.log(pc.dim(`  Using ${route.keyEnv} saved on this computer (${maskCredential(found.value)})`));
+        // Running setup again usually means something needs changing — often the
+        // key itself, because it expired or was wrong. Silently reusing the saved
+        // one makes that impossible, so offer the same choice as for an
+        // environment key.
+        console.log();
+        console.log(`${route.keyEnv} is already saved on this computer (${maskCredential(found.value)}).`);
+        const choice = await select(rl, "Use it?", [
+            `Keep using it                    ${pc.dim("no change")}`,
+            `Replace it                       ${pc.dim("paste a new key")}`,
+            `Remove it                        ${pc.dim("delete the saved key and stop")}`,
+        ]);
+        if (choice === 1) {
+            const key = await readKey(rl, route.keyEnv, `  ${route.keyEnv} (hidden): `);
+            if (key) {
+                saveCredential(route.keyEnv, key);
+                console.log(pc.dim(`  replaced (${maskCredential(key)})`));
+            }
+            else {
+                console.log(pc.dim("  nothing entered — keeping the saved key"));
+            }
+        }
+        else if (choice === 2) {
+            deleteCredential(route.keyEnv);
+            console.log(pc.dim(`  removed. Run faber again to set one up.`));
+            return { switchedTo: "quit" };
+        }
         return {};
     }
     if (found?.from === "environment") {
@@ -156,13 +221,42 @@ export async function ensureCredential(rl, route, profile) {
         return {};
     }
     if (route.id === "bedrock") {
-        // Bedrock can sign with an IAM role, so a key may not be needed at all.
+        // Two ways in, and which one you pick can matter for billing: an IAM role
+        // charges through the account that owns it, a Bedrock API key can belong
+        // to a different arrangement entirely. So ask rather than assume, even
+        // when one option is obvious from the environment.
         const { discoverAwsCredentials } = await import("./sigv4.js");
         const aws = await discoverAwsCredentials();
         console.log();
-        console.log(aws
-            ? pc.dim(`  No key needed — signing with AWS credentials from ${aws.source}.`)
-            : pc.yellow(`  No AWS credentials found. Set ${route.keyEnv}, or run where an IAM role is available.`));
+        const how = await select(rl, "How should Faber authenticate with AWS?", [
+            `AWS credentials (IAM role)       ${pc.dim(aws ? `found: ${aws.source}` : "none found here")}`,
+            `Bedrock API key                  ${pc.dim("billed through that key instead")}`,
+        ]);
+        if (how === 0) {
+            if (!aws) {
+                // Nothing to sign with, so setup did not succeed and saves nothing.
+                console.log(pc.yellow("  No AWS credentials on this machine."));
+                console.log(pc.dim("  Run where an IAM role is available (SageMaker, EC2, ECS), or `aws configure`."));
+                return { switchedTo: "quit" };
+            }
+            console.log(pc.dim(`  Signing automatically with your AWS role. No key needed.`));
+            delete profile.apiKeyEnv; // this route authenticates by signing
+            return {};
+        }
+        console.log();
+        console.log("Faber needs a Bedrock API key.");
+        const where = KEY_SOURCE[route.keyEnv];
+        if (where)
+            console.log(pc.dim(`  Get one at ${where}`));
+        const key = await readKey(rl, route.keyEnv, `  ${route.keyEnv} (hidden): `);
+        if (!key) {
+            console.log(pc.yellow("  No key entered — setup not completed, nothing saved."));
+            return { switchedTo: "quit" };
+        }
+        saveCredential(route.keyEnv, key);
+        profile.apiKeyEnv = route.keyEnv;
+        profile.preferStoredKey = true; // an explicit choice beats a role
+        console.log(pc.dim(`  saved (${maskCredential(key)}) — kept on this computer only`));
         return {};
     }
     // No key anywhere: say where to get one, read it hidden, and if they don't
@@ -182,18 +276,55 @@ export async function ensureCredential(rl, route, profile) {
     // starts over from the beginning rather than resuming into a broken state.
     return { switchedTo: "quit" };
 }
+/** Does the provider accept this credential? Never blocks on being offline. */
+async function verifyCredential(route, profile) {
+    if (!route.keyEnv)
+        return "ok";
+    try {
+        const { LLMClient } = await import("./llm.js");
+        const { resolveCredential } = await import("./credentials.js");
+        const key = resolveCredential(route.keyEnv);
+        const baseUrl = profile.baseUrl ?? baseUrlFor(route, profile.region);
+        if (!key || !baseUrl)
+            return "unreachable";
+        process.stdout.write(pc.dim("  checking your key… "));
+        const llm = new LLMClient({
+            provider: route.wire, baseUrl, apiKey: key, model: "x", route: route.id,
+        });
+        const verdict = await llm.verifyKey();
+        process.stdout.write("\r\x1b[2K");
+        return verdict;
+    }
+    catch {
+        process.stdout.write("\r\x1b[2K");
+        return "unreachable";
+    }
+}
+/** Ask the provider which models this key can use. Empty on any failure. */
+async function discoverModels(route, profile) {
+    try {
+        const { LLMClient } = await import("./llm.js");
+        const { resolveCredential } = await import("./credentials.js");
+        const key = route.keyEnv ? resolveCredential(route.keyEnv) : undefined;
+        const baseUrl = profile.baseUrl ?? baseUrlFor(route, profile.region);
+        if (!baseUrl)
+            return [];
+        process.stdout.write(pc.dim("  checking which models your key can use… "));
+        const llm = new LLMClient({
+            provider: route.wire, baseUrl, apiKey: key, model: "x", route: route.id,
+        });
+        const models = await llm.listModels();
+        process.stdout.write("\r\x1b[2K");
+        return models;
+    }
+    catch {
+        process.stdout.write("\r\x1b[2K");
+        return [];
+    }
+}
 async function finish(rl, route, base) {
     const profile = { ...base, route: route.id };
     const activeRoute = route;
-    if (route.needsRegion) {
-        const ans = (await rl.question(`AWS region [${DEFAULT_REGION}]: `)).trim();
-        profile.region = ans || DEFAULT_REGION;
-    }
-    if (route.needsBaseUrl) {
-        const ans = (await rl.question("Base URL of the OpenAI-compatible endpoint: ")).trim();
-        if (ans)
-            profile.baseUrl = ans;
-    }
     if (route.keyEnv) {
         profile.apiKeyEnv = route.keyEnv;
         const outcome = await ensureCredential(rl, activeRoute, profile);
@@ -203,30 +334,138 @@ async function finish(rl, route, base) {
             return { profile, route: activeRoute, aborted: true };
         }
     }
-    // model: pick from aliases, or ask for an id on routes where ids vary
-    const choices = modelsForRoute(activeRoute);
-    if (choices.length) {
-        const mi = await select(rl, "Default model", choices.map((m) => `${m.alias.padEnd(8)} ${pc.dim(m.blurb)}`));
-        profile.model = choices[mi].alias;
+    if (route.id === "foundry") {
+        // Same question as Azure OpenAI: the resource name is what people know.
+        const res = await askText(rl, "Azure resource name (from your endpoint URL): ");
+        if (res === undefined)
+            return { profile, route: activeRoute, aborted: true };
+        if (res) {
+            profile.baseUrl = /^https?:\/\//.test(res)
+                ? res.replace(/\/+$/, "")
+                : `https://${res}.services.ai.azure.com/anthropic`;
+        }
+    }
+    else if (route.id === "azure-openai") {
+        // Ask for the resource name rather than a URL: it's the part people know
+        // from the portal, and the rest of the endpoint is fixed.
+        const res = await askText(rl, "Azure resource name (from your endpoint URL): ");
+        if (res === undefined)
+            return { profile, route: activeRoute, aborted: true };
+        if (res) {
+            profile.baseUrl = /^https?:\/\//.test(res)
+                ? res.replace(/\/+$/, "")
+                : `https://${res}.openai.azure.com/openai`;
+        }
+    }
+    else if (route.needsBaseUrl) {
+        const ans = await askText(rl, "Base URL of the OpenAI-compatible endpoint: ");
+        if (ans === undefined)
+            return { profile, route: activeRoute, aborted: true };
+        if (ans)
+            profile.baseUrl = ans;
+    }
+    if (route.needsRegion) {
+        // Only ask when the environment hasn't already answered.
+        const { discoverAwsRegion } = await import("./sigv4.js");
+        const found = discoverAwsRegion();
+        if (found) {
+            profile.region = found.region;
+            console.log(pc.dim(`  Region ${found.region} (from ${found.source}) · /route to change`));
+        }
+        else {
+            const ans = await askText(rl, `AWS region [${DEFAULT_REGION}]: `);
+            if (ans === undefined)
+                return { profile, route: activeRoute, aborted: true };
+            profile.region = ans || DEFAULT_REGION;
+        }
+    }
+    // Model choice, with real ids and real prices.
+    //
+    // Aliases like "gpt" or "sonnet" hide what you're actually paying for, and
+    // the difference is not small: gpt-4o costs about 17x gpt-4o-mini. Since the
+    // credential is saved by now, ask the provider what this key can really use
+    // and show each model's rate, so nothing about the bill is implicit.
+    const { refreshPrices, priceFor, readPriceCache } = await import("./pricing.js");
+    if (!readPriceCache())
+        process.stdout.write(pc.dim("  fetching prices… "));
+    await refreshPrices(undefined, { baseUrl: profile.baseUrl ?? activeRoute.baseUrl });
+    process.stdout.write("\r\x1b[2K");
+    // Verify the credential before going further. A rejected key means setup
+    // did not succeed, so nothing is saved and the next run starts over — the
+    // same rule as skipping the key entirely.
+    const verdict = await verifyCredential(activeRoute, profile);
+    if (verdict === "rejected") {
+        if (activeRoute.keyEnv)
+            deleteCredential(activeRoute.keyEnv);
+        console.log();
+        console.log(pc.yellow(`${activeRoute.label} rejected that key.`));
+        console.log(pc.dim("  Nothing was saved. Run faber again with a working key."));
+        return { profile, route: activeRoute, aborted: true };
+    }
+    const { isChatModel, sortModels, requiresUnsupportedApi } = await import("./models.js");
+    const discovered = sortModels((await discoverModels(activeRoute, profile))
+        .filter((m) => isChatModel(m.id) && !requiresUnsupportedApi(m.id)), activeRoute.wire);
+    const fallback = modelsForRoute(activeRoute).map((m) => ({ id: m.id, name: m.blurb }));
+    const options = discovered.length ? discovered : fallback;
+    if (options.length) {
+        // Say which list this is. A built-in fallback and a live list look
+        // identical otherwise, and the user can't tell whether the models shown
+        // are the ones their key can actually reach.
+        console.log();
+        if (discovered.length) {
+            console.log(pc.dim(`  ${discovered.length} models available to this key`));
+        }
+        else {
+            const { lastModelListError } = await import("./llm.js");
+            const why = lastModelListError();
+            console.log(pc.yellow("  Couldn't list models — showing built-in defaults."));
+            console.log(pc.dim(why ? `  ${why}` : "  No response from the provider."));
+            console.log(pc.dim("  /model re-checks later."));
+        }
+        const width = Math.min(34, Math.max(...options.map((m) => m.id.length)) + 2);
+        const labels = options.map((m) => {
+            const p = priceFor(m.id);
+            const cost = p ? `$${p.in}/$${p.out} per Mtok` : "price unknown";
+            return `${m.id.padEnd(width)}${pc.dim(cost)}${m.name ? pc.dim("  " + m.name) : ""}`;
+        });
+        console.log();
+        const mi = await select(rl, "Which model? (input/output cost per million tokens)", labels);
+        profile.model = options[mi].id; // a concrete id, never an alias
     }
     else {
         const hint = activeRoute.id === "ollama" ? "qwen2.5-coder" : "";
-        const ans = (await rl.question(`Model id${hint ? ` [${hint}]` : ""} ${pc.dim("(ids differ on this route)")}: `)).trim();
+        const ans = await askText(rl, `Model id${hint ? ` [${hint}]` : ""}: `);
+        if (ans === undefined)
+            return { profile, route: activeRoute, aborted: true };
         profile.model = ans || hint || undefined;
     }
-    // Fetch prices once during setup: costs are frozen per task, so starting
-    // with current rates keeps day-one history accurate.
-    const { refreshPrices } = await import("./pricing.js");
-    process.stdout.write(pc.dim("  fetching current prices… "));
-    const n = await refreshPrices(undefined, { baseUrl: profile.baseUrl ?? activeRoute.baseUrl });
-    process.stdout.write("\r\x1b[2K");
-    if (!n)
-        console.log(pc.dim("  (couldn't fetch prices — using built-in rates)"));
+    // Nothing is written unless the result is genuinely usable. Every earlier
+    // exit already returns aborted, but this is the single place that decides,
+    // so a future step can't accidentally save a half-finished profile.
+    const check = await setupComplete({
+        route: profile.route,
+        model: profile.model,
+        baseUrl: profile.baseUrl ?? baseUrlFor(activeRoute, profile.region),
+        apiKey: activeRoute.keyEnv ? credentialSource(activeRoute.keyEnv)?.value : undefined,
+    });
+    if (!check.complete) {
+        console.log();
+        console.log(pc.yellow(`Setup not completed — ${check.missing}.`));
+        console.log(pc.dim("  Nothing was saved. Run faber again to start over."));
+        return { profile, route: activeRoute, aborted: true };
+    }
     const settings = loadSettings();
     settings.profiles[settings.activeProfile] = profile;
     saveSettings(settings);
-    const missingKeyEnv = activeRoute.keyEnv && !credentialSource(activeRoute.keyEnv)
+    // Bedrock signs with an IAM role when one is available, so a missing key is
+    // not "one thing left" — saying so contradicts the line printed moments ago.
+    let missingKeyEnv = activeRoute.keyEnv && !credentialSource(activeRoute.keyEnv)
         ? activeRoute.keyEnv : undefined;
+    if (missingKeyEnv && activeRoute.id === "bedrock") {
+        const { discoverAwsCredentials } = await import("./sigv4.js");
+        if (await discoverAwsCredentials())
+            missingKeyEnv = undefined;
+    }
     return { profile, route: activeRoute, missingKeyEnv };
 }
 /** Summary printed after onboarding, including anything still to be done. */

package/dist/pricing.js

@@ -50,6 +50,14 @@ export function normalizeModelId(id) {
 function cacheFile() {
     return path.join(os.homedir(), ".faber", "cache", "prices.json");
 }
+/**
+ * Bumped whenever the cached shape gains a field Faber relies on. A cache
+ * written by an older version is discarded rather than trusted: after adding
+ * `mode` and `supported_endpoints`, a stale file looked complete but carried
+ * neither, so Responses-only models were routed to the wrong endpoint and
+ * failed with a 404 that looked like a Faber bug.
+ */
+export const PRICE_CACHE_VERSION = 2;
 /** Wait this long before retrying after a failed refresh. */
 export const RETRY_AFTER_FAILURE_MS = 24 * 60 * 60 * 1000;
 /** How old the cached prices are, in days. undefined = never fetched. */
@@ -66,7 +74,11 @@ export function pricesAreStale(now = Date.now()) {
 export function readPriceCache() {
     try {
         const raw = JSON.parse(fs.readFileSync(cacheFile(), "utf8"));
-        return raw.prices && typeof raw.prices === "object" ? raw : undefined;
+        if (!raw.prices || typeof raw.prices !== "object")
+            return undefined;
+        if ((raw.version ?? 1) < PRICE_CACHE_VERSION)
+            return undefined; // stale shape
+        return raw;
     }
     catch {
         return undefined;
@@ -77,7 +89,7 @@ export function writePriceCache(prices, source, etag) {
         const f = cacheFile();
         fs.mkdirSync(path.dirname(f), { recursive: true });
         const now = Date.now();
-        fs.writeFileSync(f, JSON.stringify({ fetchedAt: now, lastAttempt: now, source, etag, prices }, null, 2));
+        fs.writeFileSync(f, JSON.stringify({ version: PRICE_CACHE_VERSION, fetchedAt: now, lastAttempt: now, source, etag, prices }, null, 2));
     }
     catch { /* best effort */ }
 }
@@ -103,6 +115,7 @@ export function markRefreshAttempt(now = Date.now()) {
         fs.mkdirSync(path.dirname(f), { recursive: true });
         const existing = readPriceCache();
         fs.writeFileSync(f, JSON.stringify({
+            version: PRICE_CACHE_VERSION,
             fetchedAt: existing?.fetchedAt ?? 0,
             lastAttempt: now,
             source: existing?.source ?? "none",
@@ -214,6 +227,11 @@ export async function refreshPrices(url = DATASET_URL, opts = {}) {
             // and these values get written to a file people read.
             const perM = (n) => Math.round(n * 1e6 * 1e6) / 1e6;
             const price = { in: perM(inC), out: perM(outC) };
+            if (typeof v["mode"] === "string")
+                price.mode = v["mode"];
+            const eps = v["supported_endpoints"];
+            if (Array.isArray(eps))
+                price.endpoints = eps.filter((e) => typeof e === "string");
             const cr = v["cache_read_input_token_cost"], cw = v["cache_creation_input_token_cost"];
             if (typeof cr === "number")
                 price.cacheRead = perM(cr);
@@ -235,6 +253,21 @@ export async function refreshPrices(url = DATASET_URL, opts = {}) {
  * id, then normalized), then the built-in table. Undefined means "unknown",
  * which the ledger renders as — rather than guessing.
  */
+/**
+ * Azure's US Data Zone deployments bill at 1.1x. Applying it keeps the ledger
+ * honest for teams who chose that deployment for data-residency reasons —
+ * under-reporting spend is the one direction a cost tool must not err in.
+ */
+export const US_DATA_ZONE_MULTIPLIER = 1.1;
+export function scalePrice(p, factor) {
+    const r = (n) => Math.round(n * factor * 1e6) / 1e6;
+    return {
+        ...p,
+        in: r(p.in), out: r(p.out),
+        cacheRead: p.cacheRead === undefined ? undefined : r(p.cacheRead),
+        cacheWrite: p.cacheWrite === undefined ? undefined : r(p.cacheWrite),
+    };
+}
 export function priceFor(modelId, override) {
     if (override?.in && override?.out)
         return { in: override.in, out: override.out };

package/dist/prompt.js

@@ -17,17 +17,48 @@ async function selectRaw(rl, question, options, defaultIndex = 0) {
         const n = Number.parseInt(ans, 10);
         return Number.isInteger(n) && n >= 1 && n <= options.length ? n - 1 : defaultIndex;
     }
-    console.log(pc.bold(question) + pc.dim("   ↑/↓ then Enter, or 1-9"));
+    // Long lists (a provider can return dozens of models) are unusable with
+    // arrow keys alone, so typing filters the list as you go.
+    const searchable = options.length > 8;
+    console.log(pc.bold(question) +
+        pc.dim(searchable ? "   ↑/↓ then Enter · type to filter" : "   ↑/↓ then Enter, or 1-9"));
     return new Promise((resolve) => {
-        let idx = defaultIndex;
-        let firstRender = true;
+        let filter = "";
+        let view = options.map((_, i) => i); // indices currently shown
+        let cursor = Math.max(0, view.indexOf(defaultIndex));
+        let painted = 0; // rows drawn last time
+        const applyFilter = () => {
+            const q = filter.toLowerCase();
+            const next = options
+                .map((o, i) => [o, i])
+                .filter(([o]) => o.toLowerCase().includes(q))
+                .map(([, i]) => i);
+            view = next.length ? next : [];
+            cursor = 0;
+        };
         const render = () => {
-            if (!firstRender)
-                process.stdout.write(`\x1b[${options.length}A`);
-            firstRender = false;
-            for (let i = 0; i < options.length; i++) {
+            if (painted)
+                process.stdout.write(`\x1b[${painted}A`);
+            const rows = view.length ? view.length : 1;
+            const extra = filter ? 1 : 0;
+            for (let r = 0; r < view.length; r++) {
                 process.stdout.write("\x1b[2K");
-                process.stdout.write((i === idx ? pc.cyan(`❯ ${options[i]}`) : pc.dim(`  ${options[i]}`)) + "\n");
+                const i = view[r];
+                process.stdout.write((r === cursor ? pc.cyan(`❯ ${options[i]}`) : pc.dim(`  ${options[i]}`)) + "\n");
+            }
+            if (!view.length) {
+                process.stdout.write("\x1b[2K" + pc.yellow(`  no match for "${filter}"`) + "\n");
+            }
+            if (filter) {
+                process.stdout.write("\x1b[2K" + pc.dim(`  filter: ${filter}`) + "\n");
+            }
+            // clear any rows the previous, longer render left behind
+            for (let r = rows + extra; r < painted; r++)
+                process.stdout.write("\x1b[2K\n");
+            painted = Math.max(rows + extra, painted);
+            if (painted > rows + extra) {
+                process.stdout.write(`\x1b[${painted - (rows + extra)}A`);
+                painted = rows + extra;
             }
         };
         const stdin = process.stdin;
@@ -40,6 +71,14 @@ async function selectRaw(rl, question, options, defaultIndex = 0) {
             stdin.removeListener("data", onData);
             stdin.setRawMode(wasRaw);
             guardFn?.(false);
+            // Drop anything still buffered — typically the Enter that confirmed this
+            // menu. Left in place, readline hands it straight to the next question,
+            // which then returns an empty answer before the user can type a
+            // character: the prompt appears and vanishes in the same instant.
+            try {
+                while (stdin.read() !== null) { /* discard */ }
+            }
+            catch { /* not readable */ }
             rl.resume();
             resolve(result);
         };
@@ -58,24 +97,45 @@ async function selectRaw(rl, question, options, defaultIndex = 0) {
                     key = s[i];
                     i += 1;
                 }
-                if (key === "\x1b[A" || key === "k") {
-                    idx = (idx - 1 + options.length) % options.length;
+                if (key === "\x1b[A") {
+                    if (view.length)
+                        cursor = (cursor - 1 + view.length) % view.length;
                     render();
                 }
-                else if (key === "\x1b[B" || key === "j") {
-                    idx = (idx + 1) % options.length;
+                else if (key === "\x1b[B") {
+                    if (view.length)
+                        cursor = (cursor + 1) % view.length;
                     render();
                 }
-                else if (key >= "1" && key <= "9" && Number(key) <= options.length) {
-                    idx = Number(key) - 1;
-                    render();
-                    finish(idx);
-                    done = true;
-                }
                 else if (key === "\r" || key === "\n") {
-                    finish(idx);
+                    if (view.length) {
+                        finish(view[cursor]);
+                        done = true;
+                    }
+                }
+                else if (key === "\x7f" || key === "\b") { // backspace edits the filter
+                    if (filter) {
+                        filter = filter.slice(0, -1);
+                        applyFilter();
+                        render();
+                    }
+                }
+                // Number shortcuts only while unfiltered; once you're typing, digits
+                // are part of the search term (model ids are full of them).
+                else if (!filter && !searchable && key >= "1" && key <= "9" && Number(key) <= options.length) {
+                    finish(Number(key) - 1);
                     done = true;
                 }
+                else if (searchable && key >= " " && key !== "\x1b") {
+                    filter += key;
+                    applyFilter();
+                    render();
+                }
+                else if (!searchable && (key === "k" || key === "j")) {
+                    if (view.length)
+                        cursor = (cursor + (key === "k" ? -1 : 1) + view.length) % view.length;
+                    render();
+                }
                 // Ctrl-C or Esc cancels. Returning -1 used to leak out as an array
                 // index, crashing the caller with "cannot read properties of
                 // undefined" — a cancel must be a clean exit, not a bad index.
@@ -118,7 +178,16 @@ export async function readSecret(rl, promptText, io) {
             resolve(value.trim());
         };
         const onData = (buf) => {
-            for (const ch of buf.toString("utf8")) {
+            // Terminals wrap pasted text in bracketed-paste markers, ESC[200~ before
+            // and ESC[201~ after. The ESC byte is below space and gets dropped by the
+            // printable test below, but "[200~" is ordinary text and would be glued
+            // onto the secret — which is how a pasted key ends up rejected as
+            // malformed. Strip the markers, and any other escape sequence, first.
+            const chunk = buf.toString("utf8")
+                .replace(/\x1b\[20[01]~/g, "")
+                .replace(/\x1b\[[0-9;]*[A-Za-z~]/g, "")
+                .replace(/\x1b./g, "");
+            for (const ch of chunk) {
                 if (ch === "\r" || ch === "\n")
                     return done();
                 if (ch === "\x03") {
@@ -126,16 +195,15 @@ export async function readSecret(rl, promptText, io) {
                     return done();
                 } // Ctrl-C
                 if (ch === "\x7f" || ch === "\b") { // backspace
-                    if (value.length) {
+                    if (value.length)
                         value = value.slice(0, -1);
-                        stdout.write("\b \b");
-                    }
                     continue;
                 }
-                if (ch >= " ") {
+                // Echo nothing at all, the way sudo and ssh do. Masking characters
+                // would still reveal the key's length, and a hundred dots for a long
+                // key looks like something went wrong.
+                if (ch >= " ")
                     value += ch;
-                    stdout.write("•");
-                }
             }
         };
         stdin.on("data", onData);

package/dist/routes.js

@@ -39,6 +39,24 @@ export const ROUTES = [
         aliasesArePinned: true, // Bedrock model ids differ per region/deployment
         implemented: true,
     },
+    {
+        // Claude hosted on Azure through Microsoft Foundry. It speaks the same
+        // Messages API as the direct route, so this is a base URL and an auth
+        // header rather than a new wire — the migration Microsoft describes as
+        // "swap the base URL and authentication, keep the calls the same".
+        id: "foundry",
+        vendor: "Anthropic",
+        label: "Microsoft Foundry (Azure)",
+        hint: "your Azure subscription owns auth and billing",
+        wire: "anthropic",
+        needsBaseUrl: true,
+        // Its own variable: a Foundry resource is separate from an Azure OpenAI
+        // one, with its own key. Sharing the name meant a key saved for GPT
+        // deployments was offered for Claude, where it cannot work.
+        keyEnv: "AZURE_FOUNDRY_API_KEY",
+        aliasesArePinned: true, // you address a deployment someone named
+        implemented: true,
+    },
     {
         id: "vertex",
         vendor: "Anthropic",
@@ -48,6 +66,21 @@ export const ROUTES = [
         aliasesArePinned: true,
         implemented: false, // needs Google OAuth
     },
+    {
+        // Azure hosts OpenAI's models under a company's own subscription, which is
+        // the answer for someone who wants codex billed through work rather than a
+        // personal card. Same wire as OpenAI, but the key travels in its own
+        // header and the deployment name lives in the URL.
+        id: "azure-openai",
+        vendor: "OpenAI",
+        label: "Azure OpenAI",
+        hint: "your Azure subscription owns auth and billing",
+        wire: "openai",
+        needsBaseUrl: true,
+        keyEnv: "AZURE_OPENAI_API_KEY",
+        aliasesArePinned: true, // you address deployments, not model ids
+        implemented: true,
+    },
     {
         id: "openai-api",
         vendor: "OpenAI",