iaoxe-cli 0.1.0

package/README.md

@@ -0,0 +1,91 @@
+# iaoxe CLI
+
+Orquestación de coding de IAOXE en tu terminal y tu CI. Mismo motor que la app de
+escritorio: **GLM-5.2 escribe el volumen, Claude revisa lo crítico**, con control
+de costo. Sin dependencias (Node ≥ 18).
+
+## Instalación
+
+```bash
+npm install -g iaoxe-cli    # paquete: iaoxe-cli · comando: iaoxe
+iaoxe help
+```
+
+Desde el repo (desarrollo):
+
+```bash
+cd iaoxe-cli
+npm link                    # expone el comando `iaoxe`
+# o directo: node bin/iaoxe.js <comando>
+```
+
+## Dos modos
+
+### Gestionado (créditos IAOXE) — recomendado
+
+```bash
+iaoxe login      # abre Google en el navegador, guarda la sesión en ~/.iaoxe/session.json
+iaoxe whoami     # muestra tu cuenta y créditos disponibles
+iaoxe logout
+```
+
+Con sesión, los comandos usan los **créditos IAOXE** (sin gestionar claves): el CLI
+rutea al proxy gestionado, igual que la app de escritorio.
+
+### BYOK (tus propias claves)
+
+Exporta las claves de proveedor, o ponlas en `~/.iaoxe/config.json`, y usa `--byok`:
+
+```bash
+export ZAI_API_KEY=...         # GLM-5.2 (workhorse)
+export ANTHROPIC_API_KEY=...   # Claude (review)
+iaoxe run --byok "..."
+```
+
+```json
+{ "keys": { "ZAI_API_KEY": "...", "ANTHROPIC_API_KEY": "..." } }
+```
+
+> Sin sesión y sin `--byok`, el CLI usa BYOK por defecto. Con sesión, usa créditos
+> IAOXE salvo que pases `--byok`.
+
+## Comandos
+
+```bash
+iaoxe run "add a subtract() to math.js and document it"   # AGENTE: lee y edita archivos del repo
+iaoxe run "..." --dry-run               # muestra qué editaría, sin escribir
+iaoxe run "..." --print                 # solo imprime la respuesta (no edita)
+iaoxe review                            # revisión crítica del diff (vs HEAD)
+iaoxe review --staged                   # revisa lo que está en stage
+iaoxe review --model claude-opus        # usa otro modelo de revisión
+iaoxe models                            # lista los modelos
+iaoxe help
+```
+
+`run` es un **agente**: lee archivos del repo y los edita (confinado al cwd). Trabaja
+mejor dentro de un repo git para revisar el diff (`git diff` / `iaoxe review`) y revertir
+si hace falta.
+
+### Revisión en CI
+
+`iaoxe review` devuelve **exit code 2** si el veredicto es *block* y **1** si pide
+cambios, así que puedes fallar un pipeline ante hallazgos críticos:
+
+```yaml
+- run: iaoxe review --staged
+```
+
+## Publicar (mantenedores)
+
+```bash
+npm login
+npm publish --access public    # paquete: iaoxe-cli (npm bloquea "iaoxe" por similitud)
+```
+
+El paquete incluye `lib/auth-config.js` con la config **client-public** de IAOXE
+(Firebase API key + OAuth client de tipo Desktop), igual que la app de escritorio.
+
+## Estado
+
+v1: `login`/`whoami` (créditos IAOXE), **`run` agéntico** (lee/edita archivos) y
+`review` (auto-review headless), en modo gestionado o BYOK.

package/bin/iaoxe.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+"use strict";
+
+const { loadEnv } = require("../lib/config");
+const { routeAliases } = require("../lib/router");
+const { review } = require("../lib/review");
+const { run } = require("../lib/run");
+const { login, clearSession, loadSession } = require("../lib/auth");
+const { billingState } = require("../lib/managed");
+const c = require("../lib/colors");
+
+const VERSION = require("../package.json").version;
+
+function parseFlags(args) {
+  const flags = {};
+  const rest = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const a = args[i];
+    if (a === "--staged" || a === "-s") flags.staged = true;
+    else if (a === "--byok") flags.byok = true;
+    else if (a === "--print") flags.print = true;
+    else if (a === "--dry-run") flags.dryRun = true;
+    else if (a === "--model" || a === "-m") flags.model = args[++i];
+    else if (a.startsWith("--model=")) flags.model = a.slice(8);
+    else if (a === "--help" || a === "-h") flags.help = true;
+    else rest.push(a);
+  }
+  return { flags, rest };
+}
+
+function help() {
+  console.log(`${c.bold("iaoxe")} ${c.dim("v" + VERSION)} — orquestacion de coding en tu terminal
+
+${c.bold("Uso:")}
+  iaoxe login                             Inicia sesion con Google (creditos IAOXE)
+  iaoxe whoami                            Muestra tu cuenta y creditos disponibles
+  iaoxe logout                            Cierra la sesion local
+  iaoxe run "<tarea>" [--dry-run|--print]  Agente: lee y edita archivos del repo
+  iaoxe review [--staged] [--model <a>]   Revision critica del diff (auth/pagos/seguridad)
+  iaoxe models                            Lista los modelos disponibles
+  iaoxe help | --version
+
+${c.bold("Modos:")} con sesion usa creditos IAOXE; --byok fuerza tus propias claves.
+${c.bold("Claves (BYOK):")} exporta ZAI_API_KEY / ANTHROPIC_API_KEY, o ~/.iaoxe/config.json
+${c.dim("review devuelve exit code 2 si bloquea y 1 si pide cambios (util en CI).")}`);
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const command = argv[0];
+  const { flags, rest } = parseFlags(argv.slice(1));
+  const env = loadEnv();
+
+  if (!command || command === "help" || flags.help) {
+    help();
+    return 0;
+  }
+  if (command === "--version" || command === "-v" || command === "version") {
+    console.log(VERSION);
+    return 0;
+  }
+  if (command === "models") {
+    console.log(routeAliases().join("\n"));
+    return 0;
+  }
+  if (command === "login") {
+    const session = await login();
+    console.log(c.green(`Sesion iniciada como ${session.email || session.uid}.`));
+    return 0;
+  }
+  if (command === "logout") {
+    clearSession();
+    console.log(c.dim("Sesion local cerrada."));
+    return 0;
+  }
+  if (command === "whoami") {
+    const session = loadSession();
+    if (!session) {
+      console.log(c.dim("Sin sesion. Ejecuta: iaoxe login"));
+      return 1;
+    }
+    console.log(`${c.bold(session.email || session.uid)}`);
+    try {
+      const billing = await billingState();
+      console.log(
+        `${c.dim("Plan:")} ${billing.planName || billing.planId} · ${c.green(
+          `${Math.round(Number(billing.availableCredits || 0))} creditos`,
+        )} ${c.dim(`de ${Math.round(Number(billing.hardLimit || 0))}`)}`,
+      );
+    } catch (error) {
+      console.log(c.dim(`(no se pudo leer billing: ${error.message})`));
+    }
+    return 0;
+  }
+  if (command === "run") {
+    return run({
+      task: rest.join(" "),
+      model: flags.model,
+      env,
+      forceByok: Boolean(flags.byok),
+      print: Boolean(flags.print),
+      dryRun: Boolean(flags.dryRun),
+    });
+  }
+  if (command === "review") {
+    return review({ staged: Boolean(flags.staged), model: flags.model || "claude-review", env, forceByok: Boolean(flags.byok) });
+  }
+
+  console.error(c.amber(`Comando desconocido: ${command}`));
+  help();
+  return 1;
+}
+
+main()
+  .then((code) => process.exit(typeof code === "number" ? code : 0))
+  .catch((error) => {
+    console.error(c.red(`Error: ${error.message}`));
+    process.exit(1);
+  });

package/lib/agent.js

@@ -0,0 +1,146 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const { execFileSync } = require("child_process");
+const { complete, activeMode } = require("./complete");
+const c = require("./colors");
+
+const MAX_STEPS = 14;
+
+const TOOLS = [
+  {
+    type: "function",
+    function: {
+      name: "list_files",
+      description: "Lista archivos del repositorio (rutas relativas).",
+      parameters: { type: "object", properties: { dir: { type: "string", description: "subdirectorio opcional" } } },
+    },
+  },
+  {
+    type: "function",
+    function: {
+      name: "read_file",
+      description: "Lee el contenido de un archivo del repo.",
+      parameters: { type: "object", properties: { path: { type: "string" } }, required: ["path"] },
+    },
+  },
+  {
+    type: "function",
+    function: {
+      name: "write_file",
+      description: "Crea o sobrescribe un archivo del repo con el contenido completo dado.",
+      parameters: {
+        type: "object",
+        properties: { path: { type: "string" }, content: { type: "string" } },
+        required: ["path", "content"],
+      },
+    },
+  },
+];
+
+const SYSTEM = [
+  "Eres un agente de coding que trabaja en el repositorio del usuario mediante herramientas.",
+  "Lee los archivos relevantes antes de editar. Haz los cambios minimos y correctos para cumplir la tarea.",
+  "Usa write_file con el contenido COMPLETO del archivo (no fragmentos).",
+  "Cuando termines, responde SIN llamar herramientas con un resumen breve de lo que hiciste.",
+].join(" ");
+
+function safeResolve(root, p) {
+  const abs = path.resolve(root, String(p || ""));
+  const base = path.resolve(root);
+  if (abs !== base && !abs.startsWith(base + path.sep)) throw new Error(`ruta fuera del repo: ${p}`);
+  return abs;
+}
+
+function listFiles(root, dir) {
+  try {
+    const out = execFileSync("git", ["ls-files"], { cwd: root, encoding: "utf8", maxBuffer: 8 * 1024 * 1024 });
+    let files = out.split(/\r?\n/).filter(Boolean);
+    if (dir) files = files.filter((f) => f.startsWith(String(dir).replace(/\\/g, "/")));
+    return files.slice(0, 300).join("\n") || "(sin archivos trackeados)";
+  } catch {
+    const base = safeResolve(root, dir || ".");
+    try {
+      return fs.readdirSync(base).slice(0, 200).join("\n");
+    } catch (error) {
+      return `error: ${error.message}`;
+    }
+  }
+}
+
+async function agentRun({ task, model = "glm-coding", env, forceByok = false, dryRun = false, root = process.cwd() }) {
+  const messages = [
+    { role: "system", content: SYSTEM },
+    { role: "user", content: task },
+  ];
+  const changed = [];
+  process.stderr.write(c.dim(`agente · ${model} · ${activeMode({ forceByok })}${dryRun ? " · dry-run" : ""}\n`));
+
+  for (let step = 0; step < MAX_STEPS; step += 1) {
+    const { message } = await complete({
+      alias: model,
+      env,
+      forceByok,
+      stream: false,
+      maxTokens: 4000,
+      temperature: 0.2,
+      messages,
+      tools: TOOLS,
+    });
+    messages.push(message);
+    const calls = Array.isArray(message.tool_calls) ? message.tool_calls : [];
+
+    if (!calls.length) {
+      if (message.content) console.log(`\n${message.content}`);
+      break;
+    }
+
+    for (const call of calls) {
+      const name = call.function?.name;
+      let args = {};
+      try {
+        args = JSON.parse(call.function?.arguments || "{}");
+      } catch {
+        args = {};
+      }
+      let result = "";
+      try {
+        if (name === "list_files") {
+          result = listFiles(root, args.dir);
+        } else if (name === "read_file") {
+          const abs = safeResolve(root, args.path);
+          result = fs.readFileSync(abs, "utf8").slice(0, 24000);
+          console.log(c.dim(`  · read ${args.path}`));
+        } else if (name === "write_file") {
+          const abs = safeResolve(root, args.path);
+          if (dryRun) {
+            console.log(c.amber(`  · (dry-run) escribiria ${args.path} (${(args.content || "").length} b)`));
+            result = "dry-run: no escrito";
+          } else {
+            fs.mkdirSync(path.dirname(abs), { recursive: true });
+            fs.writeFileSync(abs, String(args.content || ""), "utf8");
+            if (!changed.includes(args.path)) changed.push(args.path);
+            console.log(c.green(`  · escribio ${args.path}`));
+            result = "ok";
+          }
+        } else {
+          result = `herramienta desconocida: ${name}`;
+        }
+      } catch (error) {
+        result = `error: ${error.message}`;
+      }
+      messages.push({ role: "tool", tool_call_id: call.id, content: String(result).slice(0, 24000) });
+    }
+  }
+
+  if (changed.length) {
+    console.log(c.green(`\n${changed.length} archivo(s) ${dryRun ? "a modificar" : "modificado(s)"}: `) + changed.join(", "));
+    if (!dryRun) console.log(c.dim("Revisa con:  git diff   ·   iaoxe review"));
+  } else {
+    console.log(c.dim("\nSin cambios de archivos."));
+  }
+  return changed.length && !dryRun ? 0 : 0;
+}
+
+module.exports = { agentRun };

package/lib/auth-config.js

@@ -0,0 +1,10 @@
+"use strict";
+
+// Config client-public de IAOXE para el login gestionado del CLI (mismos valores
+// que el desktop). Permite OAuth Google -> token Firebase -> proxy de inferencia.
+module.exports = {
+  FIREBASE_API_KEY: "AIzaSyACQMu0Ky7GTsTbHfpm0WStVMYtsyUVbYU",
+  GOOGLE_OAUTH_CLIENT_ID: "506222517298-34f0qj15milisudbkh4t6ulp3gkoq78n.apps.googleusercontent.com",
+  GOOGLE_OAUTH_CLIENT_SECRET: "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",
+  IAOXE_BACKEND_URL: process.env.IAOXE_BACKEND_URL || "https://us-central1-iaoxe-ai.cloudfunctions.net",
+};

package/lib/auth.js

@@ -0,0 +1,162 @@
+"use strict";
+
+const http = require("http");
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { exec } = require("child_process");
+const cfg = require("./auth-config");
+
+const SESSION_PATH = path.join(os.homedir(), ".iaoxe", "session.json");
+
+function base64Url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd =
+    platform === "win32" ? `start "" "${url}"` : platform === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+  exec(cmd, () => {});
+}
+
+function loadSession() {
+  try {
+    return JSON.parse(fs.readFileSync(SESSION_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function saveSession(session) {
+  fs.mkdirSync(path.dirname(SESSION_PATH), { recursive: true });
+  fs.writeFileSync(SESSION_PATH, JSON.stringify(session, null, 2), "utf8");
+  return session;
+}
+
+function clearSession() {
+  try {
+    fs.unlinkSync(SESSION_PATH);
+  } catch {
+    // no session
+  }
+}
+
+function waitForCode(server) {
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      server.close();
+      reject(new Error("El login expiro antes de recibir respuesta de Google."));
+    }, 180000);
+    server.on("request", (request, response) => {
+      const url = new URL(request.url, "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        response.writeHead(404);
+        response.end("Not found");
+        return;
+      }
+      clearTimeout(timeout);
+      const error = url.searchParams.get("error");
+      response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      response.end(
+        "<html><body style=\"font-family:system-ui;background:#0b0b0c;color:#eee;text-align:center;padding-top:18vh\"><h2>IAOXE</h2><p>Sesion iniciada. Vuelve a tu terminal.</p></body></html>",
+      );
+      server.close();
+      if (error) reject(new Error(`Google rechazo el login: ${error}`));
+      else resolve(url.searchParams.get("code"));
+    });
+  });
+}
+
+async function login() {
+  const verifier = base64Url(crypto.randomBytes(64));
+  const challenge = base64Url(crypto.createHash("sha256").update(verifier).digest());
+
+  const server = http.createServer();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const port = server.address().port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+
+  const authUrl = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+  authUrl.searchParams.set("client_id", cfg.GOOGLE_OAUTH_CLIENT_ID);
+  authUrl.searchParams.set("redirect_uri", redirectUri);
+  authUrl.searchParams.set("response_type", "code");
+  authUrl.searchParams.set("scope", "openid email profile");
+  authUrl.searchParams.set("code_challenge", challenge);
+  authUrl.searchParams.set("code_challenge_method", "S256");
+  authUrl.searchParams.set("prompt", "select_account");
+
+  const codePromise = waitForCode(server);
+  openBrowser(authUrl.toString());
+  process.stderr.write("Abre esta URL si el navegador no se abrio:\n" + authUrl.toString() + "\n");
+  const code = await codePromise;
+  if (!code) throw new Error("Google no devolvio codigo de autorizacion.");
+
+  const tokenBody = new URLSearchParams({
+    code,
+    client_id: cfg.GOOGLE_OAUTH_CLIENT_ID,
+    client_secret: cfg.GOOGLE_OAUTH_CLIENT_SECRET,
+    code_verifier: verifier,
+    redirect_uri: redirectUri,
+    grant_type: "authorization_code",
+  });
+  const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: tokenBody,
+  });
+  const token = await tokenResponse.json();
+  if (!tokenResponse.ok) throw new Error(token.error_description || token.error || "OAuth fallo.");
+
+  const idp = new URLSearchParams({ providerId: "google.com", id_token: token.id_token || "" });
+  const fbResponse = await fetch(
+    `https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=${encodeURIComponent(cfg.FIREBASE_API_KEY)}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ postBody: idp.toString(), requestUri: "http://localhost", returnIdpCredential: true, returnSecureToken: true }),
+    },
+  );
+  const fb = await fbResponse.json();
+  if (!fbResponse.ok) throw new Error(fb.error?.message || "Firebase rechazo el login de Google.");
+
+  return saveSession({
+    provider: "firebase-google",
+    email: fb.email || "",
+    uid: fb.localId,
+    idToken: fb.idToken,
+    refreshToken: fb.refreshToken,
+    expiresAt: Date.now() + Number(fb.expiresIn || 3600) * 1000,
+  });
+}
+
+async function refresh(session) {
+  const response = await fetch(`https://securetoken.googleapis.com/v1/token?key=${encodeURIComponent(cfg.FIREBASE_API_KEY)}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: session.refreshToken }),
+  });
+  const body = await response.json();
+  if (!response.ok) throw new Error(body.error?.message || "Sesion expirada. Ejecuta: iaoxe login");
+  return saveSession({
+    ...session,
+    idToken: body.id_token,
+    refreshToken: body.refresh_token || session.refreshToken,
+    expiresAt: Date.now() + Number(body.expires_in || 3600) * 1000,
+  });
+}
+
+async function getValidToken() {
+  const session = loadSession();
+  if (!session || !session.refreshToken) throw new Error("No has iniciado sesion. Ejecuta: iaoxe login");
+  if (Date.now() > Number(session.expiresAt || 0) - 120000) {
+    return (await refresh(session)).idToken;
+  }
+  return session.idToken;
+}
+
+module.exports = { login, refresh, getValidToken, loadSession, clearSession, SESSION_PATH };

package/lib/colors.js

@@ -0,0 +1,14 @@
+"use strict";
+
+// ANSI colors, disabled when not a TTY or NO_COLOR is set.
+const on = process.stdout.isTTY && !process.env.NO_COLOR;
+const wrap = (code) => (s) => (on ? `[${code}m${s}` : String(s));
+
+module.exports = {
+  green: wrap("32"),
+  amber: wrap("33"),
+  red: wrap("31"),
+  cyan: wrap("36"),
+  bold: wrap("1"),
+  dim: wrap("2"),
+};

package/lib/complete.js

@@ -0,0 +1,20 @@
+"use strict";
+
+const { chatCompletion } = require("./router");
+const { managedChat } = require("./managed");
+const { loadSession } = require("./auth");
+
+// Decide la via: si hay sesion (creditos IAOXE) y no se forzo BYOK, usa el proxy
+// gestionado; si no, llama al proveedor directo con la clave BYOK del entorno.
+async function complete({ alias, env, messages, stream, onToken, maxTokens, temperature, tools, forceByok }) {
+  if (!forceByok && loadSession()) {
+    return managedChat({ alias, messages, stream, onToken, maxTokens, temperature, tools });
+  }
+  return chatCompletion({ alias, env, messages, stream, onToken, maxTokens, temperature, tools });
+}
+
+function activeMode({ forceByok } = {}) {
+  return !forceByok && loadSession() ? "managed" : "byok";
+}
+
+module.exports = { complete, activeMode };

package/lib/config.js

@@ -0,0 +1,23 @@
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+// Carga claves desde el entorno y, si existe, ~/.iaoxe/config.json:
+//   { "keys": { "ZAI_API_KEY": "...", "ANTHROPIC_API_KEY": "..." } }
+function loadEnv() {
+  const env = { ...process.env };
+  const cfgPath = path.join(os.homedir(), ".iaoxe", "config.json");
+  if (fs.existsSync(cfgPath)) {
+    try {
+      const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+      if (cfg && cfg.keys && typeof cfg.keys === "object") Object.assign(env, cfg.keys);
+    } catch {
+      // config invalido: se ignora, se usa solo el entorno
+    }
+  }
+  return env;
+}
+
+module.exports = { loadEnv };

package/lib/managed.js

@@ -0,0 +1,76 @@
+"use strict";
+
+const cfg = require("./auth-config");
+const { getValidToken } = require("./auth");
+
+// Inferencia gestionada (creditos IAOXE) via el proxy Firebase, con el token de sesion.
+async function managedChat({ alias, messages, stream = false, onToken, maxTokens = 2000, temperature = 0.2, tools }) {
+  const token = await getValidToken();
+  const body = { model: alias, messages, temperature, max_tokens: maxTokens };
+  if (stream) body.stream = true;
+  if (tools) body.tools = tools;
+
+  const response = await fetch(`${cfg.IAOXE_BACKEND_URL}/inference`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) {
+    const text = await response.text();
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = null;
+    }
+    throw new Error(parsed?.error || parsed?.error?.message || `Proxy IAOXE HTTP ${response.status}: ${text.slice(0, 200)}`);
+  }
+
+  if (!stream) {
+    const json = await response.json();
+    const message = json.choices?.[0]?.message || {};
+    return { content: message.content || "", message, usage: json.usage || null };
+  }
+
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let full = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    let index;
+    while ((index = buffer.indexOf("\n")) >= 0) {
+      const line = buffer.slice(0, index).trim();
+      buffer = buffer.slice(index + 1);
+      if (!line.startsWith("data:")) continue;
+      const data = line.slice(5).trim();
+      if (!data || data === "[DONE]") continue;
+      try {
+        const obj = JSON.parse(data);
+        const delta = obj.choices?.[0]?.delta?.content;
+        if (delta) {
+          full += delta;
+          if (onToken) onToken(delta);
+        }
+      } catch {
+        // chunk parcial
+      }
+    }
+  }
+  return { content: full };
+}
+
+async function billingState() {
+  const token = await getValidToken();
+  const response = await fetch(`${cfg.IAOXE_BACKEND_URL}/getBillingState`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  const body = await response.json();
+  if (!response.ok || body.ok === false) throw new Error(body.error || "No se pudo leer el estado de billing.");
+  return body.billing;
+}
+
+module.exports = { managedChat, billingState };

package/lib/review.js

@@ -0,0 +1,103 @@
+"use strict";
+
+const { execFileSync } = require("child_process");
+const { complete, activeMode } = require("./complete");
+const c = require("./colors");
+
+const REVIEW_PROMPT = [
+  "Eres un revisor de codigo senior especializado en seguridad y arquitectura.",
+  "Revisas el diff producido por un modelo de coding mas economico antes de que llegue a produccion.",
+  "Prioriza: secretos expuestos, autenticacion y permisos, manejo de pagos, validacion de entrada,",
+  "inyeccion (SQL/command/XSS), manejo de datos sensibles, correctitud y posibles regresiones.",
+  'Si no hay cambios riesgosos, el verdict es "pass".',
+  "Devuelve UNICAMENTE un objeto JSON valido, sin texto adicional, con esta forma exacta:",
+  '{ "verdict": "pass"|"changes_requested"|"block", "summary": "1-3 frases",',
+  '  "findings": [ { "severity": "critical"|"high"|"medium"|"low", "file": "ruta", "title": "...", "detail": "...", "recommendation": "..." } ],',
+  '  "strengths": ["..."] }',
+].join("\n");
+
+function getDiff(staged) {
+  const run = (args) => {
+    try {
+      return execFileSync("git", args, { encoding: "utf8", maxBuffer: 32 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
+    } catch {
+      return "";
+    }
+  };
+  let diff = staged ? run(["diff", "--cached"]) : run(["diff", "HEAD"]).trim() || run(["diff"]);
+  diff = String(diff || "").trim();
+  return diff.length > 60000 ? `${diff.slice(0, 60000)}\n... [diff truncado] ...` : diff;
+}
+
+function extractJson(text) {
+  const start = String(text || "").indexOf("{");
+  const end = String(text || "").lastIndexOf("}");
+  if (start === -1 || end === -1 || end < start) return null;
+  try {
+    return JSON.parse(text.slice(start, end + 1));
+  } catch {
+    return null;
+  }
+}
+
+const SEVERITY = { critical: c.red("CRITICO"), high: c.red("ALTO"), medium: c.amber("MEDIO"), low: c.dim("BAJO") };
+const VERDICT = {
+  pass: c.green("APROBADO"),
+  changes_requested: c.amber("CAMBIOS SUGERIDOS"),
+  block: c.red("BLOQUEADO"),
+};
+
+async function review({ staged = false, model = "claude-review", env, forceByok = false }) {
+  const diff = getDiff(staged);
+  if (!diff) {
+    console.log(c.dim(`No hay cambios ${staged ? "en stage" : "sin commitear"} para revisar.`));
+    return 0;
+  }
+
+  process.stderr.write(c.dim(`Revisando con ${model} (${activeMode({ forceByok })})...\n`));
+  const { content, usage } = await complete({
+    alias: model,
+    env,
+    forceByok,
+    temperature: 0.1,
+    maxTokens: 2000,
+    messages: [
+      { role: "system", content: REVIEW_PROMPT },
+      { role: "user", content: `Revisa de forma critica este diff y responde solo con el JSON pedido:\n\n${diff}` },
+    ],
+  });
+
+  const parsed = extractJson(content);
+  if (!parsed) {
+    console.log(c.amber("El modelo no devolvio un reporte estructurado:\n"));
+    console.log(content);
+    return 1;
+  }
+
+  console.log(`\n${c.bold("Veredicto:")} ${VERDICT[parsed.verdict] || parsed.verdict || "—"}`);
+  if (parsed.summary) console.log(c.dim(parsed.summary));
+
+  const findings = Array.isArray(parsed.findings) ? parsed.findings : [];
+  if (findings.length) {
+    console.log("");
+    for (const f of findings) {
+      const sev = SEVERITY[String(f.severity || "low").toLowerCase()] || String(f.severity || "");
+      console.log(`${sev}  ${c.bold(f.title || "Hallazgo")}${f.file ? c.dim(`  (${f.file})`) : ""}`);
+      if (f.detail) console.log(`   ${f.detail}`);
+      if (f.recommendation) console.log(`   ${c.cyan("→")} ${f.recommendation}`);
+    }
+  } else {
+    console.log(c.green("\nSin hallazgos de riesgo en este cambio."));
+  }
+
+  if (usage) {
+    console.log(c.dim(`\nTokens: ${Number(usage.prompt_tokens || 0)} in / ${Number(usage.completion_tokens || 0)} out`));
+  }
+
+  // exit code util para CI: 2 si bloquea, 1 si pide cambios, 0 si pasa.
+  if (parsed.verdict === "block") return 2;
+  if (parsed.verdict === "changes_requested") return 1;
+  return 0;
+}
+
+module.exports = { review };

package/lib/router.js

@@ -0,0 +1,84 @@
+"use strict";
+
+// Misma tabla de routing que el desktop/proxy: alias -> proveedor OpenAI-compatible.
+const ROUTES = {
+  "glm-coding": { baseURL: "https://api.z.ai/api/coding/paas/v4", envKey: "ZAI_API_KEY", model: "glm-5.2" },
+  "deepseek-coding": { baseURL: "https://api.deepseek.com", envKey: "DEEPSEEK_API_KEY", model: "deepseek-chat" },
+  "claude-review": { baseURL: "https://api.anthropic.com/v1", envKey: "ANTHROPIC_API_KEY", model: "claude-sonnet-4-6" },
+  "claude-opus": { baseURL: "https://api.anthropic.com/v1", envKey: "ANTHROPIC_API_KEY", model: "claude-opus-4-1" },
+  "openai-fallback": { baseURL: "https://api.openai.com/v1", envKey: "OPENAI_API_KEY", model: "gpt-4.1" },
+  "gemini-vision": { baseURL: "https://generativelanguage.googleapis.com/v1beta/openai", envKey: "GEMINI_API_KEY", model: "gemini-2.0-flash" },
+};
+
+function routeAliases() {
+  return Object.keys(ROUTES);
+}
+
+function resolveRoute(alias) {
+  return ROUTES[String(alias || "").trim()] || null;
+}
+
+// Llama a un modelo (OpenAI-compatible) con la clave BYOK del entorno.
+// stream:true -> invoca onToken(delta) y devuelve { content }.
+async function chatCompletion({ alias, env, messages, stream = false, onToken, maxTokens = 2000, temperature = 0.2, tools }) {
+  const route = resolveRoute(alias);
+  if (!route) throw new Error(`Modelo desconocido: ${alias}. Usa "iaoxe models".`);
+  const key = String((env && env[route.envKey]) || "").trim();
+  if (!key) {
+    throw new Error(
+      `Falta ${route.envKey} para usar "${alias}". Exporta la variable o agregala en ~/.iaoxe/config.json.`,
+    );
+  }
+
+  const body = { model: route.model, messages, temperature, max_tokens: maxTokens };
+  if (stream) body.stream = true;
+  if (tools) body.tools = tools;
+
+  const response = await fetch(`${route.baseURL}/chat/completions`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Proveedor (${alias}) respondio HTTP ${response.status}: ${text.slice(0, 200)}`);
+  }
+
+  if (!stream) {
+    const json = await response.json();
+    const message = json.choices?.[0]?.message || {};
+    return { content: message.content || "", message, usage: json.usage || null };
+  }
+
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let full = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    let index;
+    while ((index = buffer.indexOf("\n")) >= 0) {
+      const line = buffer.slice(0, index).trim();
+      buffer = buffer.slice(index + 1);
+      if (!line.startsWith("data:")) continue;
+      const data = line.slice(5).trim();
+      if (!data || data === "[DONE]") continue;
+      try {
+        const obj = JSON.parse(data);
+        const delta = obj.choices?.[0]?.delta?.content;
+        if (delta) {
+          full += delta;
+          if (onToken) onToken(delta);
+        }
+      } catch {
+        // chunk parcial
+      }
+    }
+  }
+  return { content: full };
+}
+
+module.exports = { ROUTES, routeAliases, resolveRoute, chatCompletion };

package/lib/run.js

@@ -0,0 +1,40 @@
+"use strict";
+
+const { complete, activeMode } = require("./complete");
+const { agentRun } = require("./agent");
+const c = require("./colors");
+
+// iaoxe run: por defecto es AGENTICO (lee y edita archivos del repo via tools).
+// --print: modo antiguo, solo transmite la respuesta sin tocar archivos.
+async function run({ task, model = "glm-coding", env, forceByok = false, print = false, dryRun = false }) {
+  if (!task || !task.trim()) {
+    console.error(c.amber('Uso: iaoxe run "describe la tarea"  [--print] [--dry-run]'));
+    return 1;
+  }
+
+  if (print) {
+    process.stderr.write(c.dim(`(${model} · ${activeMode({ forceByok })})\n`));
+    await complete({
+      alias: model,
+      env,
+      forceByok,
+      stream: true,
+      maxTokens: 2000,
+      temperature: 0.3,
+      messages: [
+        {
+          role: "system",
+          content: "Eres un asistente de coding directo y conciso. Devuelve codigo claro, listo para usar.",
+        },
+        { role: "user", content: task },
+      ],
+      onToken: (delta) => process.stdout.write(delta),
+    });
+    process.stdout.write("\n");
+    return 0;
+  }
+
+  return agentRun({ task, model, env, forceByok, dryRun });
+}
+
+module.exports = { run };

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "iaoxe-cli",
+  "version": "0.1.0",
+  "description": "IAOXE orchestration in your terminal: GLM writes, Claude reviews, with cost control. Agentic run + critical review, managed credits or BYOK.",
+  "bin": {
+    "iaoxe": "bin/iaoxe.js"
+  },
+  "type": "commonjs",
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "README.md"
+  ],
+  "keywords": [
+    "ai",
+    "coding",
+    "cli",
+    "agent",
+    "code-review",
+    "llm",
+    "orchestration",
+    "iaoxe"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cristianrjs01/iaoxe.git",
+    "directory": "iaoxe-cli"
+  },
+  "homepage": "https://iaoxe.com",
+  "bugs": {
+    "url": "https://github.com/Cristianrjs01/iaoxe/issues"
+  },
+  "author": "IAOXE LLC",
+  "license": "UNLICENSED",
+  "scripts": {
+    "lint": "node --check bin/iaoxe.js && node --check lib/router.js && node --check lib/config.js && node --check lib/colors.js && node --check lib/review.js && node --check lib/run.js && node --check lib/auth.js && node --check lib/auth-config.js && node --check lib/managed.js && node --check lib/complete.js && node --check lib/agent.js",
+    "prepublishOnly": "npm run lint"
+  }
+}