isorite 0.8.1 → 0.9.1

package/dist/main.js

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
 import { chmodSync, closeSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Document, Scalar, isMap, isScalar, isSeq, parseDocument, stringify } from "yaml";
 import MarkdownIt from "markdown-it";
 import { parse, stringify as stringify$1 } from "smol-toml";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { arch, constants, homedir, hostname, platform, release, tmpdir } from "node:os";
 import { createSecureContext, getCACertificates, setDefaultCACertificates } from "node:tls";
-import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { get } from "node:http";
 import { Worker } from "node:worker_threads";
 import { Agent, request } from "node:https";
 import { Readable } from "node:stream";
@@ -18,8 +19,10 @@ import { streamSSE } from "hono/streaming";
 import { z } from "zod";
 import { OpenCode } from "@opencode/client";
 import { appendFile, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
 import { createServer } from "node:net";
-import { createInterface } from "node:readline";
+import { isSea } from "node:sea";
+import { createInterface as createInterface$1 } from "node:readline";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __esmMin = (fn, res, err) => () => {
@@ -1944,19 +1947,50 @@ function unreachable(err, url) {
 	try {
 		host = new URL(url).host;
 	} catch {}
-	const advice = UNTRUSTED.has(code) ? `Its certificate is signed by an authority not trusted here, often a company's own. Add it to the system's authorities (isorite trusts those), or set NODE_EXTRA_CA_CERTS to its certificate (a .pem), or name that as ca in [provider].` : code === "CERT_HAS_EXPIRED" ? "Its certificate has expired: that is the gateway's to fix." : code === "ERR_TLS_CERT_ALTNAME_INVALID" ? `Its certificate is not for ${host}: check the url in [provider].` : /CERTIFICATE_REQUIRED|HANDSHAKE_FAILURE|BAD_CERTIFICATE|UNKNOWN_CA/.test(code) ? "It asks for a client certificate (mTLS) and was given none it accepts: name yours as pfx (with pfx_passphrase), or cert and cert_key, in [provider]." : code === "UND_ERR_SOCKET" && url.startsWith("https:") ? "It closed the connection as it was being set up. A gateway that asks for a client certificate (mTLS) does this: name yours as pfx, or cert and cert_key, in [provider]." : code === "ENOTFOUND" || code === "EAI_AGAIN" ? `The name ${host} could not be found: check the url in [provider], and whether it is only found on the company's network or VPN.` : code === "ECONNREFUSED" ? `Nothing answers at ${host}: check the url and its port in [provider].` : code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || code === "ENETUNREACH" || code === "EHOSTUNREACH" ? `${host} did not answer. If the company's network reaches it through a proxy, set HTTPS_PROXY.` : "";
+	const proxy = /Proxy response \((\d{3})\)/.exec(said)?.[1];
+	const advice = proxy === "407" ? "The proxy (HTTPS_PROXY), not the provider, refused with 407: it wants credentials of its own, as http://user:password@proxy:port in HTTPS_PROXY, or its own sign-in. isorite can't answer a proxy that signs in by Kerberos or NTLM." : proxy ? `The proxy (HTTPS_PROXY) answered ${proxy}, not the provider: check HTTPS_PROXY, and NO_PROXY for hosts reached directly.` : UNTRUSTED.has(code) ? `Its certificate is signed by an authority not trusted here, often a company's own. Add it to the system's authorities (isorite trusts those), or set NODE_EXTRA_CA_CERTS to its certificate (a .pem), or name that as ca in [provider].` : code === "CERT_HAS_EXPIRED" ? "Its certificate has expired: that is the gateway's to fix." : code === "ERR_TLS_CERT_ALTNAME_INVALID" ? `Its certificate is not for ${host}: check the url in [provider].` : /CERTIFICATE_REQUIRED|HANDSHAKE_FAILURE|BAD_CERTIFICATE|UNKNOWN_CA/.test(code) ? "It asks for a client certificate (mTLS) and was given none it accepts: name yours as pfx (with pfx_passphrase), or cert and cert_key, in [provider]." : code === "UND_ERR_SOCKET" && url.startsWith("https:") ? "It closed the connection as it was being set up. A gateway that asks for a client certificate (mTLS) does this: name yours as pfx, or cert and cert_key, in [provider]." : code === "ENOTFOUND" || code === "EAI_AGAIN" ? `The name ${host} could not be found: check the url in [provider], and whether it is only found on the company's network or VPN.` : code === "ECONNREFUSED" ? `Nothing answers at ${host}: check the url and its port in [provider].` : code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || code === "ENETUNREACH" || code === "EHOSTUNREACH" ? `${host} did not answer. If the company's network reaches it through a proxy, set HTTPS_PROXY.` : "";
 	return [
 		said || err?.message || "no reason given",
 		code && !said.includes(code) ? ` (${code})` : "",
 		advice ? `. ${advice}` : ""
 	].join("");
 }
+/** The header the key goes in, and what goes before it: Authorization with "Bearer " unless said otherwise (M21).
+*  `key_header = "authorization"` alone means Bearer too: a bare key in Authorization is rarely what a gateway
+*  wants. `key_prefix = ""` sends it bare. */
+function keySent(p) {
+	const header = p.keyHeader || "Authorization";
+	return {
+		header,
+		prefix: p.keyPrefix ?? (header.toLowerCase() === "authorization" ? "Bearer " : "")
+	};
+}
+/** How the key is sent, as said to the person: `Authorization: Bearer <41 characters>`. */
+function keySentAs(p, key) {
+	const { header, prefix } = keySent(p);
+	return `${header}: ${prefix}<${key.length} characters>`;
+}
+/** What a provider said with a refusal: its `error.message` (or `message`, or `error`), else its text without
+*  markup, cut to 300 characters, and never the key, should it say it back. */
+function refusal(body, key = null) {
+	let said = "";
+	try {
+		const j = JSON.parse(body);
+		said = (typeof j.error === "string" ? j.error : j.error?.message) ?? j.message ?? "";
+	} catch {
+		said = body.replace(/<[^>]+>/g, " ");
+	}
+	said = said.replace(/\s+/g, " ").trim();
+	if (key && key.length >= 8) said = said.split(key).join("<the key>");
+	return said.length > 300 ? said.slice(0, 299) + "…" : said;
+}
 /** The address of `path` at the provider, and the headers that go with every request to it: its key, where it
 *  wants it, and its own. */
 function endpoint(p, key, path) {
 	const url = new URL(p.url.replace(/\/+$/, "") + path);
 	for (const [name, value] of Object.entries(p.query ?? {})) url.searchParams.set(name, value);
-	const auth = !key ? {} : p.keyHeader ? { [p.keyHeader]: key } : { Authorization: `Bearer ${key}` };
+	const sent = keySent(p);
+	const auth = !key ? {} : { [sent.header]: sent.prefix + key };
 	return {
 		url: url.toString(),
 		headers: {
@@ -2023,13 +2057,7 @@ async function completeOnce(http, p, key, call, heard) {
 	if (!res.ok || !res.body) {
 		let detail = "";
 		try {
-			const said = await res.text();
-			try {
-				const j = JSON.parse(said);
-				detail = (typeof j.error === "string" ? j.error : j.error?.message) ?? j.message ?? "";
-			} catch {
-				detail = said.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim().slice(0, 300);
-			}
+			detail = refusal(await res.text(), key);
 		} catch {}
 		if (DOWN.has(res.status)) throw new ModelError(`${p.name} is unavailable (${res.status}${detail ? `: ${detail}` : ""})`, 502, {
 			kind: "unavailable",
@@ -2041,7 +2069,7 @@ async function completeOnce(http, p, key, call, heard) {
 			retry: true,
 			after: afterOf(res)
 		});
-		const advice = res.status === 401 ? " The key was not accepted: set it again in settings." : res.status === 402 ? " The key's credit is spent." : res.status === 404 ? ` ${p.name} may have no model called ${call.model}${p.defaultTiers ? ", which is OpenRouter's name for it: name this provider's models under [tiers] in config.toml" : ""}.` : "";
+		const advice = res.status === 401 ? ` The key was not accepted${key ? `, sent as ${keySentAs(p, key)}` : ""}: set it again in settings, or check key_header and key_prefix.` : res.status === 402 ? " The key's credit is spent." : res.status === 404 ? ` ${p.name} may have no model called ${call.model}${p.defaultTiers ? ", which is OpenRouter's name for it: name this provider's models under [tiers] in config.toml" : ""}.` : "";
 		throw new ModelError(`${p.name} said ${res.status}${detail ? `: ${detail}` : ""}.${advice}`, res.status === 401 || res.status === 403 ? 409 : 502);
 	}
 	let text = "", usage = null, finish = "";
@@ -6697,7 +6725,7 @@ function writeHome(dir, { gateway = null, plugin = pluginDir, instructions = []
 			recursive: true,
 			force: true
 		});
-		symlinkSync(plugin, link, "dir");
+		symlinkSync(plugin, link, process.platform === "win32" ? "junction" : "dir");
 	}
 	return dir;
 }
@@ -6724,12 +6752,14 @@ function withLocal(config, local) {
 	};
 }
 function linksTo(path, target) {
+	const plain = (p) => resolve(p).replace(/[\\/]+$/, "");
 	try {
-		return lstatSync(path).isSymbolicLink() && readlinkSync(path) === target;
+		return lstatSync(path).isSymbolicLink() && plain(readlinkSync(path)) === plain(target);
 	} catch {
 		return false;
 	}
 }
+const PACKAGE$1 = `@opencode/cli@2.0.32`;
 /** The version a `--version` line names, as "2.0.32", or null. */
 function parseVersion(output) {
 	return output.match(/(\d+)\.(\d+)\.(\d+)/)?.[0] ?? null;
@@ -6749,20 +6779,57 @@ const probe = (command) => {
 		return null;
 	}
 };
-/** ISORITE_OPENCODE if set, else `opencode2`, else `opencode`: the first that is OpenCode 2. */
-function findOpenCode(env = process.env, run = probe) {
+/** isorite's own prefix for OpenCode 2. Not ~/.config/isorite/opencode, which is OpenCode's configuration as
+*  `term` writes it (home.ts): an npm prefix there would put node_modules among it. */
+function ownPrefix(env = process.env) {
+	return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "isorite", "opencode-cli");
+}
+/** The OpenCode 2 in isorite's own prefix, as npm links it; on Windows, the package's own opencode.exe, as npm's
+*  opencode2.cmd can't be run without a shell (Node refuses .cmd files since 2024). */
+const ownCommand = (env = process.env, platform = process.platform) => platform === "win32" ? join(ownPrefix(env), "node_modules", "@opencode", "cli", "bin", "opencode.exe") : join(ownPrefix(env), "node_modules", ".bin", "opencode2");
+/** A command on the PATH as Windows can run it without a shell: `<name>.exe`, or for npm's `<name>.cmd` the
+*  package's opencode.exe beside it, in the global node_modules. Null when there is neither. */
+function onWindowsPath(name, env = process.env, exists = existsSync) {
+	for (const dir of (env.PATH ?? env.Path ?? "").split(win32.delimiter).filter(Boolean)) {
+		if (exists(win32.join(dir, `${name}.exe`))) return win32.join(dir, `${name}.exe`);
+		const exe = win32.join(dir, "node_modules", "@opencode", "cli", "bin", "opencode.exe");
+		if (exists(win32.join(dir, `${name}.cmd`)) && exists(exe)) return exe;
+	}
+	return null;
+}
+/** The line that installs OpenCode 2 for isorite alone, to copy. */
+const installLine = (env = process.env) => `isorite opencode   (npm install --prefix ${ownPrefix(env)} ${PACKAGE$1})`;
+/** OpenCode 2 wasn't found. `old` is an OpenCode 1 that was, if one was. */
+var NoOpenCode = class extends Error {
+	old;
+	constructor(tried, old, env) {
+		super((old ? `isorite term needs OpenCode 2; ${old} is OpenCode 1 (${tried.join("; ")}).\n` : `isorite term needs OpenCode 2 (${tried.join("; ")}).\n`) + `  Install it for isorite only, leaving the global one as it is: ${installLine(env)}\n  or name one with: ISORITE_OPENCODE=/path/to/opencode isorite term`);
+		this.old = old;
+	}
+};
+/** ISORITE_OPENCODE if set, else isorite's own prefix's, else `opencode2`, else `opencode`: the first that is
+*  OpenCode 2. */
+function findOpenCode(env = process.env, run = probe, platform = process.platform, where = onWindowsPath) {
 	const tried = [];
-	const candidates = env.ISORITE_OPENCODE ? [env.ISORITE_OPENCODE] : ["opencode2", "opencode"];
-	for (const command of candidates) {
+	let old = null;
+	const candidates = env.ISORITE_OPENCODE ? [[env.ISORITE_OPENCODE, "ISORITE_OPENCODE"]] : [
+		[ownCommand(env, platform), "isorite opencode"],
+		["opencode2", "the PATH"],
+		["opencode", "the PATH"]
+	];
+	for (const [named, from] of candidates) {
+		const command = platform === "win32" && from === "the PATH" ? where(named, env) ?? named : named;
 		const output = run(command);
 		const version = output === null ? null : parseVersion(output);
 		if (version && Number(version.split(".")[0]) === 2) return {
 			command,
-			version
+			version,
+			from
 		};
-		tried.push(output === null ? `${command}: not found` : `${command}: ${version ?? "unknown version"}`);
+		if (version && Number(version.split(".")[0]) < 2) old ??= `${command} ${version}`;
+		if (output !== null || from !== "isorite opencode") tried.push(output === null ? `${command}: not found` : `${command}: ${version ?? "unknown version"}`);
 	}
-	throw new Error(`isorite term needs OpenCode 2 (${tried.join("; ")}).\n  Install it with: npm i -g @opencode/cli\n  or name one with: ISORITE_OPENCODE=/path/to/opencode isorite term`);
+	throw new NoOpenCode(tried, old, env);
 }
 //#endregion
 //#region packages/server/src/config.ts
@@ -6850,6 +6917,7 @@ function providerFrom(config, env = process.env) {
 		...headers ? { headers } : {},
 		...query ? { query } : {},
 		...typeof p.key_header === "string" && p.key_header ? { keyHeader: p.key_header } : {},
+		...typeof p.key_prefix === "string" ? { keyPrefix: p.key_prefix } : {},
 		...p.stream_usage === false ? { streamUsage: false } : {},
 		...typeof p.max_tokens === "number" && p.max_tokens > 0 ? { maxTokens: Math.floor(p.max_tokens) } : {}
 	};
@@ -6953,6 +7021,23 @@ function lendBase(name, lend, path = configPath()) {
 }
 //#endregion
 //#region packages/server/src/model.ts
+/** Where a mirror keeps the .tgz (M21): ISORITE_MODEL_BASE_URL names the folder it's in, tried before the rest. */
+function mirrorOf(env = process.env) {
+	const base = env.ISORITE_MODEL_BASE_URL?.trim();
+	return base ? `${base.replace(/\/+$/, "")}/${RELEASE_FILE}` : null;
+}
+/** How to fetch the model by hand, to copy: the file, its SHA-256, and the command that takes it. */
+function byHand(env = process.env) {
+	const mirror = mirrorOf(env);
+	return [
+		"Fetch this file another way (a browser, or a machine that can reach it):",
+		`  ${RELEASE}`,
+		...mirror ? [`  or from your mirror: ${mirror}`] : [],
+		`  SHA-256 ${RELEASE_SHA256}`,
+		"then run:",
+		`  isorite model --from ~/Downloads/${RELEASE_FILE}`
+	];
+}
 /** Where the server looks for the model, in order, and why each place is there. */
 function modelPlaces(env = process.env) {
 	if (env.ISORITE_EMBED_DIR) return [{
@@ -7042,7 +7127,7 @@ function unpack(pkg) {
 }
 /** Fetch the model's files into `out`, keeping only files whose SHA-256 is the one expected: from a folder if one is
 *  named; else from npm, then the GitHub release, then Hugging Face, each tried in turn. */
-async function fetchModel(out, say = console.log, { from, pkg = PACKAGE, release = RELEASE, hub = HUB, files = FILES } = {}) {
+async function fetchModel(out, say = console.log, { from, pkg = PACKAGE, release = RELEASE, mirror = null, url, hub = HUB, files = FILES, tgzSha = files === FILES ? RELEASE_SHA256 : null } = {}) {
 	mkdirSync(out, { recursive: true });
 	const missing = () => files.filter(([, to, want]) => !(existsSync(join(out, to)) && sha(readFileSync(join(out, to))) === want));
 	for (const [, to] of files) if (!missing().some((f) => f[1] === to)) say(`${to}: already here`);
@@ -7071,31 +7156,42 @@ async function fetchModel(out, say = console.log, { from, pkg = PACKAGE, release
 		}
 	};
 	const why = (e, url) => e.message === "fetch failed" || e.cause ? unreachable(e, url) : e.message;
-	if (missing().length && pkg) try {
-		fromPackage(pkg);
-	} catch (e) {
-		tried.push(`npm (${pkg}): ${e.message}`);
-		say(`From npm (${pkg}): ${e.message}`);
-	}
-	if (missing().length && release) {
+	/** The .tgz at an address, checked by its SHA-256 before it's unpacked; a failure is kept in `tried`. */
+	const fromWeb = async (where, address) => {
 		const tmp = mkdtempSync(join(tmpdir(), "isorite-model-release-"));
 		try {
-			say(`From GitHub: ${release}`);
-			const res = await fetch(release);
+			say(`From ${where}: ${address}`);
+			const res = await fetch(address);
 			if (!res.ok) throw new Error(`it said ${res.status}`);
-			const tgz = join(tmp, basename(new URL(release).pathname));
-			writeFileSync(tgz, new Uint8Array(await res.arrayBuffer()));
+			const buf = new Uint8Array(await res.arrayBuffer());
+			if (tgzSha && sha(buf) !== tgzSha) throw new Error(`not the file expected: its SHA-256 is ${sha(buf)}, not ${tgzSha}, so it was not unpacked`);
+			const tgz = join(tmp, basename(new URL(address).pathname) || "isorite-model-granite-1.0.0.tgz");
+			writeFileSync(tgz, buf);
 			fromPackage(tgz);
 		} catch (e) {
-			tried.push(`GitHub (${release}): ${why(e, release)}`);
-			say(`From GitHub: ${why(e, release)}`);
+			tried.push(`${where} (${address}): ${why(e, address)}`);
+			say(`From ${where}: ${why(e, address)}`);
 		} finally {
 			rmSync(tmp, {
 				recursive: true,
 				force: true
 			});
 		}
+	};
+	if (url) {
+		await fromWeb("--url", url);
+		if (missing().length) throw new ModelFetchError(tried);
+		say(`The model is in ${out}`);
+		return;
 	}
+	if (missing().length && mirror) await fromWeb("the mirror (ISORITE_MODEL_BASE_URL)", mirror);
+	if (missing().length && pkg) try {
+		fromPackage(pkg);
+	} catch (e) {
+		tried.push(`npm (${pkg}): ${e.message}`);
+		say(`From npm (${pkg}): ${e.message}`);
+	}
+	if (missing().length && release) await fromWeb("GitHub", release);
 	if (missing().length && hub) {
 		say("From Hugging Face");
 		try {
@@ -7115,6 +7211,19 @@ async function fetchModel(out, say = console.log, { from, pkg = PACKAGE, release
 *  checked by using it: it must load, and give DIM numbers for a sentence. Kept in the user's models, and used from
 *  then on. */
 async function installFrom(from, say = console.log, env = process.env) {
+	if (/\.(tgz|tar\.gz)$/.test(from) && existsSync(from) && statSync(from).isFile()) {
+		const got = sha(readFileSync(from));
+		if (got !== "8d8ab528ae289dfc81fd2bfa80c867ca0c8342a2d98f7c86141df4b15fdf028c") throw new Error(`${from} is not ${RELEASE_FILE}: its SHA-256 is ${got}, not ${RELEASE_SHA256}`);
+		const dir = unpack(resolve(from));
+		try {
+			return await installFrom(join(dir, "package"), say, env);
+		} finally {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
 	if (!hasModel(from)) throw new Error(`${from} has no model: it needs model.onnx and tokenizer.json`);
 	const granite = !existsSync(join(from, "isorite-model.json")) && FILES.every(([, to, want]) => existsSync(join(from, to)) && sha(readFileSync(join(from, to))) === want);
 	let out = userModelDir(env);
@@ -7142,7 +7251,7 @@ async function installFrom(from, say = console.log, env = process.env) {
 }
 /** `isorite model [--from <folder>]`: says which model is installed and where, or installs one, and on failure
 *  where it looked, what it tried, and what to do. */
-async function modelCommand(from, say = console.log, env = process.env, sources = {}) {
+async function modelCommand(from, say = console.log, env = process.env, sources = {}, url) {
 	const told = (i, why) => say(`search by meaning: ${i.name} at ${i.dir} (sha256 ${i.sha.slice(0, 12)}, ${i.pooling} pooling), found by ${why}`);
 	if (env.ISORITE_EMBED === "off") say("ISORITE_EMBED=off: search by meaning is switched off, whatever is installed");
 	if (from) try {
@@ -7159,27 +7268,35 @@ async function modelCommand(from, say = console.log, env = process.env, sources
 		return 0;
 	}
 	say(`No model in ${places.map((p) => p.dir).join(", ")}`);
+	if (!url) say(`If it can't be fetched from here: ${RELEASE} (SHA-256 ${RELEASE_SHA256}), then isorite model --from <that file>`);
 	try {
-		await fetchModel(userModelDir(env), say, sources);
+		await fetchModel(userModelDir(env), say, {
+			mirror: mirrorOf(env),
+			...sources,
+			...url ? { url } : {}
+		});
 		return 0;
 	} catch (e) {
 		say(e.message);
 		say([
-			"What to do:",
-			`  - copy the model's files from a machine that has them (${userModelDir()} there), then: isorite model --from <folder>`,
-			`  - or the package's .tgz, from ${RELEASE}: unpack it, then isorite model --from <its package folder>`,
-			`  - or any compatible model (ONNX, 384 numbers out, with its tokenizer.json): isorite model --from <folder>, or ISORITE_EMBED_DIR=<folder>`,
+			...byHand(env),
+			"Or:",
+			`  - a mirror: ISORITE_MODEL_BASE_URL=<the folder ${RELEASE_FILE} is in> isorite model, or isorite model --url <its address>`,
+			`  - the model's files from a machine that has them (${userModelDir()} there): isorite model --from <folder>`,
+			`  - any compatible model (ONNX, 384 numbers out, with its tokenizer.json): isorite model --from <folder>, or ISORITE_EMBED_DIR=<folder>`,
 			"Search by words works without it."
 		].join("\n"));
 		return 1;
 	}
 }
-var NAME$2, MODEL, RELEASE, PACKAGE, HUB, FILES, sha, userModelsDir, userModelDir, hasModel, ModelFetchError, modelFiles;
+var NAME$2, MODEL, RELEASE_FILE, RELEASE, RELEASE_SHA256, PACKAGE, HUB, FILES, sha, userModelsDir, userModelDir, hasModel, ModelFetchError, modelFiles;
 var init_model = __esmMin((() => {
 	init_src();
 	NAME$2 = "granite-embedding-small-english-r2";
 	MODEL = `${NAME$2}-q8`;
-	RELEASE = "https://github.com/lachlanjs/isorite/releases/download/model-granite-1.0.0/isorite-model-granite-1.0.0.tgz";
+	RELEASE_FILE = "isorite-model-granite-1.0.0.tgz";
+	RELEASE = `https://github.com/lachlanjs/isorite/releases/download/model-granite-1.0.0/${RELEASE_FILE}`;
+	RELEASE_SHA256 = "8d8ab528ae289dfc81fd2bfa80c867ca0c8342a2d98f7c86141df4b15fdf028c";
 	PACKAGE = "isorite-model-granite@1.0.0";
 	HUB = `https://huggingface.co/onnx-community/granite-embedding-small-english-r2-ONNX/resolve/1dc7835ba0cb9c76a3618d0bf0c427c97671b3c8`;
 	FILES = [
@@ -7982,6 +8099,7 @@ const SetupDraft = z.object({
 	url: z.string().max(2e3),
 	keyHeld: z.boolean(),
 	keyHeader: z.string().max(200),
+	keyPrefix: z.string().max(50).default(""),
 	headers: z.array(Pair).max(40),
 	query: z.array(Pair).max(40),
 	pfx: Path,
@@ -8481,6 +8599,7 @@ const FORM = [
 	"auth",
 	"key",
 	"key_header",
+	"key_prefix",
 	"headers",
 	"query",
 	"pfx",
@@ -8512,6 +8631,7 @@ function readSetup(config) {
 		url: gateway ? p.url : OPENROUTER.url,
 		keyHeld: text(p.key) !== "",
 		keyHeader: text(p.key_header),
+		keyPrefix: text(p.key_prefix).trim(),
 		headers: pairs(p.headers),
 		query: pairs(p.query),
 		pfx: text(p.pfx),
@@ -8553,6 +8673,9 @@ function applySetup(config, draft) {
 	}
 	if (gateway) {
 		if (draft.keyHeader.trim()) p.key_header = draft.keyHeader.trim();
+		const prefix = (draft.keyPrefix ?? "").trim();
+		if (prefix) p.key_prefix = prefix + " ";
+		else if (old.key_prefix === "" && draft.keyHeader.trim()) p.key_prefix = "";
 		const pairs = (field, given) => {
 			const before = table(old[field]), out = {};
 			for (const pair of given) {
@@ -8713,7 +8836,7 @@ var Setup = class {
 };
 //#endregion
 //#region packages/server/src/version.ts
-const VERSION = "0.8.1";
+const VERSION = "0.9.1";
 //#endregion
 //#region packages/server/src/git.ts
 /** The top of the repository `folder` is in, or null: the nearest folder holding `.git`, a directory or, in a
@@ -8946,6 +9069,27 @@ async function serve$1(path, { host = "127.0.0.1", port = 4767, allowHosts = [],
 	process.on("SIGTERM", stop);
 }
 //#endregion
+//#region packages/server/src/self.ts
+/** Whether this is the single executable. */
+const single = () => {
+	try {
+		return isSea();
+	} catch {
+		return false;
+	}
+};
+/** What runs isorite again with `args`, given the script (npm's or a checkout's) to run when not single. */
+function self(script, args, execArgv = process.execArgv) {
+	return {
+		command: process.execPath,
+		args: single() ? args : [
+			...execArgv,
+			script,
+			...args
+		]
+	};
+}
+//#endregion
 //#region packages/server/src/term.ts
 init_src$1();
 const MAIN = import.meta.url.endsWith(".ts") ? fileURLToPath(new URL("./main.ts", import.meta.url)) : fileURLToPath(import.meta.url);
@@ -8992,14 +9136,14 @@ async function ensureServer(path, { port = 4767, env = process.env, wait = 12e4,
 		if (!opened) throw new StudyError(`nothing is serving on port ${port}: name a base`);
 		const log = join(tmpdir(), `isorite-term-${port}.log`);
 		const out = openSync(log, "w");
-		started = spawn(process.execPath, [
-			MAIN,
+		const again = self(MAIN, [
 			"serve",
 			path,
 			"--port",
 			String(port),
 			"--held"
-		], {
+		], []);
+		started = spawn(again.command, again.args, {
 			stdio: [
 				"ignore",
 				out,
@@ -9068,6 +9212,25 @@ async function freePort() {
 		});
 	});
 }
+/** Whether `address` asks a browser that opens it for a password (M21): a 401 with Basic, as OpenCode 2 answers
+*  for /api (its page itself is served to anyone). Asked as a browser navigates, by node:http: OpenCode leaves the
+*  challenge out for its own page's fetches (Sec-Fetch-Mode: cors), which is all Node's fetch can send. */
+function asksPassword(address) {
+	return new Promise((done) => {
+		const req = get(address, {
+			headers: {
+				Accept: "text/html",
+				"Sec-Fetch-Mode": "navigate",
+				"Sec-Fetch-Dest": "document"
+			},
+			timeout: 3e3
+		}, (res) => {
+			res.resume();
+			done(res.statusCode === 401 && /^\s*basic\b/i.test(String(res.headers["www-authenticate"] ?? "")));
+		});
+		req.on("timeout", () => req.destroy()).on("error", () => done(false));
+	});
+}
 /** A POST to the isorite server, made as its page makes one: from its origin, with the token it hands out. */
 async function tell(url, path, body) {
 	const token = await tokenOf(url);
@@ -9187,8 +9350,57 @@ function where(port, models, env, tty, page = "/") {
 async function tokenOf(url) {
 	return (await (await fetch(`${url}/api/session`)).json()).token;
 }
+/** `isorite opencode` (M21): OpenCode 2, at the version isorite is tested with, in isorite's own npm prefix, the
+*  global one left as it is. npm's registry, proxy and mirror settings apply. Run again, it installs it again. */
+function installOpenCode(env = process.env, say = console.log, npm = "npm") {
+	const prefix = ownPrefix(env);
+	say(`isorite opencode: installing ${PACKAGE$1} in ${prefix}, for isorite alone; nothing global is changed`);
+	const win = process.platform === "win32";
+	const done = spawnSync(npm, [
+		"install",
+		"--prefix",
+		win ? `"${prefix}"` : prefix,
+		"--no-fund",
+		"--no-audit",
+		"--loglevel=error",
+		PACKAGE$1
+	], {
+		stdio: "inherit",
+		env,
+		shell: win
+	});
+	if (done.status !== 0) {
+		say(`npm could not install it${done.error ? `: ${done.error.message}` : ""}. If npm's registry or mirror is the trouble, fetch an OpenCode 2 another way and name it: ISORITE_OPENCODE=/path/to/opencode isorite term`);
+		return 1;
+	}
+	try {
+		const found = findOpenCode(env);
+		say(`OpenCode ${found.version} is ${found.command}: isorite term uses it from now on`);
+		return 0;
+	} catch (e) {
+		say(e.message);
+		return 1;
+	}
+}
+/** OpenCode 2, or, when there's none and a person is at the terminal, the offer to install it for isorite alone. */
+async function openCodeFor(env) {
+	try {
+		return findOpenCode(env);
+	} catch (e) {
+		if (!(e instanceof NoOpenCode) || env.ISORITE_OPENCODE || !process.stdin.isTTY || !process.stdout.isTTY) throw e;
+		console.error(e.message);
+		const ask = createInterface({
+			input: process.stdin,
+			output: process.stdout
+		});
+		const yes = /^y(es)?$/i.test((await ask.question(`Install OpenCode 2 for isorite only, in ${ownPrefix(env)}? [y/N] `)).trim());
+		ask.close();
+		if (!yes || installOpenCode(env) !== 0) throw new StudyError("isorite term needs OpenCode 2");
+		return findOpenCode(env);
+	}
+}
 async function term(path, { port = 4767, cwd = process.cwd(), env: given = process.env, wait = 12e4, onServer } = {}) {
-	const opencode = findOpenCode(given);
+	const opencode = await openCodeFor(given);
 	const server = await ensureServer(path, {
 		port,
 		env: given,
@@ -9207,7 +9419,6 @@ async function term(path, { port = 4767, cwd = process.cwd(), env: given = proce
 	}
 	const { gateway, env } = models;
 	const said = where(port, models, given, void 0, new URL(server.url).pathname.replace(/\/?$/, "/"));
-	for (const line of said) console.log(line);
 	const agents = path === void 0 ? null : join(locate(path).notes, AGENTS_FILE);
 	const home = writeHome(defaultHome(env), {
 		gateway,
@@ -9229,6 +9440,8 @@ async function term(path, { port = 4767, cwd = process.cwd(), env: given = proce
 		server.release();
 		throw e;
 	}
+	if (await asksPassword(`${backend.url}/api/session`)) said.push(`  OpenCode's own web page (port ${new URL(backend.url).port}) asks for a password: don't open it. isorite's page is above, and /web in the terminal opens it`);
+	for (const line of said) console.log(line);
 	await tell(server.url, "/api/terminal/attach", {
 		url: backend.url,
 		password: backend.password,
@@ -9295,6 +9508,7 @@ const READ = [
 	"SSH_CONNECTION",
 	"ISORITE_EMBED",
 	"ISORITE_EMBED_DIR",
+	"ISORITE_MODEL_BASE_URL",
 	"XDG_DATA_HOME",
 	"XDG_CACHE_HOME"
 ];
@@ -9341,7 +9555,10 @@ async function checkProvider(p, h, key, say) {
 			const missing = models.filter((m) => !listed.includes(m));
 			say("reached", "ok", `${to.url.replace(/\?.*$/, "")} answered with ${listed.length} models`);
 			if (listed.length && missing.length) say("models", "fail", `${missing.join(", ")} not among them; it has ${listed.slice(0, 12).join(", ")}${listed.length > 12 ? ", …" : ""}. Name its models under [tiers]`);
-		} else say("reached", res.status === 401 || res.status === 403 ? "fail" : "ok", res.status === 401 || res.status === 403 ? `it said ${res.status} to the list of models: the key${p.keyHeader ? "" : ", or the header it goes in (key_header)"}, or a header it wants (headers), is not accepted` : `it answered (${res.status} for the list of models, which some gateways don't have)`);
+		} else if (res.status === 401 || res.status === 403) {
+			const said = refusal(await res.text().catch(() => ""), key);
+			say("reached", "fail", `it said ${res.status} to the list of models${said ? `: “${said}”` : ""}. The key${key ? `, sent as ${keySentAs(p, key)},` : ""} or a header it wants (headers), is not accepted: check key_header and key_prefix`);
+		} else say("reached", "ok", `it answered (${res.status} for the list of models, which some gateways don't have)`);
 	} catch (e) {
 		reached = false;
 		say("reached", "fail", unreachable(e, p.url));
@@ -9401,7 +9618,7 @@ async function doctor(folder, o = {}) {
 		const tls = gatewayTls(path, env);
 		http ??= gatewayHttp(provider, tls, env);
 		if (existsSync(path)) say("config", "ok", `${path}: ${provider.name} at ${provider.url}`);
-		say("key", key ? "ok" : tls ? "warn" : "fail", key ? `${hidden(key)}, sent ${provider.keyHeader ? `in ${provider.keyHeader}` : "as Authorization: Bearer"}` : tls ? "none; the client certificate alone is sent" : "none: set one in Iso's settings, or as key under [provider]");
+		say("key", key ? "ok" : tls ? "warn" : "fail", key ? `sent as ${keySentAs(provider, key)}${provider.keyHeader?.toLowerCase() === "authorization" && provider.keyPrefix === void 0 ? ` (key_header = "${provider.keyHeader}" alone means Bearer since 0.9.0; key_prefix = "" sends it bare)` : ""}` : tls ? "none; the client certificate alone is sent" : "none: set one in Iso's settings, or as key under [provider]");
 		if (tls) say("certificate", "ok", `${tls.files.join(", ")}${tls.pfx || tls.cert ? "" : " (an authority only, no client certificate)"}`);
 		const tiers = `low ${provider.tiers.low}, mid ${provider.tiers.mid}, max ${provider.tiers.max}`;
 		say("models", provider.defaultTiers ? "warn" : "ok", provider.defaultTiers ? `${tiers}: OpenRouter's names, kept because [tiers] names none for ${provider.name}; a gateway usually calls its models otherwise` : tiers);
@@ -9427,11 +9644,21 @@ async function doctor(folder, o = {}) {
 		if (!o.report) out(`  asking ${p.name}: its models, then ${models.length + 1} replies of a few words (a few hundred tokens in all)`);
 		await checkProvider(p, h, key, say);
 	}
+	const began = Date.now(), git = spawnSync(o.git ?? "git", ["--version"], {
+		encoding: "utf8",
+		env,
+		timeout: 3e3,
+		killSignal: "SIGKILL"
+	});
+	const took = Date.now() - began;
+	if (git.error && git.error.code === "ENOENT") say("git", "skip", "not found: isorite doesn't need it; OpenCode works without it, as a folder that isn't a repository");
+	else if (git.status !== 0 || took >= 3e3) say("git", "warn", `git --version ${took >= 3e3 ? "didn't answer in 3 s" : `failed after ${took} ms`}: likely a wrapper (a company's) that waits on the network. isorite no longer waits on git to start; OpenCode may, and isorite term then says it's waiting for OpenCode's server`);
+	else say("git", took > 1e3 ? "warn" : "ok", `${git.stdout.trim()}, in ${took} ms${took > 1e3 ? ": slow, likely a wrapper; OpenCode may wait on it as it starts" : ""}`);
 	try {
 		const found = findOpenCode(env, o.probe);
-		say("opencode", "ok", `${found.command} ${found.version}`);
+		say("opencode", "ok", `${found.command} ${found.version}${found.from === "the PATH" ? "" : ` (${found.from})`}`);
 	} catch (e) {
-		say("opencode", "warn", e.message.replace(/\n\s*/g, " "));
+		say("opencode", e instanceof NoOpenCode && e.old ? "fail" : "warn", e.message.replace(/\n\s*/g, " "));
 	}
 	const port = o.port ?? 4767, url = `http://127.0.0.1:${port}`, served = await serving(url);
 	say("port", "ok", served === null ? `${port} is free: isorite term starts a server there` : `${port} is isorite's, serving ${served}`);
@@ -9449,6 +9676,12 @@ async function doctor(folder, o = {}) {
 		known = false;
 	}
 	say("terminal", known ? "ok" : "warn", terminal);
+	const hint = "isorite term also runs OpenCode's own web server, on a port of its own, which asks for a password: open isorite's pages and panes (/web in the terminal), not OpenCode's";
+	if (served === null) say("browser pages", "ok", hint);
+	else {
+		const asking = (await Promise.all([`${url}/`, `${url}/api/session`].map(async (at) => await asksPassword(at) ? at : null))).filter(Boolean);
+		say("browser pages", asking.length ? "fail" : "ok", asking.length ? `${asking.join(" and ")} asked for a password (401, Basic): that is not isorite's server; stop it, or give isorite another port (--port <n>)` : `isorite's pages at ${url}/ ask for no password. ${hint}`);
+	}
 	if (env.SSH_CONNECTION) say("browser", "ok", `over SSH: on your own machine, ssh -L ${port}:localhost:${port} <this host>, then http://localhost:${port}/`);
 	let model = null;
 	if (env.ISORITE_EMBED === "off") say("search by meaning", "skip", "switched off (ISORITE_EMBED=off)");
@@ -9460,7 +9693,23 @@ async function doctor(folder, o = {}) {
 			say("search by meaning", "fail", `${dir}: ${e.message}`);
 		}
 		if (model) say("search by meaning", "ok", `${model.name} at ${model.dir}`);
-		else if (!dir) say("search by meaning", "warn", `no model in ${modelPlaces(env).map((p) => p.dir).join(" or ")}: isorite model fetches it (53 MB). Search by words works without it`);
+		else if (!dir) {
+			let reach = "";
+			if (!o.offline) {
+				const from = mirrorOf(env) ?? RELEASE;
+				try {
+					const res = await fetch(from, {
+						method: "HEAD",
+						redirect: "follow",
+						signal: AbortSignal.timeout(1e4)
+					});
+					reach = res.ok ? ` ${from} answers from here.` : ` ${from} said ${res.status}.`;
+				} catch (e) {
+					reach = ` ${from} can't be reached from here: ${unreachable(e, from)}.`;
+				}
+			}
+			say("search by meaning", "warn", `no model in ${modelPlaces(env).map((p) => p.dir).join(" or ")}: isorite model fetches it (53 MB).${reach} By hand: ${mirrorOf(env) ?? RELEASE} (SHA-256 ${RELEASE_SHA256}), then isorite model --from <that file>. Search by words works without it`);
+		}
 	}
 	if (folder) try {
 		const { notes } = locate(folder);
@@ -9538,7 +9787,8 @@ function proxied(env, execArgv = process.execArgv) {
 }
 /** Run this command again with `env`, its input and output its own; its exit code. */
 function rerun(env, argv = process.argv, execArgv = process.execArgv) {
-	const child = spawn(process.execPath, [...execArgv, ...argv.slice(1)], {
+	const again = self(argv[1], argv.slice(2), execArgv);
+	const child = spawn(again.command, again.args, {
 		stdio: "inherit",
 		env
 	});
@@ -9746,7 +9996,7 @@ async function mcp(path, { port = 4767, agent = "mcp", quiet = QUIET_MS, input =
 		}
 		throw Object.assign(/* @__PURE__ */ new Error(`no method ${rpc.method}`), { code: -32601 });
 	};
-	const lines = createInterface({
+	const lines = createInterface$1({
 		input,
 		crlfDelay: Infinity
 	});
@@ -11051,9 +11301,13 @@ const USAGE = `isorite: an agentic harness for understanding
   isorite mcp [<notes>] [--port <n>] [--agent <name>]
                                          the knowledge base's tools over MCP, on stdio, for Claude Code or Pi:
                                          claude mcp add isorite -- isorite mcp <base> --agent claude-code
-  isorite model [--from <folder>]        the model for search by meaning: which is installed, and where; else
-                                         fetched (53 MB, once) from npm, GitHub or Hugging Face; or from a
+  isorite model [--from <folder|.tgz>] [--url <url>]
+                                         the model for search by meaning: which is installed, and where; else
+                                         fetched (53 MB, once) from ISORITE_MODEL_BASE_URL, npm, GitHub or
+                                         Hugging Face, or --url alone; or from the .tgz fetched by hand, or a
                                          folder: its files copied there, or any compatible model
+  isorite opencode                       OpenCode 2 for isorite term, installed in isorite's own folder
+                                         (~/.config/isorite/opencode-cli), the global one left as it is
   isorite doctor [<notes>] [--report] [--offline]
                                          whether isorite can work here: the configuration, the network, the
                                          provider (asked a few words, a few hundred tokens), the terminal and
@@ -11151,13 +11405,18 @@ function main(argv) {
 			});
 		}
 		if (command === "model") {
-			const from = rest[rest.indexOf("--from") + 1];
+			const from = rest[rest.indexOf("--from") + 1], url = rest[rest.indexOf("--url") + 1];
 			if (rest.includes("--from") && !from) {
-				console.error("--from takes a folder");
+				console.error("--from takes a folder, or the model's .tgz");
+				return 2;
+			}
+			if (rest.includes("--url") && !/^https?:\/\//.test(url ?? "")) {
+				console.error("--url takes the address of the model's .tgz");
 				return 2;
 			}
-			return modelCommand(rest.includes("--from") ? from : void 0);
+			return modelCommand(rest.includes("--from") ? from : void 0, console.log, process.env, {}, rest.includes("--url") ? url : void 0);
 		}
+		if (command === "opencode") return installOpenCode();
 		if (command === "memory") return memory(rest.find((a) => !a.startsWith("--")));
 		if (command === "bases") return bases(rest);
 		if (command === "--version" || command === "-v") {
@@ -11232,16 +11491,19 @@ function starting(argv, env = process.env, write = (s) => process.stderr.write(s
 	write("isorite: starting…\n");
 	return true;
 }
-if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(resolve(process.argv[1]))).href) {
-	starting(process.argv.slice(2));
+/** The command as run: said to be starting, the proxy turned on (running itself again), the system's authorities
+*  trusted; its exit code. The single executable calls this (M21). */
+async function run(argv) {
+	starting(argv);
 	delete process.env.ISORITE_STARTING;
 	const env = proxied(process.env);
-	if (env) process.exit(await rerun({
+	if (env) return rerun({
 		...env,
 		ISORITE_STARTING: "1"
-	}));
+	});
 	trustSystem();
-	process.exit(await main(process.argv.slice(2)));
+	return main(argv);
 }
+if (!single() && process.argv[1] && import.meta.url === pathToFileURL(realpathSync(resolve(process.argv[1]))).href) process.exit(await run(process.argv.slice(2)));
 //#endregion
-export { check, main, starting };
+export { check, main, run, starting };