omni-ai-cli 1.0.0 → 1.1.0

package/README.md

@@ -1,6 +1,12 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/assets/omni-ai-cli-logo.png" alt="Omni AI CLI" width="440">
+</p>
+
 # Omni AI CLI
 
-![npm](https://img.shields.io/badge/npm-em%20breve-1A1714)
+[![npm](https://img.shields.io/npm/v/omni-ai-cli?color=C4552F)](https://www.npmjs.com/package/omni-ai-cli)
+[![downloads](https://img.shields.io/npm/dm/omni-ai-cli?color=1A1714)](https://www.npmjs.com/package/omni-ai-cli)
+[![provenance](https://img.shields.io/badge/npm-OIDC%20trusted%20publishing-C4552F)](https://docs.npmjs.com/trusted-publishers)
 [![License: MIT](https://img.shields.io/badge/license-MIT-C4552F.svg)](LICENSE)
 ![Plataformas](https://img.shields.io/badge/macOS%20·%20Linux%20·%20Windows-1A1714)
 ![Idiomas](https://img.shields.io/badge/pt--BR%20·%20en%20·%20es%20·%20fr-C4552F)
@@ -49,55 +55,7 @@ Da linha digitada até a resposta salva. O chat (`chat.py`) não chama nenhuma I
 direto: ele dispara o roteador (`cli.py`) como subprocesso e lê os eventos que ele
 emite, linha a linha, para mostrar quem está atendendo e o que está fazendo.
 
-```mermaid
-flowchart TD
-    A["Você digita e tecla Enter<br/>(a caixa nunca trava)"] --> B{"Começa com / ?"}
-    B -- sim --> C["Comando interno<br/>/model · /account · /key · /lang · /versions"]
-    C --> C1["config.py grava em<br/>models.json, profiles.json ou keys/"]
-    B -- não --> FQ["Entra na fila<br/>com a ferramenta do momento do envio"]
-
-    subgraph CHAT ["chat.py — chat"]
-        FQ --> FW{"Esperou na fila e a resposta<br/>anterior já resolve o pedido?"}
-        FW -- "sim (classificador grátis)" --> FS["Pulado, avisa na tela"]
-        FW -- não --> D["Monta o contexto: últimas mensagens<br/>da sessão até 48 mil caracteres + idioma"]
-        D --> E["Worker em thread dispara o roteador<br/>em grupo de processos próprio"]
-        E -. "eventos JSON linha a linha" .-> F["Mostra provedor, comandos e resposta"]
-        X["Ctrl-C"] -. "esvazia a fila; SIGTERM no grupo,<br/>após 5 s, SIGKILL" .-> E
-    end
-
-    subgraph ROUTER ["cli.py — roteador"]
-        E --> G["Carrega modelos:<br/>env > models.json > padrão"]
-        G --> H{"Ferramenta fixada<br/>com /tool?"}
-        H -- sim --> H1["Só a ferramenta escolhida"]
-        H -- auto --> I{"Classifica: Groq → Cerebras →<br/>OpenRouter grátis → Grok;<br/>sem resposta, palavras-chave"}
-        I -- simples --> J["OpenRouter: gratuitos, ou pagos<br/>se autorizados · dados pessoais mascarados"]
-        J -- "sem chave ou falhou" --> K["Codex: assinatura,<br/>depois chave de API"]
-        K -- falhou --> L["Antigravity: assinatura,<br/>depois chave de API"]
-        L -- falhou --> LP["Pagos só se listados em fallback_order:<br/>Cursor, Grok, DeepSeek"]
-        LP -- falhou --> M
-        I -- complexa --> M["Claude: próxima conta ativa<br/>por prioridade"]
-        M --> N{"Rate limit?"}
-        N -- sim --> O["Conta em cooldown de 60 min"]
-        O --> P{"Outra conta<br/>disponível?"}
-        P -- sim --> M
-        P -- não --> PK{"Chave de API<br/>da Anthropic?"}
-        PK -- sim --> PK1["Claude com ANTHROPIC_API_KEY"]
-        PK1 -- ok --> R
-        PK1 -- falhou --> Q
-        PK -- não --> Q["Último recurso:<br/>Codex, depois Antigravity"]
-    end
-
-    N -- não --> R["Resposta"]
-    J -- ok --> R
-    K -- ok --> R
-    L -- ok --> R
-    LP -- ok --> R
-    Q --> R
-    H1 --> R
-    R --> F
-    F --> S[("Sessão salva em disco<br/>com escrita atômica")]
-    S --> FQ
-```
+![Fluxo do pedido até a resposta](https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/diagrams/flow1.pt.png)
 
 Três detalhes que o diagrama torna explícitos:
 
@@ -142,7 +100,7 @@ curl -fsSL https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/get.sh |
 irm https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/get.ps1 | iex
 ```
 
-**Em breve no npm, yarn, pnpm e bun.** O pacote `omni-ai-cli` está pronto e sai assim que a publicação for liberada:
+**No npm, yarn, pnpm ou bun:**
 
 ```bash
 npm install -g omni-ai-cli
@@ -151,7 +109,7 @@ pnpm add -g omni-ai-cli
 bun add -g omni-ai-cli
 ```
 
-Por enquanto, use o comando de macOS/Linux ou Windows acima.
+Qualquer um dos comandos acima (script ou gerenciador de pacotes) instala o mesmo `ai`.
 
 Para atualizar depois: `ai --update` (ou `/update` no chat).
 
@@ -429,6 +387,7 @@ ai --deepseek "explicar CAP theorem"   # força DeepSeek
 ai --install                           # instala as ferramentas que faltam (pergunta antes)
 ai --classify "prompt"                 # mostra como seria classificado
 ai --log                               # últimas chamadas
+ai doctor                              # diagnóstico de instalação, contas e chaves
 ```
 
 ---
@@ -490,7 +449,7 @@ python3 -m unittest discover -s tests -v
 bash -n scripts/install.sh
 ```
 
-**38 testes**: persistência e retomada de sessão, limite de contexto, permissão dos
+**106 testes**: persistência e retomada de sessão, limite de contexto, permissão dos
 arquivos, sessão aberta em dois terminais, leitura de eventos, cancelamento da árvore de
 processos, paralelismo real, sandbox somente leitura, mascaramento de dados pessoais,
 fallback OpenRouter → Codex, validação de modelos, armazenamento das chaves e o ciclo de vida das contas. Todos os
@@ -541,31 +500,20 @@ O `/versions` mostra o título de cada `feat`/`fix` como a "visão simples" e o
 - Um commit por mudança perceptível. Refatoração e testes vão em `refactor:`/`test:`,
   que não aparecem em `/versions`.
 
-```mermaid
-flowchart TD
-    A[PR aberto] --> B[CI: testes Python 3.11-3.13 em Linux e macOS<br/>+ npm pack + launcher]
-    A --> C[PR title: Conventional Commits?]
-    B -->|falhou| X[Merge bloqueado]
-    C -->|fora do padrão| X
-    B -->|ok| D[Squash merge em main / next / beta]
-    C -->|ok| D
-    D --> E[Release: CI roda de novo]
-    E -->|falhou| Y[Nada é publicado]
-    E -->|ok| F{semantic-release:<br/>há feat/fix/breaking<br/>desde a última tag?}
-    F -->|não| Z[Sem release]
-    F -->|sim| G[Calcula versão e cria tag vX.Y.Z]
-    G --> H[npm publish com provenance<br/>no dist-tag da branch]
-    G --> I[GitHub Release com notas]
-```
+![Fluxo de release e publicação](https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/diagrams/flow2.pt.png)
+
+A publicação usa **OIDC / trusted publishing**: o GitHub Actions se autentica no npm sem
+token, e o pacote sai com *provenance*. Configuração única:
 
-Configuração única no GitHub:
+1. **npm → página do pacote → Settings → Trusted Publisher**: adicionar *GitHub Actions*
+   com `samuelrms/omni-ai-cli` e o workflow `release.yml`.
+2. **GitHub → Settings → Branches**: proteger `main` (e `next`/`beta`, se usar) exigindo PR
+   e os checks `Tests (...)`, `npm package` e `conventional`.
+3. **GitHub → Settings → General → Pull Requests**: deixar só *Allow squash merging* e
+   marcar *Default to pull request title*.
 
-1. **Settings → Secrets and variables → Actions**: criar `NPM_TOKEN` (token *Automation*
-   ou *Granular* com permissão de publish no npmjs.com).
-2. **Settings → Branches**: proteger `main` (e `next`/`beta`, se usar) exigindo PR e os
-   checks `Tests (...)`, `npm package` e `conventional`.
-3. **Settings → General → Pull Requests**: deixar só *Allow squash merging* e marcar
-   *Default to pull request title*.
+O workflow já pede `id-token: write` e `NPM_CONFIG_PROVENANCE`; não há `NPM_TOKEN` para
+guardar nem rotacionar.
 
 ---
 

package/docs/README.en.md

@@ -1,6 +1,12 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/assets/omni-ai-cli-logo.png" alt="Omni AI CLI" width="440">
+</p>
+
 # Omni AI CLI
 
-![npm](https://img.shields.io/badge/npm-coming%20soon-1A1714)
+[![npm](https://img.shields.io/npm/v/omni-ai-cli?color=C4552F)](https://www.npmjs.com/package/omni-ai-cli)
+[![downloads](https://img.shields.io/npm/dm/omni-ai-cli?color=1A1714)](https://www.npmjs.com/package/omni-ai-cli)
+[![provenance](https://img.shields.io/badge/npm-OIDC%20trusted%20publishing-C4552F)](https://docs.npmjs.com/trusted-publishers)
 [![License: MIT](https://img.shields.io/badge/license-MIT-C4552F.svg)](../LICENSE)
 ![Platforms](https://img.shields.io/badge/macOS%20·%20Linux%20·%20Windows-1A1714)
 ![Languages](https://img.shields.io/badge/pt--BR%20·%20en%20·%20es%20·%20fr-C4552F)
@@ -49,55 +55,7 @@ From the typed line to the saved answer. The chat (`chat.py`) does not call any
 directly: it launches the router (`cli.py`) as a subprocess and reads the events it
 emits, line by line, to show who is answering and what they are doing.
 
-```mermaid
-flowchart TD
-    A["You type and press Enter<br/>(the box never locks)"] --> B{"Starts with / ?"}
-    B -- yes --> C["Internal command<br/>/model · /account · /key · /lang · /versions"]
-    C --> C1["config.py writes to<br/>models.json, profiles.json or keys/"]
-    B -- no --> FQ["Goes into the queue<br/>with the tool selected at send time"]
-
-    subgraph CHAT ["chat.py — chat"]
-        FQ --> FW{"Waited in the queue and the previous<br/>answer already covers the request?"}
-        FW -- "yes (free classifier)" --> FS["Skipped, shown on screen"]
-        FW -- no --> D["Builds the context: latest messages<br/>of the session up to 48 thousand characters + language"]
-        D --> E["Thread worker launches the router<br/>in its own process group"]
-        E -. "JSON events line by line" .-> F["Shows provider, commands and answer"]
-        X["Ctrl-C"] -. "empties the queue; SIGTERM to the group,<br/>after 5 s, SIGKILL" .-> E
-    end
-
-    subgraph ROUTER ["cli.py — router"]
-        E --> G["Loads models:<br/>env > models.json > default"]
-        G --> H{"Tool pinned<br/>with /tool?"}
-        H -- yes --> H1["Only the chosen tool"]
-        H -- auto --> I{"Classifies: Groq → Cerebras →<br/>free OpenRouter → Grok;<br/>no answer, keywords"}
-        I -- simple --> J["OpenRouter: free, or paid<br/>if authorized · personal data masked"]
-        J -- "no key or failed" --> K["Codex: subscription,<br/>then API key"]
-        K -- failed --> L["Antigravity: subscription,<br/>then API key"]
-        L -- failed --> LP["Paid ones only if listed in fallback_order:<br/>Cursor, Grok, DeepSeek"]
-        LP -- failed --> M
-        I -- complex --> M["Claude: next active account<br/>by priority"]
-        M --> N{"Rate limit?"}
-        N -- yes --> O["Account on 60 min cooldown"]
-        O --> P{"Another account<br/>available?"}
-        P -- yes --> M
-        P -- no --> PK{"Anthropic<br/>API key?"}
-        PK -- yes --> PK1["Claude with ANTHROPIC_API_KEY"]
-        PK1 -- ok --> R
-        PK1 -- failed --> Q
-        PK -- no --> Q["Last resort:<br/>Codex, then Antigravity"]
-    end
-
-    N -- no --> R["Answer"]
-    J -- ok --> R
-    K -- ok --> R
-    L -- ok --> R
-    LP -- ok --> R
-    Q --> R
-    H1 --> R
-    R --> F
-    F --> S[("Session saved to disk<br/>with atomic write")]
-    S --> FQ
-```
+![Request-to-answer flow](https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/diagrams/flow1.en.png)
 
 Three details the diagram makes explicit:
 
@@ -142,7 +100,7 @@ curl -fsSL https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/get.sh |
 irm https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/get.ps1 | iex
 ```
 
-**Coming soon to npm, yarn, pnpm and bun.** The `omni-ai-cli` package is ready and ships as soon as publishing is unlocked:
+**On npm, yarn, pnpm or bun:**
 
 ```bash
 npm install -g omni-ai-cli
@@ -151,7 +109,7 @@ pnpm add -g omni-ai-cli
 bun add -g omni-ai-cli
 ```
 
-For now, use the macOS/Linux or Windows command above.
+Any of the commands above (script or package manager) installs the same `ai`.
 
 To update later: `ai --update` (or `/update` in the chat).
 
@@ -428,6 +386,7 @@ ai --deepseek "explicar CAP theorem"   # forces DeepSeek
 ai --install                           # installs the missing tools (asks first)
 ai --classify "prompt"                 # shows how it would be classified
 ai --log                               # latest calls
+ai doctor                              # diagnose install, accounts and keys
 ```
 
 ---
@@ -489,7 +448,7 @@ python3 -m unittest discover -s tests -v
 bash -n scripts/install.sh
 ```
 
-**38 tests**: session persistence and resume, context limit, file permissions, session
+**106 tests**: session persistence and resume, context limit, file permissions, session
 open in two terminals, event reading, process tree cancellation, real parallelism,
 read-only sandbox, personal data masking, OpenRouter → Codex fallback, model
 validation, key storage and the account lifecycle. All the
@@ -540,31 +499,20 @@ titles that don't follow the convention.
 - One commit per noticeable change. Refactoring and tests go in `refactor:`/`test:`,
   which don't show up in `/versions`.
 
-```mermaid
-flowchart TD
-    A[PR opened] --> B[CI: Python 3.11-3.13 tests on Linux and macOS<br/>+ npm pack + launcher]
-    A --> C[PR title: Conventional Commits?]
-    B -->|failed| X[Merge blocked]
-    C -->|invalid| X
-    B -->|ok| D[Squash merge into main / next / beta]
-    C -->|ok| D
-    D --> E[Release: CI runs again]
-    E -->|failed| Y[Nothing is published]
-    E -->|ok| F{semantic-release:<br/>any feat/fix/breaking<br/>since last tag?}
-    F -->|no| Z[No release]
-    F -->|yes| G[Compute version and tag vX.Y.Z]
-    G --> H[npm publish with provenance<br/>on the branch dist-tag]
-    G --> I[GitHub Release with notes]
-```
+![Release and publish flow](https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/diagrams/flow2.en.png)
+
+Publishing uses **OIDC / trusted publishing**: GitHub Actions authenticates to npm with no
+token and the package ships with *provenance*. One-time setup:
 
-One-time GitHub setup:
+1. **npm → package page → Settings → Trusted Publisher**: add *GitHub Actions* with
+   `samuelrms/omni-ai-cli` and the `release.yml` workflow.
+2. **GitHub → Settings → Branches**: protect `main` (and `next`/`beta` if used), requiring a
+   PR and the `Tests (...)`, `npm package` and `conventional` checks.
+3. **GitHub → Settings → General → Pull Requests**: allow only *squash merging* and tick
+   *Default to pull request title*.
 
-1. **Settings → Secrets and variables → Actions**: add `NPM_TOKEN` (an *Automation* or
-   *Granular* npmjs.com token with publish permission).
-2. **Settings → Branches**: protect `main` (and `next`/`beta` if used), requiring a PR and
-   the `Tests (...)`, `npm package` and `conventional` checks.
-3. **Settings → General → Pull Requests**: allow only *squash merging* and tick *Default
-   to pull request title*.
+The workflow already requests `id-token: write` and `NPM_CONFIG_PROVENANCE`; there is no
+`NPM_TOKEN` to store or rotate.
 
 ---
 

package/docs/README.es.md

@@ -1,6 +1,12 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/assets/omni-ai-cli-logo.png" alt="Omni AI CLI" width="440">
+</p>
+
 # Omni AI CLI
 
-![npm](https://img.shields.io/badge/npm-pr%C3%B3ximamente-1A1714)
+[![npm](https://img.shields.io/npm/v/omni-ai-cli?color=C4552F)](https://www.npmjs.com/package/omni-ai-cli)
+[![downloads](https://img.shields.io/npm/dm/omni-ai-cli?color=1A1714)](https://www.npmjs.com/package/omni-ai-cli)
+[![provenance](https://img.shields.io/badge/npm-OIDC%20trusted%20publishing-C4552F)](https://docs.npmjs.com/trusted-publishers)
 [![License: MIT](https://img.shields.io/badge/license-MIT-C4552F.svg)](../LICENSE)
 ![Plataformas](https://img.shields.io/badge/macOS%20·%20Linux%20·%20Windows-1A1714)
 ![Idiomas](https://img.shields.io/badge/pt--BR%20·%20en%20·%20es%20·%20fr-C4552F)
@@ -50,55 +56,7 @@ ninguna IA directamente: lanza el enrutador (`cli.py`) como subproceso y lee los
 eventos que este emite, línea por línea, para mostrar quién está atendiendo y qué está
 haciendo.
 
-```mermaid
-flowchart TD
-    A["Escribes y presionas Enter<br/>(la caja nunca se bloquea)"] --> B{"¿Empieza con / ?"}
-    B -- sí --> C["Comando interno<br/>/model · /account · /key · /lang · /versions"]
-    C --> C1["config.py guarda en<br/>models.json, profiles.json o keys/"]
-    B -- no --> FQ["Entra en la cola<br/>con la herramienta del momento del envío"]
-
-    subgraph CHAT ["chat.py — chat"]
-        FQ --> FW{"¿Esperó en la cola y la respuesta<br/>anterior ya resuelve el pedido?"}
-        FW -- "sí (clasificador gratis)" --> FS["Omitido, avisa en pantalla"]
-        FW -- no --> D["Arma el contexto: últimos mensajes<br/>de la sesión hasta 48 mil caracteres + idioma"]
-        D --> E["Worker en hilo lanza el enrutador<br/>en un grupo de procesos propio"]
-        E -. "eventos JSON línea por línea" .-> F["Muestra proveedor, comandos y respuesta"]
-        X["Ctrl-C"] -. "vacía la cola; SIGTERM al grupo,<br/>tras 5 s, SIGKILL" .-> E
-    end
-
-    subgraph ROUTER ["cli.py — enrutador"]
-        E --> G["Carga modelos:<br/>env > models.json > predeterminado"]
-        G --> H{"¿Herramienta fijada<br/>con /tool?"}
-        H -- sí --> H1["Solo la herramienta elegida"]
-        H -- auto --> I{"Clasifica: Groq → Cerebras →<br/>OpenRouter gratis → Grok;<br/>sin respuesta, palabras clave"}
-        I -- simple --> J["OpenRouter: gratuitos, o pagos<br/>si se autorizan · datos personales enmascarados"]
-        J -- "sin clave o falló" --> K["Codex: suscripción,<br/>luego clave de API"]
-        K -- falló --> L["Antigravity: suscripción,<br/>luego clave de API"]
-        L -- falló --> LP["De pago solo si están en fallback_order:<br/>Cursor, Grok, DeepSeek"]
-        LP -- falló --> M
-        I -- compleja --> M["Claude: siguiente cuenta activa<br/>por prioridad"]
-        M --> N{"¿Rate limit?"}
-        N -- sí --> O["Cuenta en cooldown de 60 min"]
-        O --> P{"¿Otra cuenta<br/>disponible?"}
-        P -- sí --> M
-        P -- no --> PK{"¿Clave de API<br/>de Anthropic?"}
-        PK -- sí --> PK1["Claude con ANTHROPIC_API_KEY"]
-        PK1 -- ok --> R
-        PK1 -- falló --> Q
-        PK -- no --> Q["Último recurso:<br/>Codex, luego Antigravity"]
-    end
-
-    N -- no --> R["Respuesta"]
-    J -- ok --> R
-    K -- ok --> R
-    L -- ok --> R
-    LP -- ok --> R
-    Q --> R
-    H1 --> R
-    R --> F
-    F --> S[("Sesión guardada en disco<br/>con escritura atómica")]
-    S --> FQ
-```
+![Flujo del pedido a la respuesta](https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/diagrams/flow1.es.png)
 
 Tres detalles que el diagrama deja explícitos:
 
@@ -143,7 +101,7 @@ curl -fsSL https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/get.sh |
 irm https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/get.ps1 | iex
 ```
 
-**Pronto en npm, yarn, pnpm y bun.** El paquete `omni-ai-cli` está listo y sale en cuanto se libere la publicación:
+**En npm, yarn, pnpm o bun:**
 
 ```bash
 npm install -g omni-ai-cli
@@ -152,7 +110,7 @@ pnpm add -g omni-ai-cli
 bun add -g omni-ai-cli
 ```
 
-Por ahora, usa el comando de macOS/Linux o Windows de arriba.
+Cualquiera de los comandos de arriba (script o gestor de paquetes) instala el mismo `ai`.
 
 Para actualizar después: `ai --update` (o `/update` en el chat).
 
@@ -429,6 +387,7 @@ ai --deepseek "explicar CAP theorem"   # fuerza DeepSeek
 ai --install                           # instala las herramientas que faltan (pregunta antes)
 ai --classify "prompt"                 # muestra cómo se clasificaría
 ai --log                               # últimas llamadas
+ai doctor                              # diagnóstico de instalación, cuentas y claves
 ```
 
 ---
@@ -490,7 +449,7 @@ python3 -m unittest discover -s tests -v
 bash -n scripts/install.sh
 ```
 
-**38 pruebas**: persistencia y reanudación de sesión, límite de contexto, permisos de
+**106 pruebas**: persistencia y reanudación de sesión, límite de contexto, permisos de
 los archivos, sesión abierta en dos terminales, lectura de eventos, cancelación del árbol
 de procesos, paralelismo real, sandbox de solo lectura, enmascaramiento de datos
 personales, fallback OpenRouter → Codex, validación de modelos, almacenamiento de las
@@ -542,32 +501,21 @@ títulos fuera del estándar.
 - Un commit por cambio perceptible. Refactorizaciones y tests van en `refactor:`/`test:`,
   que no aparecen en `/versions`.
 
-```mermaid
-flowchart TD
-    A[PR abierto] --> B[CI: tests Python 3.11-3.13 en Linux y macOS<br/>+ npm pack + launcher]
-    A --> C[PR title: ¿Conventional Commits?]
-    B -->|falló| X[Merge bloqueado]
-    C -->|inválido| X
-    B -->|ok| D[Squash merge en main / next / beta]
-    C -->|ok| D
-    D --> E[Release: CI corre de nuevo]
-    E -->|falló| Y[No se publica nada]
-    E -->|ok| F{semantic-release:<br/>¿hay feat/fix/breaking<br/>desde la última tag?}
-    F -->|no| Z[Sin release]
-    F -->|sí| G[Calcula versión y crea tag vX.Y.Z]
-    G --> H[npm publish con provenance<br/>en el dist-tag de la rama]
-    G --> I[GitHub Release con notas]
-```
+![Flujo de release y publicación](https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/diagrams/flow2.es.png)
 
-Configuración única en GitHub:
+La publicación usa **OIDC / trusted publishing**: GitHub Actions se autentica en npm sin
+token y el paquete sale con *provenance*. Configuración única:
 
-1. **Settings → Secrets and variables → Actions**: crear `NPM_TOKEN` (token *Automation*
-   o *Granular* de npmjs.com con permiso de publish).
-2. **Settings → Branches**: proteger `main` (y `next`/`beta` si se usan) exigiendo PR y
-   los checks `Tests (...)`, `npm package` y `conventional`.
-3. **Settings → General → Pull Requests**: permitir solo *squash merging* y marcar
+1. **npm → página del paquete → Settings → Trusted Publisher**: añadir *GitHub Actions* con
+   `samuelrms/omni-ai-cli` y el workflow `release.yml`.
+2. **GitHub → Settings → Branches**: proteger `main` (y `next`/`beta` si se usan) exigiendo
+   PR y los checks `Tests (...)`, `npm package` y `conventional`.
+3. **GitHub → Settings → General → Pull Requests**: permitir solo *squash merging* y marcar
    *Default to pull request title*.
 
+El workflow ya pide `id-token: write` y `NPM_CONFIG_PROVENANCE`; no hay `NPM_TOKEN` que
+guardar ni rotar.
+
 ---
 
 ## Troubleshooting

package/docs/README.fr.md

@@ -1,6 +1,12 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/assets/omni-ai-cli-logo.png" alt="Omni AI CLI" width="440">
+</p>
+
 # Omni AI CLI
 
-![npm](https://img.shields.io/badge/npm-bient%C3%B4t-1A1714)
+[![npm](https://img.shields.io/npm/v/omni-ai-cli?color=C4552F)](https://www.npmjs.com/package/omni-ai-cli)
+[![downloads](https://img.shields.io/npm/dm/omni-ai-cli?color=1A1714)](https://www.npmjs.com/package/omni-ai-cli)
+[![provenance](https://img.shields.io/badge/npm-OIDC%20trusted%20publishing-C4552F)](https://docs.npmjs.com/trusted-publishers)
 [![License: MIT](https://img.shields.io/badge/license-MIT-C4552F.svg)](../LICENSE)
 ![Plateformes](https://img.shields.io/badge/macOS%20·%20Linux%20·%20Windows-1A1714)
 ![Langues](https://img.shields.io/badge/pt--BR%20·%20en%20·%20es%20·%20fr-C4552F)
@@ -50,55 +56,7 @@ De la ligne saisie jusqu'à la réponse sauvegardée. Le chat (`chat.py`) n'appe
 aucune IA directement : il lance le routeur (`cli.py`) comme sous-processus et lit
 les événements qu'il émet, ligne par ligne, pour afficher qui répond et ce qu'il fait.
 
-```mermaid
-flowchart TD
-    A["Vous saisissez et appuyez sur Entrée<br/>(la zone ne se bloque jamais)"] --> B{"Commence par / ?"}
-    B -- oui --> C["Commande interne<br/>/model · /account · /key · /lang · /versions"]
-    C --> C1["config.py écrit dans<br/>models.json, profiles.json ou keys/"]
-    B -- non --> FQ["Entre dans la file<br/>avec l'outil choisi au moment de l'envoi"]
-
-    subgraph CHAT ["chat.py — chat"]
-        FQ --> FW{"A attendu dans la file et la réponse<br/>précédente règle déjà la demande ?"}
-        FW -- "oui (classifieur gratuit)" --> FS["Ignorée, signalé à l'écran"]
-        FW -- non --> D["Construit le contexte : derniers messages<br/>de la session jusqu'à 48 mille caractères + langue"]
-        D --> E["Worker en thread lance le routeur<br/>dans son propre groupe de processus"]
-        E -. "événements JSON ligne par ligne" .-> F["Affiche le fournisseur, les commandes et la réponse"]
-        X["Ctrl-C"] -. "vide la file ; SIGTERM sur le groupe,<br/>après 5 s, SIGKILL" .-> E
-    end
-
-    subgraph ROUTER ["cli.py — routeur"]
-        E --> G["Charge les modèles :<br/>env > models.json > défaut"]
-        G --> H{"Outil fixé<br/>avec /tool ?"}
-        H -- oui --> H1["Seulement l'outil choisi"]
-        H -- auto --> I{"Classe : Groq → Cerebras →<br/>OpenRouter gratuit → Grok ;<br/>sans réponse, mots-clés"}
-        I -- simple --> J["OpenRouter : gratuits, ou payants<br/>si autorisés · données personnelles masquées"]
-        J -- "sans clé ou échec" --> K["Codex : abonnement,<br/>puis clé d'API"]
-        K -- échec --> L["Antigravity : abonnement,<br/>puis clé d'API"]
-        L -- échec --> LP["Payants seulement si listés dans fallback_order :<br/>Cursor, Grok, DeepSeek"]
-        LP -- échec --> M
-        I -- complexe --> M["Claude : prochain compte actif<br/>par priorité"]
-        M --> N{"Rate limit ?"}
-        N -- oui --> O["Compte en cooldown de 60 min"]
-        O --> P{"Un autre compte<br/>disponible ?"}
-        P -- oui --> M
-        P -- non --> PK{"Clé d'API<br/>Anthropic ?"}
-        PK -- oui --> PK1["Claude avec ANTHROPIC_API_KEY"]
-        PK1 -- ok --> R
-        PK1 -- échec --> Q
-        PK -- non --> Q["Dernier recours :<br/>Codex, puis Antigravity"]
-    end
-
-    N -- non --> R["Réponse"]
-    J -- ok --> R
-    K -- ok --> R
-    L -- ok --> R
-    LP -- ok --> R
-    Q --> R
-    H1 --> R
-    R --> F
-    F --> S[("Session sauvegardée sur disque<br/>avec écriture atomique")]
-    S --> FQ
-```
+![Flux de la demande à la réponse](https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/diagrams/flow1.fr.png)
 
 Trois détails que le diagramme rend explicites :
 
@@ -145,7 +103,7 @@ curl -fsSL https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/get.sh |
 irm https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/get.ps1 | iex
 ```
 
-**Bientôt sur npm, yarn, pnpm et bun.** Le paquet `omni-ai-cli` est prêt et sera publié dès que possible :
+**Sur npm, yarn, pnpm ou bun :**
 
 ```bash
 npm install -g omni-ai-cli
@@ -154,7 +112,7 @@ pnpm add -g omni-ai-cli
 bun add -g omni-ai-cli
 ```
 
-En attendant, utilisez la commande macOS/Linux ou Windows ci-dessus.
+N'importe laquelle des commandes ci-dessus (script ou gestionnaire de paquets) installe le même `ai`.
 
 Pour mettre à jour ensuite : `ai --update` (ou `/update` dans le chat).
 
@@ -438,6 +396,7 @@ ai --deepseek "explicar CAP theorem"   # force DeepSeek
 ai --install                           # installe les outils manquants (demande avant)
 ai --classify "prompt"                 # montre la classification
 ai --log                               # derniers appels
+ai doctor                              # diagnostic installation, comptes et clés
 ```
 
 ---
@@ -499,7 +458,7 @@ python3 -m unittest discover -s tests -v
 bash -n scripts/install.sh
 ```
 
-**38 tests** : persistance et reprise de session, limite de contexte, permissions des
+**106 tests** : persistance et reprise de session, limite de contexte, permissions des
 fichiers, session ouverte dans deux terminaux, lecture des événements, annulation de
 l'arbre de processus, parallélisme réel, sandbox en lecture seule, masquage des données
 personnelles, fallback OpenRouter → Codex, validation des modèles, stockage des clés et
@@ -551,31 +510,20 @@ bloque les titres hors convention.
 - Un commit par changement perceptible. Refactorisations et tests vont dans
   `refactor:`/`test:`, qui n'apparaissent pas dans `/versions`.
 
-```mermaid
-flowchart TD
-    A[PR ouverte] --> B[CI : tests Python 3.11-3.13 sur Linux et macOS<br/>+ npm pack + launcher]
-    A --> C[PR title : Conventional Commits ?]
-    B -->|échec| X[Merge bloqué]
-    C -->|invalide| X
-    B -->|ok| D[Squash merge dans main / next / beta]
-    C -->|ok| D
-    D --> E[Release : la CI tourne à nouveau]
-    E -->|échec| Y[Rien n'est publié]
-    E -->|ok| F{semantic-release :<br/>feat/fix/breaking<br/>depuis le dernier tag ?}
-    F -->|non| Z[Pas de release]
-    F -->|oui| G[Calcule la version et crée le tag vX.Y.Z]
-    G --> H[npm publish avec provenance<br/>sur le dist-tag de la branche]
-    G --> I[GitHub Release avec notes]
-```
+![Flux de release et publication](https://raw.githubusercontent.com/samuelrms/omni-ai-cli/main/docs/diagrams/flow2.fr.png)
+
+La publication utilise **OIDC / trusted publishing** : GitHub Actions s'authentifie auprès
+de npm sans jeton et le paquet est publié avec *provenance*. Configuration unique :
 
-Configuration unique sur GitHub :
+1. **npm → page du paquet → Settings → Trusted Publisher** : ajouter *GitHub Actions* avec
+   `samuelrms/omni-ai-cli` et le workflow `release.yml`.
+2. **GitHub → Settings → Branches** : protéger `main` (et `next`/`beta` si utilisées) en
+   exigeant une PR et les checks `Tests (...)`, `npm package` et `conventional`.
+3. **GitHub → Settings → General → Pull Requests** : n'autoriser que le *squash merging* et
+   cocher *Default to pull request title*.
 
-1. **Settings → Secrets and variables → Actions** : créer `NPM_TOKEN` (jeton *Automation*
-   ou *Granular* npmjs.com avec droit de publish).
-2. **Settings → Branches** : protéger `main` (et `next`/`beta` si utilisées) en exigeant
-   une PR et les checks `Tests (...)`, `npm package` et `conventional`.
-3. **Settings → General → Pull Requests** : n'autoriser que le *squash merging* et cocher
-   *Default to pull request title*.
+Le workflow demande déjà `id-token: write` et `NPM_CONFIG_PROVENANCE` ; il n'y a pas de
+`NPM_TOKEN` à stocker ni à renouveler.
 
 ---
 

package/docs/diagrams/flow1.en.mmd

@@ -0,0 +1,47 @@
+flowchart TD
+    A["You type and press Enter<br/>(the box never locks)"] --> B{"Starts with / ?"}
+    B -- yes --> C["Internal command<br/>/model · /account · /key · /lang · /versions"]
+    C --> C1["config.py writes to<br/>models.json, profiles.json or keys/"]
+    B -- no --> FQ["Goes into the queue<br/>with the tool selected at send time"]
+
+    subgraph CHAT ["chat.py — chat"]
+        FQ --> FW{"Waited in the queue and the previous<br/>answer already covers the request?"}
+        FW -- "yes (free classifier)" --> FS["Skipped, shown on screen"]
+        FW -- no --> D["Builds the context: latest messages<br/>of the session up to 48 thousand characters + language"]
+        D --> E["Thread worker launches the router<br/>in its own process group"]
+        E -. "JSON events line by line" .-> F["Shows provider, commands and answer"]
+        X["Ctrl-C"] -. "empties the queue; SIGTERM to the group,<br/>after 5 s, SIGKILL" .-> E
+    end
+
+    subgraph ROUTER ["cli.py — router"]
+        E --> G["Loads models:<br/>env > models.json > default"]
+        G --> H{"Tool pinned<br/>with /tool?"}
+        H -- yes --> H1["Only the chosen tool"]
+        H -- auto --> I{"Classifies: Groq → Cerebras →<br/>free OpenRouter → Grok;<br/>no answer, keywords"}
+        I -- simple --> J["OpenRouter: free, or paid<br/>if authorized · personal data masked"]
+        J -- "no key or failed" --> K["Codex: subscription,<br/>then API key"]
+        K -- failed --> L["Antigravity: subscription,<br/>then API key"]
+        L -- failed --> LP["Paid ones only if listed in fallback_order:<br/>Cursor, Grok, DeepSeek"]
+        LP -- failed --> M
+        I -- complex --> M["Claude: next active account<br/>by priority"]
+        M --> N{"Rate limit?"}
+        N -- yes --> O["Account on 60 min cooldown"]
+        O --> P{"Another account<br/>available?"}
+        P -- yes --> M
+        P -- no --> PK{"Anthropic<br/>API key?"}
+        PK -- yes --> PK1["Claude with ANTHROPIC_API_KEY"]
+        PK1 -- ok --> R
+        PK1 -- failed --> Q
+        PK -- no --> Q["Last resort:<br/>Codex, then Antigravity"]
+    end
+
+    N -- no --> R["Answer"]
+    J -- ok --> R
+    K -- ok --> R
+    L -- ok --> R
+    LP -- ok --> R
+    Q --> R
+    H1 --> R
+    R --> F
+    F --> S[("Session saved to disk<br/>with atomic write")]
+    S --> FQ

package/docs/diagrams/flow1.es.mmd

@@ -0,0 +1,47 @@
+flowchart TD
+    A["Escribes y presionas Enter<br/>(la caja nunca se bloquea)"] --> B{"¿Empieza con / ?"}
+    B -- sí --> C["Comando interno<br/>/model · /account · /key · /lang · /versions"]
+    C --> C1["config.py guarda en<br/>models.json, profiles.json o keys/"]
+    B -- no --> FQ["Entra en la cola<br/>con la herramienta del momento del envío"]
+
+    subgraph CHAT ["chat.py — chat"]
+        FQ --> FW{"¿Esperó en la cola y la respuesta<br/>anterior ya resuelve el pedido?"}
+        FW -- "sí (clasificador gratis)" --> FS["Omitido, avisa en pantalla"]
+        FW -- no --> D["Arma el contexto: últimos mensajes<br/>de la sesión hasta 48 mil caracteres + idioma"]
+        D --> E["Worker en hilo lanza el enrutador<br/>en un grupo de procesos propio"]
+        E -. "eventos JSON línea por línea" .-> F["Muestra proveedor, comandos y respuesta"]
+        X["Ctrl-C"] -. "vacía la cola; SIGTERM al grupo,<br/>tras 5 s, SIGKILL" .-> E
+    end
+
+    subgraph ROUTER ["cli.py — enrutador"]
+        E --> G["Carga modelos:<br/>env > models.json > predeterminado"]
+        G --> H{"¿Herramienta fijada<br/>con /tool?"}
+        H -- sí --> H1["Solo la herramienta elegida"]
+        H -- auto --> I{"Clasifica: Groq → Cerebras →<br/>OpenRouter gratis → Grok;<br/>sin respuesta, palabras clave"}
+        I -- simple --> J["OpenRouter: gratuitos, o pagos<br/>si se autorizan · datos personales enmascarados"]
+        J -- "sin clave o falló" --> K["Codex: suscripción,<br/>luego clave de API"]
+        K -- falló --> L["Antigravity: suscripción,<br/>luego clave de API"]
+        L -- falló --> LP["De pago solo si están en fallback_order:<br/>Cursor, Grok, DeepSeek"]
+        LP -- falló --> M
+        I -- compleja --> M["Claude: siguiente cuenta activa<br/>por prioridad"]
+        M --> N{"¿Rate limit?"}
+        N -- sí --> O["Cuenta en cooldown de 60 min"]
+        O --> P{"¿Otra cuenta<br/>disponible?"}
+        P -- sí --> M
+        P -- no --> PK{"¿Clave de API<br/>de Anthropic?"}
+        PK -- sí --> PK1["Claude con ANTHROPIC_API_KEY"]
+        PK1 -- ok --> R
+        PK1 -- falló --> Q
+        PK -- no --> Q["Último recurso:<br/>Codex, luego Antigravity"]
+    end
+
+    N -- no --> R["Respuesta"]
+    J -- ok --> R
+    K -- ok --> R
+    L -- ok --> R
+    LP -- ok --> R
+    Q --> R
+    H1 --> R
+    R --> F
+    F --> S[("Sesión guardada en disco<br/>con escritura atómica")]
+    S --> FQ

package/docs/diagrams/flow1.fr.mmd

@@ -0,0 +1,47 @@
+flowchart TD
+    A["Vous saisissez et appuyez sur Entrée<br/>(la zone ne se bloque jamais)"] --> B{"Commence par / ?"}
+    B -- oui --> C["Commande interne<br/>/model · /account · /key · /lang · /versions"]
+    C --> C1["config.py écrit dans<br/>models.json, profiles.json ou keys/"]
+    B -- non --> FQ["Entre dans la file<br/>avec l'outil choisi au moment de l'envoi"]
+
+    subgraph CHAT ["chat.py — chat"]
+        FQ --> FW{"A attendu dans la file et la réponse<br/>précédente règle déjà la demande ?"}
+        FW -- "oui (classifieur gratuit)" --> FS["Ignorée, signalé à l'écran"]
+        FW -- non --> D["Construit le contexte : derniers messages<br/>de la session jusqu'à 48 mille caractères + langue"]
+        D --> E["Worker en thread lance le routeur<br/>dans son propre groupe de processus"]
+        E -. "événements JSON ligne par ligne" .-> F["Affiche le fournisseur, les commandes et la réponse"]
+        X["Ctrl-C"] -. "vide la file ; SIGTERM sur le groupe,<br/>après 5 s, SIGKILL" .-> E
+    end
+
+    subgraph ROUTER ["cli.py — routeur"]
+        E --> G["Charge les modèles :<br/>env > models.json > défaut"]
+        G --> H{"Outil fixé<br/>avec /tool ?"}
+        H -- oui --> H1["Seulement l'outil choisi"]
+        H -- auto --> I{"Classe : Groq → Cerebras →<br/>OpenRouter gratuit → Grok ;<br/>sans réponse, mots-clés"}
+        I -- simple --> J["OpenRouter : gratuits, ou payants<br/>si autorisés · données personnelles masquées"]
+        J -- "sans clé ou échec" --> K["Codex : abonnement,<br/>puis clé d'API"]
+        K -- échec --> L["Antigravity : abonnement,<br/>puis clé d'API"]
+        L -- échec --> LP["Payants seulement si listés dans fallback_order :<br/>Cursor, Grok, DeepSeek"]
+        LP -- échec --> M
+        I -- complexe --> M["Claude : prochain compte actif<br/>par priorité"]
+        M --> N{"Rate limit ?"}
+        N -- oui --> O["Compte en cooldown de 60 min"]
+        O --> P{"Un autre compte<br/>disponible ?"}
+        P -- oui --> M
+        P -- non --> PK{"Clé d'API<br/>Anthropic ?"}
+        PK -- oui --> PK1["Claude avec ANTHROPIC_API_KEY"]
+        PK1 -- ok --> R
+        PK1 -- échec --> Q
+        PK -- non --> Q["Dernier recours :<br/>Codex, puis Antigravity"]
+    end
+
+    N -- non --> R["Réponse"]
+    J -- ok --> R
+    K -- ok --> R
+    L -- ok --> R
+    LP -- ok --> R
+    Q --> R
+    H1 --> R
+    R --> F
+    F --> S[("Session sauvegardée sur disque<br/>avec écriture atomique")]
+    S --> FQ

package/docs/diagrams/flow1.pt.mmd

@@ -0,0 +1,47 @@
+flowchart TD
+    A["Você digita e tecla Enter<br/>(a caixa nunca trava)"] --> B{"Começa com / ?"}
+    B -- sim --> C["Comando interno<br/>/model · /account · /key · /lang · /versions"]
+    C --> C1["config.py grava em<br/>models.json, profiles.json ou keys/"]
+    B -- não --> FQ["Entra na fila<br/>com a ferramenta do momento do envio"]
+
+    subgraph CHAT ["chat.py — chat"]
+        FQ --> FW{"Esperou na fila e a resposta<br/>anterior já resolve o pedido?"}
+        FW -- "sim (classificador grátis)" --> FS["Pulado, avisa na tela"]
+        FW -- não --> D["Monta o contexto: últimas mensagens<br/>da sessão até 48 mil caracteres + idioma"]
+        D --> E["Worker em thread dispara o roteador<br/>em grupo de processos próprio"]
+        E -. "eventos JSON linha a linha" .-> F["Mostra provedor, comandos e resposta"]
+        X["Ctrl-C"] -. "esvazia a fila; SIGTERM no grupo,<br/>após 5 s, SIGKILL" .-> E
+    end
+
+    subgraph ROUTER ["cli.py — roteador"]
+        E --> G["Carrega modelos:<br/>env > models.json > padrão"]
+        G --> H{"Ferramenta fixada<br/>com /tool?"}
+        H -- sim --> H1["Só a ferramenta escolhida"]
+        H -- auto --> I{"Classifica: Groq → Cerebras →<br/>OpenRouter grátis → Grok;<br/>sem resposta, palavras-chave"}
+        I -- simples --> J["OpenRouter: gratuitos, ou pagos<br/>se autorizados · dados pessoais mascarados"]
+        J -- "sem chave ou falhou" --> K["Codex: assinatura,<br/>depois chave de API"]
+        K -- falhou --> L["Antigravity: assinatura,<br/>depois chave de API"]
+        L -- falhou --> LP["Pagos só se listados em fallback_order:<br/>Cursor, Grok, DeepSeek"]
+        LP -- falhou --> M
+        I -- complexa --> M["Claude: próxima conta ativa<br/>por prioridade"]
+        M --> N{"Rate limit?"}
+        N -- sim --> O["Conta em cooldown de 60 min"]
+        O --> P{"Outra conta<br/>disponível?"}
+        P -- sim --> M
+        P -- não --> PK{"Chave de API<br/>da Anthropic?"}
+        PK -- sim --> PK1["Claude com ANTHROPIC_API_KEY"]
+        PK1 -- ok --> R
+        PK1 -- falhou --> Q
+        PK -- não --> Q["Último recurso:<br/>Codex, depois Antigravity"]
+    end
+
+    N -- não --> R["Resposta"]
+    J -- ok --> R
+    K -- ok --> R
+    L -- ok --> R
+    LP -- ok --> R
+    Q --> R
+    H1 --> R
+    R --> F
+    F --> S[("Sessão salva em disco<br/>com escrita atômica")]
+    S --> FQ

package/docs/diagrams/flow2.en.mmd

@@ -0,0 +1,14 @@
+flowchart TD
+    A[PR opened] --> B[CI: Python 3.11-3.13 tests on Linux and macOS<br/>+ npm pack + launcher]
+    A --> C[PR title: Conventional Commits?]
+    B -->|failed| X[Merge blocked]
+    C -->|invalid| X
+    B -->|ok| D[Squash merge into main / next / beta]
+    C -->|ok| D
+    D --> E[Release: CI runs again]
+    E -->|failed| Y[Nothing is published]
+    E -->|ok| F{semantic-release:<br/>any feat/fix/breaking<br/>since last tag?}
+    F -->|no| Z[No release]
+    F -->|yes| G[Compute version and tag vX.Y.Z]
+    G --> H[npm publish via OIDC / trusted publishing<br/>with provenance, on the branch dist-tag]
+    G --> I[GitHub Release with notes]

package/docs/diagrams/flow2.es.mmd

@@ -0,0 +1,14 @@
+flowchart TD
+    A[PR abierto] --> B[CI: tests Python 3.11-3.13 en Linux y macOS<br/>+ npm pack + launcher]
+    A --> C[PR title: ¿Conventional Commits?]
+    B -->|falló| X[Merge bloqueado]
+    C -->|inválido| X
+    B -->|ok| D[Squash merge en main / next / beta]
+    C -->|ok| D
+    D --> E[Release: CI corre de nuevo]
+    E -->|falló| Y[No se publica nada]
+    E -->|ok| F{semantic-release:<br/>¿hay feat/fix/breaking<br/>desde la última tag?}
+    F -->|no| Z[Sin release]
+    F -->|sí| G[Calcula versión y crea tag vX.Y.Z]
+    G --> H[npm publish vía OIDC / trusted publishing<br/>con provenance, en el dist-tag de la rama]
+    G --> I[GitHub Release con notas]

package/docs/diagrams/flow2.fr.mmd

@@ -0,0 +1,14 @@
+flowchart TD
+    A[PR ouverte] --> B[CI : tests Python 3.11-3.13 sur Linux et macOS<br/>+ npm pack + launcher]
+    A --> C[PR title : Conventional Commits ?]
+    B -->|échec| X[Merge bloqué]
+    C -->|invalide| X
+    B -->|ok| D[Squash merge dans main / next / beta]
+    C -->|ok| D
+    D --> E[Release : la CI tourne à nouveau]
+    E -->|échec| Y[Rien n'est publié]
+    E -->|ok| F{semantic-release :<br/>feat/fix/breaking<br/>depuis le dernier tag ?}
+    F -->|non| Z[Pas de release]
+    F -->|oui| G[Calcule la version et crée le tag vX.Y.Z]
+    G --> H[npm publish via OIDC / trusted publishing<br/>avec provenance, sur le dist-tag de la branche]
+    G --> I[GitHub Release avec notes]

package/docs/diagrams/flow2.pt.mmd

@@ -0,0 +1,14 @@
+flowchart TD
+    A[PR aberto] --> B[CI: testes Python 3.11-3.13 em Linux e macOS<br/>+ npm pack + launcher]
+    A --> C[PR title: Conventional Commits?]
+    B -->|falhou| X[Merge bloqueado]
+    C -->|fora do padrão| X
+    B -->|ok| D[Squash merge em main / next / beta]
+    C -->|ok| D
+    D --> E[Release: CI roda de novo]
+    E -->|falhou| Y[Nada é publicado]
+    E -->|ok| F{semantic-release:<br/>há feat/fix/breaking<br/>desde a última tag?}
+    F -->|não| Z[Sem release]
+    F -->|sim| G[Calcula versão e cria tag vX.Y.Z]
+    G --> H[npm publish via OIDC / trusted publishing<br/>com provenance, no dist-tag da branch]
+    G --> I[GitHub Release com notas]

package/omni_ai/cli.py

@@ -7,7 +7,7 @@
   ai --mode plan|edits|auto|yolo "question"
   ai --usage                         Uso e limites de todas as ferramentas e contas
   ai --setup                         First-run guide: logins and API keys
-  ai --status | --reset | --log | --classify "prompt"
+  ai --status | --doctor | --reset | --log | --classify "prompt"
   ai --model ... | --account ... | --key ... | --sync ...
 """
 import json
@@ -683,6 +683,91 @@ def show_status():
     say()
 
 
+def ai_version():
+    try:
+        return json.loads((REPO / 'package.json').read_text()).get('version', '?')
+    except (OSError, ValueError):
+        return '?'
+
+
+def doctor():
+    """Health check: what is installed, logged in and configured, and what is missing. Returns 1 when
+    nothing can answer a request (no Claude login and no API key), 0 otherwise."""
+    import platform
+    ok, warn, bad = f'{GREEN}✓{NC}', f'{YELLOW}!{NC}', f'{RED}✗{NC}'
+    problems = []
+
+    say(f'{BOLD}{CYAN}  🩺 Omni AI CLI — diagnóstico{NC}\n')
+
+    say(f'{BOLD}  Sistema{NC}')
+    say(f'  {ok} Omni AI CLI {ai_version()}')
+    say(f'  {ok} Python {platform.python_version()} · {platform.system()} {platform.machine()}')
+    local_bin = str(Path('~/.local/bin').expanduser())
+    if local_bin in os.environ.get('PATH', '').split(os.pathsep):
+        say(f'  {ok} ~/.local/bin no PATH')
+    else:
+        say(f'  {warn} ~/.local/bin fora do PATH (adicione ao shell para o comando `ai`)')
+        problems.append('~/.local/bin não está no PATH')
+    say()
+
+    say(f'{BOLD}  Configuração{NC}')
+    cfg = config_tool.CONFIG_DIR
+    say(f'  {ok if cfg.is_dir() else warn} {cfg}')
+    say()
+
+    say(f'{BOLD}  Contas Claude{NC}')
+    logged = 0
+    profiles = config_tool.ordered(config_tool.profiles())
+    for name, conf in profiles:
+        if not conf.get('enabled', True):
+            say(f'  {warn} {name}: desabilitado')
+            continue
+        has_login = bool(conf.get('config_dir')) or (
+            conf.get('credentials_file') and Path(conf['credentials_file']).expanduser().is_file())
+        left = cooldown_left(name)
+        if has_login and left:
+            say(f'  {warn} {name}: em cooldown ({left // 60}m{left % 60}s)')
+            logged += 1
+        elif has_login:
+            say(f'  {ok} {name}: logado')
+            logged += 1
+        else:
+            say(f'  {bad} {name}: sem login (ai --account login {name})')
+    if not logged:
+        say(f'  {warn} nenhuma conta Claude logada')
+    say()
+
+    say(f'{BOLD}  Chaves de API{NC}')
+    keys = [p for p in config_tool.KEYS if config_tool.stored_key(p)[0]]
+    say(f"  {ok if keys else warn} {', '.join(keys) if keys else 'nenhuma configurada (ai --key)'}")
+    say()
+
+    say(f'{BOLD}  Ferramentas{NC}')
+    for name in CLIS:
+        label = TOOLS[name].label
+        say(f'  {ok} {label}: {version(name)}' if installed(name) else f'  {warn} {label}: não instalado')
+    say()
+
+    classifiers = [p for p in ('groq', 'cerebras') if config_tool.stored_key(p)[0]]
+    if classifiers:
+        say(f'  {ok} Classificador: {", ".join(classifiers)} (rápido e grátis)')
+    else:
+        say(f'  {warn} Sem chave de classificador (Groq/Cerebras); usa OpenRouter grátis ou palavras-chave')
+    say()
+
+    if not logged and not keys:
+        problems.append('nenhuma conta Claude logada e nenhuma chave de API: o roteador não tem como responder')
+
+    if problems:
+        say(f'{BOLD}{YELLOW}  Pendências:{NC}')
+        for p in problems:
+            say(f'  {warn} {p}')
+        say(f'\n{DIM}  Rode `ai --setup` para um guia de primeiro acesso.{NC}\n')
+    else:
+        say(f'{GREEN}  Tudo pronto.{NC}\n')
+    return 1 if not logged and not keys else 0
+
+
 def ago(seconds):
     seconds = int(seconds)
     return f'{seconds // 3600}h{seconds % 3600 // 60:02d}m' if seconds >= 3600 else f'{seconds // 60}m'
@@ -867,7 +952,12 @@ def show_log():
 def update():
     """Pull the latest version into the install folder; settings live in ~/.config and are kept."""
     if (REPO / '.git').is_dir() and resolve_bin('git'):
-        code = subprocess.call(['git', '-C', str(REPO), 'pull', '--ff-only'])
+        # Pull the current branch from origin explicitly, so it works even when the branch has no
+        # upstream tracking set (a plain `git pull` fails there). A detached HEAD updates from main.
+        branch = subprocess.run(['git', '-C', str(REPO), 'rev-parse', '--abbrev-ref', 'HEAD'],
+                                capture_output=True, text=True).stdout.strip()
+        ref = branch if branch and branch != 'HEAD' else 'main'
+        code = subprocess.call(['git', '-C', str(REPO), 'pull', '--ff-only', 'origin', ref])
         say(f'{GREEN}✓ Omni AI atualizado.{NC}' if code == 0 else f'{RED}✗ Não consegui atualizar; veja a mensagem acima.{NC}')
         return code
     if os.environ.get('SMART_AI_INSTALLER') == 'npm':
@@ -895,7 +985,7 @@ USAGE = f'''{BOLD}Uso:{NC}
   ai --usage                         Uso e limites de todas as ferramentas e contas
   ai --setup                          Guia de primeiro acesso: logins e chaves
   ai --install                       Instala as ferramentas que faltam (pergunta antes)
-  ai --status | --reset | --log | --classify "prompt"
+  ai --status | --doctor | --reset | --log | --classify "prompt"
   ai --update                        Atualizar para a versão mais nova
 '''
 
@@ -945,6 +1035,8 @@ def main(argv):
         elif arg in ('--status', '-s'):
             show_status()
             return 0
+        elif arg in ('--doctor', 'doctor'):
+            return doctor()
         elif arg in ('--setup', '--install'):
             from . import onboarding
             onboarding.main(install_missing=arg == '--install' or 'install' in argv[i + 1:])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omni-ai-cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "One chat for Claude Code, Codex, Antigravity and OpenRouter, with automatic routing, account fallback, API keys, permission modes and MCP/skill sync.",
   "bin": {
     "ai": "bin/ai.js",
@@ -12,9 +12,13 @@
     "omni_ai/",
     "!omni_ai/**/__pycache__",
     "docs/",
+    "!docs/**/*.png",
     "README.md",
     "LICENSE"
   ],
+  "scripts": {
+    "diagrams": "bash scripts/diagrams.sh"
+  },
   "optionalDependencies": {
     "@anthropic-ai/claude-code": "*"
   },