omnigateway 0.4.13 → 0.5.0

package/README.md

@@ -402,6 +402,53 @@ supervisor; use `omni restart` from a terminal there. Shutdown is offered in
 every shape. In a container it is a one-way door: bring the process back from
 the host.
 
+### Behind a reverse proxy
+
+Set `OMNI_BASE_URL` to the public HTTPS origin, or OAuth callbacks come back to
+the wrong host.
+
+Beyond that, two things travel badly through a proxy, and both are streams.
+Client responses on `/v1/*` are server-sent events, and the console keeps one
+WebSocket open on `/api/stream`. Neither is optional: buffer the first and every
+token of an agent's reply arrives at once at the end, and drop the second and
+the console silently falls back to polling.
+
+Caddy and Cloudflare pass WebSockets and unbuffered responses by default and
+need nothing. nginx needs telling:
+
+```nginx
+location / {
+    proxy_pass http://127.0.0.1:9000;
+    proxy_http_version 1.1;
+
+    # Without these two the Upgrade handshake never reaches the gateway and the
+    # console shows LIVE·POLL instead of LIVE·PUSH. It keeps working — the
+    # fallback exists for exactly this — but you paid for a socket you are not
+    # getting.
+    proxy_set_header Upgrade    $http_upgrade;
+    proxy_set_header Connection "upgrade";
+
+    proxy_set_header Host              $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # The socket's heartbeat is 20s and it gives up on a missed pong at 60s.
+    # A read timeout below that closes a healthy connection from the outside,
+    # and the console reconnects in a loop that looks like an unstable gateway.
+    proxy_read_timeout 300s;
+
+    # SSE must not be buffered. The gateway already sends
+    # `x-accel-buffering: no` on streaming responses, which nginx honours on its
+    # own, so this line is belt and braces for a proxy chain where something
+    # else strips that header before nginx sees it.
+    proxy_buffering off;
+}
+```
+
+The gateway sends downstream `: keepalive` comments on streaming responses
+because provider heartbeats are decoded away, so an idle stream still looks
+alive to whatever sits in between. Keep any idle timeout in the proxy above
+your longest expected request.
+
 ## Configuration
 
 Configuration is environment variables, read from the installation's `.env`:
@@ -417,7 +464,6 @@ Configuration is environment variables, read from the installation's `.env`:
 | `OMNI_LOG_LEVEL` | No | `info` | Stdout threshold: `debug`, `info`, `warn`, or `error` |
 | `OMNI_LOG_FILE` | No | the systemd journal, when there is one | Where stdout was already redirected, so the Console screen can read it back. Names a file; does not create one |
 | `OMNI_BODY_LOGGING_ALLOWED` | No | unset | Permits request/response body capture on this installation. Read at boot. Capture also needs the runtime setting; see [Recording bodies](#recording-bodies) |
-| `OMNI_EXPOSE_CLAUDE_CODE_ALIASES` | No | off | Advertises the reserved `claude/*` aliases on `/v1/models`. Read at boot |
 | `OMNI_ROOT` | No | the installation in the current directory, else `~/.config/omnigateway` | Which installation the CLI acts on, when `--root` is not passed |
 | `OMNI_PLUGIN_REGISTRY` | No | the public npm registry | Registry `omni plugin install <name>` resolves through; must be `https://` |
 
@@ -680,6 +726,11 @@ ID       NAME               VERSION  API  SDK     CAPABILITIES
 pokemon  Pokémon Companion  1.0.0    1    ^1.0.0  storage,files,net:outbound,…    ok
 ```
 
+The capabilities a manifest may declare are `storage`, `files`, `net:outbound`,
+`events:request`, `events:limit` and `channels` — the last being namespaced
+topics on the gateway's push socket, which a plugin owns without ever touching a
+connection. Anything a plugin did not declare is absent from what it is handed.
+
 A plugin that would *not* load is listed with the reason rather than hidden,
 because a plugin missing from the console is exactly what you are trying to
 explain. For one plugin's full detail — its entry points and the outbound

package/bin/omni.js

@@ -405,7 +405,6 @@ function loadConfig(env) {
   const baseUrl = optionalText(env.OMNI_BASE_URL, derivedBaseUrl).replace(/\/+$/, "") || derivedBaseUrl;
   const staticDir = env.OMNI_STATIC_DIR?.trim();
   const logFile = env.OMNI_LOG_FILE?.trim();
-  const exposeClaudeCodeAliases = TRUTHY.has((env.OMNI_EXPOSE_CLAUDE_CODE_ALIASES ?? "").trim().toLowerCase());
   const bodyLoggingAllowed = TRUTHY.has((env.OMNI_BODY_LOGGING_ALLOWED ?? "").trim().toLowerCase());
   const rawLogLevel = env.OMNI_LOG_LEVEL?.trim();
   const logLevel = parseLogLevel(rawLogLevel);
@@ -418,7 +417,6 @@ function loadConfig(env) {
     encryptionKey,
     baseUrl,
     staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir,
-    exposeClaudeCodeAliases,
     bodyLoggingAllowed,
     logFile: logFile === undefined || logFile.length === 0 ? null : logFile
   };
@@ -18593,6 +18591,7 @@ var targetSchema = exports_external.discriminatedUnion("provider", [
     }),
     contextWindow: exports_external.number().int().positive().optional(),
     maxOutputTokens: exports_external.number().int().positive().optional(),
+    credentialId: exports_external.string().trim().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/, "credentialId must be an account id").optional(),
     capabilities: exports_external.object({
       tools: exports_external.boolean(),
       images: exports_external.boolean(),
@@ -18614,6 +18613,7 @@ var targetSchema = exports_external.discriminatedUnion("provider", [
     }),
     contextWindow: exports_external.number().int().positive().optional(),
     maxOutputTokens: exports_external.number().int().positive().optional(),
+    credentialId: exports_external.string().trim().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/, "credentialId must be an account id").optional(),
     capabilities: exports_external.object({
       tools: exports_external.boolean(),
       images: exports_external.boolean(),
@@ -18622,9 +18622,7 @@ var targetSchema = exports_external.discriminatedUnion("provider", [
   }).strict()
 ]);
 var modelSchema = exports_external.object({
-  id: exports_external.string().min(1).refine((value) => !value.toLowerCase().startsWith("claude/"), {
-    message: 'model id must not start with "claude/": that prefix is reserved for discovery mirrors'
-  }),
+  id: exports_external.string().min(1),
   strategy: exports_external.enum(["score", "priority", "roundRobin", "weighted"]),
   isAlias: exports_external.boolean(),
   targets: exports_external.array(targetSchema).min(1, "a virtual model needs at least one target")
@@ -18636,6 +18634,9 @@ var keyCreateSchema = exports_external.object({
   bodyLoggingOptOut: exports_external.boolean().default(false)
 }).strict();
 var keyLimitsSchema = exports_external.object({ limits: limitConfigSchema }).strict();
+var keyModelsSchema = exports_external.object({
+  modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable()
+}).strict();
 var retentionSchema = exports_external.object({
   keepLatest: exports_external.number().int().min(1).max(100),
   maxAgeDays: exports_external.number().int().min(1).max(3650)
@@ -18733,13 +18734,76 @@ async function readSource(deps, source, lines) {
   ]);
   return result.code === 0 ? result.stdout : "";
 }
+function parseConsoleLines(text, query) {
+  const lines = consoleLimit(query.lines);
+  return text.split(`
+`).filter((raw) => raw.trim().length > 0).map(parseLine).filter((line) => keep(line, query)).slice(-lines);
+}
 async function readConsole(deps, source, query) {
   const limited = { ...query, lines: consoleLimit(query.lines) };
   const text = await readSource(deps, source, scanWidth(limited));
-  const lines = text.split(`
-`).filter((raw) => raw.trim().length > 0).map(parseLine).filter((line) => keep(line, limited)).slice(-limited.lines);
+  const lines = parseConsoleLines(text, limited);
   return source.kind === "file" ? { source: "file", path: source.path, lines } : { source: source.kind, lines };
 }
+// packages/store/src/types.ts
+var WINDOW_DURATION_MS = {
+  fiveHour: 5 * 60 * 60 * 1000,
+  daily: 24 * 60 * 60 * 1000,
+  weekly: 7 * 24 * 60 * 60 * 1000
+};
+function durationFor(windowType, windowMs) {
+  return windowMs !== null && windowMs > 0 ? windowMs : WINDOW_DURATION_MS[windowType];
+}
+var SAME_WINDOW_TOLERANCE_MS = 60000;
+function sameWindow(a, b) {
+  if (a === null || b === null)
+    return a === b;
+  return Math.abs(a - b) <= SAME_WINDOW_TOLERANCE_MS;
+}
+function quotaVerdict(window, estimate) {
+  if (estimate === undefined)
+    return "unknown";
+  if (window.observedAt > 0 && estimate.stale)
+    return "stale";
+  if (estimate.ratePerHour === null || window.limit === null)
+    return "unknown";
+  if (estimate.survives === false && estimate.exhaustsAt !== null)
+    return "empty";
+  return estimate.survives === true ? "ok" : "unknown";
+}
+var READ_OVER_INPUT = 0.1;
+function cacheReadRate(prices) {
+  return prices.cacheRead ?? prices.input * READ_OVER_INPUT;
+}
+function servesTarget(target, account) {
+  if (account.provider !== target.provider)
+    return false;
+  if (target.provider === "custom" && account.providerData.endpointId !== target.endpointId) {
+    return false;
+  }
+  return target.credentialId === undefined || account.id === target.credentialId;
+}
+function resolvePin(target, accounts) {
+  if (target.credentialId === undefined)
+    return;
+  return accounts.find((account) => servesTarget(target, account));
+}
+var DEFAULT_SETTINGS = {
+  weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
+  maxAttempts: 3,
+  requestDeadlineMs: 120000,
+  breakerThreshold: 3,
+  breakerCooldownMs: 30000,
+  logRetentionDays: 30,
+  quotaPollIntervalMs: 300000,
+  rtkEnabled: false,
+  autoCacheEnabled: true,
+  bodyLoggingEnabled: false,
+  bodyLoggingCaptureStreamChunks: false,
+  snapshotKeepLatest: 5,
+  snapshotMaxAgeDays: 30
+};
+
 // packages/router/src/snapshot.ts
 var HEALTH_KEY_SEP = "::";
 function healthKey(credentialId, model) {
@@ -18799,12 +18863,11 @@ function eligible(input) {
   const excluded = [];
   for (const target of model.targets) {
     const missing = needNative && !ANTHROPIC_NATIVE_TOOLS[target.provider] ? "anthropicTools" : ["tools", "images", "reasoning"].find((cap) => need[cap] && !target.capabilities[cap]);
+    let pinSeen = false;
     for (const credential of snapshot.credentials) {
-      if (credential.provider !== target.provider)
+      if (!servesTarget(target, credential))
         continue;
-      if (target.provider === "custom" && credential.providerData.endpointId !== target.endpointId) {
-        continue;
-      }
+      pinSeen = target.credentialId !== undefined;
       const drop = (reason) => {
         excluded.push({ credentialId: credential.id, model: target.model, reason });
       };
@@ -18841,56 +18904,17 @@ function eligible(input) {
       }
       pairs.push({ credential, target });
     }
+    if (target.credentialId !== undefined && !pinSeen) {
+      excluded.push({
+        credentialId: target.credentialId,
+        model: target.model,
+        reason: "pin:missing"
+      });
+    }
   }
   return { pairs, excluded };
 }
 
-// packages/store/src/types.ts
-var WINDOW_DURATION_MS = {
-  fiveHour: 5 * 60 * 60 * 1000,
-  daily: 24 * 60 * 60 * 1000,
-  weekly: 7 * 24 * 60 * 60 * 1000
-};
-function durationFor(windowType, windowMs) {
-  return windowMs !== null && windowMs > 0 ? windowMs : WINDOW_DURATION_MS[windowType];
-}
-var SAME_WINDOW_TOLERANCE_MS = 60000;
-function sameWindow(a, b) {
-  if (a === null || b === null)
-    return a === b;
-  return Math.abs(a - b) <= SAME_WINDOW_TOLERANCE_MS;
-}
-function quotaVerdict(window, estimate) {
-  if (estimate === undefined)
-    return "unknown";
-  if (window.observedAt > 0 && estimate.stale)
-    return "stale";
-  if (estimate.ratePerHour === null || window.limit === null)
-    return "unknown";
-  if (estimate.survives === false && estimate.exhaustsAt !== null)
-    return "empty";
-  return estimate.survives === true ? "ok" : "unknown";
-}
-var READ_OVER_INPUT = 0.1;
-function cacheReadRate(prices) {
-  return prices.cacheRead ?? prices.input * READ_OVER_INPUT;
-}
-var DEFAULT_SETTINGS = {
-  weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
-  maxAttempts: 3,
-  requestDeadlineMs: 120000,
-  breakerThreshold: 3,
-  breakerCooldownMs: 30000,
-  logRetentionDays: 30,
-  quotaPollIntervalMs: 300000,
-  rtkEnabled: false,
-  autoCacheEnabled: true,
-  bodyLoggingEnabled: false,
-  bodyLoggingCaptureStreamChunks: false,
-  snapshotKeepLatest: 5,
-  snapshotMaxAgeDays: 30
-};
-
 // packages/router/src/quota.ts
 var UNKNOWN_QUOTA = 0.5;
 var QUOTA_FLOOR = 0.1;
@@ -20570,6 +20594,12 @@ function createKeyRepo(db, logger2 = noopLogger) {
         id
       ]);
     },
+    async setModelAllowlist(id, modelAllowlist) {
+      db.run("UPDATE api_keys SET model_allowlist = ? WHERE id = ?", [
+        modelAllowlist === null ? null : JSON.stringify(modelAllowlist),
+        id
+      ]);
+    },
     async revoke(id) {
       db.run("UPDATE api_keys SET revoked_at = ? WHERE id = ?", [Date.now(), id]);
     }
@@ -21198,6 +21228,7 @@ async function createStore(opts) {
       findByHash: (hash3) => handle.keys.findByHash(hash3),
       create: (input) => handle.keys.create(input),
       setLimits: (id, limits) => handle.keys.setLimits(id, limits),
+      setModelAllowlist: (id, modelAllowlist) => handle.keys.setModelAllowlist(id, modelAllowlist),
       revoke: (id) => handle.keys.revoke(id)
     },
     usage: {
@@ -21831,6 +21862,14 @@ async function setKeyLimits(store, id, input, now = Date.now()) {
   await store.keys.setLimits(id, body2.limits);
   return toSummary(store, { ...key, limits: body2.limits }, now);
 }
+async function setKeyModels(store, id, input, now = Date.now()) {
+  const body2 = parseOrThrow(keyModelsSchema, input);
+  const key = (await store.keys.list()).find((entry) => entry.id === id);
+  if (key === undefined)
+    throw new GatewayError("BAD_REQUEST", "no such api key");
+  await store.keys.setModelAllowlist(id, body2.modelAllowlist);
+  return toSummary(store, { ...key, modelAllowlist: body2.modelAllowlist }, now);
+}
 async function revokeKey(store, id) {
   await store.keys.revoke(id);
 }
@@ -21843,8 +21882,8 @@ function narrower(a, b) {
     ...output.length === 0 ? {} : { maxOutputTokens: Math.min(...output) }
   };
 }
-function targetLimits(target, auths) {
-  const ways = auths.size === 0 ? ["apiKey"] : [...auths];
+function targetLimits(target, auths, pinned) {
+  const ways = pinned !== undefined ? [pinned.authType] : auths.size === 0 ? ["apiKey"] : [...auths];
   let listed = {};
   for (const auth of ways) {
     const entry = catalogLimits(target.provider, target.model, auth);
@@ -21864,20 +21903,22 @@ function targetLimits(target, auths) {
 }
 function servingAuths(credentials) {
   const byProvider = new Map;
+  const routable = [];
   for (const credential of credentials) {
     if (!credential.enabled)
       continue;
     const ways = byProvider.get(credential.provider) ?? new Set;
     ways.add(credential.authType);
     byProvider.set(credential.provider, ways);
+    routable.push(credential);
   }
-  return byProvider;
+  return { byProvider, routable };
 }
 function resolveModelLimits(model, credentials) {
-  const auths = servingAuths(credentials);
+  const { byProvider, routable } = servingAuths(credentials);
   let limits = {};
   for (const target of model.targets) {
-    limits = narrower(limits, targetLimits(target, auths.get(target.provider) ?? new Set));
+    limits = narrower(limits, targetLimits(target, byProvider.get(target.provider) ?? new Set, resolvePin(target, routable)));
   }
   return limits;
 }
@@ -21921,15 +21962,18 @@ function unreachable(model, credentials, stored) {
   const held = heldAuths(credentials);
   const grandfathered = new Set((stored?.targets ?? []).map(pairOf));
   for (const target of model.targets) {
-    if (grandfathered.has(pairOf(target)))
+    const pinned = resolvePin(target, credentials);
+    if (pinned === undefined && grandfathered.has(pairOf(target)))
       continue;
-    const have = held.get(target.provider);
+    const have = pinned === undefined ? held.get(target.provider) : new Set([pinned.authType]);
     if (have === undefined)
       continue;
     const reach = catalogModelAuths(target.provider, target.model);
     if (reach.some((auth) => have.has(auth)))
       continue;
-    return new GatewayError("BAD_REQUEST", `${target.provider} serves "${target.model}" to ${phrase(reach)} credentials only, ` + `and every ${target.provider} credential here is ${phrase([...have])} \u2014 ` + `connect the other kind, or pick a model this one can reach`);
+    const holds = pinned === undefined ? `every ${target.provider} credential here is ${phrase([...have])}` : `this target is pinned to "${pinned.label}", which is ${phrase([...have])}`;
+    const fix = pinned === undefined ? "connect the other kind, or pick a model this one can reach" : "pin it to the other kind, or pick a model this account can reach";
+    return new GatewayError("BAD_REQUEST", `${target.provider} serves "${target.model}" to ${phrase(reach)} credentials only, ` + `and ${holds} \u2014 ${fix}`);
   }
   return null;
 }
@@ -21973,14 +22017,15 @@ import { basename as basename2, join as join3, resolve as resolve2, sep as sep2
 
 // packages/plugin-api/src/version.ts
 var PLUGIN_API_VERSION = 1;
-var DASHBOARD_SDK_VERSION = "0.1.1";
+var DASHBOARD_SDK_VERSION = "0.1.2";
 // packages/plugin-api/src/manifest.ts
 var CAPABILITIES = [
   "storage",
   "files",
   "net:outbound",
   "events:request",
-  "events:limit"
+  "events:limit",
+  "channels"
 ];
 var ID_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
 var idSchema = exports_external.string().regex(ID_PATTERN, "id must match /^[a-z][a-z0-9-]{0,31}$/");
@@ -23678,9 +23723,11 @@ var KEY_PLACEHOLDER = "<your OmniGateway key>";
 async function describeModelsForSetup(store) {
   const models = await listModels(store);
   const credentials = (await listCredentials(store)).map((credential) => ({
+    id: credential.id,
     provider: credential.provider,
     authType: credential.authType,
-    enabled: credential.enabled
+    enabled: credential.enabled,
+    providerData: credential.providerData
   }));
   return models.map((model) => ({
     model,
@@ -23716,8 +23763,7 @@ function claudeSettings(described, input, mapping, existing) {
   const visibleId = (slot, id) => {
     if (!ids.has(id))
       throw new Error(`${slot} names unknown virtual model "${id}"`);
-    const useMirror = input.discoveryMirrors === true && !/^(?:claude|anthropic)/i.test(id);
-    return useMirror ? `claude/${id}` : id;
+    return id;
   };
   const settings = settingsObject(existing);
   const currentEnv = settings.env;
@@ -24603,7 +24649,8 @@ var credentialsRemove = {
   async run(args, { ctx, writer, prompt }) {
     const id = requirePositional(args, 0, "credential id");
     const credential = await findCredential(ctx, id);
-    const confirmed = await prompt.confirm(`delete ${credential.provider} credential "${credential.label}" (${id})?`);
+    const pinned = (await listModels(await ctx.store())).filter((model) => model.targets.some((target) => target.credentialId === id)).map((model) => model.id);
+    const confirmed = await prompt.confirm(`delete ${credential.provider} credential "${credential.label}" (${id})?` + (pinned.length === 0 ? "" : ` ${pinned.length === 1 ? "model" : "models"} ${pinned.join(", ")} ` + `${pinned.length === 1 ? "pins a target" : "pin targets"} to it, and ` + `${pinned.length === 1 ? "that target" : "those targets"} will fail rather than ` + "fall back to another account."));
     if (!confirmed)
       throw new CliError("cancelled");
     await removeCredential(await ctx.store(), id);
@@ -25070,6 +25117,43 @@ var keysRevoke = {
     emit(ctx, writer, { id, revoked: true }, () => `${id} revoked`);
   }
 };
+var keysModels = {
+  usage: "keys models <id> [--allow <model> ...] [--all] [--none]",
+  summary: "Show or replace one key's allowed models",
+  options: {
+    allow: { type: "string", multiple: true },
+    all: { type: "boolean" },
+    none: { type: "boolean" }
+  },
+  async run(args, { ctx, writer }) {
+    const id = requirePositional(args, 0, "key id");
+    const allow = listFlag(args.values, "allow");
+    const all = boolFlag(args.values, "all");
+    const none = boolFlag(args.values, "none");
+    const store = await ctx.store();
+    const existing = (await listKeys(store)).find((entry) => entry.id === id);
+    if (existing === undefined)
+      throw new CliError(`no api key "${id}"`);
+    let key = existing;
+    if (all || none || allow !== undefined) {
+      if ([all, none, allow !== undefined].filter(Boolean).length > 1) {
+        throw new UsageError("--all, --none, and --allow cannot be combined");
+      }
+      const next = all ? null : none ? [] : allow ?? [];
+      key = await setKeyModels(store, id, { modelAllowlist: next });
+    }
+    emit(ctx, writer, key, () => {
+      const head = fields([
+        ["id", key.id],
+        ["label", key.label],
+        ["prefix", `${key.prefix}\u2026`]
+      ]);
+      const models = key.modelAllowlist === null ? "every model" : key.modelAllowlist.length === 0 ? "no models; every request this key makes is refused" : key.modelAllowlist.join(", ");
+      return `${head}
+models: ${models}`;
+    });
+  }
+};
 
 // apps/cli/src/commands/models.ts
 var modelsList = {
@@ -25102,6 +25186,7 @@ var modelsShow = {
   async run(args, { ctx, writer }) {
     const id = requirePositional(args, 0, "model id");
     const model = await getModel(await ctx.store(), id);
+    const pinned = model.targets.some((target) => target.credentialId !== undefined);
     emit(ctx, writer, { model }, () => [
       fields([
         ["id", model.id],
@@ -25112,6 +25197,7 @@ var modelsShow = {
       table([
         { header: "PROVIDER" },
         { header: "MODEL" },
+        ...pinned ? [{ header: "ACCOUNT" }] : [],
         { header: "TIER", align: "right" },
         { header: "WEIGHT", align: "right" },
         { header: "IN $/MTOK", align: "right" },
@@ -25125,6 +25211,7 @@ var modelsShow = {
       ], model.targets.map((target) => [
         provider(ctx, target.provider),
         target.model,
+        ...pinned ? [target.credentialId ?? "any"] : [],
         String(target.tier),
         String(target.weight),
         target.costPerMTok.input.toFixed(2),
@@ -25788,6 +25875,17 @@ async function orphanTables(ctx) {
     return null;
   }
 }
+async function danglingPins(ctx) {
+  if (ctx.configError !== null || !existsSync5(ctx.databasePath))
+    return null;
+  try {
+    const store = await ctx.store();
+    const accounts = await store.credentials.list();
+    return (await store.config.listModels()).flatMap((model) => model.targets.filter((target) => target.credentialId !== undefined && resolvePin(target, accounts) === undefined).map((target) => `${model.id}/${target.model} \u2192 ${target.credentialId}`));
+  } catch {
+    return null;
+  }
+}
 var doctor = {
   usage: "doctor",
   summary: "Check what this CLI resolved, and whether it can do anything with it",
@@ -25800,6 +25898,7 @@ var doctor = {
     const usageRollup = await rollupState(ctx);
     const plugins = listPlugins(doctorPluginDeps(), deps.root);
     const orphans = await orphanTables(ctx);
+    const pins = await danglingPins(ctx);
     const checks3 = {
       root: deps.root,
       rootSource: ctx.root.source,
@@ -25817,6 +25916,7 @@ var doctor = {
       pluginsDir: pluginsDir(deps.root),
       plugins,
       orphanPluginTables: orphans,
+      danglingPins: pins,
       warnings: ctx.warnings
     };
     emit(ctx, writer, checks3, () => {
@@ -25843,6 +25943,10 @@ var doctor = {
           "orphan plugin tables",
           orphans === null ? paint(ctx, "dim", "not checked") : orphans.length === 0 ? ok(true, "none") : paint(ctx, "yellow", `${orphans.length}: ${orphans.join(", ")}`)
         ],
+        [
+          "dangling pins",
+          pins === null ? paint(ctx, "dim", "not checked") : pins.length === 0 ? ok(true, "none") : paint(ctx, "yellow", `${pins.length}: ${pins.join(", ")}`)
+        ],
         ...checks3.warnings.map((warning) => ["ignored", paint(ctx, "yellow", warning)])
       ]);
     });
@@ -25996,7 +26100,6 @@ var setupClaude = {
     const path = join8(dir, "settings.json");
     const file2 = claudeSettings(models, {
       baseUrl: baseUrl(ctx),
-      discoveryMirrors: ctx.config().exposeClaudeCodeAliases,
       ...key === undefined ? {} : { apiKey: key }
     }, mapping, setupFs.read(path) ?? undefined);
     finish(ctx, writer, [at(dir, file2)], dryRun2, key, setupFs.write);
@@ -26247,6 +26350,7 @@ var COMMANDS = {
   "keys list": keysList,
   "keys create": keysCreate,
   "keys limits": keysLimits,
+  "keys models": keysModels,
   "keys revoke": keysRevoke,
   "plugin list": pluginList,
   "plugin verify": pluginVerify,