rovecode 0.3.3 → 0.4.0-beta.3

package/src/cli/auth-login.ts

@@ -1,122 +0,0 @@
-/** `rovecode auth login <provider>` and the `rovecode auth list` renderer (port #66). All of the auth
- *  CLI's OAuth logic lives here; main.ts only dispatches.
- *
- *  login: github-copilot (GitHub device code), openrouter (PKCE + loopback callback), openai (device
- *  code) — src/providers/oauth/registry.ts. The flow talks to the terminal only through notices
- *  rendered here: the device code + URL to open, the auth URL + callback address, progress. The
- *  credential goes to the credentials store (providers/auth.ts, `type: "oauth"`); the final line
- *  names the file and the expiry. `anthropic` is refused with the owner-decision note. Ctrl-C aborts
- *  the flow (exit 130). Nothing here prints, throws or logs a token: notices carry none by
- *  construction (oauth/common.ts) and the only value echoed from a credential is its expiry.
- *
- *  list: one row per stored entry — provider, kind (api | oauth), key name, redacted prefix, and
- *  for oauth the expiry (`expires <ISO>`, `EXPIRED <ISO>`, or `never expires`). */
-
-import { credentialsPath, listProviders, saveOAuthCredential, type ProviderListing, type StoredOAuthCredential } from "../providers/auth.ts";
-import type { OAuthDeps, OAuthNotice, OAuthProvider } from "../providers/oauth/common.ts";
-import { OAUTH_PROVIDER_IDS, OAUTH_REFUSED, defaultOAuthDeps, oauthProvider } from "../providers/oauth/registry.ts";
-
-export const AUTH_LOGIN_USAGE = `usage: rovecode auth login <${OAUTH_PROVIDER_IDS.join("|")}>`;
-
-export interface AuthLoginDeps {
-  out: (line: string) => void;
-  err: (line: string) => void;
-  /** provider lookup (tests inject fake-endpoint instances); default: the registry */
-  provider?: (id: string) => OAuthProvider | undefined;
-  /** network/clock/timer overrides for the flow */
-  oauth?: Partial<OAuthDeps>;
-  /** Ctrl-C */
-  signal?: AbortSignal;
-  /** credential sink; default: providers/auth.ts saveOAuthCredential */
-  save?: (id: string, cred: StoredOAuthCredential) => void;
-}
-
-/** `expires 2026-09-03T12:00:00.000Z` | `EXPIRED …` | `never expires` (MAX_SAFE_INTEGER / beyond Date's range).
- *  Never throws: a value below Date's range (or NaN) renders as EXPIRED instead of a RangeError (#66 fix). */
-export function expiryText(expires: number, now: number = Date.now()): string {
-  if (expires >= Number.MAX_SAFE_INTEGER || expires > 8.64e15) return "never expires";
-  if (!(expires >= -8.64e15)) return "EXPIRED (invalid expiry)";
-  const iso = new Date(expires).toISOString();
-  return expires <= now ? `EXPIRED ${iso}` : `expires ${iso}`;
-}
-
-/** Rows for `rovecode auth list`. Secrets never enter: the entries are already redacted. */
-export function formatAuthList(entries: ProviderListing[] = listProviders(), now: number = Date.now()): string[] {
-  return entries.map((e) => {
-    const tail = e.kind === "oauth" && e.expires !== undefined ? `  ${expiryText(e.expires, now)}` : "";
-    return `${e.provider.padEnd(14)} ${e.kind.padEnd(6)} ${e.keyName.padEnd(24)} ${e.redacted}${tail}`;
-  });
-}
-
-export function printAuthList(): void {
-  const rows = formatAuthList();
-  if (rows.length === 0) {
-    console.log(`no stored credentials (${credentialsPath()}) — run: rovecode auth set <provider> | rovecode auth login <provider>`);
-    return;
-  }
-  for (const row of rows) console.log(row);
-}
-
-/** What the terminal shows for a flow notice (indented by the caller). */
-export function describeNotice(n: OAuthNotice): string[] {
-  switch (n.type) {
-    case "device_code":
-      return [
-        `open   ${n.verificationUri}`,
-        `enter  ${n.userCode}`,
-        `waiting for authorization — polling every ${n.intervalSeconds}s, up to ${Math.max(1, Math.round(n.expiresInSeconds / 60))} min (Ctrl-C cancels)`,
-      ];
-    case "auth_url":
-      return [
-        `open   ${n.url}`,
-        `waiting for the browser to return to ${n.callbackUrl} (loopback — the browser must run on this machine; Ctrl-C cancels)`,
-      ];
-    case "progress":
-      return [n.message];
-  }
-}
-
-/** Run one login. Returns the exit code: 0 stored · 1 refused/unknown/failed · 130 cancelled. */
-export async function runAuthLogin(id: string, deps: AuthLoginDeps): Promise<number> {
-  // the refusals belong to the production registry; an injected `provider` (tests driving a flow against a
-  // fake server, or a build that has the missing wire) replaces the registry, refusals included
-  const refusal = deps.provider === undefined ? OAUTH_REFUSED[id] : undefined;
-  if (refusal !== undefined) {
-    deps.err(`rovecode auth login ${id}: refused — ${refusal}`);
-    return 1;
-  }
-  const provider = (deps.provider ?? oauthProvider)(id);
-  if (!provider) {
-    if (id.length > 0) deps.err(`error: no OAuth login for "${id}"`);
-    deps.err(AUTH_LOGIN_USAGE);
-    return 1;
-  }
-  const signal = deps.signal ?? new AbortController().signal;
-  const oauth: OAuthDeps = { ...defaultOAuthDeps(), ...deps.oauth };
-  deps.out(`rovecode auth login ${id} — ${provider.label}`);
-  try {
-    const cred = await provider.login({ notify: (n) => { for (const line of describeNotice(n)) deps.out(`  ${line}`); }, signal }, oauth);
-    (deps.save ?? saveOAuthCredential)(id, cred);
-    deps.out(`stored OAuth token for ${id} in ${credentialsPath()} (${expiryText(cred.expires, oauth.now())})`);
-    return 0;
-  } catch (e) {
-    if (signal.aborted) {
-      deps.err("login cancelled");
-      return 130;
-    }
-    deps.err(`error: ${e instanceof Error ? e.message : String(e)}`);
-    return 1;
-  }
-}
-
-/** argv entry (main.ts `auth login …`): console output, SIGINT → abort. */
-export async function cmdAuthLogin(args: string[]): Promise<number> {
-  const ac = new AbortController();
-  const onSigint = () => ac.abort();
-  process.once("SIGINT", onSigint);
-  try {
-    return await runAuthLogin(args[0] ?? "", { out: (l) => console.log(l), err: (l) => console.error(l), signal: ac.signal });
-  } finally {
-    process.removeListener("SIGINT", onSigint);
-  }
-}

package/src/cli/connect.ts

@@ -1,244 +0,0 @@
-/** `rovecode connect` — one line from "nothing configured" to "a model answers".
- *
- *    rovecode connect                                  the step-by-step wizard (cli/setup.ts)
- *    rovecode connect anthropic                        a built-in: key from the env, else a hidden prompt
- *    rovecode connect anthropic --model claude-opus-5  pin the model too
- *    rovecode connect ollama --no-key                  a local server, nothing to store
- *    rovecode connect myproxy https://host/v1 --key    any OpenAI-compatible or Anthropic URL
- *    echo $KEY | rovecode connect groq --key-stdin     scripts and CI: no TTY needed
- *
- *  It does what `setup` does — register, store the key, pick the model, one tiny real call, persist the
- *  default — but takes the answers from argv instead of asking, so it fits in a README, a Dockerfile or
- *  a CI step. `rovecode connect` with no arguments is exactly `rovecode setup`.
- *
- *  The secret is never a flag VALUE: `--key` prompts (hidden, TTY), `--key-stdin` reads one line, and
- *  `--key-env NAME` names an env var to read at call time. A key passed as argv would sit in the shell
- *  history and in every `ps` listing on the machine, so there is no `--key <value>` form.
- *
- *  Every step reads through an injectable seam (secret / stdin / save / probe / out) so the whole flow
- *  is unit-testable with no network and no terminal.
- *
- *  Exit codes: 0 connected · 1 the test call failed (the config IS written — a script should notice) ·
- *  2 usage error / no key available and no way to ask · 3 CONNECT_WAITING, only when the caller passed
- *  `deferKey`: the provider is registered and the flow is parked until the key lands (the TUI, which has
- *  no masked input, arms a watcher and re-enters). Wording: core/voice.ts — short lines, every problem
- *  ends with "→ next:". */
-
-import { readSecret, saveCredential } from "../providers/auth.ts";
-import { PROVIDER_ID_RE, inferProtocol, isConfigured, type ProviderProtocol, type ProviderSpec, type ResolvedProvider } from "../providers/provider-config.ts";
-import type { FileScope } from "../providers/provider-config.ts";
-import type { ProviderRegistry } from "../providers/registry.ts";
-import { next } from "../core/voice.ts";
-import type { ProbeResult } from "./setup.ts";
-
-/** returned instead of an error when `deferKey` handles the missing key: nothing failed, the flow is parked */
-export const CONNECT_WAITING = 3;
-
-export const CONNECT_USAGE =
-  "usage: rovecode connect [<id> [<baseUrl>]] [--model <id>] [--key | --key-stdin | --key-env NAME | --no-key] [--protocol openai|anthropic] [--project] [--no-test]";
-
-export interface ConnectArgs {
-  id: string;
-  baseUrl?: string;
-  model?: string;
-  protocol?: ProviderProtocol;
-  /** how the key is obtained; "auto" = stored/env if there is one, else prompt when a TTY allows it */
-  key: "auto" | "prompt" | "stdin" | "none";
-  keyEnv?: string;
-  scope: FileScope;
-  test: boolean;
-}
-
-/** argv → ConnectArgs. Pure: no files, no env, no network — the parser is the half worth pinning. */
-export function parseConnectArgs(words: readonly string[]): ConnectArgs | { error: string } {
-  const pos: string[] = [];
-  let model: string | undefined;
-  let protocol: ProviderProtocol | undefined;
-  let keyEnv: string | undefined;
-  let key: ConnectArgs["key"] = "auto";
-  let scope: FileScope = "user";
-  let test = true;
-  const keyFlags: string[] = [];
-
-  for (let i = 0; i < words.length; i++) {
-    const w = words[i]!;
-    const value = (): string | undefined => { const v = words[i + 1]; if (v === undefined || v.startsWith("-")) return undefined; i++; return v; };
-    switch (w) {
-      case "--model": { const v = value(); if (v === undefined) return { error: `--model needs a value — ${CONNECT_USAGE}` }; model = v; break; }
-      case "--key-env": { const v = value(); if (v === undefined) return { error: `--key-env needs a value — ${CONNECT_USAGE}` }; keyEnv = v; keyFlags.push(w); break; }
-      case "--protocol": {
-        const v = value();
-        if (v !== "openai" && v !== "anthropic") return { error: `--protocol takes openai or anthropic — ${CONNECT_USAGE}` };
-        protocol = v; break;
-      }
-      case "--key": key = "prompt"; keyFlags.push(w); break;
-      case "--key-stdin": key = "stdin"; keyFlags.push(w); break;
-      case "--no-key": key = "none"; keyFlags.push(w); break;
-      case "--project": scope = "project"; break;
-      case "--no-test": test = false; break;
-      default:
-        if (w.startsWith("-")) return { error: `unknown flag ${w} — ${CONNECT_USAGE}` };
-        pos.push(w);
-    }
-  }
-
-  // --key-env names an env var to read; --key/--key-stdin store a secret; --no-key stores nothing.
-  // Two of them together is a contradiction, not a precedence puzzle — say so instead of picking one.
-  if (keyFlags.length > 1) return { error: `${keyFlags.join(" and ")} contradict each other — pick one` };
-  if (pos.length === 0) return { error: `connect needs a provider id — ${CONNECT_USAGE}` };
-  if (pos.length > 2) return { error: `unexpected argument "${pos[2]}" — ${CONNECT_USAGE}` };
-
-  const id = pos[0]!.toLowerCase();
-  if (!PROVIDER_ID_RE.test(id)) return { error: `"${id}" won't work as an id (letters, digits, - _ .)` };
-  const baseUrl = pos[1];
-  if (baseUrl !== undefined && !/^https?:\/\//.test(baseUrl)) return { error: `"${baseUrl}" is not an http(s) URL — ${CONNECT_USAGE}` };
-  if (baseUrl === undefined && protocol !== undefined) return { error: "--protocol only applies when you give a base URL" };
-
-  return { id, ...(baseUrl !== undefined ? { baseUrl } : {}), ...(model !== undefined ? { model } : {}),
-           ...(protocol !== undefined ? { protocol } : {}), ...(keyEnv !== undefined ? { keyEnv } : {}), key, scope, test };
-}
-
-export interface ConnectDeps {
-  registry: ProviderRegistry;
-  /** default console.log */
-  out?: (line: string) => void;
-  /** one secret, masked (default: auth.ts readSecret) */
-  secret?: (prompt: string) => Promise<string>;
-  /** one line of piped stdin, for --key-stdin (default: reads process.stdin to end) */
-  stdin?: () => Promise<string>;
-  /** default auth.ts saveCredential */
-  save?: (id: string, secret: string, keyEnv: string) => void;
-  /** default registry.probe — one tiny real call */
-  probe?: (id: string, model?: string) => Promise<ProbeResult>;
-  /** default process.stdin.isTTY === true; a pipe must never be consumed by a prompt */
-  tty?: boolean;
-  /** a surface with no masked input (the TUI): called instead of failing when the key is missing and
-   *  cannot be asked for. It owns the hand-off wording and the waiting; runConnect returns CONNECT_WAITING. */
-  deferKey?: (spec: ResolvedProvider) => void;
-  /** the closing line(s). Default is the CLI's; the TUI passes its own ("tell me what you want done"). */
-  done?: string;
-  /** which surface the "→ next:" steps are spelled for — `rovecode provider test` on a shell,
-   *  `/provider test` in the TUI (core/voice.ts noModelHint uses the same distinction) */
-  where?: "cli" | "tui";
-}
-
-async function readAllStdin(): Promise<string> {
-  const chunks: Buffer[] = [];
-  for await (const c of process.stdin) chunks.push(c as Buffer);
-  return Buffer.concat(chunks).toString("utf8");
-}
-
-export async function runConnect(args: ConnectArgs, deps: ConnectDeps): Promise<number> {
-  const out = deps.out ?? console.log;
-  const secret = deps.secret ?? ((p: string) => readSecret(p));
-  const stdin = deps.stdin ?? readAllStdin;
-  const save = deps.save ?? saveCredential;
-  const reg = deps.registry;
-  const probe = deps.probe ?? ((id: string, model?: string) => reg.probe(id, model));
-  const tty = deps.tty ?? process.stdin.isTTY === true;
-  const tui = deps.where === "tui";
-
-  // ---- 1. the provider ----
-  // A base URL registers (or re-registers) the endpoint. Without one the id must already be known —
-  // built-in or previously added — and --no-key/--key-env/--model still write a user entry over it,
-  // which is how a built-in row becomes a local keyless server (setup.ts does the same thing).
-  const existing = reg.get(args.id);
-  const patching = args.key === "none" || args.keyEnv !== undefined;
-  if (args.baseUrl !== undefined || patching) {
-    const baseUrl = args.baseUrl ?? existing?.baseUrl;
-    if (baseUrl === undefined) {
-      out(`◆ I don't know a provider called "${args.id}".`);
-      out(`  known: ${reg.ids().join(" ")}`);
-      out(`  ${next(`rovecode connect ${args.id} <baseUrl>`)} to register your own endpoint`);
-      return 2;
-    }
-    const protocol = args.protocol ?? existing?.protocol ?? inferProtocol(baseUrl);
-    const defaultModel = args.model ?? existing?.defaultModel;
-    const spec: ProviderSpec = {
-      id: args.id, baseUrl, protocol,
-      ...(args.keyEnv !== undefined ? { keyEnv: args.keyEnv } : existing?.keyEnv !== undefined && args.baseUrl === undefined ? { keyEnv: existing.keyEnv } : {}),
-      ...(defaultModel !== undefined ? { defaultModel } : {}),
-      ...(args.key === "none" ? { noKey: true } : {}),
-    };
-    const r = reg.add(spec, args.scope);
-    if ("error" in r) { out(`◆ ${r.error}`); out(`  ${next("rovecode connect")} for the step-by-step version`); return 2; }
-    out(`◆ ${r.id} registered (${r.protocol} protocol, ${r.baseUrl}${args.key === "none" ? ", no key" : ""}).`);
-  } else if (existing === undefined) {
-    out(`◆ I don't know a provider called "${args.id}".`);
-    out(`  known: ${reg.ids().join(" ")}`);
-    out(`  ${next(`rovecode connect ${args.id} <baseUrl>`)} to register your own endpoint`);
-    return 2;
-  }
-
-  const spec = reg.get(args.id);
-  if (spec === undefined) { out(`◆ ${args.id} did not survive registration — that is a bug.`); return 2; }
-
-  // ---- 2. the key ----
-  let hasKey = isConfigured(spec);
-  if (!hasKey || args.key === "prompt" || args.key === "stdin") {
-    if (args.key === "stdin") {
-      const s = (await stdin()).split("\n")[0]!.trim();
-      if (s.length === 0) { out(`◆ nothing came in on stdin — no key stored.`); out(`  ${next(`echo $KEY | rovecode connect ${args.id} --key-stdin`)}`); return 2; }
-      save(args.id, s, spec.keyEnv);
-      out(`◆ key stored for ${args.id} (hidden; ~/.rovecode/credentials.json).`);
-      hasKey = true;
-    } else if (args.key === "prompt" || (args.key === "auto" && tty)) {
-      const s = (await secret(`${spec.keyEnv} (hidden): `)).trim();
-      if (s.length === 0) {
-        out(`◆ no key stored — I can't call ${args.id} without one.`);
-        out(`  ${next(`rovecode auth set ${args.id}`)}   (or set ${spec.keyEnv} in your environment)`);
-        return 2;
-      }
-      save(args.id, s, spec.keyEnv);
-      out(`◆ key stored for ${args.id} (hidden; ~/.rovecode/credentials.json).`);
-      hasKey = true;
-    } else if (deps.deferKey !== undefined) {
-      // a surface that cannot prompt (the TUI) takes over: it says how to hand the key over and
-      // finishes this same call once the key lands
-      deps.deferKey(spec);
-      return CONNECT_WAITING;
-    } else {
-      // no key anywhere and no terminal to ask on: a pipe must not be consumed by a prompt
-      out(`◆ ${args.id} has no key, and there is no terminal to ask on.`);
-      out(`  ${next(`set ${spec.keyEnv}, or pipe it: echo $KEY | rovecode connect ${args.id} --key-stdin`)}`);
-      return 2;
-    }
-  } else {
-    out(spec.noKey === true
-      ? `◆ ${args.id} needs no key (local server).`
-      : `◆ ${args.id} already has a key (${spec.keySource === "stored" ? "stored" : `env ${spec.keyEnv}`}).`);
-  }
-  reg.refresh();
-
-  // ---- 3. the model ----
-  const model = args.model ?? reg.get(args.id)?.defaultModel;
-  if (model === undefined) {
-    out(`◆ ${args.id} is connected but has no model yet.`);
-    out(`  ${next(tui ? `/models ${args.id}, then /model ${args.id}/<model> --save` : `rovecode model list ${args.id}, then rovecode model use ${args.id}/<model>`)}`);
-    return 0;
-  }
-
-  // ---- 4. one tiny real call ----
-  let ok = true;
-  if (args.test) {
-    out(`◆ testing ${args.id}/${model} …`);
-    const r = await probe(args.id, model);
-    ok = r.ok;
-    out(`  ${r.detail}`);
-  }
-
-  // ---- 5. the default ----
-  // written even when the probe failed: the config is what the user asked for, and `provider test`
-  // is one command away. The exit code carries the failure instead.
-  const d = reg.setDefault(`${args.id}/${model}`, args.scope);
-  if ("error" in d) { out(`◆ ${d.error}`); out(`  ${next(`rovecode model use ${args.id}/<model>`)}`); return 2; }
-  out(`◆ default → ${d.provider}/${d.model} (${tui ? "this session switched too" : "running TUIs switch live"}).`);
-
-  if (!ok) {
-    out(`  ${next(`check the key and the URL, then ${tui ? "/provider" : "rovecode provider"} test ${args.id} ${model}`)}`);
-    return 1;
-  }
-  out("");
-  out(deps.done ?? 'Done. Try:  rovecode "explain this repo"\n  or open the cockpit:  rovecode');
-  return 0;
-}

package/src/cli/context-cmd.ts

@@ -1,199 +0,0 @@
-/** `rovecode context [session-id]` — what is in the window right now, item by item, and how far our
- *  arithmetic is from the provider's own count.
- *
- *  Reads a saved session from `<cwd>/.rovecode/sessions` (the newest one unless an id is given) and
- *  prints the breakdown core/context-report.ts computes. The interesting line is `drift`: the estimate
- *  is o200k, which is exact for OpenAI models and an approximation everywhere else, so the honest thing
- *  is to print the provider's own number beside ours whenever a turn reported one — and to say plainly
- *  when the two disagree by more than a twentieth, because compaction fires on the estimate.
- *
- *  Offline: the catalog is the bundled snapshot plus rovecode's own table, no fetch. `--json` prints the
- *  report verbatim for scripts; `--no-runtime` skips building the runtime, and with it the system-prompt
- *  and tool-schema rows, for a project whose config does not load. */
-
-import { join } from "node:path";
-import { listSessions, SessionStore } from "../core/session.ts";
-import { contextReport, DRIFT_TOLERANCE, type ContextReport } from "../core/context-report.ts";
-import { ModelCatalog } from "../providers/catalog.ts";
-
-export interface ContextCliDeps {
-  cwd?: string;
-  /** overridden in tests; production reads the default model from the provider registry */
-  currentRef?: () => { provider: string; model: string } | null;
-  log?: (line: string) => void;
-  err?: (line: string) => void;
-}
-
-const bar = (fraction: number, width = 24): string => {
-  const filled = Math.max(0, Math.min(width, Math.round(fraction * width)));
-  return "█".repeat(filled) + "·".repeat(width - filled);
-};
-
-const n = (v: number): string => v.toLocaleString("en-US");
-const pct = (v: number): string => `${(v * 100).toFixed(1)}%`;
-
-export function renderContext(r: ContextReport, sessionId: string): string[] {
-  const out: string[] = [];
-  out.push(`session ${sessionId} · ${r.model.provider}/${r.model.model}`);
-  out.push("");
-  if (r.window) {
-    out.push(`context  ${bar(r.fraction ?? 0)}  ~${n(r.corrected)} of ${n(r.window)} (${pct(r.fraction ?? 0)})`);
-    out.push(`         ${n(r.remaining ?? 0)} left${r.nearLimit ? " — near the limit, compaction is due" : ""}`);
-  } else {
-    out.push(`context  ~${n(r.corrected)} tokens — this model's window is not in the catalog`);
-  }
-  // never correct a number silently: say the raw estimate, the factor, and where the factor is from
-  if (r.scale.factor !== 1) {
-    out.push(`         o200k counted ${n(r.estimated)}, scaled by ${r.scale.factor}× — ${r.scale.note}`);
-  } else if (!r.scale.measured) {
-    out.push(`         ${r.scale.note}`);
-  }
-  out.push("");
-  const width = Math.max(...r.slices.map((s) => s.label.length), 10);
-  for (const s of r.slices) {
-    out.push(`  ${s.label.padEnd(width)}  ${n(s.tokens).padStart(9)}  ${pct(s.share).padStart(6)}${s.note ? `  — ${s.note}` : ""}`);
-  }
-  if (r.images > 0) out.push(`  ${"images".padEnd(width)}  ${String(r.images).padStart(9)}         — not estimated; image tokens are provider-specific`);
-  out.push("");
-  if (r.drift) {
-    const d = r.drift;
-    const dir = d.delta > 0 ? "more than we estimate" : "less than we estimate";
-    out.push(`drift    provider counted ${n(d.reported)} for the last turn's prompt, we estimated ${n(d.estimated)}`);
-    out.push(`         ${n(Math.abs(d.delta))} ${dir} (${pct(d.fraction)})${d.beyondTolerance ? ` — beyond the ${pct(DRIFT_TOLERANCE)} tolerance; the meter above reads ${d.delta > 0 ? "low" : "high"} for this model` : ""}`);
-  } else {
-    out.push("drift    no turn reported usage yet — nothing to compare the estimate against");
-  }
-  out.push("");
-  const t = r.totals;
-  out.push(`billed   ${n(t.input)} in · ${n(t.output)} out · ${n(t.cacheRead)} cache read · ${n(t.cacheWrite)} cache written`);
-  // three different silences, and saying the wrong one is a lie about the catalog: nothing has been
-  // billed yet, versus the catalog not pricing this model, versus a partly priced transcript.
-  const billedAnything = t.input + t.output + t.cacheRead + t.cacheWrite > 0;
-  out.push(
-    r.costUsd !== undefined
-      ? `cost     $${r.costUsd.toFixed(4)}${r.unpricedTurns > 0 ? ` — lower bound, ${r.unpricedTurns} turn${r.unpricedTurns > 1 ? "s" : ""} unpriced` : ""}`
-      : billedAnything
-        ? `cost     unknown — no pricing for ${r.model.provider}/${r.model.model}`
-        : "cost     $0.0000 — nothing has been billed in this session yet",
-  );
-  return out;
-}
-
-/** the `--exact` rows: the provider's own count of this prompt, and how far our meter sits from it.
- *  A refusal prints the reason on the same row — a count nobody could obtain is not a zero. */
-export function renderExact(e: { inputTokens?: number; reason?: string; placeholder?: boolean }, estimated: number): string[] {
-  if (e.inputTokens === undefined) return ["", `exact    not counted — ${e.reason ?? "no reason given"}`];
-  const delta = estimated - e.inputTokens;
-  const fraction = e.inputTokens > 0 ? Math.abs(delta) / e.inputTokens : 0;
-  const verdict =
-    delta === 0
-      ? "our estimate agrees exactly"
-      : `our estimate reads ${delta > 0 ? "high" : "low"} by ${n(Math.abs(delta))} (${pct(fraction)})${fraction > DRIFT_TOLERANCE ? ` — beyond the ${pct(DRIFT_TOLERANCE)} tolerance` : ""}`;
-  const rows = ["", `exact    the provider counted ${n(e.inputTokens)} for this prompt`, `         ${verdict}`];
-  if (e.placeholder) rows.push("         this session has no turns yet — the count includes a one-character placeholder message, which the API requires");
-  return rows;
-}
-
-export async function cmdContext(args: string[], deps: ContextCliDeps = {}): Promise<number> {
-  const log = deps.log ?? ((l: string) => console.log(l));
-  const err = deps.err ?? ((l: string) => console.error(l));
-  const cwd = deps.cwd ?? process.cwd();
-  const json = args.includes("--json");
-  const id = args.find((a) => !a.startsWith("-"));
-
-  // --json is one document on stdout on every exit, the failing ones included — a script that asked for the
-  // report gets `{error}` it can read, not an empty stdout and a 1 (the market commands keep the same rule)
-  const fail = (msg: string): 1 => { err(msg); if (json) log(JSON.stringify({ error: msg })); return 1; };
-
-  const sessionsDir = join(cwd, ".rovecode", "sessions");
-  const sessions = listSessions(sessionsDir);
-  const chosen = id ?? sessions[0]?.id;
-  if (!chosen) return fail("no sessions here — run rovecode in this directory first");
-  if (id && !sessions.some((s) => s.id === id)) return fail(`no session ${id} here — rovecode context lists the newest by default`);
-
-  const messages = new SessionStore(sessionsDir, chosen).messages();
-  const ref = deps.currentRef
-    ? deps.currentRef()
-    : await (async () => {
-        const { ProviderRegistry } = await import("../providers/registry.ts");
-        return new ProviderRegistry(cwd).defaultRef() ?? null;
-      })();
-  if (!ref) return fail("no default model — rovecode model use <provider/model>");
-
-  // The system prompt and the tool schemas are the two rows a transcript cannot tell us, and they are
-  // the largest fixed cost of every turn — so the command builds the same runtime a real run would and
-  // asks it, unless --no-runtime says not to (a broken project config should not stop a token count).
-  // MCP tools are deliberately absent: their schemas exist only after connecting to a server, and
-  // starting other people's processes to print a number is not a trade this command should make.
-  let fixed: { system?: string; toolSchemas?: string; schemas?: unknown[]; note?: string } = {};
-  if (!args.includes("--no-runtime")) {
-    try {
-      const { createRuntime } = await import("./runtime.ts");
-      // sessionId: the one we are reporting on. Without it the runtime opens a NEW session directory,
-      // so merely asking "what is in the window" would leave an empty session behind — and the next
-      // `rovecode context` would report that empty one instead.
-      const rt = createRuntime({ cwd, stream: null, sessionId: chosen });
-      const schemas = rt.registry.list().map((t) => t.schema);
-      // buildDef, not systemPrompt(): the prompt a run actually sends is the base plus the model
-      // profile, the design section and — for a model without native tool calling — the tool block.
-      // Asking for the base alone under-counts the row by everything that makes it big.
-      const def = rt.buildDef({ ...ref, effort: "auto" });
-      const system = typeof def.systemPrompt === "string" ? def.systemPrompt : def.systemPrompt({});
-      fixed = { system, toolSchemas: JSON.stringify(schemas), schemas };
-      await rt.mcp?.close().catch(() => {});
-    } catch (e) {
-      fixed = { note: `the system prompt and tool schemas are not counted — this project's runtime did not build (${e instanceof Error ? e.message : String(e)})` };
-    }
-  }
-
-  const catalog = new ModelCatalog();
-  const report = contextReport({
-    messages,
-    current: ref,
-    ...(fixed.system !== undefined ? { system: fixed.system } : {}),
-    ...(fixed.toolSchemas !== undefined ? { toolSchemas: fixed.toolSchemas } : {}),
-    lookup: (r) => {
-      const info = catalog.lookup(r.provider, r.model);
-      if (!info) return undefined;
-      return {
-        ...(info.contextWindow !== undefined ? { contextWindow: info.contextWindow } : {}),
-        ...(info.pricing ? { pricing: info.pricing } : {}),
-        // the tier travels with the pricing or the report bills a 250k-token xAI turn at half rate
-        ...(info.tier ? { tier: info.tier } : {}),
-      };
-    },
-  });
-
-  // --exact: stop estimating and ask the provider. Anthropic counts the same body a request would carry
-  // and returns the number the window and the bill are computed from; o200k is only our stand-in for it.
-  let exact: { inputTokens?: number; reason?: string; endpoint?: string; placeholder?: true } | undefined;
-  if (args.includes("--exact")) {
-    const { countPromptRemotely } = await import("../core/count-remote.ts");
-    const { ProviderRegistry } = await import("../providers/registry.ts");
-    const p = new ProviderRegistry(cwd).get(ref.provider);
-    if (!p) exact = { reason: `provider "${ref.provider}" is not configured here` };
-    else {
-      const r = await countPromptRemotely({
-        provider: { baseUrl: p.baseUrl, protocol: p.protocol, ...(p.apiKey ? { apiKey: p.apiKey } : {}), ...(p.headers ? { headers: p.headers } : {}) },
-        model: ref.model,
-        messages,
-        ...(fixed.system !== undefined ? { system: fixed.system } : {}),
-        // the same schemas the estimate counted; without them the two numbers would describe
-        // different prompts and the comparison below would be meaningless
-        ...(fixed.schemas ? { tools: fixed.schemas } : {}),
-      });
-      exact = r.ok
-        ? { inputTokens: r.inputTokens, endpoint: r.endpoint, ...(r.placeholder ? { placeholder: true as const } : {}) }
-        : { reason: r.reason };
-    }
-  }
-
-  if (json) log(JSON.stringify({ session: chosen, ...report, ...(exact ? { exact } : {}), ...(fixed.note ? { note: fixed.note } : {}) }, null, 2));
-  else {
-    for (const line of renderContext(report, chosen)) log(line);
-    if (exact) for (const line of renderExact(exact, report.estimated)) log(line);
-    if (fixed.note) log(`note     ${fixed.note}`);
-    else if (fixed.system !== undefined) log("note     MCP tools are not counted — their schemas exist only once a server is connected");
-  }
-  return 0;
-}

package/src/cli/dispatch.ts

@@ -1,82 +0,0 @@
-/** Pure CLI argv parsing — separated from main.ts (which runs at import) so
- *  dispatch is unit-testable. Flags (--*) never become the command, and neither
- *  does the VALUE of a value-taking flag: `rovecode --out o.md export abc` must
- *  dispatch `export`, not `o.md` — an unknown cmd falls through to the bare-
- *  prompt one-shot, which spends tokens on a real provider. */
-
-import { existsSync } from "node:fs";
-import { parseEffort, type ThinkingEffort } from "../core/types.ts";
-
-export interface CliInvocation {
-  /** first non-flag arg after the script path; "" = interactive default */
-  cmd: string;
-  plain: boolean;
-  yolo: boolean;
-  /** the middle tier: writes inside the workspace stop asking (ROVECODE_ACCEPT_EDITS=1 does the same) */
-  acceptEdits: boolean;
-  /** `--effort off|low|medium|high` — how hard the model thinks (ROVECODE_EFFORT does the same); absent when not given */
-  effort?: ThinkingEffort;
-  /** port #44: `--classic` forces the pi-tui chat (the sextant surface is the default on a capable TTY) */
-  classic: boolean;
-  /** port #44: `--pet <name>` names the sextant pet (TUI-only value flag; absent when not given) */
-  pet?: string;
-  /** args after the command, flags excluded (one-shot prompt words, ids) */
-  rest: string[];
-}
-
-/** Every flag the CLI hand-parses a VALUE for out of process.argv: --resume
- *  (main.ts, TUI session id), --key (cmdAuth, key name), --out (export.ts, target
- *  path), --output (output.ts, cmdRun output mode), --pet (here, the sextant pet
- *  name), --protocol / --key-env / --model / --scope (cmdProvider, `rovecode provider add`;
- *  providers/registry.ts parseAddArgs). parseCli only skips the value when locating cmd;
- *  the owners still read it themselves, and `rest` keeps post-command values
- *  (cmdAuth/export.ts/output.ts drop their own). Add here when a new value flag lands. */
-/** Every flag that takes a value. A flag missing from this set does not merely parse oddly: its VALUE
- *  becomes a prompt word. `rovecode run "yazi golgesi gozukmuyor" --max-cost 0.15` sent the model
- *  "yazi golgesi gozukmuyor 0.15", and the model read the stray number as the shadow's opacity and used
- *  it. --max-cost landed in 60456d6 without being added here; the same class of bug had just been fixed
- *  for every other value flag in the same commit, which is exactly why the table has to be one list. */
-export const VALUE_FLAGS: ReadonlySet<string> = new Set(["--resume", "--key", "--out", "--output", "--pet", "--effort", "--protocol", "--key-env", "--model", "--scope", "--max-turns", "--max-seconds", "--max-cost", "--add-dir"]); // --add-dir: cli/run-flags.ts (a workspace root, never a prompt word)
-
-/** file extensions a stray argv word tends to carry: code, docs, data. Not a guess at natural language —
- *  a word that ends like a file is treated like one, a word that does not is left alone */
-const FILE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|kt|rb|php|c|h|cpp|cs|swift|sh|ps1|bat|md|mdx|txt|json|jsonc|yaml|yml|toml|ini|env|html|css|scss|svg|csv|sql|lock)$/i;
-
-/** A first word that is shaped like a PATH rather than a command or a sentence: it starts the way paths
- *  start (./ ../ / .\ ..\ \ or a drive letter), or ends the way files end, or names something that
- *  exists on disk. Only single words are ever path-shaped — a sentence is a prompt however it begins.
- *  main.ts asks before sending such a word to the provider: an unknown first word falls through to the
- *  one-shot `run`, and on 2026-09-06 `rovecode ./src/cli/main.ts` typed by mistake became a billed prompt.
- *  `exists` is injectable for tests. */
-export function pathShaped(word: string, exists: (p: string) => boolean = existsSync): boolean {
-  if (word.length === 0 || /\s/.test(word)) return false;
-  if (/^(\.\.?[\\/]|[\\/]|[A-Za-z]:[\\/])/.test(word)) return true;
-  if (FILE_EXT.test(word)) return true;
-  try { return exists(word); } catch { return false; }
-}
-
-export function parseCli(argv: string[]): CliInvocation {
-  const args = argv.slice(2);
-  const isFlag = (a: string) => a.startsWith("-");
-  // a token is the command unless it is a flag or the value of the value flag before it
-  const cmdIdx = args.findIndex((a, i) => !isFlag(a) && !(i > 0 && VALUE_FLAGS.has(args[i - 1]!)));
-  const wantsHelp = args.includes("--help") || args.includes("-h");
-  // --pet <name>: a flag-shaped "value" is not a value (the flag after it stays a flag)
-  const petIdx = args.indexOf("--pet");
-  const petArg = petIdx !== -1 ? args[petIdx + 1] : undefined;
-  const pet = petArg !== undefined && !isFlag(petArg) ? petArg : undefined;
-  // --effort <level>: an unrecognized word is DROPPED, not read as "off" — a typo must leave the
-  // runtime's own default in place rather than silently turning thinking off
-  const effIdx = args.indexOf("--effort");
-  const effortArg = parseEffort(effIdx !== -1 ? args[effIdx + 1] : undefined);
-  return {
-    cmd: wantsHelp && cmdIdx === -1 ? "help" : cmdIdx === -1 ? "" : args[cmdIdx]!,
-    plain: args.includes("--plain"),
-    yolo: args.includes("--yolo"),
-    acceptEdits: args.includes("--accept-edits"),
-    ...(effortArg !== undefined ? { effort: effortArg } : {}),
-    classic: args.includes("--classic"),
-    ...(pet !== undefined ? { pet } : {}),
-    rest: cmdIdx === -1 ? [] : args.slice(cmdIdx + 1).filter((a) => !isFlag(a)),
-  };
-}