shortcutxl 0.3.66 → 0.3.68

package/BINARY-INVENTORY.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-07-05T22:33:02.450Z",
+  "generatedAt": "2026-07-07T16:51:48.477Z",
   "package": "shortcutxl",
   "binaryExtensions": [
     ".dll",
@@ -11,7 +11,7 @@
   "files": [
     {
       "path": "xll/ShortcutXL.xll",
-      "sha256": "496ee4c9a50460b1059a45aa0968e7c16b5ccbc71531e6595a29f07925f5034f",
+      "sha256": "cfa2fd09be91611de19c4783e7cf811e12de681c5ac4992b7581e6193802d6b5",
       "source": "ShortcutXL native XLL build",
       "version": "package",
       "builtBy": "shortcut",
@@ -523,7 +523,7 @@
     },
     {
       "path": "xll/python/Scripts/httpx.exe",
-      "sha256": "031eb3e3b2d40faab175de19ab026c906f258de7e942d03d1e73a18b52d46713",
+      "sha256": "513600b1071b099e3cd29c6822e6b7e426e56b39516250024232eb800d3a39a9",
       "source": "httpx console launcher installed into embedded Python",
       "version": "see packaged httpx distribution",
       "builtBy": "third-party",
@@ -531,7 +531,7 @@
     },
     {
       "path": "xll/python/Scripts/idna.exe",
-      "sha256": "3507fcce71ef09fdbee695c31827b4fc16be173b856a4851abd821d88590556a",
+      "sha256": "b0523c05ff7312a8c3be28567369c1c70d8ab8c76185b2c54b6b74a268475257",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -539,7 +539,7 @@
     },
     {
       "path": "xll/python/Scripts/pip.exe",
-      "sha256": "6c981a5608712887689c7d809c3c6402bd70b3477517d2a5e37c581cb7273259",
+      "sha256": "0d4a9f4b4fe84443b91e90e05a45017fbcd2a6e26ccd86719c1d73aac5ec3279",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -547,7 +547,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.13.exe",
-      "sha256": "6c981a5608712887689c7d809c3c6402bd70b3477517d2a5e37c581cb7273259",
+      "sha256": "0d4a9f4b4fe84443b91e90e05a45017fbcd2a6e26ccd86719c1d73aac5ec3279",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -555,7 +555,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.exe",
-      "sha256": "6c981a5608712887689c7d809c3c6402bd70b3477517d2a5e37c581cb7273259",
+      "sha256": "0d4a9f4b4fe84443b91e90e05a45017fbcd2a6e26ccd86719c1d73aac5ec3279",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -563,7 +563,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_postinstall.exe",
-      "sha256": "d9d476c526bf11c4e1230e4df6dd83c35c974b36b1e6db75617757b8c3294def",
+      "sha256": "d12dacb337e27c293f084cf871043c010d6e17ebcea54fa5b33b90172246413d",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -571,7 +571,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_testall.exe",
-      "sha256": "acfd69054b6e059bca45a255c20053fee2a6690b3b3a4db8cb0d65736ecfcd06",
+      "sha256": "91433e91bc8ba60593d601cf5e182d31a20aaed423e729f2238ae63467b0a5be",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",

package/CHANGELOG.md

@@ -1,9 +1,9 @@
 # Changelog
 
-## [0.3.66]
+## [0.3.68]
 
-- **Fireworks GLM 5.2** — Added the Fireworks GLM 5.2 model.
-- **Quarterly update skill** — New built-in skill for producing quarterly updates.
+- **Model availability fix** - Introducing GLM 5.2 and Pivot models for eligible individual CLI accounts, not teams plans.
+- **Persistent prompt history** — Your prompt history now persists across CLI sessions and can be accessed by up/down arrows.
 
 ## [0.3.65]
 

package/agent-docs/README.md

@@ -315,6 +315,25 @@ shortcut config                   # Enable/disable package resources
 | `--session-dir <dir>` | Custom session storage directory |
 | `--no-session` | Ephemeral mode (don't save) |
 
+### Permission Options
+
+Shortcut has separate controls for runtime permissions and spreadsheet permissions. Use the flag that matches the permission boundary you want to bypass for a single session.
+
+| Option | Description |
+|--------|-------------|
+| `--skip-runtime-permissions` | Bypass runtime filesystem and shell approval checks for this session |
+| `--skip-spreadsheet-permissions` | Allow headless spreadsheet auto-approval for this session |
+
+Runtime and spreadsheet approvals are separate. `--skip-runtime-permissions` affects runtime-owned filesystem and shell checks; it does not change spreadsheet approvals. `--skip-spreadsheet-permissions` affects headless spreadsheet approval only; it does not bypass runtime filesystem or shell checks.
+
+Use both flags when a non-interactive run needs both runtime access and spreadsheet auto-approval:
+
+```bash
+shortcut --skip-runtime-permissions --skip-spreadsheet-permissions -p "..."
+```
+
+In an interactive session, use `/permissions skip-runtime-permissions` to inspect or change the runtime bypass setting.
+
 ### Resource Options
 
 | Option | Description |

package/agent-docs/docs/keybindings.md

@@ -4,7 +4,7 @@ All keyboard shortcuts can be customized via `~/.shortcut/agent/keybindings.json
 
 ## Key Format
 
-`modifier+key` where modifiers are `ctrl`, `shift`, `alt` (combinable) and keys are:
+`modifier+key` where modifiers are `ctrl`, `shift`, `alt`/`option`/`meta` (combinable) and keys are:
 
 - **Letters:** `a-z`
 - **Special:** `escape`, `esc`, `enter`, `return`, `tab`, `space`, `backspace`, `delete`, `insert`, `clear`, `home`, `end`, `pageUp`, `pageDown`, `up`, `down`, `left`, `right`
@@ -13,121 +13,127 @@ All keyboard shortcuts can be customized via `~/.shortcut/agent/keybindings.json
 
 Modifier combinations: `ctrl+shift+x`, `alt+ctrl+x`, `ctrl+shift+alt+x`, etc.
 
+On macOS, Shortcut displays the Alt/Meta modifier as `Option`. In config files, `alt`, `option`, and `meta` are accepted as aliases for the same terminal modifier, so `"option+p"` and `"alt+p"` behave the same when your terminal sends Option as Meta/Alt input.
+
 ## All Actions
 
 ### Cursor Movement
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `cursorUp` | `up` | Move cursor up |
-| `cursorDown` | `down` | Move cursor down |
-| `cursorLeft` | `left`, `ctrl+b` | Move cursor left |
-| `cursorRight` | `right`, `ctrl+f` | Move cursor right |
-| `cursorWordLeft` | `alt+left`, `ctrl+left`, `alt+b` | Move cursor word left |
-| `cursorWordRight` | `alt+right`, `ctrl+right`, `alt+f` | Move cursor word right |
-| `cursorLineStart` | `home`, `ctrl+a` | Move to line start |
-| `cursorLineEnd` | `end`, `ctrl+e` | Move to line end |
-| `jumpForward` | `ctrl+]` | Jump forward to character |
-| `jumpBackward` | `ctrl+alt+]` | Jump backward to character |
-| `pageUp` | `pageUp` | Scroll up by page |
-| `pageDown` | `pageDown` | Scroll down by page |
+| Action            | Default                            | Description                |
+| ----------------- | ---------------------------------- | -------------------------- |
+| `cursorUp`        | `up`                               | Move cursor up             |
+| `cursorDown`      | `down`                             | Move cursor down           |
+| `cursorLeft`      | `left`, `ctrl+b`                   | Move cursor left           |
+| `cursorRight`     | `right`, `ctrl+f`                  | Move cursor right          |
+| `cursorWordLeft`  | `alt+left`, `ctrl+left`, `alt+b`   | Move cursor word left      |
+| `cursorWordRight` | `alt+right`, `ctrl+right`, `alt+f` | Move cursor word right     |
+| `cursorLineStart` | `home`, `ctrl+a`                   | Move to line start         |
+| `cursorLineEnd`   | `end`, `ctrl+e`                    | Move to line end           |
+| `jumpForward`     | `ctrl+]`                           | Jump forward to character  |
+| `jumpBackward`    | `ctrl+alt+]`                       | Jump backward to character |
+| `pageUp`          | `pageUp`                           | Scroll up by page          |
+| `pageDown`        | `pageDown`                         | Scroll down by page        |
 
 ### Deletion
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `deleteCharBackward` | `backspace` | Delete character backward |
-| `deleteCharForward` | `delete`, `ctrl+d` | Delete character forward |
-| `deleteWordBackward` | `ctrl+w`, `alt+backspace` | Delete word backward |
-| `deleteWordForward` | `alt+d`, `alt+delete` | Delete word forward |
-| `deleteToLineStart` | `ctrl+u` | Delete to line start |
-| `deleteToLineEnd` | `ctrl+k` | Delete to line end |
+| Action               | Default                   | Description               |
+| -------------------- | ------------------------- | ------------------------- |
+| `deleteCharBackward` | `backspace`               | Delete character backward |
+| `deleteCharForward`  | `delete`, `ctrl+d`        | Delete character forward  |
+| `deleteWordBackward` | `ctrl+w`, `alt+backspace` | Delete word backward      |
+| `deleteWordForward`  | `alt+d`, `alt+delete`     | Delete word forward       |
+| `deleteToLineStart`  | `ctrl+u`                  | Delete to line start      |
+| `deleteToLineEnd`    | `ctrl+k`                  | Delete to line end        |
 
 ### Text Input
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `newLine` | `shift+enter` | Insert new line |
-| `submit` | `enter` | Submit input |
-| `tab` | `tab` | Tab / autocomplete |
+| Action    | Default       | Description        |
+| --------- | ------------- | ------------------ |
+| `newLine` | `shift+enter` | Insert new line    |
+| `submit`  | `enter`       | Submit input       |
+| `tab`     | `tab`         | Tab / autocomplete |
 
 ### Kill Ring
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `yank` | `ctrl+y` | Paste most recently deleted text |
-| `yankPop` | `alt+y` | Cycle through deleted text after yank |
-| `undo` | `ctrl+-` | Undo last edit |
+| Action    | Default  | Description                           |
+| --------- | -------- | ------------------------------------- |
+| `yank`    | `ctrl+y` | Paste most recently deleted text      |
+| `yankPop` | `alt+y`  | Cycle through deleted text after yank |
+| `undo`    | `ctrl+-` | Undo last edit                        |
 
 ### Clipboard
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `copy` | `ctrl+c` | Copy selection |
-| `pasteImage` | `ctrl+v` | Paste image from clipboard |
+| Action       | Default                       | Description                |
+| ------------ | ----------------------------- | -------------------------- |
+| `copy`       | `ctrl+c`                      | Copy selection             |
+| `pasteImage` | `ctrl+v` (`alt+v` on Windows) | Paste image from clipboard |
 
 ### Application
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `interrupt` | `escape` | Cancel / abort |
-| `clear` | `ctrl+c` | Clear editor |
-| `exit` | `ctrl+d` | Exit (when editor empty) |
-| `suspend` | `ctrl+z` | Suspend to background |
-| `externalEditor` | `ctrl+g` | Open in external editor (`$VISUAL` or `$EDITOR`) |
+| Action                          | Default     | Description                                      |
+| ------------------------------- | ----------- | ------------------------------------------------ |
+| `interrupt`                     | `escape`    | Cancel / abort                                   |
+| `clear`                         | `ctrl+c`    | Clear editor                                     |
+| `exit`                          | `ctrl+d`    | Exit (when editor empty)                         |
+| `suspend`                       | `ctrl+z`    | Suspend to background                            |
+| `toggleAutoApprove`             | `shift+tab` | Toggle auto-approve                              |
+| `toggleRuntimePermissionBypass` | `alt+r`     | Toggle file/shell permission bypass              |
+| `toggleFastMode`                | `alt+f`     | Toggle fast mode                                 |
+| `externalEditor`                | `ctrl+g`    | Open in external editor (`$VISUAL` or `$EDITOR`) |
 
 ### Session
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `newSession` | *(none)* | Start a new session (`/new`) |
-| `tree` | *(none)* | Open session tree navigator (`/tree`) |
-| `fork` | *(none)* | Fork current session (`/fork`) |
-| `resume` | *(none)* | Open session resume picker (`/resume`) |
+| Action       | Default  | Description                            |
+| ------------ | -------- | -------------------------------------- |
+| `newSession` | _(none)_ | Start a new session (`/new`)           |
+| `tree`       | _(none)_ | Open session tree navigator (`/tree`)  |
+| `fork`       | _(none)_ | Fork current session (`/fork`)         |
+| `resume`     | _(none)_ | Open session resume picker (`/resume`) |
+| `cycleMode`  | `alt+m`  | Cycle agent mode                       |
 
 ### Models & Thinking
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `selectModel` | `ctrl+l` | Open model selector |
-| `cycleModelForward` | `ctrl+p` | Cycle to next model |
-| `cycleModelBackward` | `shift+ctrl+p` | Cycle to previous model |
-| `cycleThinkingLevel` | `shift+tab` | Cycle thinking level |
+| Action               | Default       | Description             |
+| -------------------- | ------------- | ----------------------- |
+| `selectModel`        | `ctrl+l`      | Open model selector     |
+| `cycleModelForward`  | `alt+p`       | Cycle to next model     |
+| `cycleModelBackward` | `shift+alt+p` | Cycle to previous model |
+| `cycleThinkingLevel` | `alt+t`       | Cycle thinking level    |
 
 ### Display
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `expandTools` | `ctrl+o` | Collapse/expand tool output |
+| Action           | Default  | Description                     |
+| ---------------- | -------- | ------------------------------- |
+| `expandTools`    | `ctrl+o` | Collapse/expand tool output     |
 | `toggleThinking` | `ctrl+t` | Collapse/expand thinking blocks |
 
 ### Message Queue
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `followUp` | `alt+enter` | Queue follow-up message |
-| `dequeue` | `alt+up` | Restore queued messages to editor |
+| Action     | Default     | Description                       |
+| ---------- | ----------- | --------------------------------- |
+| `followUp` | `alt+enter` | Queue follow-up message           |
+| `dequeue`  | `alt+up`    | Restore queued messages to editor |
 
 ### Selection (Lists, Pickers)
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `selectUp` | `up` | Move selection up |
-| `selectDown` | `down` | Move selection down |
-| `selectPageUp` | `pageUp` | Page up in list |
-| `selectPageDown` | `pageDown` | Page down in list |
-| `selectConfirm` | `enter` | Confirm selection |
-| `selectCancel` | `escape`, `ctrl+c` | Cancel selection |
+| Action           | Default            | Description         |
+| ---------------- | ------------------ | ------------------- |
+| `selectUp`       | `up`               | Move selection up   |
+| `selectDown`     | `down`             | Move selection down |
+| `selectPageUp`   | `pageUp`           | Page up in list     |
+| `selectPageDown` | `pageDown`         | Page down in list   |
+| `selectConfirm`  | `enter`            | Confirm selection   |
+| `selectCancel`   | `escape`, `ctrl+c` | Cancel selection    |
 
 ### Session Picker
 
-| Action | Default | Description |
-|--------|---------|-------------|
-| `toggleSessionPath` | `ctrl+p` | Toggle path display |
-| `toggleSessionSort` | `ctrl+s` | Toggle sort mode |
-| `toggleSessionNamedFilter` | `ctrl+n` | Toggle named-only filter |
-| `renameSession` | `ctrl+r` | Rename session |
-| `deleteSession` | `ctrl+d` | Delete session |
+| Action                     | Default          | Description                       |
+| -------------------------- | ---------------- | --------------------------------- |
+| `toggleSessionPath`        | `ctrl+p`         | Toggle path display               |
+| `toggleSessionSort`        | `ctrl+s`         | Toggle sort mode                  |
+| `toggleSessionNamedFilter` | `ctrl+n`         | Toggle named-only filter          |
+| `renameSession`            | `ctrl+r`         | Rename session                    |
+| `deleteSession`            | `ctrl+d`         | Delete session                    |
 | `deleteSessionNoninvasive` | `ctrl+backspace` | Delete session (when query empty) |
 
 ## Custom Configuration

package/dist/ai/types.d.ts

@@ -148,6 +148,7 @@ export interface Tool<TParameters extends TSchema = TSchema> {
     name: string;
     description: string;
     parameters: TParameters;
+    normalizeArguments?: (args: unknown, toolCall: ToolCall) => unknown;
 }
 export interface Context {
     systemPrompt?: string;

package/dist/ai/utils/validation.js

@@ -23,6 +23,10 @@ if (!isBrowserExtension) {
         console.warn('AJV validation disabled due to CSP restrictions');
     }
 }
+function getValidationArgs(tool, toolCall) {
+    const args = structuredClone(toolCall.arguments);
+    return tool.normalizeArguments ? tool.normalizeArguments(args, toolCall) : args;
+}
 /**
  * Finds a tool by name and validates the tool call arguments against its TypeBox schema
  * @param tools Array of tool definitions
@@ -49,12 +53,12 @@ export function validateToolArguments(tool, toolCall) {
     if (!ajv || isBrowserExtension) {
         // Trust the LLM's output without validation
         // Browser extensions can't use AJV due to Manifest V3 CSP restrictions
-        return toolCall.arguments;
+        return getValidationArgs(tool, toolCall);
     }
     // Compile the schema
     const validate = ajv.compile(tool.parameters);
     // Clone arguments so AJV can safely mutate for type coercion
-    const args = structuredClone(toolCall.arguments);
+    const args = getValidationArgs(tool, toolCall);
     // Validate the arguments (AJV mutates args in-place for type coercion)
     if (validate(args)) {
         return args;

package/dist/ai/validation.d.ts

@@ -3,6 +3,7 @@ import type { ToolCall } from './types.js';
 interface ValidatedTool {
     name: string;
     parameters: TSchema;
+    normalizeArguments?: (args: unknown, toolCall: ToolCall) => unknown;
 }
 export declare function validateToolArguments<TArgs = unknown>(tool: ValidatedTool, toolCall: ToolCall): TArgs;
 export {};

package/dist/ai/validation.js

@@ -20,12 +20,16 @@ if (!isBrowserExtension) {
         console.warn('AJV validation disabled due to CSP restrictions');
     }
 }
+function getValidationArgs(tool, toolCall) {
+    const args = structuredClone(toolCall.arguments);
+    return tool.normalizeArguments ? tool.normalizeArguments(args, toolCall) : args;
+}
 export function validateToolArguments(tool, toolCall) {
     if (!ajv || isBrowserExtension) {
-        return toolCall.arguments;
+        return getValidationArgs(tool, toolCall);
     }
     const validate = ajv.compile(tool.parameters);
-    const args = structuredClone(toolCall.arguments);
+    const args = getValidationArgs(tool, toolCall);
     if (validate(args)) {
         return args;
     }

package/dist/app/background/tool-summaries.js

@@ -36,7 +36,8 @@ export async function generateToolSummaryDetailed(input, shortcutLlmProxy, optio
             ],
             max_output_tokens: maxOutputTokens,
             effort_level: 'low',
-            thinking_type: 'off'
+            thinking_type: 'off',
+            llmOperation: 'summarize'
         }, {
             signal
         });

package/dist/app/prompts/com-api.js

@@ -127,7 +127,13 @@ export function getExcelComApiGuidelines(filterTag) {
 ===========================
 ## Shortcut Wrapper API
 ===========================
-Workbook, Worksheet, and helpers are pre-injected in execute_code (no import needed).`;
+Workbook, Worksheet, and helpers are pre-injected in execute_code (no import needed).
+
+### ALWAYS start a task like this (app is already injected — do NOT import win32com or Dispatch Excel):
+names = [wb.Name for wb in app.Workbooks]        # find the target workbook name
+wb = Workbook(app.Workbooks("YourFile.xlsx"))    # wrap the COM object — NOT a filename string: Workbook("YourFile.xlsx") fails
+print(wb.getSheetNames())                         # use getSheetNames() — NOT wb.SheetNames
+ws = wb.getSheet("Sheet1")                        # use getSheet(name) — NOT wb.Worksheets(...)`;
     const sections = [COM_GUIDELINES, header];
     for (const [name, cls] of Object.entries(ref.interfaces)) {
         sections.push(renderSection(name, cls, filterTag));

package/dist/app/prompts/spreadjs-api-reference.json

@@ -4,7 +4,7 @@
       "functions": {
         "getAPIInfo": {
           "signature": "getAPIInfo(functionName: string): string;",
-          "docstring": "Retrieves extended API documentation for less common functions. Returns docstring, function signature, parameters, return types, and all parameter type definitions.\n\nMerging/unmerging cells: addSpanAt, removeSpanAt\nCopying: cutAndPasteRange (move/cut-paste within same workbook), copySheet (full sheet duplication within same workbook)\nSheet dimensions: setTotalRowCount, setTotalColumnCount, expandSheetToFit\n  - CRITICAL: SpreadJS initializes sheets with 10K rows and 100 columns. Writing to cells beyond these limits will SILENTLY FAIL unless you expand first!\n  - Example: sheet.expandSheetToFit(\"A60000\"); sheet.setCell(\"A60000\", \"data\");\nNamed ranges: getNamedRangeInfo, addNamedRange, removeNamedRange\n@example general.getAPIInfo(\"addSpanAt\");",
+          "docstring": "Retrieves extended API documentation for less common functions. Returns docstring, function signature, parameters, return types, and all parameter type definitions.\n\nMerging/unmerging cells: addSpanAt, removeSpanAt\nSizing (all in px coordinates): setColumnWidthAt, setRowHeightAt, autoFitColumnsAt\nCopying: cutAndPasteRange (move/cut-paste within same workbook), copySheet (full sheet duplication within same workbook)\nSheet dimensions: setTotalRowCount, setTotalColumnCount, expandSheetToFit\n  - CRITICAL: SpreadJS initializes sheets with 10K rows and 100 columns. Writing to cells beyond these limits will SILENTLY FAIL unless you expand first!\n  - Example: sheet.expandSheetToFit(\"A60000\"); sheet.setCell(\"A60000\", \"data\");\nNamed ranges: getNamedRangeInfo, addNamedRange, removeNamedRange\n@example general.getAPIInfo(\"addSpanAt\");",
           "usedTypes": [],
           "tags": ["action", "ask"]
         },
@@ -221,6 +221,12 @@
           "usedTypes": [],
           "tags": ["action", "ask"]
         },
+        "autoFitColumnsAt": {
+          "signature": "autoFitColumnsAt(columnRange: string): void;",
+          "docstring": "Auto-fit the columns specified by columnRange e.g. autoFitColumnsAt(\"A:G\");\n@example sheet.autoFitColumnsAt(\"A:G\");",
+          "usedTypes": [],
+          "tags": ["hidden", "approval"]
+        },
         "clearFormatting": {
           "signature": "clearFormatting(range: string, properties?: (keyof Style)[]): void;",
           "docstring": "Clear formatting from a range of cells. Clears all formatting if no properties specified.\nPass specific Style keys to clear only those properties.",
@@ -245,12 +251,24 @@
           "usedTypes": [],
           "tags": ["action", "approval"]
         },
+        "setColumnWidthAt": {
+          "signature": "setColumnWidthAt(columnLetter: string, width: number): void;",
+          "docstring": "Set explicit width for the given column in pixels. Default column width is 72px.\n@example setColumnWidthAt(\"A\", 100);",
+          "usedTypes": [],
+          "tags": ["action", "approval"]
+        },
         "getDependentCells": {
           "signature": "getDependentCells(address: string): string;",
           "docstring": "Get all cells that depend on the given cell",
           "usedTypes": [],
           "tags": ["action", "ask"]
         },
+        "setRowHeightAt": {
+          "signature": "setRowHeightAt(rowAddress: string, height: number): void;",
+          "docstring": "Set explicit height for the given row in pixels. Default row height is 21px.\n@example setRowHeightAt(\"1\", 100);",
+          "usedTypes": [],
+          "tags": ["hidden", "approval"]
+        },
         "addSpanAt": {
           "signature": "addSpanAt(address: string, rowCount: number, colCount: number): void;",
           "docstring": "Merge a range starting from the cell at address (e.g., \"A1\")",

package/dist/app/providers/register-shortcut-provider.js

@@ -33,6 +33,50 @@ const BUILTIN_STREAM_BY_TRANSPORT = {
     'openai-responses': streamSimpleOpenAIResponses,
     'google-vertex': streamSimpleGoogleVertexGateway
 };
+function headerValue(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function isMainAgentStreamOptions(options) {
+    if (!options)
+        return false;
+    return (typeof options.convertToLlm === 'function' ||
+        options.userMessageId !== undefined ||
+        options.agentMode !== undefined ||
+        options.initialFileId !== undefined ||
+        options.fileAttachmentIds !== undefined ||
+        options.interactionMode !== undefined ||
+        options.speed !== undefined);
+}
+function createShortcutApiV2AttributionHeaders(options) {
+    const attribution = options;
+    const headers = {
+        'X-Agent-Runtime': 'shortcutxl_cli'
+    };
+    const userMessageId = headerValue(attribution?.userMessageId);
+    if (userMessageId)
+        headers['X-Turn-Id'] = userMessageId;
+    const agentMode = headerValue(attribution?.agentMode);
+    if (agentMode)
+        headers['X-Agent-Mode'] = agentMode;
+    const interactionMode = headerValue(attribution?.interactionMode);
+    if (interactionMode)
+        headers['X-Interaction-Mode'] = interactionMode;
+    const llmOperation = headerValue(attribution?.llmOperation) ??
+        (isMainAgentStreamOptions(attribution) ? 'chat' : undefined);
+    if (llmOperation)
+        headers['X-LLM-Operation'] = llmOperation;
+    const initialFileId = headerValue(attribution?.initialFileId);
+    if (initialFileId)
+        headers['X-Initial-File-Id'] = initialFileId;
+    if (attribution?.fileAttachmentIds?.length) {
+        headers['X-File-Attachment-Ids'] = attribution.fileAttachmentIds.join(',');
+    }
+    if (attribution?.speed === 'fast' || attribution?.speed === 'standard') {
+        headers['X-Shortcut-Speed'] = attribution.speed;
+    }
+    return headers;
+}
 /**
  * Dispatch a Shortcut model to its provider-native stream function, routed at
  * the api-v2 gateway with Shortcut auth. `options.apiKey` is the Shortcut
@@ -53,7 +97,8 @@ export function createShortcutApiV2Dispatcher(getExtraHeaders) {
         const shortcutToken = options?.apiKey ?? '';
         const authHeaders = {
             Authorization: `Bearer ${shortcutToken}`,
-            ...getExtraHeaders()
+            ...getExtraHeaders(),
+            ...createShortcutApiV2AttributionHeaders(options)
         };
         // Present the model to the native stream function under its real transport,
         // with the base URL shaped the way that transport's SDK expects (the OpenAI

package/dist/app/providers/shortcut-llm-proxy-client.d.ts

@@ -14,6 +14,7 @@ export interface ShortcutLlmAttribution {
     sessionId?: string;
     userMessageId?: string;
 }
+export type ShortcutLlmProxyOperation = 'code_preview' | 'compaction' | 'file_naming' | 'formula_trace' | 'llm_analysis' | 'sandbox_llm' | 'screenshot' | 'sentiment_analysis' | 'subagent' | 'suggestions' | 'summarize';
 /**
  * A helper LLM request. `messages` uses the simplified role/content shape
  * callers already build (`system`/`human`, string or OpenAI-style content
@@ -28,6 +29,7 @@ export interface ShortcutLlmProxyRequest {
     max_tokens?: number;
     max_output_tokens?: number;
     speed?: 'fast' | 'standard';
+    llmOperation?: ShortcutLlmProxyOperation;
 }
 export interface ShortcutLlmMessage {
     role: 'system' | 'human' | 'user' | 'ai' | 'assistant';

package/dist/app/providers/shortcut-llm-proxy-client.js

@@ -43,6 +43,8 @@ export function mapShortcutLlmProxyError(error) {
 }
 /** Parse an OpenAI-style data URI (`data:<mime>;base64,<data>`) into parts. */
 function parseDataUri(url) {
+    // [\s\S]* matches everything (incl. newlines) without the `s` dotAll flag,
+    // which requires an es2018+ target; keeps this parser target-agnostic.
     const match = /^data:([^;]+);base64,([\s\S]*)$/.exec(url);
     if (!match)
         return undefined;
@@ -108,6 +110,18 @@ function collectAssistantText(events) {
         return text;
     })();
 }
+function createShortcutLlmProxyHeaders(request, attribution) {
+    const headers = {};
+    if (attribution?.sessionId)
+        headers['X-Session-Id'] = attribution.sessionId;
+    if (attribution?.userMessageId)
+        headers['X-Turn-Id'] = attribution.userMessageId;
+    if (request.llmOperation)
+        headers['X-LLM-Operation'] = request.llmOperation;
+    if (request.speed)
+        headers['X-Shortcut-Speed'] = request.speed;
+    return Object.keys(headers).length > 0 ? headers : undefined;
+}
 /**
  * Create a Shortcut helper LLM client backed by the model registry's native
  * transport path (api-v2). All helper calls share the main agent's transport.
@@ -129,9 +143,7 @@ export function createShortcutLlmProxyClient(options) {
                 throw new ShortcutLlmProxyError('missing-transport', `No stream transport registered for model "${request.model}" (api ${model.api}).`);
             }
             const attribution = options.getAttribution?.();
-            const headers = attribution?.sessionId
-                ? { 'X-Session-Id': attribution.sessionId }
-                : undefined;
+            const headers = createShortcutLlmProxyHeaders(request, attribution);
             const stream = apiProvider.streamSimple(model, toContext(request), {
                 apiKey,
                 maxTokens: request.max_tokens ?? request.max_output_tokens,

package/dist/app/session/model-manager.js

@@ -6,7 +6,7 @@
  * Stable deps (agent, registries, managers) are constructor-injected.
  * Part of the AgentSession extracted modules.
  */
-import { clampThinkingLevel, computeNextModel, cycleThinkingLevel as computeNextThinkingLevel, getAvailableThinkingLevels } from './session-models.js';
+import { clampThinkingLevel, computeNextModel, cycleThinkingLevel as computeNextThinkingLevel, filterInteractiveSelectableModels, getAvailableThinkingLevels } from './session-models.js';
 // ============================================================================
 // Manager
 // ============================================================================
@@ -29,7 +29,7 @@ export class ModelManager {
     }
     /** Cycle to the next available model. Returns result or undefined if none available. */
     async cycleModel(direction = 'forward') {
-        const available = await this._modelRegistry.getAvailable();
+        const available = filterInteractiveSelectableModels(await this._modelRegistry.getAvailable());
         const next = computeNextModel(available, this._agent.state.model, direction);
         if (!next)
             return undefined;

package/dist/app/session/session-models.d.ts

@@ -32,6 +32,10 @@ export declare function clampThinkingLevel(level: ThinkingLevel, availableLevels
  * @returns The next level, or undefined if model doesn't support thinking.
  */
 export declare function cycleThinkingLevel(currentLevel: ThinkingLevel, model: Model<any> | undefined): ThinkingLevel | undefined;
+/** True when a model should be shown by interactive model controls and hotkey cycling. */
+export declare function isInteractiveSelectableModel(model: Model<any>): boolean;
+/** Filter raw available models to the same curated set used by `/model`. */
+export declare function filterInteractiveSelectableModels(models: Model<any>[]): Model<any>[];
 /**
  * Compute the next model in the cycle.
  * Pure index math — does not mutate state.