subconscious-cli 6.3.1 → 8.0.0

package/bin/cli.js

@@ -35,6 +35,7 @@ import {
 } from './harness-manifest.js';
 import { headlessPromptIndex } from './headless-args.js';
 import { resolveModelCatalog } from './models.js';
+import { ensureSystemCa, refuseUnsupportedSystemCa } from './network.js';
 import {
   configCommand,
   DEFAULT_PROFILE,
@@ -44,6 +45,7 @@ import {
   printConfigHelp,
   RUNBOOK_DEFAULTS,
   resolvedModelSetting,
+  systemCaEnabledFor,
   updatePlatformUrlCommand,
   updateUrlCommand,
   validateProfileName,
@@ -58,6 +60,23 @@ function isHelpArg(arg) {
   return arg === 'help' || arg === '-h' || arg === '--help';
 }
 
+// Commands that never make a network request.
+const OFFLINE_COMMANDS = new Set([
+  '--help',
+  '-h',
+  'help',
+  'config',
+  'update-key',
+  'logout',
+  'setup',
+  'settings',
+  'cursor',
+]);
+
+function needsNetwork(args) {
+  return !OFFLINE_COMMANDS.has(args[0]) && !isHelpArg(args[1]);
+}
+
 function printHelp() {
   const agents = agentList()
     .map(
@@ -122,6 +141,9 @@ ${agents}
     ${c.dim}$${c.reset} subc codex headless "fix the failing test"
     ${c.dim}$${c.reset} subc -p staging codex
 
+  ${c.bold}Network${c.reset}
+    Behind a proxy or a TLS-inspecting firewall? Run ${c.cyan}subc login help${c.reset}.
+
   ${c.dim}Use subc <command> help for command-specific usage.${c.reset}
 `);
 }
@@ -136,6 +158,16 @@ Usage:
 Authenticate and save an API key to the selected profile.
 Opens a browser to a one-time login link. If the browser does not open, use the URL printed in the terminal.
 To sign in without a browser, copy an API key from the dashboard and run subc update-key <your-api-key>.
+
+Behind a proxy or firewall:
+  If login fails with ENOTFOUND, ECONNREFUSED or a timeout, the network may require a proxy.
+  Set HTTPS_PROXY=http://host:port (or http://user:pass@host:port) and retry.
+  NO_PROXY=host1,.example.com lists hosts to reach directly, not through the proxy.
+  If the error names a certificate (SELF_SIGNED_CERT_IN_CHAIN, UNABLE_TO_VERIFY_LEAF_SIGNATURE),
+  the proxy re-signs TLS traffic. Ask IT for its root certificate, then either:
+    export NODE_EXTRA_CA_CERTS=/path/to/corporate-root-ca.pem
+    or set SYSTEM_CA=on in the profile (subc config edit) to trust the OS certificate store. Needs Node 22.15 or newer.
+  If nothing works, subc update-key <your-api-key> saves a key without any network request.
 `,
   logout: `
 Usage:
@@ -369,6 +401,16 @@ async function main() {
     return;
   }
 
+  // Trust the OS certificate store before any request when the profile opts in.
+  // Node reads --use-system-ca at startup, so this re-execs once. Commands that
+  // make no request skip it, so help and config edit still work on old Node.
+  if (needsNetwork(args)) {
+    const profile = await loadProfile(profileName);
+    const systemCaEnabled = systemCaEnabledFor(profile);
+    if (refuseUnsupportedSystemCa(systemCaEnabled, profile.path)) return;
+    if (systemCaEnabled && (await ensureSystemCa())) return;
+  }
+
   const launchTui =
     !command &&
     process.stdin.isTTY === true &&
@@ -500,6 +542,7 @@ async function main() {
     });
     modelsCommand(catalog.models, {
       selectedModel,
+      entries: catalog.entries,
       error: catalog.error,
       source: catalog.source,
       hasApiKey: Boolean(auth?.key),

package/bin/feedback.js

@@ -12,6 +12,7 @@ import { createInterface } from 'node:readline/promises';
 import { getApiKey, getPlatformUrl } from './auth.js';
 import { imageContentType, readClipboardImage } from './clipboard-image.js';
 import { c } from './colors.js';
+import { proxyAwareFetch } from './network.js';
 import { DEFAULT_PROFILE } from './profiles.js';
 
 export const FEEDBACK_API_PATH = '/api/cli/feedback';
@@ -111,7 +112,7 @@ export async function submitFeedback(
   apiKey,
   platformUrl,
   payload,
-  fetchImpl = fetch,
+  fetchImpl = proxyAwareFetch,
 ) {
   const res = await fetchImpl(
     `${platformUrl.replace(/\/$/, '')}${FEEDBACK_API_PATH}`,

package/bin/model-capabilities.js

@@ -1,8 +1,16 @@
 import { MODEL_CAPABILITIES } from './agent-data.js';
 
-// The models endpoint supplies IDs, not modality metadata, so capabilities
-// are listed by exact model ID: similarly named models inherit nothing.
-export function modelSupportsVision(modelId) {
+// Capabilities are listed by exact model ID: similarly named models inherit
+// nothing. The canonical catalog's per-model modality metadata is preferred
+// when a launch carries it; the packaged map is the offline fallback.
+export function modelSupportsVision(modelId, entries = []) {
+  const entry = entries.find((candidate) => candidate?.id === modelId);
+  if (entry?.modalities) {
+    const input = Array.isArray(entry.modalities.input)
+      ? entry.modalities.input
+      : [];
+    return input.includes('image');
+  }
   return (
     Object.hasOwn(MODEL_CAPABILITIES, modelId) &&
     MODEL_CAPABILITIES[modelId].vision === true
@@ -10,6 +18,38 @@ export function modelSupportsVision(modelId) {
 }
 
 /** Vision model IDs, newline-separated, for the runbooks' shell lookup. */
-export function visionModelList() {
-  return Object.keys(MODEL_CAPABILITIES).filter(modelSupportsVision).join('\n');
+export function visionModelList(entries = []) {
+  const ids = entries.length
+    ? entries
+        .map((entry) => entry.id)
+        .filter((id) => modelSupportsVision(id, entries))
+    : Object.keys(MODEL_CAPABILITIES).filter((id) =>
+        modelSupportsVision(id, entries),
+      );
+  return ids.join('\n');
+}
+
+/**
+ * Canonical catalog entries from the launch env's SUBC_MODEL_METADATA (a
+ * JSON array), or an empty list when discovery did not run, was skipped,
+ * or wrote malformed JSON.
+ */
+export function catalogEntriesFromMetadata(metadataJson) {
+  if (typeof metadataJson !== 'string' || !metadataJson.trim()) return [];
+  try {
+    const entries = JSON.parse(metadataJson);
+    return Array.isArray(entries) ? entries : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * The vision list for a runbook script, from the launch env's catalog
+ * metadata with the packaged map as the fallback when discovery did not
+ * run or failed.
+ */
+export function visionModelListFromMetadata(metadataJson) {
+  const entries = catalogEntriesFromMetadata(metadataJson);
+  return entries.length ? visionModelList(entries) : visionModelList();
 }

package/bin/models.js

@@ -1,21 +1,24 @@
 /**
  * Resolve the model catalog exposed by an OpenAI-compatible gateway.
  *
- * When a profile (or agent) API key is present, prefer the key-scoped
- * /v1/models/available list. If that request fails, fall back to the public
- * /v1/models fleet catalog. Launches keep working with the packaged registry
- * when the gateway is offline or returns nothing usable.
+ * A key-scoped GET /v1/models is the canonical source: the gateway filters
+ * it by the key's model access and describes each model (lifecycle, limits,
+ * modalities, capabilities). Older gateways without the canonical catalog
+ * answer with a minimal list, which still names the fleet. Launches keep
+ * working with the packaged registry when the gateway is offline or returns
+ * nothing usable.
  */
 
+import { proxyAwareFetch } from './network.js';
+
 const MODEL_ID_PATTERN = /^[-A-Za-z0-9._:/+]+$/;
 export const DEFAULT_MODEL_FETCH_TIMEOUT_MS = 3000;
-export const AVAILABLE_MODELS_PATH = '/v1/models/available';
 export const PUBLIC_MODELS_PATH = '/v1/models';
 export const PUBLIC_CATALOG_FALLBACK_MESSAGE =
   'Provisioned catalog unavailable; showing the public model list.';
 
 export function isLiveModelSource(source) {
-  return source === 'available' || source === 'public';
+  return source === 'catalog' || source === 'public';
 }
 
 export function isAbortError(error) {
@@ -58,6 +61,34 @@ export function normalizeModelIds(modelIds = [], selectedModel) {
   return models;
 }
 
+/**
+ * Rich entry fields from a canonical /v1/models response: lifecycle
+ * (status, deprecation_date, replacement), limits, modalities, and
+ * capabilities. Minimal legacy responses produce entries that carry only
+ * the id; every optional field is absent, never guessed.
+ */
+export function parseCatalogEntries(data = []) {
+  const entries = [];
+  for (const model of data) {
+    if (model == null || typeof model !== 'object') continue;
+    const id = typeof model.id === 'string' ? model.id.trim() : '';
+    if (!id || !MODEL_ID_PATTERN.test(id)) continue;
+    entries.push({
+      id,
+      lifecycle: model.lifecycle ?? null,
+      limits: model.limits ?? null,
+      modalities: model.modalities ?? null,
+      capabilities: model.capabilities ?? null,
+    });
+  }
+  return entries;
+}
+
+/** True when the response is the canonical catalog, not a minimal list. */
+function isCanonicalResponse(data = []) {
+  return data.some((model) => model?.schema_version === '1');
+}
+
 function gatewayOrigin(baseUrl) {
   if (!baseUrl?.trim()) throw new Error('Gateway URL is not configured');
   return baseUrl.trim().replace(/\/+$/, '');
@@ -68,12 +99,12 @@ function modelsEndpoint(baseUrl, path) {
   return `${gatewayOrigin(baseUrl)}${normalizedPath}`;
 }
 
-export async function fetchGatewayModels({
+async function fetchModelsPayload({
   baseUrl,
   apiKey,
-  path = PUBLIC_MODELS_PATH,
-  fetchImpl = globalThis.fetch,
-  timeoutMs = DEFAULT_MODEL_FETCH_TIMEOUT_MS,
+  path,
+  fetchImpl,
+  timeoutMs,
   signal,
 }) {
   if (typeof fetchImpl !== 'function') {
@@ -123,7 +154,7 @@ export async function fetchGatewayModels({
         throw new Error('Model discovery returned an invalid response');
       }
 
-      return normalizeModelIds(payload.data.map((model) => model?.id));
+      return payload.data;
     };
     return await Promise.race([discover(), aborted]);
   } catch (error) {
@@ -138,16 +169,35 @@ export async function fetchGatewayModels({
   }
 }
 
-async function fetchPublicModels({ baseUrl, fetchImpl, timeoutMs, signal }) {
-  const models = await fetchGatewayModels({
+/**
+ * Fetch one models listing. Returns the id list, the parsed catalog
+ * entries, and whether the gateway answered with the canonical catalog.
+ */
+export async function fetchGatewayCatalog({
+  baseUrl,
+  apiKey,
+  path = PUBLIC_MODELS_PATH,
+  fetchImpl = proxyAwareFetch,
+  timeoutMs = DEFAULT_MODEL_FETCH_TIMEOUT_MS,
+  signal,
+}) {
+  const data = await fetchModelsPayload({
     baseUrl,
-    path: PUBLIC_MODELS_PATH,
+    apiKey,
+    path,
     fetchImpl,
     timeoutMs,
     signal,
   });
+  const entries = parseCatalogEntries(data);
+  const models = normalizeModelIds(entries.map((entry) => entry.id));
   if (!models.length)
     throw new Error('Model discovery returned no usable model IDs');
+  return { models, entries, canonical: isCanonicalResponse(data) };
+}
+
+export async function fetchGatewayModels(args) {
+  const { models } = await fetchGatewayCatalog(args);
   return models;
 }
 
@@ -157,14 +207,33 @@ function packagedCatalog(selectedModel, fallbackModels, error) {
       [selectedModel, ...fallbackModels],
       selectedModel,
     ),
+    defaultModels: normalizeModelIds(
+      [selectedModel, ...fallbackModels],
+      selectedModel,
+    ),
+    entries: [],
     source: 'packaged',
     error,
   };
 }
 
-function liveCatalog(models, selectedModel, source) {
+/**
+ * Assemble the catalog views. `models` is everything the caller can invoke,
+ * deprecated models included. `defaultModels` drops models the gateway
+ * marked deprecated or retired, so new sessions pick a current model while
+ * existing configurations that name a deprecated model keep working.
+ */
+function liveCatalog(models, selectedModel, source, entries = []) {
+  const normalized = normalizeModelIds(models, selectedModel);
+  const entryById = new Map(entries.map((entry) => [entry.id, entry]));
+  const defaults = normalized.filter((id) => {
+    const status = entryById.get(id)?.lifecycle?.status;
+    return status !== 'deprecated' && status !== 'retired';
+  });
   return {
-    models: normalizeModelIds(models, selectedModel),
+    models: normalized,
+    defaultModels: defaults.length ? defaults : normalized,
+    entries,
     source,
     error: null,
   };
@@ -176,7 +245,7 @@ export async function resolveModelCatalog({
   selectedModel,
   fallbackModels = [],
   pinnedModels,
-  fetchImpl = globalThis.fetch,
+  fetchImpl = proxyAwareFetch,
   timeoutMs = DEFAULT_MODEL_FETCH_TIMEOUT_MS,
   signal,
 }) {
@@ -186,6 +255,8 @@ export async function resolveModelCatalog({
   if (pinned?.length) {
     return {
       models: normalizeModelIds(pinned, selectedModel),
+      defaultModels: normalizeModelIds(pinned, selectedModel),
+      entries: [],
       source: 'pinned',
       error: null,
     };
@@ -194,41 +265,60 @@ export async function resolveModelCatalog({
   const key = apiKey?.trim() || '';
 
   if (key) {
+    let catalogError;
     try {
-      const discovered = await fetchGatewayModels({
+      // The canonical catalog is key-scoped and access-filtered by the
+      // gateway, so no second request is needed when it answers.
+      const discovered = await fetchGatewayCatalog({
         baseUrl,
         apiKey: key,
-        path: AVAILABLE_MODELS_PATH,
+        path: PUBLIC_MODELS_PATH,
         fetchImpl,
         timeoutMs,
         signal,
       });
-      return liveCatalog(discovered, selectedModel, 'available');
-    } catch (availableError) {
-      if (isAbortError(availableError) || signal?.aborted) throw availableError;
-      try {
-        const discovered = await fetchPublicModels({
-          baseUrl,
-          fetchImpl,
-          timeoutMs,
-          signal,
-        });
-        return liveCatalog(discovered, selectedModel, 'public');
-      } catch (publicError) {
-        if (isAbortError(publicError) || signal?.aborted) throw publicError;
-        return packagedCatalog(selectedModel, fallbackModels, availableError);
-      }
+      // An older gateway answers /v1/models with a minimal public list;
+      // those ids still name the fleet, so use them rather than the
+      // packaged registry.
+      return discovered.canonical
+        ? liveCatalog(
+            discovered.models,
+            selectedModel,
+            'catalog',
+            discovered.entries,
+          )
+        : liveCatalog(discovered.models, selectedModel, 'public');
+    } catch (error) {
+      if (isAbortError(error) || signal?.aborted) throw error;
+      catalogError = error;
+    }
+
+    try {
+      const discovered = await fetchGatewayCatalog({
+        baseUrl,
+        fetchImpl,
+        timeoutMs,
+        signal,
+      });
+      return liveCatalog(discovered.models, selectedModel, 'public');
+    } catch (publicError) {
+      if (isAbortError(publicError) || signal?.aborted) throw publicError;
+      return packagedCatalog(
+        selectedModel,
+        fallbackModels,
+        catalogError ?? publicError,
+      );
     }
   }
 
   try {
-    const discovered = await fetchPublicModels({
+    const discovered = await fetchGatewayCatalog({
       baseUrl,
       fetchImpl,
       timeoutMs,
       signal,
     });
-    return liveCatalog(discovered, selectedModel, 'public');
+    return liveCatalog(discovered.models, selectedModel, 'public');
   } catch (error) {
     if (isAbortError(error) || signal?.aborted) throw error;
     return packagedCatalog(selectedModel, fallbackModels, error);