talos-code 0.0.1 → 0.2.0

package/dist/tui/catalog-service.js

@@ -0,0 +1,560 @@
+/*
+ * B1 slice 18 — provider first, then model.
+ *
+ * `listProviders` says, for each chat destination, whether a key is usable and where it would come from;
+ * `providerModels` is the live list of ONE provider, or the list TALOS already knows marked not verified;
+ * `setProviderKey` tests a key against its own provider and saves it only when the test passes;
+ * `readiness` is what a send asks before anything leaves the machine.
+ */
+import { providerDescriptionText, providerLabelText } from "../provider/provider-text.js";
+import { REASONING_EFFORTS } from "../config/types.js";
+import { providerOfModel } from "../provider/environment-keys.js";
+import { benchCauseText, benchedKeyRefusal } from "../provider/health.js";
+import { missingKeyText, providerLabel } from "../provider/missing-key.js";
+import { catalogSourceFromKernel, mergeModelRows, normalizeModelRows } from "../provider/model-catalog.js";
+import { t, tn } from "../i18n/index.js";
+import { kernelProbeDetail, looksItalian } from "../i18n/kernel-map.js";
+/* R5a lane R, S2 (Q-R5-3): a live list that carries a model's window or output limit feeds its profile. */
+import { rememberProviderModelRows } from "../runtime/model-profile.js";
+function collectReasoningEfforts(...sources) {
+    let observed = false;
+    const out = [];
+    for (const source of sources) {
+        if (!Array.isArray(source))
+            continue;
+        observed = true;
+        for (const value of source) {
+            if (typeof value !== 'string' || !REASONING_EFFORTS.includes(value))
+                continue;
+            const effort = value;
+            if (!out.includes(effort))
+                out.push(effort);
+        }
+    }
+    return observed ? out : null;
+}
+export function normalizeModels(rows, provider, available) {
+    return normalizeModelRows(rows, provider, available === 'remote' ? 'live' : available);
+}
+export function availabilityFromCatalog(source, successfulCatalogBoundary = false) {
+    return catalogSourceFromKernel(source, { successfulCatalogBoundary });
+}
+export function mergeModels(...groups) {
+    return mergeModelRows(...groups.flat());
+}
+/**
+ * Providers whose kernel probe cannot verify a key, measured 2026-09-17 against the provider's own documentation.
+ * OpenRouter: `GET /api/v1/models` has no security block (public), so the kernel probe answers "connected" for any
+ * key; `GET /api/v1/models/user` requires the bearer token (401 without it). Source: openrouterteam/docs
+ * `openapi/openapi.yaml`, read through Context7 on 2026-09-17.
+ */
+const AUTHENTICATED_KEY_CHECK = Object.freeze({ openrouter: { path: '/models/user' } });
+/*
+ * B1 slice 25 — slice 18's interim one-token table (`ONE_TOKEN_KEY_CHECK`) is gone. The kernel registry now declares the minimal
+ * request of DeepInfra, Novita, Ollama Cloud and Hugging Face as it did for Z.ai's Anthropic port (CLI-REQ-06, desktop lane
+ * `95716162`), and its probe sends it, reads the body under a 64 KiB cap, and states `credenzialeVerificata`. The key test asks the
+ * kernel for every provider that declares it (`testProviderKey` below).
+ */
+/** Live lists this CLI fetches itself, because the kernel's direct catalog does not cover them. No key is sent. */
+const PUBLIC_MODEL_LIST = Object.freeze({ openrouter: { path: '/models' } });
+const KEY_TEST_TIMEOUT_MS = 30_000;
+/*
+ * R4 Q-R4-10 (gate E10): the models a LOCAL engine has installed, read by this CLI. The kernel's direct catalogue leaves local
+ * engines out, so before R4 the model picker for Ollama said "could not be reached" while Ollama was running. The registry
+ * declares where each engine lists its models (`catalogo: {fonte:'runtime-locale', forma, percorso}`); the rows are read the way
+ * the kernel's own local runtime reads them (`harness-ui/src/openai-compatible-runtime.mjs`, normalizeOllamaModel and
+ * normalizeLmModel). No key is sent, a redirect is refused, the answer is capped and the wait is short: it is this computer.
+ */
+const LOCAL_LIST_TIMEOUT_MS = 3_000;
+const LOCAL_LIST_MAX_BYTES = 4 * 1024 * 1024;
+function localCatalogOf(record) {
+    const catalog = record?.catalogo;
+    return catalog?.fonte === 'runtime-locale' && (catalog.forma === 'ollama-tags' || catalog.forma === 'lmstudio-models') && typeof catalog.percorso === 'string' && catalog.percorso.startsWith('/') ? { forma: catalog.forma, percorso: catalog.percorso } : null;
+}
+/* The engine's own root: an address saved for its OpenAI port (`…/v1`) lists models at the root, as the engines document. */
+function engineRoot(endpoint) { return endpoint.trim().replace(/\/+$/u, '').replace(/\/v1$/u, ''); }
+/* The address as the person reads it: scheme, host and path, never a user name or password. */
+function shownAddress(root) { try {
+    const url = new URL(root);
+    return `${url.protocol}//${url.host}${url.pathname.replace(/\/+$/u, '')}`;
+}
+catch {
+    return root;
+} }
+function ollamaRows(body) {
+    if (!Array.isArray(body?.models))
+        return null;
+    return body.models.flatMap((raw) => {
+        const id = typeof raw?.name === 'string' && raw.name.trim() ? raw.name : '';
+        if (!id)
+            return [];
+        const details = raw.details ?? {};
+        const families = Array.isArray(details.families) ? details.families : null;
+        return [{ id, name: id,
+                ...(Number.isSafeInteger(details.context_length) && details.context_length > 0 ? { contextLength: details.context_length } : {}),
+                ...(families ? { inputModalities: families.some((family) => /(?:clip|vision|llava)/iu.test(String(family))) ? ['text', 'image'] : ['text'] } : {}) }];
+    });
+}
+function lmstudioRows(body) {
+    if (!Array.isArray(body?.models))
+        return null;
+    return body.models.flatMap((raw) => {
+        if (raw?.type !== 'llm' || typeof raw.key !== 'string' || raw.key.trim() === '')
+            return [];
+        const caps = raw.capabilities ?? {};
+        const allowed = Array.isArray(caps.reasoning?.allowed_options) ? caps.reasoning.allowed_options : [];
+        return [{ id: raw.key, name: typeof raw.display_name === 'string' && raw.display_name ? raw.display_name : raw.key,
+                ...(Number.isSafeInteger(raw.max_context_length) && raw.max_context_length > 0 ? { contextLength: raw.max_context_length } : {}),
+                ...(typeof caps.trained_for_tool_use === 'boolean' ? { toolCalling: caps.trained_for_tool_use } : {}),
+                ...(typeof caps.vision === 'boolean' ? { inputModalities: caps.vision ? ['text', 'image'] : ['text'] } : {}),
+                reasoning: allowed.length > 0, ...(allowed.length ? { reasoningEfforts: allowed } : {}) }];
+    });
+}
+/* R4 Q-R4-16 (a): the probe's detail reaches the screen (the provider list falls back to it) in English: the kernel's sentence
+   by its pinned template, an English detail as it is, and an Italian sentence no template matches not at all. */
+function probeDetailText(detail, label) {
+    const text = String(detail ?? '');
+    return kernelProbeDetail(text, { label }) ?? (looksItalian(text) ? '' : text);
+}
+/* Reads at most `cap` bytes of a body; null when it is longer (the rest is not read). */
+async function readCapped(response, cap) {
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > cap)
+                return null;
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    return new TextDecoder().decode(Buffer.concat(chunks));
+}
+/**
+ * B1 slice 25 — what the kernel's public row says about a provider whose stored keys cannot be used now, or `null` when it stores
+ * none. Read from `listPublic`'s pool entries (`stato`, `inPanchinaFino`, `causa`). ⛔ Call it only when the key usable now
+ * (`getKey`) is absent: the pool is the description, `getKey` is the decision.
+ */
+export function keyBench(row) {
+    const pool = Array.isArray(row?.pool) ? row.pool : [];
+    const benched = pool.filter(entry => entry?.stato === 'in-panchina');
+    if (row?.keyConfigured !== true && benched.length === 0)
+        return null;
+    const timed = benched.filter(entry => Number.isFinite(entry?.inPanchinaFino)).sort((a, b) => a.inPanchinaFino - b.inPanchinaFino);
+    const first = timed[0] ?? benched[0] ?? null;
+    /* R2 (E1): the one bench-cause table, in the dictionary through `provider/health.ts`. */
+    const cause = benchCauseText(first?.causa);
+    return { cause, until: Number.isFinite(first?.inPanchinaFino) ? Number(first.inPanchinaFino) : null, keys: Math.max(1, pool.length) };
+}
+/* `benchClock` and `benchedKeyText` live in `provider/health.ts` since R0 (one benched-key sentence for every path); re-exported here. */
+export { benchClock, benchedKeyText } from "../provider/health.js";
+/**
+ * The refusal of a send whose provider has no key usable now: missing, or stored and benched.
+ * R2 (E8 / Q-R2-7): `provider` is the provider id (a label is still understood, for callers that only hold a row's label); a
+ * missing key is the one sentence of `missingKeyText`, the same as `-p`, `provider test` and `doctor`.
+ */
+export function unusableKeyRefusal(provider, bench, now = Date.now()) {
+    if (!bench)
+        return { code: 'PROVIDER_KEY_MISSING', message: missingKeyText(provider) };
+    return { code: 'PROVIDER_KEY_BENCHED', message: benchedKeyRefusal(providerLabel(provider), bench, now) };
+}
+/** ⛔ The only outcome that saves a key. */
+const PASSED = new Set(['valid']);
+/** A key as providers issue it, after trimming: printable ASCII 0x21-0x7E, no space, tab, line break, DEL or non-ASCII. */
+const PRINTABLE_KEY = /^[\x21-\x7e]{1,4096}$/u;
+function codeOf(error) { const code = error?.code; return typeof code === 'string' && /^[A-Z0-9_]{1,64}$/u.test(code) ? code : 'UNAVAILABLE'; }
+function joinPath(endpoint, path) { return `${String(endpoint).replace(/\/+$/u, '')}${path}`; }
+export function keyTestMessage(outcome, label, httpStatus) {
+    const status = httpStatus === null ? '' : ` (HTTP ${httpStatus})`;
+    const notVerified = 'The key was not verified.';
+    switch (outcome) {
+        case 'valid': return `${label} accepted the key${status}.`;
+        case 'invalid': return `${label} refused the key${status}.`;
+        case 'permission': return `${label} recognised the key but denied permission${status}.`;
+        case 'rate-limited': return `${label} answered HTTP ${httpStatus ?? 429}: rate-limited; try again shortly. ${notVerified}`;
+        case 'not-verified': return httpStatus !== null && httpStatus >= 200 && httpStatus < 300
+            ? `${label} answered HTTP ${httpStatus} without a well-formed response. ${notVerified}`
+            : httpStatus !== null ? `${label} answered HTTP ${httpStatus}, which does not show that the key is valid. ${notVerified}`
+                : `${label} did not give an answer that shows the key is valid. ${notVerified}`;
+        case 'redirected': return `${label} answered with a redirect, and TALOS does not send a key on to another address. ${notVerified}`;
+        case 'unreachable': return `${label} could not be reached, so the key could not be tested.`;
+        case 'unverifiable': return `TALOS has no way to verify a ${label} key.`;
+        case 'malformed': return 'The key is empty or contains a character no provider issues (only printable ASCII without spaces is accepted). Nothing was sent.';
+        default: return httpStatus !== null && httpStatus >= 500 ? `${label} answered HTTP ${httpStatus}, a server error. ${notVerified}` : `${label} answered with an error${status}. ${notVerified}`;
+    }
+}
+/** An HTTP status that is not an affirmative acceptance. 2xx is decided by the caller, which knows whether the body was checked. */
+function refusedStatus(httpStatus) {
+    if (httpStatus === 401)
+        return 'invalid';
+    if (httpStatus === 403)
+        return 'permission';
+    if (httpStatus === 429)
+        return 'rate-limited';
+    if (httpStatus >= 500)
+        return 'error';
+    return 'not-verified';
+}
+/**
+ * The kernel probe's answer about a candidate key, read by its written contract (`provider-probe.mjs:225-235`):
+ * - `credenzialeVerificata === true` → `valid`, the only answer that saves;
+ * - `false` → judged, not confirmed: `non-autorizzato` is a refusal naming its status (401 `invalid`, 403 `permission`),
+ *   `collegato` reached a public catalogue that says nothing of this key (`unverifiable`), any other is `not-verified`;
+ * - anything else (`null`, and off contract `undefined` or a non-boolean) → not judged, "could not tell": unreachable, no way to
+ *   probe, or the status that answered without reading the key. ⛔ Never `invalid` or `permission`, whatever the status.
+ */
+export function classifyKeyTest(result) {
+    const httpStatus = Number.isInteger(result?.httpStatus) ? Number(result.httpStatus) : null;
+    const verdict = result?.credenzialeVerificata;
+    if (verdict === true)
+        return { outcome: result?.esito === 'collegato' ? 'valid' : 'not-verified', httpStatus };
+    if (verdict === false) {
+        if (result?.esito === 'non-autorizzato')
+            return { outcome: httpStatus === 403 ? 'permission' : 'invalid', httpStatus };
+        return { outcome: result?.esito === 'collegato' ? 'unverifiable' : 'not-verified', httpStatus };
+    }
+    if (result?.esito === 'irraggiungibile')
+        return { outcome: 'unreachable', httpStatus };
+    if (result?.esito === 'non-sondabile' || result?.esito === 'non-provabile')
+        return { outcome: 'unverifiable', httpStatus };
+    if (httpStatus === 429)
+        return { outcome: 'rate-limited', httpStatus };
+    if (httpStatus !== null && httpStatus >= 500)
+        return { outcome: 'error', httpStatus };
+    return { outcome: httpStatus !== null || result?.esito === 'collegato' ? 'not-verified' : 'error', httpStatus };
+}
+/** Node's fetch with `redirect:'error'` rejects with this cause (measured on Node 24.18: TypeError "fetch failed", cause "unexpected redirect"). */
+function isRefusedRedirect(error) { return /unexpected redirect/u.test(String(error?.cause?.message ?? '')); }
+export function createTuiCatalogService(deps) {
+    const labelOf = (id) => providerLabelText(id, String(deps.registry[id]?.etichetta ?? id));
+    const listProviders = async () => {
+        if (deps.controlPlane) {
+            return deps.controlPlane.list().map(profile => ({
+                id: profile.id, label: profile.label, description: profile.description,
+                configured: profile.auth.required ? profile.auth.usable : profile.id === 'esterno' ? profile.execution === 'configurato' : true,
+                requiresKey: profile.auth.required, authType: profile.auth.type, local: profile.local, cloud: profile.cloud,
+                endpointHost: profile.endpoint.host, supportsEndpoint: profile.endpoint.supportsCustom, supportsOAuth: profile.supportsOAuth,
+                execution: profile.execution, keySource: profile.auth.source, environmentVariable: profile.auth.environmentVariable,
+                benched: profile.cooldown.active ? { cause: profile.cooldown.cause, until: profile.cooldown.until, keys: Math.max(1, profile.cooldown.keys) } : null,
+            }));
+        }
+        const publicRows = deps.publicProviders() ?? [];
+        const byId = new Map(publicRows.map(row => [String(row?.id ?? ''), row]));
+        return Object.values(deps.registry).filter((record) => record?.destinazioneChat === true).map((record) => {
+            const row = byId.get(record.id) ?? {};
+            const runtime = deps.runtimeFor(record.id) ?? {};
+            const endpoint = row.endpoint ?? runtime.endpoint ?? record.baseUrl ?? null;
+            let endpointHost = null;
+            try {
+                endpointHost = endpoint ? new URL(String(endpoint)).host : null;
+            }
+            catch {
+                endpointHost = null;
+            }
+            const requiresKey = typeof row.requiresKey === 'boolean' ? row.requiresKey : record.chiaveObbligatoria === true;
+            const execution = String(row.execution ?? record.esecuzione ?? 'unknown');
+            /* ⛔ B1 slice 25: usable means the key usable NOW (`getKey`). The kernel's `keyConfigured` is `hasKey`, which counts a benched
+               key too; it says only that a key is stored, which decides where the key comes from and whether it is benched. */
+            const usable = Boolean(deps.keyFor(record.id));
+            const stored = usable || row.keyConfigured === true;
+            const configured = record.id === 'esterno' ? execution === 'configurato' : requiresKey ? usable : true;
+            const benched = requiresKey && !usable ? keyBench(row) : null;
+            const local = record.wire === 'locale' || record.catalogo?.fonte === 'runtime-locale' || /locale/u.test(String(record.esecuzione ?? ''));
+            const environment = requiresKey ? deps.environmentKey?.(record.id) ?? null : null;
+            const keySource = !requiresKey ? 'not-required'
+                : row.origineChiave === 'custodia' ? 'saved'
+                    : stored ? 'environment'
+                        : environment?.state === 'unanswered' ? 'environment-unanswered'
+                            : environment?.state === 'declined' ? 'environment-declined'
+                                : 'missing';
+            return {
+                id: String(record.id), label: providerLabelText(String(record.id), String(row.label ?? record.etichetta ?? record.id)), description: providerDescriptionText(String(record.id), String(record.descrizione ?? '')), configured, requiresKey,
+                authType: String(record.auth?.tipo ?? (requiresKey ? 'key' : 'none')), local, cloud: Boolean(record.cloud), endpointHost,
+                supportsEndpoint: row.supportsEndpoint === true || record.indirizzoModificabile === true, supportsOAuth: row.supportsOAuth === true || Boolean(record.oauth), execution,
+                keySource, environmentVariable: environment?.variable ?? null, benched,
+            };
+        });
+    };
+    const enrichRegistryReasoning = (provider, row) => {
+        const bare = row.id.startsWith(`${provider}:`) ? row.id.slice(provider.length + 1) : row.id;
+        const record = deps.registry[provider] ?? {};
+        const compatible = record?.richiestaCompatibile?.modelli?.[bare];
+        const known = Array.isArray(record?.modelliNoti) ? record.modelliNoti.find((entry) => String(entry?.id ?? '') === bare) : null;
+        const observed = collectReasoningEfforts(compatible?.livelliRagionamento, known?.ragionamento?.livelli);
+        if (observed === null)
+            return row;
+        const evidenceUrl = typeof record?.richiestaCompatibile?.fonte === 'string' ? record.richiestaCompatibile.fonte : typeof known?.fonte === 'string' ? known.fonte : null;
+        const evidenceDate = typeof record?.richiestaCompatibile?.data === 'string' ? record.richiestaCompatibile.data : typeof known?.data === 'string' ? known.data : null;
+        const [documented] = normalizeModels([{
+                id: row.id, name: row.name, reasoning: true, reasoningEfforts: observed,
+                ...(evidenceUrl ? { fonteMetadati: evidenceUrl } : {}), ...(evidenceDate ? { dataMetadati: evidenceDate } : {}),
+            }], provider, 'documented');
+        return documented ? mergeModels([row], [documented])[0] ?? row : row;
+    };
+    const knownModels = async (provider) => {
+        const publicRows = deps.publicProviders() ?? [];
+        const pub = publicRows.find(x => x?.id === provider);
+        const configured = deps.runtimeFor(provider)?.modelli ?? [];
+        const fallback = pub?.modelliDiRiserva ?? deps.registry[provider]?.modelliDiRiserva ?? [];
+        return mergeModels(normalizeModels(configured, provider, 'configured'), normalizeModels(fallback, provider, 'documented')).map(row => enrichRegistryReasoning(provider, row));
+    };
+    const endpointOf = (provider) => { const runtime = deps.runtimeFor(provider) ?? {}; return String(runtime.endpoint ?? deps.registry[provider]?.baseUrl ?? ''); };
+    const timeoutSignal = (signal) => signal ? AbortSignal.any([signal, AbortSignal.timeout(KEY_TEST_TIMEOUT_MS)]) : AbortSignal.timeout(KEY_TEST_TIMEOUT_MS);
+    async function localModels(provider, catalog, signal) {
+        const root = engineRoot(endpointOf(provider));
+        const address = shownAddress(root);
+        if (!/^https?:\/\//iu.test(root) || !deps.fetchImpl)
+            return { kind: 'down', address };
+        const timeout = AbortSignal.timeout(LOCAL_LIST_TIMEOUT_MS);
+        let response;
+        try {
+            response = await deps.fetchImpl(root + catalog.percorso, { method: 'GET', headers: { Accept: 'application/json' }, redirect: 'error', signal: signal ? AbortSignal.any([signal, timeout]) : timeout });
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            return { kind: isRefusedRedirect(error) ? 'unreadable' : 'down', address };
+        }
+        if (!response.ok) {
+            try {
+                await response.body?.cancel();
+            }
+            catch { /* not read */ }
+            return { kind: 'unreadable', address };
+        }
+        let text;
+        try {
+            text = await readCapped(response, LOCAL_LIST_MAX_BYTES);
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            return { kind: 'unreadable', address };
+        }
+        let body = null;
+        try {
+            body = text === null ? null : JSON.parse(text);
+        }
+        catch {
+            body = null;
+        }
+        const raw = catalog.forma === 'ollama-tags' ? ollamaRows(body) : lmstudioRows(body);
+        if (!raw)
+            return { kind: 'unreadable', address };
+        return { kind: 'ok', rows: normalizeModels(raw, provider, 'live') };
+    }
+    async function liveModels(provider, signal) {
+        const own = PUBLIC_MODEL_LIST[provider];
+        if (own) {
+            if (!deps.fetchImpl)
+                throw Object.assign(new Error('PROVIDER_CATALOG_UNAVAILABLE'), { code: 'PROVIDER_CATALOG_UNAVAILABLE' });
+            let response;
+            try {
+                response = await deps.fetchImpl(joinPath(endpointOf(provider), own.path), { method: 'GET', headers: { Accept: 'application/json' }, redirect: 'error', signal: timeoutSignal(signal) });
+            }
+            catch (error) {
+                if (error?.name === 'AbortError' && signal?.aborted)
+                    throw error;
+                throw Object.assign(new Error('CATALOG_UNREACHABLE'), { code: 'CATALOG_UNREACHABLE' });
+            }
+            if (!response.ok)
+                throw Object.assign(new Error('CATALOG_UPSTREAM_ERROR'), { code: 'CATALOG_UPSTREAM_ERROR', httpStatus: response.status });
+            const body = await response.json().catch(() => null);
+            if (!Array.isArray(body?.data))
+                throw Object.assign(new Error('CATALOG_UPSTREAM_ERROR'), { code: 'CATALOG_UPSTREAM_ERROR' });
+            rememberProviderModelRows(provider, body.data);
+            return normalizeModels(body.data, provider, 'live');
+        }
+        const remote = await deps.createProbe(signal).elencaModelli(provider);
+        const source = catalogSourceFromKernel(remote?.fonte, { successfulCatalogBoundary: true });
+        if (source === 'documented' || source === 'configured')
+            return null;
+        rememberProviderModelRows(provider, remote?.modelli ?? []);
+        return normalizeModels(remote?.modelli ?? [], provider, source);
+    }
+    /** The kernel declares a minimal generation for this provider: only the key test may ask the probe to send it. */
+    const declaresMinimalRequest = (id) => Boolean(deps.registry[id]?.sonda?.richiestaMinima);
+    function keyTestNotice(id) {
+        if (!deps.registry[id] || !declaresMinimalRequest(id))
+            return null;
+        return `One message with a one-token limit is sent to ${labelOf(id)} to test the key and may use a small amount of credit.`;
+    }
+    async function testProviderKey(id, secret, signal) {
+        const record = deps.registry[id];
+        if (!record)
+            throw Object.assign(new Error('PROVIDER_INVALID'), { code: 'PROVIDER_INVALID' });
+        const label = labelOf(id);
+        const candidate = typeof secret === 'string' ? secret.trim() : '';
+        const done = (outcome, httpStatus) => ({ provider: id, label, outcome, passed: PASSED.has(outcome), httpStatus, message: keyTestMessage(outcome, label, httpStatus) });
+        /* ⛔ Measured with Node's fetch: `€` or DEL make fetch throw before sending, while a tab, a non-breaking space, `é` or an inner
+           space are sent as they are. No provider issues such a key, so nothing is sent for it. */
+        if (!PRINTABLE_KEY.test(candidate))
+            return done('malformed', null);
+        const fetchFailure = (error) => {
+            if (error?.name === 'AbortError' && signal?.aborted)
+                throw error;
+            return done(isRefusedRedirect(error) ? 'redirected' : 'unreachable', null);
+        };
+        const own = AUTHENTICATED_KEY_CHECK[id];
+        if (own) {
+            if (!deps.fetchImpl)
+                return done('unverifiable', null);
+            let response;
+            try {
+                response = await deps.fetchImpl(joinPath(endpointOf(id), own.path), { method: 'GET', headers: { Accept: 'application/json', Authorization: `Bearer ${candidate}` }, redirect: 'error', signal: timeoutSignal(signal) });
+            }
+            catch (error) {
+                return fetchFailure(error);
+            }
+            try {
+                await response.body?.cancel();
+            }
+            catch { /* the body is never read: it could echo the request */ }
+            if (response.status >= 200 && response.status < 300)
+                return done('valid', response.status);
+            return done(refusedStatus(response.status), response.status);
+        }
+        if (!deps.createKeyProbe)
+            return done('unverifiable', null);
+        const probe = deps.createKeyProbe(id, candidate, signal);
+        /* ⛔ The ONLY call in this CLI that lets the kernel probe generate: the key test, for a provider that declares its minimal request. */
+        const result = declaresMinimalRequest(id) ? await probe.prova(id, { consentiGenerazione: true }) : await probe.prova(id);
+        /* ⛔ B1 slice 25: saved only on `credenzialeVerificata === true` (`classifyKeyTest` gives `valid` for nothing else). */
+        const classified = classifyKeyTest(result);
+        return done(classified.outcome, classified.httpStatus);
+    }
+    return {
+        listProviders,
+        async probeProvider(id, signal) {
+            if (deps.controlPlane) {
+                const profile = await deps.controlPlane.probe(id, signal);
+                const health = profile.lastHealth;
+                const decision = deps.controlPlane.readiness(id);
+                const state = health.state === 'available' ? 'available' : health.state === 'unconfigured' ? 'unconfigured' : health.state === 'unknown' || health.state === 'unprobeable' ? 'unknown' : 'unavailable';
+                return { provider: id, state, detail: probeDetailText(health.detail, profile.label ?? labelOf(id)), latencyMs: health.latencyMs, remediation: profile.remediation, readinessCode: decision.ready ? null : decision.code };
+            }
+            const result = await deps.createProbe(signal).prova(id);
+            const state = result?.esito === 'collegato' ? 'available' : result?.codice === 'PROVIDER_KEY_MISSING' ? 'unconfigured' : result?.esito === 'non-provabile' || result?.esito === 'non-sondabile' ? 'unknown' : 'unavailable';
+            return { provider: id, state, detail: probeDetailText(result?.motivo ?? result?.esito, labelOf(id)), latencyMs: Number.isFinite(result?.millisecondi) ? Number(result.millisecondi) : null, remediation: null, readinessCode: null };
+        },
+        async listModels(input = {}) {
+            if (input.provider && input.refresh) {
+                const remote = await deps.createProbe(input.signal).elencaModelli(input.provider);
+                const source = availabilityFromCatalog(remote?.fonte, true);
+                return normalizeModels(remote?.modelli ?? [], input.provider, source).map(row => enrichRegistryReasoning(input.provider, row));
+            }
+            const providers = await listProviders();
+            return (await Promise.all(providers.filter(p => !input.provider || p.id === input.provider).map(p => knownModels(p.id)))).flat();
+        },
+        async providerModels(provider, signal) {
+            if (!deps.registry[provider])
+                throw Object.assign(new Error('PROVIDER_INVALID'), { code: 'PROVIDER_INVALID' });
+            const label = labelOf(provider);
+            const known = await knownModels(provider);
+            const local = localCatalogOf(deps.registry[provider]);
+            if (local) {
+                /* R4 Q-R4-10: what the engine has installed; the models configured for it are kept, marked when it does not have them. */
+                const result = await localModels(provider, local, signal);
+                if (result.kind !== 'ok') {
+                    const said = t(result.kind === 'down' ? 'firstrun.models.down' : 'firstrun.models.unreadable', { label, address: result.address });
+                    return { provider, label, rows: known, verified: false, notice: known.length ? `${said} ${t('firstrun.models.knownOnly')}` : said, engine: result.kind };
+                }
+                const rows = mergeModels(result.rows, known);
+                const installed = result.rows.length;
+                const missing = rows.filter(row => !row.availabilityVerified).length;
+                const said = installed ? tn('firstrun.models.live', installed, { label }) : t('firstrun.models.empty', { label });
+                return { provider, label, rows, verified: missing === 0, notice: missing ? `${said} ${tn('firstrun.models.notInstalled', missing, { label })}` : said };
+            }
+            try {
+                const live = await liveModels(provider, signal);
+                if (live && live.length) {
+                    const rows = mergeModels(live, known);
+                    const liveVerified = rows.filter(row => row.availabilityVerified).length;
+                    const unverified = rows.length - liveVerified;
+                    const verified = unverified === 0 && rows.length > 0;
+                    const notice = verified
+                        ? `Live list from ${label}: ${rows.length} models.`
+                        : `Catalog from ${label}: ${liveVerified} live-verified; ${unverified} configured/documented/unknown model${unverified === 1 ? ' is' : 's are'} not verified as currently available.`;
+                    return { provider, label, rows, verified, notice };
+                }
+                return { provider, label, rows: known, verified: false, notice: `${label} did not return a live list; these are the models TALOS already knows. Not verified.` };
+            }
+            catch (error) {
+                if (error?.name === 'AbortError' && signal?.aborted)
+                    throw error;
+                return { provider, label, rows: known, verified: false, notice: `${label} could not be reached (${codeOf(error)}); these are the models TALOS already knows. Not verified.` };
+            }
+        },
+        async selectModel(id, scope) { if (scope !== 'project-user')
+            throw Object.assign(new Error('CONFIG_SCOPE_INVALID'), { code: 'CONFIG_SCOPE_INVALID' }); await deps.persistModel(id); },
+        testProviderKey,
+        keyTestNotice,
+        ...(deps.openRouterLogin ? { startOpenRouterLogin: (input) => deps.openRouterLogin(input) } : {}),
+        async setProviderKey(id, secret, signal) {
+            const test = await testProviderKey(id, secret, signal);
+            if (!test.passed)
+                return { ...test, saved: false };
+            /* ⛔ A key that passed but could not be stored says so, by code only: store errors are never echoed as text. */
+            try {
+                deps.setKey(id, String(secret).trim());
+            }
+            catch (error) {
+                return { ...test, saved: false, message: `${test.message} It could not be saved (${codeOf(error)}).` };
+            }
+            deps.controlPlane?.invalidate(id);
+            return { ...test, saved: true };
+        },
+        async clearProviderKey(id) { deps.clearKey(id); deps.controlPlane?.invalidate(id); },
+        async answerEnvironmentKey(id, answer) {
+            if (!deps.answerEnvironmentKey)
+                throw Object.assign(new Error('PROVIDER_CONSENT_UNAVAILABLE'), { code: 'PROVIDER_CONSENT_UNAVAILABLE' });
+            deps.answerEnvironmentKey(id, answer);
+            deps.controlPlane?.invalidate(id);
+        },
+        async chosenProvider() { return deps.chosenProvider?.() ?? null; },
+        async chooseProvider(id) {
+            if (!deps.registry[id] || deps.registry[id]?.destinazioneChat !== true)
+                throw Object.assign(new Error('PROVIDER_INVALID'), { code: 'PROVIDER_INVALID' });
+            if (!deps.chooseProvider)
+                throw Object.assign(new Error('PROVIDER_CONSENT_UNAVAILABLE'), { code: 'PROVIDER_CONSENT_UNAVAILABLE' });
+            deps.chooseProvider(id);
+        },
+        async readiness(model) {
+            const chosen = deps.chosenProvider?.() ?? null;
+            if (!chosen)
+                return { ready: false, code: 'PROVIDER_NOT_CHOSEN', provider: null, message: 'No provider has been chosen yet, so nothing was sent. Choose one with /provider.' };
+            const provider = providerOfModel(model);
+            if (provider !== chosen)
+                return { ready: false, code: 'MODEL_NOT_CHOSEN', provider: chosen, message: `No ${labelOf(chosen)} model has been chosen yet, so nothing was sent. Choose one with /model.` };
+            const row = (await listProviders()).find(entry => entry.id === provider);
+            if (!row)
+                return { ready: false, code: 'MODEL_NOT_CHOSEN', provider, message: `${provider} is not a provider TALOS can send to. Choose one with /provider.` };
+            if (deps.controlPlane) {
+                const decision = deps.controlPlane.readiness(provider);
+                if (!decision.ready)
+                    return { ready: false, code: decision.code, provider, message: decision.message };
+                return { ready: true, provider, model };
+            }
+            /*
+             * ⛔ Same predicate as `listProviders` (the key usable now), so the screen never calls ready what the runtime will refuse.
+             * B1 slice 25: slice 18's `RUNTIME_OPENROUTER_KEY_REQUIRED` step is gone. The session registry no longer asks every session
+             *   for an OpenRouter key: it asks the composition whether the session's own model is usable (`prontoFn`, CLI-REQ-05,
+             *   `harness-ui/src/session-registry.mjs:2859-2876`).
+             */
+            if (row.requiresKey && !row.configured) {
+                const refusal = unusableKeyRefusal(row.id, row.benched);
+                return { ready: false, code: refusal.code, provider, message: refusal.message };
+            }
+            return { ready: true, provider, model };
+        },
+    };
+}

package/dist/tui/components/assistant-stream.js

@@ -0,0 +1 @@
+export function assistantStreamView(message) { return message ? { label: 'TALOS', id: message.id, text: message.text } : null; }

package/dist/tui/components/command-menu.js

@@ -0,0 +1,68 @@
+import { t } from "../../i18n/index.js";
+import { SLASH_COMMANDS } from "../slash-commands.js";
+import { filterItems, moveSelection } from "../selection-list.js";
+import { pickerSection } from "../overlays/scroll-window.js";
+function commandQuery(input) { return input.trim().replace(/^\//u, ''); }
+export function commandMenuItems(input) {
+    const query = commandQuery(input);
+    const items = SLASH_COMMANDS.map(command => ({ id: command.name, label: command.name, searchText: `${command.name} ${command.description}`, value: command }));
+    return filterItems(items, query).map((item, index) => ({ command: item.value, score: items.length - index }));
+}
+export function completeCommandSelection(command) { return `/${command.name} `; }
+/*
+ * R4 Q-R4-5 / gate E6: which row Enter runs, or -1 for none. The top row is highlighted while the typed text is the start
+ * of its name (`/mo` → /model; `/` alone → the first row); a row the person moved to stays highlighted. After a typo (a
+ * fuzzy match only) or once arguments are typed nothing is highlighted, so Enter sends the text as typed and the existing
+ * "Did you mean" answer appears (Claude Code "Commands" :171-173, 2.1.269 → 2026-09-11, gate B.1).
+ */
+export function commandMenuHighlight(input, selection) {
+    const rows = commandMenuItems(input);
+    if (!rows.length)
+        return -1;
+    if (selection.moved)
+        return Math.max(0, Math.min(rows.length - 1, Math.trunc(selection.selected) || 0));
+    const query = commandQuery(input);
+    return rows[0].command.name.startsWith(query) ? 0 : -1;
+}
+const initialCommandMenuSelection = () => ({ query: '', selected: 0, pageSize: 10, moved: false });
+export function createCommandMenuSelectionStore() {
+    let snapshot = initialCommandMenuSelection();
+    const listeners = new Set();
+    const publish = (next) => {
+        if (next.query === snapshot.query && next.selected === snapshot.selected && next.pageSize === snapshot.pageSize && Boolean(next.moved) === Boolean(snapshot.moved))
+            return snapshot;
+        snapshot = next;
+        for (const listener of [...listeners])
+            listener();
+        return snapshot;
+    };
+    return {
+        getSnapshot: () => snapshot,
+        subscribe(listener) { listeners.add(listener); return () => listeners.delete(listener); },
+        reset() { return publish(initialCommandMenuSelection()); },
+        move(count, action) { return publish({ ...moveSelection(snapshot, count, action), moved: true }); },
+        highlight(index) { return publish({ ...snapshot, selected: Math.max(0, Math.trunc(index) || 0), moved: true }); },
+    };
+}
+export function commandMenuFastTextInput(input) {
+    if (input.bootPhase !== 'ready' || input.focus !== 'command-menu' || input.modalOwner)
+        return null;
+    if (input.key.ctrl || input.key.meta)
+        return null;
+    if (input.routed?.kind !== 'text' || typeof input.routed.text !== 'string' || input.routed.text.length === 0)
+        return null;
+    return input.routed.text;
+}
+// R1 Q-R1-3: the slash-command menu as app.ts draws it (single border), capped to lane L's `maxRows` and scrolled
+// around the selection by overlays/scroll-window.ts. R4: `selected` is the highlight (-1: none, see commandMenuHighlight);
+// an empty menu says so and what Enter will do (Q-R4-13; Claude Code `No commands match "/name"`, gate §5.2).
+export function commandMenuOverlay({ text, selected }) {
+    const rows = commandMenuItems(text);
+    return {
+        head: [{ text: t('screen.help.commands'), tone: 'strong' }],
+        sections: [rows.length
+                ? pickerSection(rows, selected, row => `/${row.command.name} · ${row.command.description}`)
+                : { lines: [{ text: t('screen.commands.none', { query: commandQuery(text) }), tone: 'dim' }] }],
+        borderStyle: 'single',
+    };
+}