tokenmix 1.5.2 → 1.5.3

package/dist/agents/codex.js

@@ -29,16 +29,22 @@ async function configure(apiKey, baseUrl, defaultModel) {
 // OpenAI-compatible provider. wire_api MUST be "responses": Codex 0.135+ dropped
 // support for "chat" (openai/codex#7782), and tokenmix's gateway implements the
 // Responses API specifically for Codex clients (POST /v1/responses).
+// Escape a value for a TOML double-quoted string (codex `--config key="value"`),
+// so a user-set model/baseUrl containing " \ or a newline can't break the parse
+// or inject extra config keys (e.g. overwrite base_url via an embedded newline).
+function tomlStr(v) {
+    return v.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\r/g, '\\r').replace(/\n/g, '\\n');
+}
 export function providerOverrides(baseUrl, model) {
     return [
         '--config',
         `model_provider="${PROVIDER_ID}"`,
         '--config',
-        `model="${model}"`,
+        `model="${tomlStr(model)}"`,
         '--config',
         `model_providers.${PROVIDER_ID}.name="TokenMix"`,
         '--config',
-        `model_providers.${PROVIDER_ID}.base_url="${baseUrl}"`,
+        `model_providers.${PROVIDER_ID}.base_url="${tomlStr(baseUrl)}"`,
         '--config',
         `model_providers.${PROVIDER_ID}.env_key="${KEY_ENV}"`,
         '--config',

package/dist/agents/continue.js

@@ -11,6 +11,9 @@ async function configure(apiKey, baseUrl, defaultModel) {
     // plus apiBase/apiKey for an OpenAI-compatible endpoint). We PRINT a ready-to-use
     // config rather than write the file, so we never clobber a user's existing
     // ~/.continue/config.yaml (and need no YAML dependency or cleanup step).
+    // Quote user-controlled scalars as YAML single-quoted strings so a model/baseUrl
+    // containing ':' '#' etc. can't break the structure when pasted into config.yaml.
+    const ys = (v) => `'${v.replace(/'/g, "''")}'`;
     const yaml = [
         'name: TokenMix',
         'version: 1.0.0',
@@ -18,9 +21,9 @@ async function configure(apiKey, baseUrl, defaultModel) {
         'models:',
         '  - name: TokenMix',
         '    provider: openai',
-        `    model: ${defaultModel}`,
-        `    apiBase: ${v1Url(baseUrl)}`,
-        `    apiKey: ${apiKey}`,
+        `    model: ${ys(defaultModel)}`,
+        `    apiBase: ${ys(v1Url(baseUrl))}`,
+        `    apiKey: ${ys(apiKey)}`,
     ].join('\n');
     return {
         notes: [

package/dist/agents/openhands.js

@@ -23,7 +23,7 @@ async function configure(apiKey, baseUrl, defaultModel) {
     return {
         envVars: {
             LLM_API_KEY: apiKey,
-            LLM_MODEL: `openai/${defaultModel}`,
+            LLM_MODEL: defaultModel.includes('/') ? defaultModel : `openai/${defaultModel}`,
             LLM_BASE_URL: v1Url(baseUrl),
             OPENHANDS_SUPPRESS_BANNER: '1',
         },

package/dist/commands/agent-runner.js

@@ -38,6 +38,7 @@ export function registerAgentCommands(program, runner = runAgent) {
             .description(t('cmd.agent', { name: agent.displayName }))
             .allowUnknownOption(true)
             .passThroughOptions(true) // forward --version / --help / --any to the underlying agent
+            .helpOption(false) // so `tokenmix <agent> --help` reaches the agent, not commander's wrapper help
             .action(async (args = []) => {
             await runner(agent, args);
         });

package/dist/i18n/index.js

@@ -23,11 +23,10 @@ export function getLocale() {
 // Translate a key for the active locale, filling {placeholders} from params.
 // Falls back to English, then to the raw key, so a partial catalog never throws.
 export function t(key, params) {
-    let s = catalogs[current]?.[key] ?? en[key] ?? key;
-    if (params) {
-        for (const [k, v] of Object.entries(params)) {
-            s = s.split(`{${k}}`).join(String(v));
-        }
-    }
-    return s;
+    const s = catalogs[current]?.[key] ?? en[key] ?? key;
+    if (!params)
+        return s;
+    // Single-pass replacement so a value that itself contains "{other}" is NOT
+    // re-substituted by a later param (order-independent and injection-safe).
+    return s.replace(/\{(\w+)\}/g, (match, name) => Object.prototype.hasOwnProperty.call(params, name) ? String(params[name]) : match);
 }

package/dist/i18n/messages.js

@@ -6,6 +6,7 @@
 // `{name}`-style placeholders are filled by t() at call time.
 export const en = {
     'common.notLoggedIn': 'Not logged in. Run `tokenmix login` first.',
+    'cli.unknownCommand': 'Unknown command: {cmd}. Run `tokenmix --help` to see available commands.',
     'config.corrupt': 'Your TokenMix config file was corrupt and has been ignored — run `tokenmix login` to re-create it.',
     // welcome screen (bare `tokenmix`, no args — onboarding for first-time users)
     'welcome.tagline': 'one account, 160+ models, every open-source coding agent',
@@ -185,6 +186,7 @@ export const en = {
 };
 export const zh = {
     'common.notLoggedIn': '未登录，请先运行 `tokenmix login`。',
+    'cli.unknownCommand': '未知命令：{cmd}。运行 `tokenmix --help` 查看可用命令。',
     'config.corrupt': 'TokenMix 配置文件已损坏，已忽略 —— 请运行 `tokenmix login` 重新创建。',
     'welcome.tagline': '一个账户、160+ 模型、对接所有开源编程 agent',
     'welcome.why': '你选的模型就是你用的模型 —— 不偷换、不降级,按真实用量计费。',
@@ -356,6 +358,7 @@ export const zh = {
 };
 export const ja = {
     'common.notLoggedIn': 'ログインしていません。まず `tokenmix login` を実行してください。',
+    'cli.unknownCommand': '不明なコマンド: {cmd}。`tokenmix --help` で利用可能なコマンドを確認してください。',
     'config.corrupt': 'TokenMix の設定ファイルが破損していたため無視しました —— `tokenmix login` を実行して再作成してください。',
     'welcome.tagline': '1 つのアカウントで 160+ モデル、あらゆるオープンソース・コーディング agent に対応',
     'welcome.why': '選んだモデルがそのまま使われます —— すり替えなし、実使用量で課金。',
@@ -512,6 +515,7 @@ export const ja = {
 };
 export const ko = {
     'common.notLoggedIn': '로그인되어 있지 않습니다. 먼저 `tokenmix login`을 실행하세요.',
+    'cli.unknownCommand': '알 수 없는 명령: {cmd}. `tokenmix --help`로 사용 가능한 명령을 확인하세요.',
     'config.corrupt': 'TokenMix 설정 파일이 손상되어 무시했습니다 —— `tokenmix login`을 실행해 다시 만드세요.',
     'welcome.tagline': '하나의 계정으로 160+ 모델, 모든 오픈소스 코딩 agent 지원',
     'welcome.why': '선택한 모델 그대로 실행됩니다 —— 몰래 바꾸지 않고 실사용량으로 과금합니다.',
@@ -668,6 +672,7 @@ export const ko = {
 };
 export const es = {
     'common.notLoggedIn': 'No has iniciado sesión. Ejecuta `tokenmix login` primero.',
+    'cli.unknownCommand': 'Comando desconocido: {cmd}. Ejecuta `tokenmix --help` para ver los comandos disponibles.',
     'config.corrupt': 'Tu archivo de configuración de TokenMix estaba dañado y se ha ignorado: ejecuta `tokenmix login` para volver a crearlo.',
     'welcome.tagline': 'una cuenta, 160+ modelos, todos los agentes de programación de código abierto',
     'welcome.why': 'El modelo que eliges es el que usas: sin cambios ocultos, facturado por uso real.',
@@ -824,6 +829,7 @@ export const es = {
 };
 export const fr = {
     'common.notLoggedIn': 'Non connecté. Exécutez d’abord `tokenmix login`.',
+    'cli.unknownCommand': 'Commande inconnue : {cmd}. Exécutez `tokenmix --help` pour voir les commandes disponibles.',
     'config.corrupt': 'Votre fichier de configuration TokenMix était corrompu et a été ignoré — exécutez `tokenmix login` pour le recréer.',
     'welcome.tagline': 'un seul compte, 160+ modèles, tous les agents de codage open source',
     'welcome.why': 'Le modèle que vous choisissez est celui que vous utilisez — sans substitution, facturé à l’usage réel.',

package/dist/program.js

@@ -9,6 +9,7 @@ import { listCommand } from './commands/list.js';
 import { doctorCommand } from './commands/doctor.js';
 import { welcomeCommand } from './commands/welcome.js';
 import { registerAgentCommands } from './commands/agent-runner.js';
+import { logger } from './utils/logger.js';
 import { t } from './i18n/index.js';
 // Read version from package.json so we never have to bump it in two places.
 const pkg = createRequire(import.meta.url)('../package.json');
@@ -25,7 +26,15 @@ export function buildProgram(deps = {}) {
         .description(t('cmd.program'))
         .version(pkg.version)
         // Bare `tokenmix` (no command) shows a friendly onboarding screen, not raw help.
-        .action(welcomeCommand);
+        // An unrecognized command would otherwise be swallowed into this default action
+        // (printing welcome + exiting 0), so reject it explicitly instead.
+        .action((_options, command) => {
+        if (command.args.length > 0) {
+            logger.error(t('cli.unknownCommand', { cmd: command.args.join(' ') }));
+            process.exit(1);
+        }
+        return welcomeCommand();
+    });
     program
         .command('login')
         .description(t('cmd.login'))

package/dist/utils/prompt.js

@@ -5,7 +5,7 @@ export async function promptApiKey() {
         type: 'password',
         name: 'apiKey',
         message: t('prompt.pasteKey'),
-        validate: (v) => (v && v.startsWith('sk-tm-') ? true : t('login.keyMustStart')),
+        validate: (v) => (v && v.trim().startsWith('sk-tm-') ? true : t('login.keyMustStart')),
     });
     const key = r.apiKey?.trim();
     return key || null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmix",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Zero-config CLI to use any open-source coding agent with TokenMix as the unified LLM backend.",
   "type": "module",
   "bin": {