ur-agent 1.31.0 → 1.33.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 1.33.0
+
+- Add API keys from inside UR while it is running: in `/model`, selecting an
+  API provider (OpenAI, Anthropic, Gemini, OpenRouter) that isn't connected now
+  shows a masked key-entry step. The key is stored in the OS keychain, then the
+  provider's models load live and you choose one — all without leaving the
+  session or setting an environment variable.
+- Subscription login is unchanged: use `ur auth <provider>` (Codex, Claude,
+  Gemini, Antigravity).
+
+## 1.32.0
+
+- `/model` now shows the subscription providers (Codex CLI, Claude Code, Gemini
+  CLI, Antigravity) again. They are enabled the moment you `ur connect` them
+  (persisted per-account opt-in) — no `UR_ENABLE_EXTERNAL_APP_PROVIDERS` env var
+  needed — and run via the official CLI. Not connected → clear connect prompt.
+- API providers (OpenAI, Anthropic, Gemini, OpenRouter) now load their model
+  lists **live** from each provider's `/models` endpoint using your connected
+  key (OpenAI/Anthropic/OpenRouter `data[].id`; Gemini `models[]` filtered to
+  `generateContent`). No hardcoded model IDs; the curated list is only a
+  fallback shown before you connect. Subscription CLIs keep a curated list
+  because their official CLIs expose no models API.
+- Live-discovered models validate against the discovered list (with cold-process
+  tolerance), so a saved API model keeps working across restarts.
+
 ## 1.31.0
 
 - Add in-app provider connection: `ur connect` / `/connect` connects a provider

package/dist/cli.js

@@ -51616,6 +51616,7 @@ __export(exports_providerRegistry, {
   isProviderRuntimeSelectable: () => isProviderRuntimeSelectable,
   isProviderId: () => isProviderId,
   isModelSupportedByProvider: () => isModelSupportedByProvider,
+  isExternalBridgeEnabled: () => isExternalBridgeEnabled,
   getValidModelIdsForProvider: () => getValidModelIdsForProvider,
   getRuntimeProviderId: () => getRuntimeProviderId,
   getProviderStatus: () => getProviderStatus,
@@ -51635,6 +51636,7 @@ __export(exports_providerRegistry, {
   formatProviderDoctor: () => formatProviderDoctor,
   formatInvalidProviderModelMessage: () => formatInvalidProviderModelMessage,
   externalAppProviderBridgeEnabled: () => externalAppProviderBridgeEnabled,
+  enableExternalBridge: () => enableExternalBridge,
   doctorProvider: () => doctorProvider,
   doctorActiveProvider: () => doctorActiveProvider,
   credentialTypeLabel: () => credentialTypeLabel,
@@ -51775,11 +51777,43 @@ function credentialTypeLabel(type) {
 function externalAppProviderBridgeEnabled(env4 = process.env) {
   return env4.UR_ENABLE_EXTERNAL_APP_PROVIDERS === "1";
 }
+function isExternalBridgeEnabled(providerId, env4 = process.env, settings = getInitialSettings()) {
+  if (externalAppProviderBridgeEnabled(env4)) {
+    return true;
+  }
+  const provider = resolveProviderId(providerId);
+  const enabled = settings.provider?.enabledExternalBridges;
+  return Boolean(provider && Array.isArray(enabled) && enabled.includes(provider));
+}
+function enableExternalBridge(providerId) {
+  const provider = resolveProviderId(providerId);
+  if (!provider) {
+    return { ok: false, message: `Unknown provider "${providerId}". Run: ur provider list` };
+  }
+  if (getProviderDefinition(provider).runtimeKind !== "external-app") {
+    return { ok: true, message: `${provider} does not require an external-app opt-in.` };
+  }
+  const settings = getInitialSettings();
+  const current = settings.provider?.enabledExternalBridges ?? [];
+  if (current.includes(provider)) {
+    return { ok: true, message: `${provider} is already enabled.` };
+  }
+  const result = updateSettingsForSource("userSettings", {
+    provider: {
+      ...settings.provider ?? {},
+      enabledExternalBridges: [...current, provider]
+    }
+  });
+  if (result.error) {
+    return { ok: false, message: `Failed to persist opt-in: ${result.error.message}` };
+  }
+  return { ok: true, message: `Enabled ${provider} for this account.` };
+}
 function getProviderRuntimeKind(providerId) {
   const provider = resolveProviderId(providerId);
   return provider ? getProviderDefinition(provider).runtimeKind : "unknown";
 }
-function getProviderRuntimeBlockReason(providerId, env4 = process.env) {
+function getProviderRuntimeBlockReason(providerId, env4 = process.env, settings = getInitialSettings()) {
   const provider = resolveProviderId(providerId);
   if (!provider) {
     return `Unknown provider "${providerId}". Run: ur provider list`;
@@ -51791,10 +51825,10 @@ function getProviderRuntimeBlockReason(providerId, env4 = process.env) {
   if (definition.runtimeKind !== "external-app") {
     return null;
   }
-  if (externalAppProviderBridgeEnabled(env4)) {
+  if (isExternalBridgeEnabled(provider, env4, settings)) {
     return null;
   }
-  return `Provider "${provider}" uses an external app bridge (${definition.displayName}), not a UR-native model endpoint. UR's independent runtime does not require Codex, Claude Code, Gemini CLI, or Antigravity to be installed. Choose an API/local/server provider such as openai-api, anthropic-api, gemini-api, openrouter, ollama, lmstudio, llama.cpp, or vllm. To intentionally delegate turns to the external app bridge, set UR_ENABLE_EXTERNAL_APP_PROVIDERS=1.`;
+  return `Provider "${provider}" uses an external app bridge (${definition.displayName}). Connect it once with \`ur connect ${provider}\` (or set UR_ENABLE_EXTERNAL_APP_PROVIDERS=1) to enable it. Otherwise choose an API/local/server provider such as openai-api, anthropic-api, gemini-api, openrouter, ollama, lmstudio, llama.cpp, or vllm.`;
 }
 function isProviderRuntimeSelectable(providerId, env4 = process.env) {
   return getProviderRuntimeBlockReason(providerId, env4) === null;
@@ -52564,6 +52598,9 @@ function staticModelsForProvider(provider) {
 async function discoverLiveModelsForProvider(provider, options = {}) {
   const definition = getProviderDefinition(provider);
   if (!definition.endpointKind) {
+    if (definition.accessType === "api" && definition.modelDiscoveryType === "live") {
+      return discoverApiProviderModels(provider, definition, options);
+    }
     return [];
   }
   const settings = options.settings ?? getInitialSettings();
@@ -52585,6 +52622,68 @@ async function discoverLiveModelsForProvider(provider, options = {}) {
   const names = definition.endpointKind === "ollama" ? parseOllamaModelNamesFromTags(body) : parseOpenAICompatibleModelNames(body);
   return modelDefinitionsFromNames(provider, names, "live");
 }
+function apiModelsRequest(provider, apiKey) {
+  switch (provider) {
+    case "anthropic-api":
+      return {
+        url: "https://api.anthropic.com/v1/models",
+        headers: { "x-api-key": apiKey, "anthropic-version": "2023-06-01" }
+      };
+    case "gemini-api":
+      return {
+        url: "https://generativelanguage.googleapis.com/v1beta/models",
+        headers: { "x-goog-api-key": apiKey }
+      };
+    case "openrouter":
+      return {
+        url: "https://openrouter.ai/api/v1/models",
+        headers: { Authorization: `Bearer ${apiKey}` }
+      };
+    default:
+      return {
+        url: "https://api.openai.com/v1/models",
+        headers: { Authorization: `Bearer ${apiKey}` }
+      };
+  }
+}
+function parseApiModelIds(provider, body) {
+  const root2 = body ?? {};
+  if (provider === "gemini-api") {
+    const models = Array.isArray(root2.models) ? root2.models : [];
+    const names2 = models.filter((m) => {
+      const methods = m.supportedGenerationMethods;
+      return !Array.isArray(methods) || methods.includes("generateContent");
+    }).map((m) => typeof m.name === "string" ? m.name.replace(/^models\//, "") : "").filter(Boolean);
+    return [...new Set(names2)].sort((a2, b) => a2.localeCompare(b));
+  }
+  const data = Array.isArray(root2.data) ? root2.data : [];
+  const names = data.map((m) => typeof m.id === "string" ? m.id : "").filter(Boolean);
+  return [...new Set(names)].sort((a2, b) => a2.localeCompare(b));
+}
+async function discoverApiProviderModels(provider, definition, options) {
+  const env4 = options.adapters?.env ?? process.env;
+  let apiKey = definition.envKey ? env4[definition.envKey] : undefined;
+  if (!apiKey) {
+    try {
+      const { getProviderApiKey: getProviderApiKey2 } = await Promise.resolve().then(() => (init_providerCredentials(), exports_providerCredentials));
+      apiKey = getProviderApiKey2(provider, { env: env4 });
+    } catch {}
+  }
+  if (!apiKey) {
+    throw new Error(`Not connected: run \`ur connect ${provider}\` to add an API key.`);
+  }
+  const { url: url3, headers } = apiModelsRequest(provider, apiKey);
+  const response = await (options.adapters?.fetch ?? fetch)(url3, {
+    method: "GET",
+    signal: options.signal,
+    headers
+  });
+  if (!response.ok) {
+    throw new Error(`${url3} returned HTTP ${response.status}.`);
+  }
+  const body = await response.json();
+  return modelDefinitionsFromNames(provider, parseApiModelIds(provider, body), "live");
+}
 async function listModelsForProviderWithSource(providerId, options = {}) {
   const provider = resolveProviderId(providerId);
   if (!provider) {
@@ -52707,12 +52806,13 @@ function validateProviderModelPair(providerId, modelId, options = {}) {
   const suppliedModels = (options.availableModels ?? []).map((model) => typeof model === "string" ? model : model.id);
   const cachedModels = getCachedProviderModels(provider).map((model) => model.id);
   const staticModelIds = staticModelsForProvider(provider).map((model) => model.id);
-  const hasDynamicModels = models.some((model) => model.isDynamic);
+  const hasDynamicModels = models.some((model) => model.isDynamic) || getProviderDefinition(provider).modelDiscoveryType === "live";
   const validModelIds = suppliedModels.length > 0 ? suppliedModels : hasDynamicModels ? cachedModels.length > 0 ? cachedModels : staticModelIds : Array.from(new Set([...staticModelIds, ...cachedModels]));
   if (validModelIds.includes(modelId)) {
     return { valid: true };
   }
-  if (hasDynamicModels && options.allowUncachedDynamic && validModelIds.length === 0) {
+  const noAuthoritativeList = cachedModels.length === 0 && suppliedModels.length === 0;
+  if (hasDynamicModels && options.allowUncachedDynamic && noAuthoritativeList) {
     return { valid: true };
   }
   const defaultModel = getDefaultModelForProvider(provider);
@@ -52889,10 +52989,10 @@ var init_providerRegistry = __esm(() => {
       statusBarName: "OpenAI",
       accessType: "api",
       credentialType: "api-key",
-      modelDiscoveryType: "static",
+      modelDiscoveryType: "live",
       statusCheck: "api-key",
       listModels: "static",
-      validateModel: "static-list",
+      validateModel: "discovered-list",
       runtimeKind: "ur-native",
       authMode: "api",
       legalPath: "OPENAI_API_KEY",
@@ -52905,10 +53005,10 @@ var init_providerRegistry = __esm(() => {
       statusBarName: "Claude API",
       accessType: "api",
       credentialType: "api-key",
-      modelDiscoveryType: "static",
+      modelDiscoveryType: "live",
       statusCheck: "api-key",
       listModels: "static",
-      validateModel: "static-list",
+      validateModel: "discovered-list",
       runtimeKind: "ur-native",
       authMode: "api",
       legalPath: "ANTHROPIC_API_KEY",
@@ -52921,10 +53021,10 @@ var init_providerRegistry = __esm(() => {
       statusBarName: "Gemini API",
       accessType: "api",
       credentialType: "api-key",
-      modelDiscoveryType: "static",
+      modelDiscoveryType: "live",
       statusCheck: "api-key",
       listModels: "static",
-      validateModel: "static-list",
+      validateModel: "discovered-list",
       runtimeKind: "ur-native",
       authMode: "api",
       legalPath: "GEMINI_API_KEY",
@@ -52937,10 +53037,10 @@ var init_providerRegistry = __esm(() => {
       statusBarName: "OpenRouter",
       accessType: "api",
       credentialType: "api-key",
-      modelDiscoveryType: "static",
+      modelDiscoveryType: "live",
       statusCheck: "api-key",
       listModels: "static",
-      validateModel: "static-list",
+      validateModel: "discovered-list",
       runtimeKind: "ur-native",
       authMode: "api",
       legalPath: "OPENROUTER_API_KEY",
@@ -69418,7 +69518,7 @@ var init_auth = __esm(() => {
 
 // src/utils/userAgent.ts
 function getURCodeUserAgent() {
-  return `ur/${"1.31.0"}`;
+  return `ur/${"1.33.0"}`;
 }
 
 // src/utils/workloadContext.ts
@@ -69440,7 +69540,7 @@ function getUserAgent() {
   const clientApp = process.env.UR_AGENT_SDK_CLIENT_APP ? `, client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}` : "";
   const workload = getWorkload();
   const workloadSuffix = workload ? `, workload/${workload}` : "";
-  return `ur-cli/${"1.31.0"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
+  return `ur-cli/${"1.33.0"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
 }
 function getMCPUserAgent() {
   const parts = [];
@@ -69454,7 +69554,7 @@ function getMCPUserAgent() {
     parts.push(`client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}`);
   }
   const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
-  return `ur/${"1.31.0"}${suffix}`;
+  return `ur/${"1.33.0"}${suffix}`;
 }
 function getWebFetchUserAgent() {
   return `UR-User (${getURCodeUserAgent()})`;
@@ -69592,7 +69692,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "1.31.0",
+      appVersion: "1.33.0",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -76109,7 +76209,7 @@ var init_metadata = __esm(() => {
   COMPOUND_OPERATOR_REGEX = /\s*(?:&&|\|\||[;|])\s*/;
   WHITESPACE_REGEX = /\s+/;
   getVersionBase = memoize_default(() => {
-    const match = "1.31.0".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "1.33.0".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -76149,7 +76249,7 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isURCodeAction: isEnvTruthy(process.env.UR_CODE_ACTION),
       isURAiAuth: isURAISubscriber2(),
-      version: "1.31.0",
+      version: "1.33.0",
       versionBase: getVersionBase(),
       buildTime: "",
       deploymentEnvironment: env2.detectDeploymentEnvironment(),
@@ -76819,7 +76919,7 @@ function initialize1PEventLogging() {
   const platform2 = getPlatform();
   const attributes = {
     [import_semantic_conventions4.ATTR_SERVICE_NAME]: "ur",
-    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.31.0"
+    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.33.0"
   };
   if (platform2 === "wsl") {
     const wslVersion = getWslVersion();
@@ -76846,7 +76946,7 @@ function initialize1PEventLogging() {
       })
     ]
   });
-  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.31.0");
+  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.33.0");
 }
 async function reinitialize1PEventLoggingIfConfigChanged() {
   if (!is1PEventLoggingEnabled() || !firstPartyEventLoggerProvider) {
@@ -82143,7 +82243,7 @@ function formatAgentTrendReport(report = buildAgentTrendReport()) {
 function formatA2AAgentCard(options = {}, pretty = true) {
   return JSON.stringify(buildA2AAgentCard(options), null, pretty ? 2 : 0);
 }
-var urVersion = "1.31.0", coverage, priorityRoadmap;
+var urVersion = "1.33.0", coverage, priorityRoadmap;
 var init_trends = __esm(() => {
   coverage = [
     {
@@ -84136,7 +84236,7 @@ function getAttributionHeader(fingerprint) {
   if (!isAttributionHeaderEnabled()) {
     return "";
   }
-  const version2 = `${"1.31.0"}.${fingerprint}`;
+  const version2 = `${"1.33.0"}.${fingerprint}`;
   const entrypoint = process.env.UR_CODE_ENTRYPOINT ?? "unknown";
   const cch = "";
   const workload = getWorkload();
@@ -191790,7 +191890,7 @@ function getTelemetryAttributes() {
     attributes["session.id"] = sessionId;
   }
   if (shouldIncludeAttribute("OTEL_METRICS_INCLUDE_VERSION")) {
-    attributes["app.version"] = "1.31.0";
+    attributes["app.version"] = "1.33.0";
   }
   const oauthAccount = getOauthAccountInfo();
   if (oauthAccount) {
@@ -227175,7 +227275,7 @@ function getInstallationEnv() {
   return;
 }
 function getURCodeVersion() {
-  return "1.31.0";
+  return "1.33.0";
 }
 async function getInstalledVSCodeExtensionVersion(command) {
   const { stdout } = await execFileNoThrow(command, ["--list-extensions", "--show-versions"], {
@@ -230014,7 +230114,7 @@ async function setupSdkMcpClients(sdkMcpConfigs, sendMcpMessage) {
     const client2 = new Client({
       name: "ur",
       title: "UR",
-      version: "1.31.0",
+      version: "1.33.0",
       description: "UR-AGENT autonomous engineering workflow engine",
       websiteUrl: PRODUCT_URL
     }, {
@@ -230368,7 +230468,7 @@ var init_client5 = __esm(() => {
       const client2 = new Client({
         name: "ur",
         title: "UR",
-        version: "1.31.0",
+        version: "1.33.0",
         description: "UR-AGENT autonomous engineering workflow engine",
         websiteUrl: PRODUCT_URL
       }, {
@@ -240182,9 +240282,9 @@ async function assertMinVersion() {
   if (false) {}
   try {
     const versionConfig = await getDynamicConfig_BLOCKS_ON_INIT("tengu_version_config", { minVersion: "0.0.0" });
-    if (versionConfig.minVersion && lt("1.31.0", versionConfig.minVersion)) {
+    if (versionConfig.minVersion && lt("1.33.0", versionConfig.minVersion)) {
       console.error(`
-It looks like your version of UR (${"1.31.0"}) needs an update.
+It looks like your version of UR (${"1.33.0"}) needs an update.
 A newer version (${versionConfig.minVersion} or higher) is required to continue.
 
 To update, please run:
@@ -240400,7 +240500,7 @@ async function installGlobalPackage(specificVersion) {
     logError2(new AutoUpdaterError("Another process is currently installing an update"));
     logEvent("tengu_auto_updater_lock_contention", {
       pid: process.pid,
-      currentVersion: "1.31.0"
+      currentVersion: "1.33.0"
     });
     return "in_progress";
   }
@@ -240409,7 +240509,7 @@ async function installGlobalPackage(specificVersion) {
     if (!env2.isRunningWithBun() && env2.isNpmFromWindowsPath()) {
       logError2(new Error("Windows NPM detected in WSL environment"));
       logEvent("tengu_auto_updater_windows_npm_in_wsl", {
-        currentVersion: "1.31.0"
+        currentVersion: "1.33.0"
       });
       console.error(`
 Error: Windows NPM detected in WSL
@@ -240944,7 +241044,7 @@ function detectLinuxGlobPatternWarnings() {
 }
 async function getDoctorDiagnostic() {
   const installationType = await getCurrentInstallationType();
-  const version2 = typeof MACRO !== "undefined" ? "1.31.0" : "unknown";
+  const version2 = typeof MACRO !== "undefined" ? "1.33.0" : "unknown";
   const installationPath = await getInstallationPath();
   const invokedBinary = getInvokedBinary();
   const multipleInstallations = await detectMultipleInstallations();
@@ -241879,8 +241979,8 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
     const maxVersion = await getMaxVersion();
     if (maxVersion && gt(version2, maxVersion)) {
       logForDebugging(`Native installer: maxVersion ${maxVersion} is set, capping update from ${version2} to ${maxVersion}`);
-      if (gte("1.31.0", maxVersion)) {
-        logForDebugging(`Native installer: current version ${"1.31.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
+      if (gte("1.33.0", maxVersion)) {
+        logForDebugging(`Native installer: current version ${"1.33.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
         logEvent("tengu_native_update_skipped_max_version", {
           latency_ms: Date.now() - startTime,
           max_version: maxVersion,
@@ -241891,7 +241991,7 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
       version2 = maxVersion;
     }
   }
-  if (!forceReinstall && version2 === "1.31.0" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
+  if (!forceReinstall && version2 === "1.33.0" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
     logForDebugging(`Found ${version2} at ${executablePath}, skipping install`);
     logEvent("tengu_native_update_complete", {
       latency_ms: Date.now() - startTime,
@@ -338795,7 +338895,7 @@ function Feedback({
       platform: env2.platform,
       gitRepo: envInfo.isGit,
       terminal: env2.terminal,
-      version: "1.31.0",
+      version: "1.33.0",
       transcript: normalizeMessagesForAPI(messages),
       errors: sanitizedErrors,
       lastApiRequest: getLastAPIRequest(),
@@ -338987,7 +339087,7 @@ function Feedback({
                       ", ",
                       env2.terminal,
                       ", v",
-                      "1.31.0"
+                      "1.33.0"
                     ]
                   }, undefined, true, undefined, this)
                 ]
@@ -339093,7 +339193,7 @@ ${sanitizedDescription}
 ` + `**Environment Info**
 ` + `- Platform: ${env2.platform}
 ` + `- Terminal: ${env2.terminal}
-` + `- Version: ${"1.31.0"}
+` + `- Version: ${"1.33.0"}
 ` + `- Feedback ID: ${feedbackId}
 ` + `
 **Errors**
@@ -342204,7 +342304,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "1.31.0"
+    value: "1.33.0"
   }, {
     label: "Session name",
     value: nameValue
@@ -345504,7 +345604,7 @@ function Config({
         }
       }, undefined, false, undefined, this)
     }, undefined, false, undefined, this) : showSubmenu === "ChannelDowngrade" ? /* @__PURE__ */ jsx_dev_runtime177.jsxDEV(ChannelDowngradeDialog, {
-      currentVersion: "1.31.0",
+      currentVersion: "1.33.0",
       onChoice: (choice) => {
         setShowSubmenu(null);
         setTabsHidden(false);
@@ -345516,7 +345616,7 @@ function Config({
           autoUpdatesChannel: "stable"
         };
         if (choice === "stay") {
-          newSettings.minimumVersion = "1.31.0";
+          newSettings.minimumVersion = "1.33.0";
         }
         updateSettingsForSource("userSettings", newSettings);
         setSettingsData((prev_27) => ({
@@ -353586,7 +353686,7 @@ function HelpV2(t0) {
   let t6;
   if ($3[31] !== tabs) {
     t6 = /* @__PURE__ */ jsx_dev_runtime204.jsxDEV(Tabs, {
-      title: `UR v${"1.31.0"}`,
+      title: `UR v${"1.33.0"}`,
       color: "professionalBlue",
       defaultTab: "general",
       children: tabs
@@ -354332,7 +354432,7 @@ function buildToolUseContext(tools, readFileStateCache) {
 async function handleInitialize(options2) {
   return {
     name: "ur-agent",
-    version: "1.31.0",
+    version: "1.33.0",
     protocolVersion: "0.1.0",
     workspaceRoot: options2.cwd,
     capabilities: {
@@ -374456,7 +374556,7 @@ function getAllReleaseNotes(changelogContent = getStoredChangelogFromMemory()) {
     return [];
   }
 }
-async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.31.0") {
+async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.33.0") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -374483,7 +374583,7 @@ async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.31.0")
     releaseNotes
   };
 }
-function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.31.0") {
+function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.33.0") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -375653,7 +375753,7 @@ function getRecentActivitySync() {
   return cachedActivity;
 }
 function getLogoDisplayData() {
-  const version2 = process.env.DEMO_VERSION ?? "1.31.0";
+  const version2 = process.env.DEMO_VERSION ?? "1.33.0";
   const serverUrl = getDirectConnectServerUrl();
   const displayPath = process.env.DEMO_VERSION ? "/code/ur" : getDisplayPath(getCwd2());
   const cwd2 = serverUrl ? `${displayPath} in ${serverUrl.replace(/^https?:\/\//, "")}` : displayPath;
@@ -376442,7 +376542,7 @@ function LogoV2() {
   if ($3[2] === Symbol.for("react.memo_cache_sentinel")) {
     t2 = () => {
       const currentConfig = getGlobalConfig();
-      if (currentConfig.lastReleaseNotesSeen === "1.31.0") {
+      if (currentConfig.lastReleaseNotesSeen === "1.33.0") {
         return;
       }
       saveGlobalConfig(_temp326);
@@ -377127,12 +377227,12 @@ function LogoV2() {
   return t41;
 }
 function _temp326(current) {
-  if (current.lastReleaseNotesSeen === "1.31.0") {
+  if (current.lastReleaseNotesSeen === "1.33.0") {
     return current;
   }
   return {
     ...current,
-    lastReleaseNotesSeen: "1.31.0"
+    lastReleaseNotesSeen: "1.33.0"
   };
 }
 function _temp243(s_0) {
@@ -394365,8 +394465,10 @@ async function connectProvider(provider, keyFlag) {
     if (alias === "provider") {
       return `No official login is configured for ${provider}.`;
     }
+    const enabled = enableExternalBridge(provider);
     const result = await launchProviderAuth(alias);
-    return result.message;
+    return `${result.message}
+${enabled.message} It will run via the official ${def2.displayName} CLI.`;
   }
   if (def2.envKey) {
     const key = keyFlag ?? await readStdinKey();
@@ -593026,7 +593128,7 @@ async function captureMemoryDiagnostics(trigger2, dumpNumber = 0) {
     smapsRollup,
     platform: process.platform,
     nodeVersion: process.version,
-    ccVersion: "1.31.0"
+    ccVersion: "1.33.0"
   };
 }
 async function performHeapDump(trigger2 = "manual", dumpNumber = 0) {
@@ -593612,7 +593714,7 @@ var init_bridge_kick = __esm(() => {
 var call137 = async () => {
   return {
     type: "text",
-    value: "1.31.0"
+    value: "1.33.0"
   };
 }, version2, version_default;
 var init_version = __esm(() => {
@@ -596492,6 +596594,9 @@ function ProviderFirstModelPicker({
   const [modelSource, setModelSource] = import_react188.useState("static");
   const [modelWarning, setModelWarning] = import_react188.useState(null);
   const [providerWarning, setProviderWarning] = import_react188.useState(null);
+  const [connectingProvider, setConnectingProvider] = import_react188.useState(null);
+  const [apiKeyInput, setApiKeyInput] = import_react188.useState("");
+  const [connectError, setConnectError] = import_react188.useState(null);
   const effortValue = useAppState(selectEffortValue2);
   const [effort] = import_react188.useState(effortValue !== undefined ? convertEffortValueToLevel(effortValue) : undefined);
   const appThinkingEnabled = useAppState(selectThinkingEnabled2);
@@ -596500,7 +596605,7 @@ function ProviderFirstModelPicker({
   import_react188.useEffect(() => {
     async function loadProviderStatus() {
       setLoadingProviders(true);
-      const providers = listProviders();
+      const providers = listProviders({ includeExternalAppBridges: true });
       const settings = getSettingsForSource("userSettings");
       const options2 = await Promise.all(providers.map(async (provider) => {
         const status2 = await getProviderStatus(provider.id, {
@@ -596577,6 +596682,13 @@ function ProviderFirstModelPicker({
         return;
       }
       if (provider.status !== "connected") {
+        if (provider.credentialType === "api-key") {
+          setConnectingProvider(provider);
+          setApiKeyInput("");
+          setConnectError(null);
+          setStep("connect");
+          return;
+        }
         setProviderWarning(`Provider "${provider.value}" is ${provider.status}: ${provider.statusLabel}. Run \`ur provider doctor ${provider.value}\`, or choose a connected API/local/server provider.`);
         return;
       }
@@ -596653,6 +596765,105 @@ function ProviderFirstModelPicker({
     setModelOptions([]);
     setModelWarning(null);
   }
+  function handleKeySubmit() {
+    if (!connectingProvider)
+      return;
+    const key = apiKeyInput.trim();
+    if (!key) {
+      setConnectError("Enter your API key (or press Esc to go back).");
+      return;
+    }
+    const saved = setProviderApiKey(connectingProvider.value, key);
+    if (!saved.ok) {
+      setConnectError(saved.message);
+      return;
+    }
+    setApiKeyInput("");
+    setConnectError(null);
+    setSelectedProvider(connectingProvider);
+    setStep("model");
+  }
+  function handleKeyCancel() {
+    setApiKeyInput("");
+    setConnectingProvider(null);
+    setConnectError(null);
+    setStep("provider");
+  }
+  if (step === "connect" && connectingProvider) {
+    const envKey = connectingProvider.provider.envKey;
+    const content2 = /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedBox_default, {
+      flexDirection: "column",
+      children: [
+        /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedBox_default, {
+          marginBottom: 1,
+          flexDirection: "column",
+          children: [
+            /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedText, {
+              color: "remember",
+              bold: true,
+              children: [
+                "Connect ",
+                connectingProvider.label
+              ]
+            }, undefined, true, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedText, {
+              dimColor: true,
+              children: "Paste your API key to use your own account. It is stored securely in your OS keychain and reused automatically \u2014 you only do this once."
+            }, undefined, false, undefined, this),
+            envKey && /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedText, {
+              dimColor: true,
+              color: "subtle",
+              children: [
+                "Equivalent to setting ",
+                envKey,
+                ". Get a key from the provider's dashboard."
+              ]
+            }, undefined, true, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedBox_default, {
+          children: [
+            /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedText, {
+              children: "API key: "
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(TextInput, {
+              value: apiKeyInput,
+              onChange: setApiKeyInput,
+              onSubmit: handleKeySubmit,
+              mask: "*",
+              placeholder: "paste key, then Enter"
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        connectError && /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedBox_default, {
+          marginTop: 1,
+          children: /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedText, {
+            color: "error",
+            children: connectError
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedBox_default, {
+          marginTop: 1,
+          children: /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(Byline, {
+            children: [
+              /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(KeyboardShortcutHint, {
+                shortcut: "Enter",
+                action: "store key & load models"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(KeyboardShortcutHint, {
+                shortcut: "Esc",
+                action: "back"
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this)
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+    return isStandaloneCommand ? /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(Pane, {
+      color: "permission",
+      children: content2
+    }, undefined, false, undefined, this) : content2;
+  }
   if (step === "provider") {
     const content2 = /* @__PURE__ */ jsx_dev_runtime346.jsxDEV(ThemedBox_default, {
       flexDirection: "column",
@@ -596954,12 +597165,14 @@ var import_react188, jsx_dev_runtime346, selectCurrentProvider = (s) => s.provid
 var init_ProviderFirstModelPicker = __esm(() => {
   init_analytics();
   init_providerRegistry();
+  init_providerCredentials();
   init_AppState();
   init_settings2();
   init_ink2();
   init_AppState();
   init_ConfigurableShortcutHint();
   init_CustomSelect();
+  init_TextInput();
   init_Byline();
   init_KeyboardShortcutHint();
   init_Pane();
@@ -603567,7 +603780,7 @@ function generateHtmlReport(data, insights) {
 </html>`;
 }
 function buildExportData(data, insights, facets, remoteStats) {
-  const version3 = typeof MACRO !== "undefined" ? "1.31.0" : "unknown";
+  const version3 = typeof MACRO !== "undefined" ? "1.33.0" : "unknown";
   const remote_hosts_collected = remoteStats?.hosts.filter((h2) => h2.sessionCount > 0).map((h2) => h2.name);
   const facets_summary = {
     total: facets.size,
@@ -607847,7 +608060,7 @@ var init_sessionStorage = __esm(() => {
   init_settings2();
   init_slowOperations();
   init_uuid();
-  VERSION5 = typeof MACRO !== "undefined" ? "1.31.0" : "unknown";
+  VERSION5 = typeof MACRO !== "undefined" ? "1.33.0" : "unknown";
   MAX_TOMBSTONE_REWRITE_BYTES = 50 * 1024 * 1024;
   SKIP_FIRST_PROMPT_PATTERN = /^(?:\s*<[a-z][\w-]*[\s>]|\[Request interrupted by user[^\]]*\])/;
   EPHEMERAL_PROGRESS_TYPES = new Set([
@@ -609052,7 +609265,7 @@ var init_filesystem = __esm(() => {
   });
   getBundledSkillsRoot = memoize_default(function getBundledSkillsRoot2() {
     const nonce = randomBytes18(16).toString("hex");
-    return join200(getURTempDir(), "bundled-skills", "1.31.0", nonce);
+    return join200(getURTempDir(), "bundled-skills", "1.33.0", nonce);
   });
   getResolvedWorkingDirPaths = memoize_default(getPathsForPermissionCheck);
 });
@@ -615341,7 +615554,7 @@ function computeFingerprint(messageText2, version3) {
 }
 function computeFingerprintFromMessages(messages) {
   const firstMessageText = extractFirstMessageText(messages);
-  return computeFingerprint(firstMessageText, "1.31.0");
+  return computeFingerprint(firstMessageText, "1.33.0");
 }
 var FINGERPRINT_SALT = "59cf53e54c78";
 var init_fingerprint = () => {};
@@ -617208,7 +617421,7 @@ async function sideQuery(opts) {
     betas.push(STRUCTURED_OUTPUTS_BETA_HEADER);
   }
   const messageText2 = extractFirstUserMessageText(messages);
-  const fingerprint = computeFingerprint(messageText2, "1.31.0");
+  const fingerprint = computeFingerprint(messageText2, "1.33.0");
   const attributionHeader = getAttributionHeader(fingerprint);
   const systemBlocks = [
     attributionHeader ? { type: "text", text: attributionHeader } : null,
@@ -621945,7 +622158,7 @@ function buildSystemInitMessage(inputs) {
     slash_commands: inputs.commands.filter((c4) => c4.userInvocable !== false).map((c4) => c4.name),
     apiKeySource: getURHQApiKeyWithSource().source,
     betas: getSdkBetas(),
-    ur_version: "1.31.0",
+    ur_version: "1.33.0",
     output_style: outputStyle2,
     agents: inputs.agents.map((agent) => agent.agentType),
     skills: inputs.skills.filter((s) => s.userInvocable !== false).map((skill2) => skill2.name),
@@ -636573,7 +636786,7 @@ var init_useVoiceEnabled = __esm(() => {
 function getSemverPart(version3) {
   return `${import_semver13.major(version3, { loose: true })}.${import_semver13.minor(version3, { loose: true })}.${import_semver13.patch(version3, { loose: true })}`;
 }
-function useUpdateNotification(updatedVersion, initialVersion = "1.31.0") {
+function useUpdateNotification(updatedVersion, initialVersion = "1.33.0") {
   const [lastNotifiedSemver, setLastNotifiedSemver] = import_react226.useState(() => getSemverPart(initialVersion));
   if (!updatedVersion) {
     return null;
@@ -636622,7 +636835,7 @@ function AutoUpdater({
       return;
     }
     if (false) {}
-    const currentVersion = "1.31.0";
+    const currentVersion = "1.33.0";
     const channel = getInitialSettings()?.autoUpdatesChannel ?? "latest";
     let latestVersion = await getLatestVersion(channel);
     const isDisabled = isAutoUpdaterDisabled();
@@ -636851,12 +637064,12 @@ function NativeAutoUpdater({
     logEvent("tengu_native_auto_updater_start", {});
     try {
       const maxVersion = await getMaxVersion();
-      if (maxVersion && gt("1.31.0", maxVersion)) {
+      if (maxVersion && gt("1.33.0", maxVersion)) {
         const msg = await getMaxVersionMessage();
         setMaxVersionIssue(msg ?? "affects your version");
       }
       const result = await installLatest(channel);
-      const currentVersion = "1.31.0";
+      const currentVersion = "1.33.0";
       const latencyMs = Date.now() - startTime;
       if (result.lockFailed) {
         logEvent("tengu_native_auto_updater_lock_contention", {
@@ -636993,17 +637206,17 @@ function PackageManagerAutoUpdater(t0) {
       const maxVersion = await getMaxVersion();
       if (maxVersion && latest && gt(latest, maxVersion)) {
         logForDebugging(`PackageManagerAutoUpdater: maxVersion ${maxVersion} is set, capping update from ${latest} to ${maxVersion}`);
-        if (gte("1.31.0", maxVersion)) {
-          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.31.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
+        if (gte("1.33.0", maxVersion)) {
+          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.33.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
           setUpdateAvailable(false);
           return;
         }
         latest = maxVersion;
       }
-      const hasUpdate = latest && !gte("1.31.0", latest) && !shouldSkipVersion(latest);
+      const hasUpdate = latest && !gte("1.33.0", latest) && !shouldSkipVersion(latest);
       setUpdateAvailable(!!hasUpdate);
       if (hasUpdate) {
-        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.31.0"} -> ${latest}`);
+        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.33.0"} -> ${latest}`);
       }
     };
     $3[0] = t1;
@@ -637037,7 +637250,7 @@ function PackageManagerAutoUpdater(t0) {
       wrap: "truncate",
       children: [
         "currentVersion: ",
-        "1.31.0"
+        "1.33.0"
       ]
     }, undefined, true, undefined, this);
     $3[3] = verbose;
@@ -649488,7 +649701,7 @@ function buildStatusLineCommandInput(permissionMode, exceeds200kTokens, settings
       project_dir: getOriginalCwd(),
       added_dirs: addedDirs
     },
-    version: "1.31.0",
+    version: "1.33.0",
     output_style: {
       name: outputStyleName
     },
@@ -649571,7 +649784,7 @@ function StatusLineInner({
   const taskValues = Object.values(tasks2);
   const taskRunningCount = taskValues.filter((task2) => task2.status === "running" || task2.status === "pending").length;
   const defaultStatusLineText = buildDefaultStatusBar({
-    version: "1.31.0",
+    version: "1.33.0",
     providerLabel: providerRuntime.providerLabel,
     authMode: providerRuntime.authLabel,
     model: providerRuntime.model ?? renderModelName(mainLoopModel),
@@ -661059,7 +661272,7 @@ async function submitTranscriptShare(messages, trigger2, appearanceId) {
     } catch {}
     const data = {
       trigger: trigger2,
-      version: "1.31.0",
+      version: "1.33.0",
       platform: process.platform,
       transcript,
       subagentTranscripts: Object.keys(subagentTranscripts).length > 0 ? subagentTranscripts : undefined,
@@ -672943,7 +673156,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "1.31.0"
+              "1.33.0"
             ]
           }, undefined, true, undefined, this)
         ]
@@ -674203,7 +674416,7 @@ function completeOnboarding() {
   saveGlobalConfig((current) => ({
     ...current,
     hasCompletedOnboarding: true,
-    lastOnboardingVersion: "1.31.0"
+    lastOnboardingVersion: "1.33.0"
   }));
 }
 function showDialog(root2, renderer) {
@@ -679240,7 +679453,7 @@ function appendToLog(path24, message) {
     cwd: getFsImplementation().cwd(),
     userType: process.env.USER_TYPE,
     sessionId: getSessionId(),
-    version: "1.31.0"
+    version: "1.33.0"
   };
   getLogWriter(path24).write(messageWithTimestamp);
 }
@@ -683334,8 +683547,8 @@ async function getEnvLessBridgeConfig() {
 }
 async function checkEnvLessBridgeMinVersion() {
   const cfg = await getEnvLessBridgeConfig();
-  if (cfg.min_version && lt("1.31.0", cfg.min_version)) {
-    return `Your version of UR (${"1.31.0"}) is too old for Remote Control.
+  if (cfg.min_version && lt("1.33.0", cfg.min_version)) {
+    return `Your version of UR (${"1.33.0"}) is too old for Remote Control.
 Version ${cfg.min_version} or higher is required. Run \`ur update\` to update.`;
   }
   return null;
@@ -683809,7 +684022,7 @@ async function initBridgeCore(params) {
   const rawApi = createBridgeApiClient({
     baseUrl,
     getAccessToken,
-    runnerVersion: "1.31.0",
+    runnerVersion: "1.33.0",
     onDebug: logForDebugging,
     onAuth401,
     getTrustedDeviceToken
@@ -689491,7 +689704,7 @@ async function startMCPServer(cwd3, debug2, verbose) {
   setCwd(cwd3);
   const server2 = new Server({
     name: "ur/tengu",
-    version: "1.31.0"
+    version: "1.33.0"
   }, {
     capabilities: {
       tools: {}
@@ -691468,7 +691681,7 @@ async function update() {
   logEvent("tengu_update_check", {});
   const diagnostic = await getDoctorDiagnostic();
   const result = await checkUpgradeStatus({
-    currentVersion: "1.31.0",
+    currentVersion: "1.33.0",
     packageName: UR_AGENT_PACKAGE_NAME,
     installationType: diagnostic.installationType,
     latestVersion: () => getLatestNpmPackageVersion(UR_AGENT_PACKAGE_NAME)
@@ -692714,7 +692927,7 @@ ${customInstructions}` : customInstructions;
       }
     }
     logForDiagnosticsNoPII("info", "started", {
-      version: "1.31.0",
+      version: "1.33.0",
       is_native_binary: isInBundledMode()
     });
     registerCleanup(async () => {
@@ -693500,7 +693713,7 @@ Usage: ur --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("1.31.0 (UR-AGENT)", "-v, --version", "Output the version number");
+  }).version("1.33.0 (UR-AGENT)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -694383,7 +694596,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"1.31.0"} (UR-AGENT)`);
+    console.log(`${"1.33.0"} (UR-AGENT)`);
     return;
   }
   if (args[0] === "a2a" && args[1] === "serve" && !args.includes("--help") && !args.includes("-h")) {

package/docs/providers.md

@@ -163,10 +163,10 @@ ur config set provider anthropic-api
 
 | Provider type | Model discovery | Source label |
 | --- | --- | --- |
-| API providers (openai-api, anthropic-api, gemini-api, openrouter) | Static list of provider-specific models | static |
+| API providers (openai-api, anthropic-api, gemini-api, openrouter) | Live discovery from the provider's `/models` endpoint using your connected key (curated fallback until connected) | live |
 | Local/server providers (ollama, lmstudio, llama.cpp, vllm) | Dynamic discovery from the selected provider endpoint | live |
 | OpenAI-compatible | Dynamic discovery from configured endpoint | live |
-| External app bridges (codex-cli, claude-code-cli, gemini-cli, antigravity-cli) | Static bridge aliases; blocked by default for normal runtime | static |
+| Subscription CLIs (codex-cli, claude-code-cli, gemini-cli, antigravity-cli) | Curated list (the official CLIs expose no models API); shown in `/model`, enabled once you `ur connect` them | static |
 
 ### API vs Subscription distinction
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ur-agent",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "description": "UR-AGENT — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",