wholestack 0.5.0 → 0.5.2

package/dist/{chunk-PGKDYDAR.js → chunk-TDSLCPQL.js}

@@ -1806,16 +1806,37 @@ ${transcript}`
 
 // src/model.ts
 import { createOpenAI } from "@ai-sdk/openai";
-var CEREBRAS_URL = "https://api.cerebras.ai/v1";
-var OPENROUTER_URL = "https://openrouter.ai/api/v1";
-var CEREBRAS_KEY = "CEREBRAS_API_KEY";
-var KEY_ENV = "OPENROUTER_API_KEY";
-var DEFAULT_CUSTOM_MODEL = "anthropic/claude-sonnet-4.6";
-var VISION_MODEL = process.env.ZETA_VISION_MODEL?.trim() || "anthropic/claude-sonnet-4.6";
+
+// ../zeta-models/dist/index.js
+var readEnv = (k) => {
+  const v = typeof process !== "undefined" ? process.env?.[k] : void 0;
+  const t = v?.trim();
+  return t && t.length > 0 ? t : void 0;
+};
+var PROVIDERS = {
+  cerebras: { id: "cerebras", baseURL: "https://api.cerebras.ai/v1", keyEnv: "CEREBRAS_API_KEY" },
+  openrouter: { id: "openrouter", baseURL: "https://openrouter.ai/api/v1", keyEnv: "OPENROUTER_API_KEY" }
+};
+var MODEL_IDS = {
+  /** BUILD lane — writes ISL, generates the full stack. Cerebras. The 80%. */
+  gptOss: readEnv("ZETA_GPTOSS_MODEL") || "gpt-oss-120b",
+  /** BRAIN lane — frontend swarm, decisions, debugging, editing, planning. Cerebras. The 20%. */
+  glm: readEnv("ZETA_GLM_MODEL") || "zai-glm-4.7",
+  /** VISION lane — accepts image input. OpenRouter (Cerebras text lanes can't see). */
+  vision: readEnv("ZETA_VISION_MODEL") || "anthropic/claude-sonnet-4.6"
+};
+
+// src/model.ts
+var CEREBRAS_URL = PROVIDERS.cerebras.baseURL;
+var OPENROUTER_URL = PROVIDERS.openrouter.baseURL;
+var CEREBRAS_KEY = PROVIDERS.cerebras.keyEnv;
+var KEY_ENV = PROVIDERS.openrouter.keyEnv;
+var DEFAULT_CUSTOM_MODEL = MODEL_IDS.vision;
+var VISION_MODEL = MODEL_IDS.vision;
 var MODELS = /* @__PURE__ */ new Map([
-  ["zeta-g1-lite", { modelId: "gpt-oss-120b", label: "Zeta-G1.0 Lite", keyEnv: CEREBRAS_KEY, baseURL: CEREBRAS_URL, contextWindow: 128e3, thinking: "budget" }],
-  ["zeta-g1", { modelId: "zai-glm-4.7", label: "Zeta-G1.0", keyEnv: CEREBRAS_KEY, baseURL: CEREBRAS_URL, contextWindow: 128e3, thinking: "budget" }],
-  ["zeta-g1-max", { modelId: "zai-glm-4.7", label: "Zeta-G1.0 MAX", keyEnv: CEREBRAS_KEY, baseURL: CEREBRAS_URL, contextWindow: 128e3, thinking: "budget" }],
+  ["zeta-g1-lite", { modelId: MODEL_IDS.gptOss, label: "Zeta-G1.0 Lite", keyEnv: CEREBRAS_KEY, baseURL: CEREBRAS_URL, contextWindow: 128e3, thinking: "budget" }],
+  ["zeta-g1", { modelId: MODEL_IDS.glm, label: "Zeta-G1.0", keyEnv: CEREBRAS_KEY, baseURL: CEREBRAS_URL, contextWindow: 128e3, thinking: "budget" }],
+  ["zeta-g1-max", { modelId: MODEL_IDS.glm, label: "Zeta-G1.0 MAX", keyEnv: CEREBRAS_KEY, baseURL: CEREBRAS_URL, contextWindow: 128e3, thinking: "budget" }],
   // The vision tier — accepts image input (screenshots, mocks, diagrams). Routed
   // over OpenRouter because the Cerebras tiers are text-only.
   ["zeta-g1-vision", { modelId: VISION_MODEL, label: "Zeta-G1.0 Vision", keyEnv: KEY_ENV, baseURL: OPENROUTER_URL, contextWindow: 2e5, thinking: null }]

package/dist/cli.js

@@ -30,7 +30,7 @@ import {
   tasks,
   userBox,
   visionCapable
-} from "./chunk-PGKDYDAR.js";
+} from "./chunk-TDSLCPQL.js";
 
 // src/cli.ts
 import { createInterface } from "readline/promises";
@@ -137,16 +137,29 @@ async function loginBrowser(opts) {
     };
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      const corsHeaders = {
+        "access-control-allow-origin": "*",
+        "access-control-allow-methods": "GET, OPTIONS",
+        "access-control-allow-headers": "*",
+        "access-control-allow-private-network": "true"
+      };
+      if (req.method === "OPTIONS") {
+        res.writeHead(204, corsHeaders).end();
+        return;
+      }
       if (url.pathname !== "/callback") {
-        res.writeHead(404).end();
+        res.writeHead(404, corsHeaders).end();
         return;
       }
       if (url.searchParams.get("state") !== state) {
-        res.writeHead(400).end("state mismatch");
+        res.writeHead(400, corsHeaders).end("state mismatch");
         return;
       }
       const token = url.searchParams.get("token")?.trim();
-      res.writeHead(token ? 200 : 400, { "content-type": "text/html; charset=utf-8" });
+      res.writeHead(token ? 200 : 400, {
+        ...corsHeaders,
+        "content-type": "text/html; charset=utf-8"
+      });
       res.end(token ? SUCCESS_HTML : "missing token");
       if (token) {
         const path = saveKey("ZETA_API_KEY", token);
@@ -770,7 +783,7 @@ async function checkForUpdate(current) {
 }
 
 // src/access.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join5 } from "path";
 var CACHE2 = join5(homedir3(), ".zeta-g", "access.json");
@@ -789,9 +802,15 @@ function writeCache2(c2) {
   } catch {
   }
 }
-async function verifyAccess(webUrl, token) {
+function clearAccessCache() {
+  try {
+    rmSync(CACHE2, { force: true });
+  } catch {
+  }
+}
+async function verifyAccess(webUrl, token, force = false) {
   if (!token) return { active: false, tier: null, degraded: false };
-  const cached = readCache2();
+  const cached = force ? null : readCache2();
   if (cached && Date.now() - cached.checkedAt < TTL_MS) {
     return { active: cached.active, tier: cached.tier, degraded: false };
   }
@@ -803,7 +822,10 @@ async function verifyAccess(webUrl, token) {
       signal: ctrl.signal
     });
     clearTimeout(t);
-    if (res.status === 401) {
+    if (res.status >= 500) {
+      return { active: true, tier: cached?.tier ?? null, degraded: true };
+    }
+    if (!res.ok) {
       writeCache2({ checkedAt: Date.now(), active: false, tier: null });
       return { active: false, tier: null, degraded: false };
     }
@@ -1018,6 +1040,7 @@ async function runLogin(raw) {
   if (raw[0] !== "login" && raw[0] !== "logout") return null;
   const rest = raw.slice(1);
   if (raw[0] === "logout") {
+    clearAccessCache();
     saveKey("ZETA_API_KEY", "");
     line(c.green("  \u2713 logged out") + c.dim("  (token cleared)"));
     return 0;
@@ -1029,7 +1052,9 @@ async function runLogin(raw) {
       line(c.red("  usage: zeta login --token <vbfl_\u2026>"));
       return 1;
     }
-    return loginWithToken(tok) ? 0 : 1;
+    const ok = loginWithToken(tok);
+    if (ok) clearAccessCache();
+    return ok ? 0 : 1;
   }
   const pick = (flag) => {
     const i = rest.indexOf(flag);
@@ -1044,6 +1069,7 @@ async function runLogin(raw) {
   if (!hit(memberFlags) && !hit(brainFlags) && !hit(buildFlags)) {
     const noBrowser = rest.includes("--no-browser");
     const token = await loginBrowser({ webBase: webBaseUrl(), noBrowser });
+    if (token) clearAccessCache();
     return token ? 0 : 1;
   }
   if (hit(memberFlags)) {
@@ -1075,6 +1101,7 @@ async function runLogin(raw) {
   }
   const what = name === "ZETA_API_KEY" ? "membership (keep + deploy your apps)" : name === "OPENROUTER_API_KEY" ? "brain (Zeta-G1.0 tiers)" : "ZETA build engine";
   const path = saveKey(name, value);
+  if (name === "ZETA_API_KEY") clearAccessCache();
   line(c.green(`  \u2713 saved key for the ${what}`) + c.dim(`  \u2192 ${path} (chmod 600)`));
   line(c.dim("  now just run `zeta-g`."));
   return 0;
@@ -1117,8 +1144,23 @@ async function main() {
     return;
   }
   {
-    const token = process.env.ZETA_API_KEY;
-    const access = await verifyAccess(webBaseUrl(), token);
+    let token = process.env.ZETA_API_KEY;
+    let access = await verifyAccess(webBaseUrl(), token);
+    if (!access.active && stdin.isTTY) {
+      const rl = createInterface({ input: stdin, output: stdout });
+      const ans = (await rl.question(
+        "\n  " + (token ? c.dim("No active plan on this account. ") + "Log in to a different account? " : "Log in now? ") + c.dim("[Y/n] ")
+      )).trim().toLowerCase();
+      rl.close();
+      if (ans === "" || ans === "y" || ans === "yes") {
+        const minted = await loginBrowser({ webBase: webBaseUrl(), noBrowser: false });
+        if (minted) {
+          token = minted;
+          process.env.ZETA_API_KEY = minted;
+          access = await verifyAccess(webBaseUrl(), token, true);
+        }
+      }
+    }
     if (!access.active) {
       showPaywall(Boolean(token), webBaseUrl());
       exit(1);

package/dist/index.js

@@ -49,7 +49,7 @@ import {
   resolveModelKey,
   severityRank,
   supportsThinking
-} from "./chunk-PGKDYDAR.js";
+} from "./chunk-TDSLCPQL.js";
 
 // src/prompts/template.ts
 var PLACEHOLDER = /\{\{([A-Za-z0-9_.]+)\}\}/g;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wholestack",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Wholestack — a pro-grade conversational terminal agent for the Wholestack codegen engine. Talk to it in plain language: it writes ISL, generates full-stack or Solidity apps, and proves them with ShipGate. Browser login, membership-gated builds, slash commands, sessions, plan mode, diffs, MCP, plugins.",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,6 +62,7 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
+    "@isl-lang/zeta-models": "workspace:*",
     "@types/diff": "^5.2.0",
     "@types/node": "^20.10.0",
     "tsup": "^8.0.1",