Highlights
- Replace an API key safely from the TUI with
c. Input stays masked, and the previous key remains active unless verification succeeds or saving anyway is explicitly confirmed. - Add direct xAI/Grok support through API keys and an experimental device OAuth profile.
- Reuse long-lived TUI HTTP clients for faster, more reliable refresh and control actions.
- Document the current CLI and TUI command surface, including a new glossary.
Security
- Reject cross-provider catalogue profiles before resolving or sending credentials.
- Restrict xAI OAuth credentials to HTTPS xAI hosts.
- Redact exact API keys, access tokens, refresh tokens, and authorization codes from provider, network, OAuth, and streaming errors.
- Update runtime HTTP dependencies and explicitly ignore local credential and runtime state.
Install or update
npm install -g lupin-code@0.4.0Notes
xAI OAuth remains experimental and account-tier dependent. If the account is not entitled to OAuth inference, use the xAI API-key profile.