@caddis/cli 0.2.6 → 0.4.0

package/dist/cli.js

@@ -2419,8 +2419,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
             if (index < this.args.length) {
               value = this.args.slice(index);
               if (declaredArg.parseArg) {
-                value = value.reduce((processed, v) => {
-                  return myParseArg(declaredArg, v, processed);
+                value = value.reduce((processed, v2) => {
+                  return myParseArg(declaredArg, v2, processed);
                 }, declaredArg.defaultValue);
               }
             } else if (value === void 0) {
@@ -3596,7 +3596,7 @@ var require_index_min = __commonJS({
       "use strict";
       Object.defineProperty(h2, "__esModule", { value: true });
     });
-    var v = exports && exports.__createBinding || (Object.create ? (function(t, e2, r2, s) {
+    var v2 = exports && exports.__createBinding || (Object.create ? (function(t, e2, r2, s) {
       s === void 0 && (s = r2);
       var n = Object.getOwnPropertyDescriptor(e2, r2);
       (!n || ("get" in n ? !e2.__esModule : n.writable || n.configurable)) && (n = { enumerable: true, get: function() {
@@ -3621,12 +3621,12 @@ var require_index_min = __commonJS({
       return function(e2) {
         if (e2 && e2.__esModule) return e2;
         var r2 = {};
-        if (e2 != null) for (var s = t(e2), n = 0; n < s.length; n++) s[n] !== "default" && v(r2, e2, s[n]);
+        if (e2 != null) for (var s = t(e2), n = 0; n < s.length; n++) s[n] !== "default" && v2(r2, e2, s[n]);
         return G2(r2, e2), r2;
       };
     })();
     var X2 = exports && exports.__exportStar || function(t, e2) {
-      for (var r2 in t) r2 !== "default" && !Object.prototype.hasOwnProperty.call(e2, r2) && v(e2, t, r2);
+      for (var r2 in t) r2 !== "default" && !Object.prototype.hasOwnProperty.call(e2, r2) && v2(e2, t, r2);
     };
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.sync = exports.isexe = exports.posix = exports.win32 = void 0;
@@ -3647,7 +3647,7 @@ var require_lib = __commonJS({
   "node_modules/which/lib/index.js"(exports, module) {
     "use strict";
     var { isexe, sync: isexeSync } = require_index_min();
-    var { join, delimiter, sep, posix } = __require("path");
+    var { join: join2, delimiter, sep, posix } = __require("path");
     var isWindows = process.platform === "win32";
     var rSlash = new RegExp(`[${posix.sep}${sep === posix.sep ? "" : sep}]`.replace(/(\\)/g, "\\$1"));
     var rRel = new RegExp(`^\\.${rSlash.source}`);
@@ -3676,7 +3676,7 @@ var require_lib = __commonJS({
     var getPathPart = (raw, cmd) => {
       const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw;
       const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : "";
-      return prefix + join(pathPart, cmd);
+      return prefix + join2(pathPart, cmd);
     };
     var which = async (cmd, opt = {}) => {
       const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
@@ -3764,8 +3764,11 @@ function packageInfo() {
   cached = { root, name: parsed.name, version: parsed.version };
   return cached;
 }
-function bundlePath(name) {
+function bundlePath(name, options = {}) {
+  const { requireManifest = true } = options;
   const dir = path.join(packageInfo().root, "bundles", name);
+  if (!existsSync(dir)) return null;
+  if (!requireManifest) return dir;
   return existsSync(path.join(dir, "plugin.json")) ? dir : null;
 }
 function bundleManifest() {
@@ -4087,11 +4090,12 @@ function fD({ input: e2 = j, output: u2 = M, overwrite: t = true, hideCursor: F2
     e2.off("keypress", i), F2 && u2.write(import_sisteransi.cursor.show), e2.isTTY && !AD && e2.setRawMode(false), s.terminal = false, s.close();
   };
 }
-var import_sisteransi, uD, W, tD, eD, FD, sD, w, N, I, R, r, iD, CD, ED, d, oD, y, V, nD, G, _, z, K, aD, k, hD, lD, xD, B, AD, S, gD, vD, h, x, dD, A;
+var import_sisteransi, import_picocolors2, uD, W, tD, eD, FD, sD, w, N, I, R, r, iD, CD, ED, d, oD, y, V, nD, G, _, z, K, aD, k, hD, lD, xD, B, AD, S, gD, vD, h, x, dD, A, TD, jD, U, MD;
 var init_dist = __esm({
   "node_modules/@clack/core/dist/index.mjs"() {
     "use strict";
     import_sisteransi = __toESM(require_src(), 1);
+    import_picocolors2 = __toESM(require_picocolors(), 1);
     uD = DD();
     W = { exports: {} };
     (function(e2) {
@@ -4324,6 +4328,28 @@ var init_dist = __esm({
       }
     };
     A = /* @__PURE__ */ new WeakMap();
+    TD = Object.defineProperty;
+    jD = (e2, u2, t) => u2 in e2 ? TD(e2, u2, { enumerable: true, configurable: true, writable: true, value: t }) : e2[u2] = t;
+    U = (e2, u2, t) => (jD(e2, typeof u2 != "symbol" ? u2 + "" : u2, t), t);
+    MD = class extends x {
+      constructor({ mask: u2, ...t }) {
+        super(t), U(this, "valueWithCursor", ""), U(this, "_mask", "\u2022"), this._mask = u2 ?? "\u2022", this.on("finalize", () => {
+          this.valueWithCursor = this.masked;
+        }), this.on("value", () => {
+          if (this.cursor >= this.value.length) this.valueWithCursor = `${this.masked}${import_picocolors2.default.inverse(import_picocolors2.default.hidden("_"))}`;
+          else {
+            const F2 = this.masked.slice(0, this.cursor), s = this.masked.slice(this.cursor);
+            this.valueWithCursor = `${F2}${import_picocolors2.default.inverse(s[0])}${s.slice(1)}`;
+          }
+        });
+      }
+      get cursor() {
+        return this._cursor;
+      }
+      get masked() {
+        return this.value.replaceAll(/./g, this._mask);
+      }
+    };
   }
 });
 
@@ -4333,13 +4359,13 @@ import y2 from "process";
 function ce() {
   return y2.platform !== "win32" ? y2.env.TERM !== "linux" : !!y2.env.CI || !!y2.env.WT_SESSION || !!y2.env.TERMINUS_SUBLIME || y2.env.ConEmuTask === "{cmd::Cmder}" || y2.env.TERM_PROGRAM === "Terminus-Sublime" || y2.env.TERM_PROGRAM === "vscode" || y2.env.TERM === "xterm-256color" || y2.env.TERM === "alacritty" || y2.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-var import_picocolors2, import_sisteransi2, V2, u, le, L2, W2, C, ue, o, d2, k2, P2, A2, T, F, $e, _2, me, de, pe, q, D, U, K2, b2, ye, xe, Ie, Se, J, Y2;
+var import_picocolors3, import_sisteransi2, V2, u, le, L2, W2, C, ue, o, d2, k2, P2, A2, T, F, $e, _2, me, de, pe, q, D, U2, K2, b2, ge, ye, xe, Ie, Se, J, Y2;
 var init_dist2 = __esm({
   "node_modules/@clack/prompts/dist/index.mjs"() {
     "use strict";
     init_dist();
     init_dist();
-    import_picocolors2 = __toESM(require_picocolors(), 1);
+    import_picocolors3 = __toESM(require_picocolors(), 1);
     import_sisteransi2 = __toESM(require_src(), 1);
     V2 = ce();
     u = (t, n) => V2 ? t : n;
@@ -4362,66 +4388,87 @@ var init_dist2 = __esm({
     pe = u("\u256F", "+");
     q = u("\u25CF", "\u2022");
     D = u("\u25C6", "*");
-    U = u("\u25B2", "!");
+    U2 = u("\u25B2", "!");
     K2 = u("\u25A0", "x");
     b2 = (t) => {
       switch (t) {
         case "initial":
         case "active":
-          return import_picocolors2.default.cyan(le);
+          return import_picocolors3.default.cyan(le);
         case "cancel":
-          return import_picocolors2.default.red(L2);
+          return import_picocolors3.default.red(L2);
         case "error":
-          return import_picocolors2.default.yellow(W2);
+          return import_picocolors3.default.yellow(W2);
         case "submit":
-          return import_picocolors2.default.green(C);
+          return import_picocolors3.default.green(C);
       }
     };
+    ge = (t) => new MD({ validate: t.validate, mask: t.mask ?? $e, render() {
+      const n = `${import_picocolors3.default.gray(o)}
+${b2(this.state)}  ${t.message}
+`, r2 = this.valueWithCursor, i = this.masked;
+      switch (this.state) {
+        case "error":
+          return `${n.trim()}
+${import_picocolors3.default.yellow(o)}  ${i}
+${import_picocolors3.default.yellow(d2)}  ${import_picocolors3.default.yellow(this.error)}
+`;
+        case "submit":
+          return `${n}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.dim(i)}`;
+        case "cancel":
+          return `${n}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.strikethrough(import_picocolors3.default.dim(i ?? ""))}${i ? `
+${import_picocolors3.default.gray(o)}` : ""}`;
+        default:
+          return `${n}${import_picocolors3.default.cyan(o)}  ${r2}
+${import_picocolors3.default.cyan(d2)}
+`;
+      }
+    } }).prompt();
     ye = (t) => {
       const n = t.active ?? "Yes", r2 = t.inactive ?? "No";
       return new dD({ active: n, inactive: r2, initialValue: t.initialValue ?? true, render() {
-        const i = `${import_picocolors2.default.gray(o)}
+        const i = `${import_picocolors3.default.gray(o)}
 ${b2(this.state)}  ${t.message}
 `, s = this.value ? n : r2;
         switch (this.state) {
           case "submit":
-            return `${i}${import_picocolors2.default.gray(o)}  ${import_picocolors2.default.dim(s)}`;
+            return `${i}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.dim(s)}`;
           case "cancel":
-            return `${i}${import_picocolors2.default.gray(o)}  ${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(s))}
-${import_picocolors2.default.gray(o)}`;
+            return `${i}${import_picocolors3.default.gray(o)}  ${import_picocolors3.default.strikethrough(import_picocolors3.default.dim(s))}
+${import_picocolors3.default.gray(o)}`;
           default:
-            return `${i}${import_picocolors2.default.cyan(o)}  ${this.value ? `${import_picocolors2.default.green(k2)} ${n}` : `${import_picocolors2.default.dim(P2)} ${import_picocolors2.default.dim(n)}`} ${import_picocolors2.default.dim("/")} ${this.value ? `${import_picocolors2.default.dim(P2)} ${import_picocolors2.default.dim(r2)}` : `${import_picocolors2.default.green(k2)} ${r2}`}
-${import_picocolors2.default.cyan(d2)}
+            return `${i}${import_picocolors3.default.cyan(o)}  ${this.value ? `${import_picocolors3.default.green(k2)} ${n}` : `${import_picocolors3.default.dim(P2)} ${import_picocolors3.default.dim(n)}`} ${import_picocolors3.default.dim("/")} ${this.value ? `${import_picocolors3.default.dim(P2)} ${import_picocolors3.default.dim(r2)}` : `${import_picocolors3.default.green(k2)} ${r2}`}
+${import_picocolors3.default.cyan(d2)}
 `;
         }
       } }).prompt();
     };
     xe = (t = "") => {
-      process.stdout.write(`${import_picocolors2.default.gray(d2)}  ${import_picocolors2.default.red(t)}
+      process.stdout.write(`${import_picocolors3.default.gray(d2)}  ${import_picocolors3.default.red(t)}
 
 `);
     };
     Ie = (t = "") => {
-      process.stdout.write(`${import_picocolors2.default.gray(ue)}  ${t}
+      process.stdout.write(`${import_picocolors3.default.gray(ue)}  ${t}
 `);
     };
     Se = (t = "") => {
-      process.stdout.write(`${import_picocolors2.default.gray(o)}
-${import_picocolors2.default.gray(d2)}  ${t}
+      process.stdout.write(`${import_picocolors3.default.gray(o)}
+${import_picocolors3.default.gray(d2)}  ${t}
 
 `);
     };
-    J = `${import_picocolors2.default.gray(o)}  `;
+    J = `${import_picocolors3.default.gray(o)}  `;
     Y2 = ({ indicator: t = "dots" } = {}) => {
       const n = V2 ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], r2 = V2 ? 80 : 120, i = process.env.CI === "true";
       let s, c, a = false, l2 = "", $2, g2 = performance.now();
       const p2 = (m2) => {
         const h2 = m2 > 1 ? "Something went wrong" : "Canceled";
         a && N2(h2, m2);
-      }, v = () => p2(2), f = () => p2(1), j2 = () => {
-        process.on("uncaughtExceptionMonitor", v), process.on("unhandledRejection", v), process.on("SIGINT", f), process.on("SIGTERM", f), process.on("exit", p2);
+      }, v2 = () => p2(2), f = () => p2(1), j2 = () => {
+        process.on("uncaughtExceptionMonitor", v2), process.on("unhandledRejection", v2), process.on("SIGINT", f), process.on("SIGTERM", f), process.on("exit", p2);
       }, E = () => {
-        process.removeListener("uncaughtExceptionMonitor", v), process.removeListener("unhandledRejection", v), process.removeListener("SIGINT", f), process.removeListener("SIGTERM", f), process.removeListener("exit", p2);
+        process.removeListener("uncaughtExceptionMonitor", v2), process.removeListener("unhandledRejection", v2), process.removeListener("SIGINT", f), process.removeListener("SIGTERM", f), process.removeListener("exit", p2);
       }, B2 = () => {
         if ($2 === void 0) return;
         i && process.stdout.write(`
@@ -4433,13 +4480,13 @@ ${import_picocolors2.default.gray(d2)}  ${t}
         const h2 = (performance.now() - m2) / 1e3, w2 = Math.floor(h2 / 60), I2 = Math.floor(h2 % 60);
         return w2 > 0 ? `[${w2}m ${I2}s]` : `[${I2}s]`;
       }, H = (m2 = "") => {
-        a = true, s = fD(), l2 = R2(m2), g2 = performance.now(), process.stdout.write(`${import_picocolors2.default.gray(o)}
+        a = true, s = fD(), l2 = R2(m2), g2 = performance.now(), process.stdout.write(`${import_picocolors3.default.gray(o)}
 `);
         let h2 = 0, w2 = 0;
         j2(), c = setInterval(() => {
           if (i && l2 === $2) return;
           B2(), $2 = l2;
-          const I2 = import_picocolors2.default.magenta(n[h2]);
+          const I2 = import_picocolors3.default.magenta(n[h2]);
           if (i) process.stdout.write(`${I2}  ${l2}...`);
           else if (t === "timer") process.stdout.write(`${I2}  ${l2} ${O2(g2)}`);
           else {
@@ -4450,7 +4497,7 @@ ${import_picocolors2.default.gray(d2)}  ${t}
         }, r2);
       }, N2 = (m2 = "", h2 = 0) => {
         a = false, clearInterval(c), B2();
-        const w2 = h2 === 0 ? import_picocolors2.default.green(C) : h2 === 1 ? import_picocolors2.default.red(L2) : import_picocolors2.default.red(W2);
+        const w2 = h2 === 0 ? import_picocolors3.default.green(C) : h2 === 1 ? import_picocolors3.default.red(L2) : import_picocolors3.default.red(W2);
         l2 = R2(m2 ?? l2), t === "timer" ? process.stdout.write(`${w2}  ${l2} ${O2(g2)}
 `) : process.stdout.write(`${w2}  ${l2}
 `), E(), s();
@@ -4540,9 +4587,9 @@ function compareVersions(a, b3) {
   }
   return 0;
 }
-function parse(v) {
-  if (!v || v === "unknown") return null;
-  const core = v.trim().replace(/^v/, "").split(/[-+]/)[0] ?? "";
+function parse(v2) {
+  if (!v2 || v2 === "unknown") return null;
+  const core = v2.trim().replace(/^v/, "").split(/[-+]/)[0] ?? "";
   const parts = core.split(".");
   if (parts.length === 0 || parts.some((p2) => p2 === "" || !/^\d+$/.test(p2))) return null;
   return parts.map((p2) => Number.parseInt(p2, 10));
@@ -4561,14 +4608,14 @@ async function checkCliUpdate(currentVersion) {
   if (!latest || latest === currentVersion) return null;
   return { current: currentVersion, latest };
 }
-function classify(adapter, detection, status4, poolVersion) {
+function classify(adapter, detection, status5, poolVersion) {
   if (!detection.present) return "absent";
   if (!adapter.supported) return "unsupported";
-  if (!status4.installed) return "missing";
-  if (!status4.version) return "unknown";
+  if (!status5.installed) return "missing";
+  if (!status5.version) return "unknown";
   if (poolVersion === "unknown") return "unknown";
-  const order = compareVersions(status4.version, poolVersion);
-  if (order === null) return status4.version === poolVersion ? "current" : "stale";
+  const order = compareVersions(status5.version, poolVersion);
+  if (order === null) return status5.version === poolVersion ? "current" : "stale";
   if (order === 0) return "current";
   return order > 0 ? "ahead" : "stale";
 }
@@ -4581,13 +4628,13 @@ async function gather(adapters, options = {}) {
     Promise.all(
       adapters.map(async (adapter) => {
         const detection = await adapter.detect();
-        const status4 = detection.present ? await adapter.status() : { installed: false, note: "agent not installed" };
+        const status5 = detection.present ? await adapter.status() : { installed: false, note: "agent not installed" };
         return {
           adapter,
           detection,
-          status: status4,
-          drift: classify(adapter, detection, status4, poolVersion),
-          extrasDrift: classifyExtras(adapter, detection, status4, extrasVersion)
+          status: status5,
+          drift: classify(adapter, detection, status5, poolVersion),
+          extrasDrift: classifyExtras(adapter, detection, status5, extrasVersion)
         };
       })
     ),
@@ -4595,19 +4642,24 @@ async function gather(adapters, options = {}) {
   ]);
   return { cliVersion, poolVersion, extrasVersion, agents, cliUpdate: cliUpdate ?? void 0 };
 }
-function classifyExtras(adapter, detection, status4, extrasVersion) {
-  if (!status4.extras) return void 0;
+function classifyExtras(adapter, detection, status5, extrasVersion) {
+  if (!status5.extras) return void 0;
   if (!detection.present) return "absent";
   if (!adapter.supported) return "unsupported";
-  if (!status4.extras.installed) return "missing";
-  if (!status4.extras.version || !extrasVersion) return "unknown";
-  return status4.extras.version === extrasVersion ? "current" : "stale";
+  if (!status5.extras.installed) return "missing";
+  if (!status5.extras.version || !extrasVersion) return "unknown";
+  const order = compareVersions(status5.extras.version, extrasVersion);
+  if (order === null) return status5.extras.version === extrasVersion ? "current" : "stale";
+  if (order === 0) return "current";
+  return order > 0 ? "ahead" : "stale";
 }
-function actionable(report, includeCurrent = false) {
+function actionable(report, options = {}) {
+  const { includeCurrent = false, allowDowngrade = false } = options;
   return report.agents.filter((entry) => {
     if (!entry.detection.present || !entry.adapter.supported) return false;
+    if (entry.drift === "ahead" && !allowDowngrade) return false;
+    if (entry.extrasDrift === "ahead" && !allowDowngrade) return false;
     if (includeCurrent) return true;
-    if (entry.drift === "ahead") return false;
     return entry.drift !== "current" || entry.extrasDrift === "stale" || entry.extrasDrift === "unknown";
   });
 }
@@ -4641,7 +4693,7 @@ async function init(options) {
     const current = entry.drift === "current";
     item(current ? "ok" : "warn", `${entry.adapter.name} \u2014 ${current ? `caddis ${entry.status.version} (current)` : entry.status.installed ? `caddis ${entry.status.version ?? "?"} \u2192 ${report.poolVersion}` : "caddis not installed"}`);
   }
-  const targets = actionable(report, true);
+  const targets = actionable(report, { includeCurrent: true });
   if (targets.length === 0) {
     Se(
       `${color.yellow("No supported agent found.")} caddis v0.1 drives Claude Code and agy \u2014 install one, then re-run.`
@@ -4684,6 +4736,266 @@ var init_init = __esm({
   }
 });
 
+// src/providers/resolve.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join } from "path";
+function expandHome(p2) {
+  if (p2 === "~") return homedir();
+  if (p2.startsWith("~/") || p2.startsWith("~\\")) return join(homedir(), p2.slice(2));
+  return p2;
+}
+function keysFilePath(env) {
+  const configured = (env[KEYS_FILE_ENV] || "").trim() || DEFAULT_KEYS_FILE;
+  const expanded = expandHome(configured);
+  return isAbsolute(expanded) ? expanded : expanded;
+}
+function parseKeysFile(path5) {
+  let text;
+  try {
+    text = readFileSync4(path5, "utf8");
+  } catch {
+    return {};
+  }
+  const out = {};
+  for (const raw of text.split(/\r?\n/)) {
+    const line2 = raw.trim();
+    if (!line2 || line2.startsWith("#") || !line2.includes("=")) continue;
+    const idx = line2.indexOf("=");
+    const key = line2.slice(0, idx).trim();
+    let val = line2.slice(idx + 1).trim();
+    if (val.length >= 2 && (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'"))) {
+      val = val.slice(1, -1);
+    }
+    out[key] = val;
+  }
+  return out;
+}
+function maskKey(key) {
+  if (!key) return "(none)";
+  return key.length <= 4 ? "*".repeat(key.length) : `${"*".repeat(8)}${key.slice(-4)}`;
+}
+var PROVIDERS, DEFAULT_KEYS_FILE, KEYS_FILE_ENV;
+var init_resolve = __esm({
+  "src/providers/resolve.ts"() {
+    "use strict";
+    PROVIDERS = {
+      deepseek: {
+        baseUrl: "https://api.deepseek.com/anthropic",
+        model: "deepseek-v4-flash[1m]",
+        keyEnv: "DEEPSEEK_API_KEY"
+      },
+      glm: {
+        baseUrl: "https://api.z.ai/api/anthropic",
+        model: "glm-5.3[1m]",
+        keyEnv: "GLM_API_KEY"
+      },
+      // OpenRouter has no Anthropic-protocol endpoint. It works only through an
+      // Anthropic-compatible gateway (e.g. LiteLLM — see claude-harness/LOCAL-MODELS.md)
+      // whose URL you supply via OSS_BASE_URL.
+      openrouter: {
+        baseUrl: "",
+        model: "deepseek/deepseek-v4-flash",
+        keyEnv: "OPENROUTER_API_KEY"
+      }
+    };
+    DEFAULT_KEYS_FILE = "~/.caddis/keys.env";
+    KEYS_FILE_ENV = "CADDIS_KEYS_FILE";
+  }
+});
+
+// src/commands/keys.ts
+var keys_exports = {};
+__export(keys_exports, {
+  keys: () => keys,
+  probeKey: () => probeKey,
+  upsertKeyLines: () => upsertKeyLines
+});
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { dirname } from "path";
+async function probeKey(baseUrl, model, apiKey) {
+  if (!baseUrl) return { ok: false, rejected: false, detail: "no endpoint for this provider" };
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 15e3);
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/v1/messages`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "anthropic-version": "2023-06-01",
+        authorization: `Bearer ${apiKey}`,
+        "x-api-key": apiKey
+      },
+      body: JSON.stringify({ model, max_tokens: 1, messages: [{ role: "user", content: "ping" }] }),
+      signal: controller.signal
+    });
+    if (res.ok) return { ok: true, rejected: false, detail: "ok" };
+    if (res.status === 401 || res.status === 403) {
+      return { ok: false, rejected: true, detail: `rejected (HTTP ${res.status})` };
+    }
+    return { ok: false, rejected: false, detail: `could not validate (HTTP ${res.status})` };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, rejected: false, detail: `could not validate (${message})` };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function upsertKeyLines(existing, updates) {
+  const lines = existing ? existing.split(/\r?\n/) : [];
+  const remaining = { ...updates };
+  const out = lines.map((line2) => {
+    const trimmed = line2.trim();
+    if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) return line2;
+    const name = trimmed.slice(0, trimmed.indexOf("=")).trim();
+    if (name in remaining) {
+      const value = remaining[name];
+      delete remaining[name];
+      return `${name}=${value}`;
+    }
+    return line2;
+  });
+  const added = Object.entries(remaining).map(([k3, v2]) => `${k3}=${v2}`);
+  if (added.length) {
+    if (out.length && out[out.length - 1].trim() !== "") out.push("");
+    out.push("# added by `caddis keys`");
+    out.push(...added);
+  }
+  let text = out.join("\n");
+  if (!text.endsWith("\n")) text += "\n";
+  return text;
+}
+function restrictPermissions(path5) {
+  if (process.platform === "win32") return null;
+  try {
+    chmodSync(path5, 384);
+    return null;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+async function keys(options = {}) {
+  const path5 = keysFilePath(process.env);
+  const fileKeys = parseKeysFile(path5);
+  const names = Object.keys(PROVIDERS).sort();
+  const current = names.map((name) => {
+    const preset = PROVIDERS[name];
+    const fromEnv = (process.env[preset.keyEnv] || "").trim();
+    const fromFile = (fileKeys[preset.keyEnv] || "").trim();
+    return {
+      name,
+      preset,
+      value: fromEnv || fromFile,
+      source: fromEnv ? "env" : fromFile ? "file" : null
+    };
+  });
+  if (options.check) {
+    const configured = current.filter((entry) => entry.value);
+    if (!configured.length) {
+      process.stdout.write(`no provider keys configured (looked in $ENV and ${path5})
+`);
+      return 1;
+    }
+    let bad = 0;
+    for (const entry of configured) {
+      const probe = await probeKey(entry.preset.baseUrl, entry.preset.model, entry.value);
+      const label = probe.ok ? color.green("ok") : probe.rejected ? color.red("REJECTED") : color.yellow("unverified");
+      process.stdout.write(`  ${entry.name.padEnd(12)} ${label}  ${probe.detail}
+`);
+      if (probe.rejected) bad += 1;
+    }
+    return bad ? 1 : 0;
+  }
+  Ie("caddis keys");
+  process.stdout.write(`  keys file: ${path5}
+
+`);
+  for (const entry of current) {
+    const state = entry.source ? `${color.green("present")} (${entry.source}) ${color.dim(maskKey(entry.value))}` : color.dim("missing");
+    process.stdout.write(`  ${entry.name.padEnd(12)} ${state}
+`);
+  }
+  process.stdout.write("\n");
+  const collected = {};
+  for (const entry of current) {
+    if (entry.source === "env") {
+      process.stdout.write(
+        color.dim(`  ${entry.name}: set via $${entry.preset.keyEnv}; the environment wins, skipping
+`)
+      );
+      continue;
+    }
+    if (entry.value && !options.yes) {
+      const replace = await ye({
+        message: `${entry.name}: a key is already saved. Replace it?`,
+        initialValue: false
+      });
+      if (pD(replace)) {
+        xe("cancelled \u2014 nothing written");
+        return 1;
+      }
+      if (!replace) continue;
+    } else if (entry.value) {
+      continue;
+    }
+    const entered = await ge({
+      message: `${entry.name} key (${entry.preset.keyEnv}) \u2014 Enter to skip`
+    });
+    if (pD(entered)) {
+      xe("cancelled \u2014 nothing written");
+      return 1;
+    }
+    const value = String(entered || "").trim();
+    if (!value) continue;
+    const probe = await probeKey(entry.preset.baseUrl, entry.preset.model, value);
+    if (probe.rejected) {
+      process.stdout.write(color.red(`  ${entry.name}: ${probe.detail} \u2014 not saved
+`));
+      continue;
+    }
+    if (!probe.ok) {
+      process.stdout.write(color.yellow(`  ${entry.name}: ${probe.detail} \u2014 saving anyway
+`));
+    } else {
+      process.stdout.write(color.green(`  ${entry.name}: validated
+`));
+    }
+    collected[entry.preset.keyEnv] = value;
+  }
+  if (!Object.keys(collected).length) {
+    Se("nothing to write");
+    return 0;
+  }
+  if (options.dryRun) {
+    Se(`dry run \u2014 would write ${Object.keys(collected).join(", ")} to ${path5}`);
+    return 0;
+  }
+  let existing = "";
+  try {
+    existing = readFileSync5(path5, "utf8");
+  } catch {
+    existing = "";
+  }
+  mkdirSync2(dirname(path5), { recursive: true });
+  writeFileSync2(path5, upsertKeyLines(existing, collected), { encoding: "utf8" });
+  const permWarning = restrictPermissions(path5);
+  process.stdout.write(`
+  wrote ${Object.keys(collected).join(", ")} to ${path5}
+`);
+  if (permWarning) process.stdout.write(color.yellow(`  could not set 0600 on the keys file: ${permWarning}
+`));
+  Se("lanes ready \u2014 try `claude-glm --print-config`");
+  return 0;
+}
+var init_keys = __esm({
+  "src/commands/keys.ts"() {
+    "use strict";
+    init_dist2();
+    init_log();
+    init_resolve();
+  }
+});
+
 // src/commands/update.ts
 var update_exports = {};
 __export(update_exports, {
@@ -4699,7 +5011,10 @@ async function update(options) {
       item("info", `${entry.adapter.name} \u2014 detected, not yet supported (v0.2)`);
     }
   }
-  const targets = actionable(report, options.force === true);
+  const targets = actionable(report, {
+    includeCurrent: options.force === true,
+    allowDowngrade: options.force === true
+  });
   if (targets.length === 0) {
     const supportedPresent = report.agents.filter((e2) => e2.detection.present && e2.adapter.supported);
     const ahead = report.agents.filter((e2) => e2.drift === "ahead");
@@ -4792,13 +5107,13 @@ function renderEnvironment(report, problems) {
 function renderAgents(report, problems) {
   heading("Agents");
   for (const entry of report.agents) {
-    const { adapter, detection, status: status4 } = entry;
+    const { adapter, detection, status: status5 } = entry;
     item(markFor(entry.drift), `${color.bold(adapter.name)} \u2014 ${describe(entry, report.poolVersion)}`);
     if (detection.path) detail(detection.path);
     if (detection.agentVersion) detail(`agent version ${detection.agentVersion}`);
-    if (status4.source) detail(`read from ${status4.source}`);
-    if (status4.note) detail(status4.note);
-    if (detection.note && detection.note !== status4.note) detail(detection.note);
+    if (status5.source) detail(`read from ${status5.source}`);
+    if (status5.note) detail(status5.note);
+    if (detection.note && detection.note !== status5.note) detail(detection.note);
     if (entry.extrasDrift) detail(describeExtras(entry, report.extrasVersion));
     const problem = problemFor(entry, report.poolVersion);
     if (problem) {
@@ -4991,18 +5306,18 @@ function renderTable(headers, rows) {
     (header, i) => Math.max(visibleWidth(header), ...rows.map((row) => visibleWidth(row[i] ?? "")))
   );
   const out = [];
-  out.push(`  ${headers.map((h2, i) => pad(import_picocolors3.default.bold(h2), widths[i] ?? 0)).join("  ")}`.trimEnd());
-  out.push(`  ${widths.map((w2) => import_picocolors3.default.dim("\u2500".repeat(w2))).join("  ")}`);
+  out.push(`  ${headers.map((h2, i) => pad(import_picocolors4.default.bold(h2), widths[i] ?? 0)).join("  ")}`.trimEnd());
+  out.push(`  ${widths.map((w2) => import_picocolors4.default.dim("\u2500".repeat(w2))).join("  ")}`);
   for (const row of rows) {
     out.push(`  ${row.map((cell, i) => pad(cell ?? "", widths[i] ?? 0)).join("  ")}`.trimEnd());
   }
   return out.join("\n");
 }
-var import_picocolors3, ANSI;
+var import_picocolors4, ANSI;
 var init_table = __esm({
   "src/util/table.ts"() {
     "use strict";
-    import_picocolors3 = __toESM(require_picocolors(), 1);
+    import_picocolors4 = __toESM(require_picocolors(), 1);
     ANSI = /\[[0-9;]*m/g;
   }
 });
@@ -5010,9 +5325,9 @@ var init_table = __esm({
 // src/commands/status.ts
 var status_exports = {};
 __export(status_exports, {
-  status: () => status3
+  status: () => status4
 });
-async function status3(options) {
+async function status4(options) {
   const report = await gather(options.adapters);
   if (options.json) {
     line(JSON.stringify(toJson2(report), null, 2));
@@ -5145,8 +5460,8 @@ function parsePluginList(stdout, plugin = PLUGIN) {
       if (version?.[1] && entry.version === void 0) {
         entry.version = version[1] === "unknown" ? void 0 : version[1];
       }
-      const status4 = line2.match(/^\s*Status\s*:\s*(.+?)\s*$/i);
-      if (status4?.[1]) entry.disabled = /disabled/i.test(status4[1]);
+      const status5 = line2.match(/^\s*Status\s*:\s*(.+?)\s*$/i);
+      if (status5?.[1]) entry.disabled = /disabled/i.test(status5[1]);
     }
     return entry;
   }
@@ -5423,32 +5738,170 @@ var agyAdapter = {
 };
 
 // src/agents/codex.ts
+init_exec();
+import { cpSync as cpSync2, existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync } from "fs";
 import os2 from "os";
 import path3 from "path";
+init_pkg();
+var BIN3 = "codex";
+var BUNDLE2 = "codex";
+function caddisSkillsDir(home = os2.homedir()) {
+  return path3.join(home, ".codex", "skills", "caddis");
+}
+function versionFile(home = os2.homedir()) {
+  return path3.join(caddisSkillsDir(home), ".caddis-version");
+}
+async function detect3() {
+  const binPath = await findBin(BIN3);
+  if (!binPath) {
+    const configDir = path3.join(os2.homedir(), ".codex");
+    if (existsSync3(configDir)) {
+      return { present: false, path: configDir, note: "no `codex` binary on PATH, but ~/.codex exists" };
+    }
+    return { present: false, note: "no `codex` binary on PATH" };
+  }
+  const version = await run(BIN3, ["--version"], { timeout: 2e4 });
+  return {
+    present: true,
+    path: binPath,
+    // `codex --version` prints "codex-cli 0.150.1"; take the trailing token.
+    agentVersion: version.ok ? version.stdout.trim().split(/\s+/).pop() || void 0 : void 0,
+    note: version.ok ? void 0 : "binary found but `codex --version` failed"
+  };
+}
+function shortenHome2(target) {
+  const home = os2.homedir();
+  return target.startsWith(home) ? path3.join("~", target.slice(home.length)) : target;
+}
+function statusFromHome2(home) {
+  const marker = versionFile(home);
+  const dir = caddisSkillsDir(home);
+  if (existsSync3(marker)) {
+    try {
+      const version = readFileSync3(marker, "utf8").trim();
+      if (version) return { installed: true, version, source: shortenHome2(marker) };
+    } catch {
+    }
+    return { installed: true, source: shortenHome2(marker), note: "version marker present but unreadable" };
+  }
+  if (existsSync3(dir)) {
+    return {
+      installed: true,
+      source: shortenHome2(dir),
+      note: "skills present but no version marker \u2014 installed by hand, or by a caddis older than this one"
+    };
+  }
+  return { installed: false, source: shortenHome2(dir), note: "caddis skills not installed into codex" };
+}
+async function status3() {
+  const detected = await detect3();
+  if (!detected.present) return { installed: false, note: "agent not installed" };
+  return statusFromHome2(os2.homedir());
+}
+async function drive3(action, options) {
+  const detected = await detect3();
+  if (!detected.present) {
+    return { ok: true, skipped: true, steps: [], message: "codex not installed \u2014 skipped" };
+  }
+  const bundle = bundlePath(BUNDLE2, { requireManifest: false });
+  if (!bundle) {
+    return {
+      ok: false,
+      skipped: false,
+      steps: [],
+      message: `the ${BUNDLE2} bundle is missing from this package \u2014 reinstall @caddis/cli`
+    };
+  }
+  const source = path3.join(bundle, ".codex", "skills");
+  if (!existsSync3(source)) {
+    return {
+      ok: false,
+      skipped: false,
+      steps: [],
+      message: `the ${BUNDLE2} bundle has no .codex/skills directory \u2014 the export shape changed`
+    };
+  }
+  const home = os2.homedir();
+  const dest = caddisSkillsDir(home);
+  const version = bundleManifest().poolVersion || "unknown";
+  const label = `copy ${BUNDLE2} skills -> ${shortenHome2(dest)}`;
+  const steps2 = [];
+  if (options.dryRun) {
+    return {
+      ok: true,
+      skipped: true,
+      steps: [{ command: label, ok: true, code: 0 }],
+      message: `dry run \u2014 would ${action} caddis ${version} into ${shortenHome2(dest)}`
+    };
+  }
+  try {
+    if (existsSync3(dest)) rmSync2(dest, { recursive: true, force: true });
+    mkdirSync(path3.dirname(dest), { recursive: true });
+    cpSync2(source, dest, { recursive: true });
+    writeFileSync(versionFile(home), `${version}
+`, "utf8");
+    steps2.push({ command: label, ok: true, code: 0 });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    steps2.push({ command: label, ok: false, code: null, output: message });
+    return { ok: false, skipped: false, steps: steps2, message: `could not install into codex: ${message}` };
+  }
+  const notes = [];
+  for (const asset of ["AGENTS.md", path3.join(".codex", "config.toml.example")]) {
+    const from = path3.join(bundle, asset);
+    if (!existsSync3(from)) continue;
+    const to = path3.join(dest, `caddis-${path3.basename(asset)}`);
+    try {
+      cpSync2(from, to);
+      notes.push(path3.basename(to));
+    } catch {
+    }
+  }
+  const extrasNote = options.extras ? " (--extras has no codex bundle yet; core only)" : "";
+  const referenceNote = notes.length ? ` Reference copies beside it: ${notes.join(", ")} \u2014 config.toml is NEVER merged for you.` : "";
+  return {
+    ok: true,
+    skipped: false,
+    steps: steps2,
+    message: `caddis ${version} ${action === "install" ? "installed" : "updated"} in ${shortenHome2(dest)}.${referenceNote}${extrasNote}`
+  };
+}
+var codexAdapter = {
+  id: "codex",
+  name: "Codex",
+  supported: true,
+  summary: "copy the caddis skill pool into ~/.codex/skills/caddis/ (config.toml never merged)",
+  detect: detect3,
+  drive: drive3,
+  status: status3
+};
+
+// src/agents/copilot.ts
+import path4 from "path";
 
 // src/agents/stub.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 var NOT_YET_SUPPORTED = "not yet supported (v0.2)";
 function createStubAdapter(spec) {
-  async function detect3() {
+  async function detect4() {
     for (const bin of spec.bins) {
       const found = await findBin(bin);
       if (found) return { present: true, path: found, note: NOT_YET_SUPPORTED };
     }
     for (const configPath of spec.configPaths) {
-      if (existsSync3(configPath)) return { present: true, path: configPath, note: NOT_YET_SUPPORTED };
+      if (existsSync4(configPath)) return { present: true, path: configPath, note: NOT_YET_SUPPORTED };
     }
     return { present: false, note: `no ${spec.bins.map((b3) => `\`${b3}\``).join(" / ")} binary or config found` };
   }
-  async function status4() {
-    const detected = await detect3();
+  async function status5() {
+    const detected = await detect4();
     return {
       installed: false,
       note: detected.present ? NOT_YET_SUPPORTED : "agent not installed"
     };
   }
-  async function drive3(_action, _options) {
-    const detected = await detect3();
+  async function drive4(_action, _options) {
+    const detected = await detect4();
     return {
       ok: true,
       skipped: true,
@@ -5461,23 +5914,13 @@ function createStubAdapter(spec) {
     name: spec.name,
     supported: false,
     summary: spec.summary,
-    detect: detect3,
-    drive: drive3,
-    status: status4
+    detect: detect4,
+    drive: drive4,
+    status: status5
   };
 }
 
-// src/agents/codex.ts
-var codexAdapter = createStubAdapter({
-  id: "codex",
-  name: "Codex",
-  bins: ["codex"],
-  configPaths: [path3.join(os2.homedir(), ".codex")],
-  summary: "merge the caddis pool into ~/.codex + AGENTS.md (v0.2)"
-});
-
 // src/agents/copilot.ts
-import path4 from "path";
 var copilotAdapter = createStubAdapter({
   id: "copilot",
   name: "GitHub Copilot",
@@ -5531,6 +5974,15 @@ withGlobalFlags(program2.command("init")).description("first run: detect your ag
     })
   );
 });
+withGlobalFlags(program2.command("keys")).description("set up provider API keys for the model lanes (GLM, DeepSeek)").option("--check", "validate configured keys and exit non-zero on failure; never prompts", false).action(async (options) => {
+  const flags = mergeFlags(options);
+  const { keys: keys2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
+  process.exitCode = await keys2({
+    check: options.check === true,
+    dryRun: flags.dryRun,
+    yes: flags.yes
+  });
+});
 withGlobalFlags(program2.command("update")).description("update every detected agent to the caddis version shipped in this CLI").option("-f, --force", "re-drive agents that already report the shipped version", false).option("--extras", "also install the optional caddis-extras long-tail skills", false).action(async (options) => {
   const flags = mergeFlags(options);
   const { update: update2 } = await Promise.resolve().then(() => (init_update(), update_exports));
@@ -5551,8 +6003,8 @@ withGlobalFlags(program2.command("doctor")).description("full health report: eve
 });
 withGlobalFlags(program2.command("status")).description("compact table: cli version, pool version, per-agent version, drift").option("--json", "machine-readable output", false).action(async (options) => {
   const flags = mergeFlags(options);
-  const { status: status4 } = await Promise.resolve().then(() => (init_status(), status_exports));
-  finish(await status4({ adapters: resolveAdapters(flags), json: options.json }));
+  const { status: status5 } = await Promise.resolve().then(() => (init_status(), status_exports));
+  finish(await status5({ adapters: resolveAdapters(flags), json: options.json }));
 });
 program2.addHelpText(
   "after",
@@ -5598,8 +6050,8 @@ async function maybeNotify(enabled) {
 }
 async function main() {
   if (process.argv.slice(2).length === 0) {
-    const { status: status4 } = await Promise.resolve().then(() => (init_status(), status_exports));
-    finish(await status4({ adapters: selectAdapters() }));
+    const { status: status5 } = await Promise.resolve().then(() => (init_status(), status_exports));
+    finish(await status5({ adapters: selectAdapters() }));
     await maybeNotify(true);
     return;
   }