@calliopelabs/cli 2.3.0 → 3.0.0

package/dist/config.js

@@ -5,187 +5,195 @@
  * Config is stored in ~/.config/calliope/config.json (or platform equivalent)
  */
 import Conf from 'conf';
-import { randomUUID } from 'crypto';
 const DEFAULT_CONFIG = {
     setupComplete: false,
     defaultProvider: 'auto',
-    persona: 'calliope',
     maxIterations: 0, // 0 = unlimited (circuit breakers provide safety)
     maxIterationTime: 600, // 10 minutes per iteration (seconds, 0 = no limit)
-    fancyOutput: true,
     autoSaveHistory: true,
     autoUpgrade: true,
     collapseTools: false,
-    collapseThinking: false,
     toolDisplayLimit: 0, // 0 = show all expanded
-    layout: 'response-bottom', // Default: tools scroll up, response at bottom
-    density: 'normal', // normal or compact
-    activeSkin: 'clean',
-    activePalette: 'default',
-    activeCompanion: 'calliope',
-    companionIntensity: 'immersive',
-    useEmojis: true,
     diffStyle: 'inline',
-    borderStyle: 'rounded',
-    bannerStyle: 'full',
-    renderer: 'ink',
-    circuitBreakersEnabled: true,
+    circuitBreakersEnabled: false,
     sandboxMode: 'auto',
-    smartRoutingEnabled: false,
-    smartRoutingCostSensitivity: 0.3,
-    recordSessions: true,
-    recordingRetentionDays: 0,
     sessionLogLimit: 0, // Unlimited by default; set > 0 to cap retained session log items
 };
-// Pre-migrate config file before Conf validates schema
-// (Conf validates before migrations run, so we patch the JSON directly)
-function preMigrateConfig() {
-    try {
-        const fs = require('fs');
-        const path = require('path');
-        const envPaths = require('env-paths');
-        const configPath = path.join(envPaths('calliope').config, 'config.json');
-        if (!fs.existsSync(configPath))
-            return;
-        const raw = fs.readFileSync(configPath, 'utf-8');
-        const data = JSON.parse(raw);
-        let changed = false;
-        const validPersonas = ['calliope', 'muse', 'minimal'];
-        if (data.persona === 'professional') {
-            data.persona = 'calliope';
-            changed = true;
-        }
-        if (data.persona && !validPersonas.includes(data.persona)) {
-            data.persona = 'calliope';
-            changed = true;
-        }
-        if (data.activeCompanion === 'professional') {
-            data.activeCompanion = 'calliope';
-            changed = true;
-        }
-        if (changed)
-            fs.writeFileSync(configPath, JSON.stringify(data, null, '\t'));
+/**
+ * Resolve the directory conf stores `config.json` in, and hard-guard tests.
+ *
+ * `CALLIOPE_CONFIG_DIR` overrides conf's default per-OS config location (conf's
+ * `cwd` option). It is the single seam that lets the test suite point every
+ * config read/write at a throwaway directory instead of the user's real store.
+ *
+ * The guard is the safety net behind #217: the config test suite calls
+ * `resetConfig()` (conf's `clear()`) in beforeEach/afterEach, and under the old
+ * default path that wiped the developer's real store on every run. Under Vitest
+ * we therefore REFUSE to open the real store unless the isolation setup
+ * (tests/setup/isolate-stores.ts) has pointed CALLIOPE_CONFIG_DIR at a temp dir.
+ * Exported so the guard is unit-testable without spawning a subprocess.
+ *
+ * Outside tests with the override unset it returns `undefined`, which conf
+ * treats as "use the env-paths default" (a falsy `cwd` is ignored by conf).
+ */
+export function resolveConfigCwd(env = process.env) {
+    const dir = env.CALLIOPE_CONFIG_DIR;
+    if (env.VITEST && !dir) {
+        throw new Error('tests must set CALLIOPE_CONFIG_DIR — refusing to touch the real config store');
     }
-    catch { /* ignore migration errors */ }
+    return dir || undefined;
 }
-preMigrateConfig();
 // Create config store
 const config = new Conf({
     projectName: 'calliope',
+    cwd: resolveConfigCwd(),
     defaults: DEFAULT_CONFIG,
     schema: {
         setupComplete: { type: 'boolean' },
         defaultProvider: { type: 'string' },
         defaultModel: { type: 'string' },
-        anthropicApiKey: { type: 'string' },
-        googleApiKey: { type: 'string' },
-        openaiApiKey: { type: 'string' },
-        togetherApiKey: { type: 'string' },
-        openrouterApiKey: { type: 'string' },
-        groqApiKey: { type: 'string' },
-        fireworksApiKey: { type: 'string' },
-        mistralApiKey: { type: 'string' },
-        ollamaBaseUrl: { type: 'string' },
-        ai21ApiKey: { type: 'string' },
-        huggingfaceApiKey: { type: 'string' },
-        litellmBaseUrl: { type: 'string' },
-        litellmApiKey: { type: 'string' },
-        bedrockApiKey: { type: 'string' },
-        bedrockBaseUrl: { type: 'string' },
-        awsRegion: { type: 'string' },
-        awsProfile: { type: 'string' },
-        openaiCompatBaseUrl: { type: 'string' },
-        openaiCompatApiKey: { type: 'string' },
-        openaiCompatModel: { type: 'string' },
-        persona: { type: 'string', enum: ['calliope', 'muse', 'minimal'] },
+        providers: { type: 'object' },
+        fleet: { type: 'object' },
         maxIterations: { type: 'number', minimum: 0, maximum: 1000000 },
         maxIterationTime: { type: 'number', minimum: 0, maximum: 3600 },
-        fancyOutput: { type: 'boolean' },
         autoSaveHistory: { type: 'boolean' },
-        workspaceRoot: { type: 'string' },
         autoUpgrade: { type: 'boolean' },
         collapseTools: { type: 'boolean' },
-        collapseThinking: { type: 'boolean' },
         toolDisplayLimit: { type: 'number', minimum: 0, maximum: 100 },
-        layout: { type: 'string', enum: ['classic', 'response-top', 'response-bottom', 'split', 'zen', 'focus', 'dashboard', 'minimal'] },
-        density: { type: 'string', enum: ['normal', 'compact'] },
-        activeSkin: { type: 'string' },
-        activePalette: { type: 'string' },
-        activeCompanion: { type: 'string' },
-        activeThemePack: { type: 'string' },
-        companionIntensity: { type: 'string', enum: ['professional', 'immersive'] },
         diffStyle: { type: 'string', enum: ['inline', 'unified', 'side-by-side'] },
-        borderStyle: { type: 'string', enum: ['rounded', 'sharp', 'double', 'ascii', 'none'] },
-        bannerStyle: { type: 'string', enum: ['full', 'compact', 'none'] },
-        renderer: { type: 'string', enum: ['ink', 'legacy', 'headless'] },
-        useEmojis: { type: 'boolean' },
         circuitBreakersEnabled: { type: 'boolean' },
         sandboxMode: { type: 'string', enum: ['auto', 'native', 'docker', 'off'] },
-        smartRoutingEnabled: { type: 'boolean' },
-        smartRoutingCostSensitivity: { type: 'number', minimum: 0, maximum: 1 },
-        recordSessions: { type: 'boolean' },
-        sessionTimeoutMs: { type: 'number', minimum: 0 },
-        recordingRetentionDays: { type: 'number', minimum: 0 },
+        routing: { type: 'object' },
         sessionLogLimit: { type: 'number', minimum: 0, maximum: 100000 },
-        apiToken: { type: 'string' },
+        audit: { type: 'object' },
+        budget: { type: 'object' },
+        policy: { type: 'object' },
+        plugins: { type: 'object' },
     },
 });
-/**
- * Get the full config object
- */
-export function getConfig() {
-    return config.store;
+// ---------------------------------------------------------------------------
+// Provider credential resolution
+//
+// Environment variables take precedence over stored config for every provider
+// except the openai-compat base URL, which historically preferred the stored
+// value — preserved here byte-for-byte. `model` has no environment fallback.
+// ---------------------------------------------------------------------------
+const PROVIDER_ENV = {
+    anthropic: { apiKey: 'ANTHROPIC_API_KEY' },
+    google: { apiKey: 'GOOGLE_API_KEY' },
+    openai: { apiKey: 'OPENAI_API_KEY' },
+    together: { apiKey: 'TOGETHER_API_KEY' },
+    openrouter: { apiKey: 'OPENROUTER_API_KEY' },
+    groq: { apiKey: 'GROQ_API_KEY' },
+    fireworks: { apiKey: 'FIREWORKS_API_KEY' },
+    mistral: { apiKey: 'MISTRAL_API_KEY' },
+    ollama: { baseUrl: 'OLLAMA_BASE_URL' },
+    ai21: { apiKey: 'AI21_API_KEY' },
+    huggingface: { apiKey: 'HUGGINGFACE_API_KEY' },
+    litellm: { apiKey: 'LITELLM_API_KEY', baseUrl: 'LITELLM_BASE_URL' },
+    bedrock: { apiKey: 'BEDROCK_API_KEY', baseUrl: 'BEDROCK_BASE_URL', region: ['AWS_REGION', 'AWS_DEFAULT_REGION'], profile: 'AWS_PROFILE' },
+    'openai-compat': { apiKey: 'OPENAI_COMPAT_API_KEY', baseUrl: 'OPENAI_COMPAT_BASE_URL' },
+};
+function firstEnv(names) {
+    if (!names)
+        return undefined;
+    for (const name of Array.isArray(names) ? names : [names]) {
+        const value = process.env[name];
+        if (value)
+            return value;
+    }
+    return undefined;
 }
 /**
- * Get a specific config value
+ * Resolve credentials for a provider, merging the stored nested config with the
+ * same environment-variable fallbacks that existed before the config shrink.
  */
-export function get(key) {
-    return config.get(key);
+export function getProviderCred(provider) {
+    const stored = (config.get('providers') ?? {})[provider] ?? {};
+    const env = PROVIDER_ENV[provider] ?? {};
+    // openai-compat prefers the stored base URL over the env var; all others prefer env.
+    const baseUrl = provider === 'openai-compat'
+        ? (stored.baseUrl || firstEnv(env.baseUrl))
+        : (firstEnv(env.baseUrl) || stored.baseUrl);
+    return {
+        apiKey: firstEnv(env.apiKey) || stored.apiKey,
+        baseUrl,
+        model: stored.model,
+        region: firstEnv(env.region) || stored.region,
+        profile: firstEnv(env.profile) || stored.profile,
+    };
 }
 /**
- * Set a config value with validation
+ * Write (merge) credentials for a provider into the nested `providers` map.
+ * Only the fields present in `patch` are updated. Validates non-empty API keys
+ * and well-formed base URLs, matching the old flat-key validation.
  */
-export function set(key, value) {
-    // Validate API keys are non-empty strings when set
-    if (key.toString().endsWith('ApiKey') && value !== undefined) {
-        if (typeof value !== 'string' || value.trim().length === 0) {
-            throw new Error(`API key for ${key} must be a non-empty string`);
+export function setProviderCred(provider, patch) {
+    if (patch.apiKey !== undefined) {
+        if (typeof patch.apiKey !== 'string' || patch.apiKey.trim().length === 0) {
+            throw new Error(`API key for ${provider} must be a non-empty string`);
         }
     }
-    // Validate URLs are proper format
-    if (key.toString().endsWith('BaseUrl') && value !== undefined) {
-        if (typeof value !== 'string') {
-            throw new Error(`Base URL for ${key} must be a string`);
+    if (patch.baseUrl !== undefined) {
+        if (typeof patch.baseUrl !== 'string') {
+            throw new Error(`Base URL for ${provider} must be a string`);
         }
         try {
-            new URL(value);
+            new URL(patch.baseUrl);
         }
         catch {
-            throw new Error(`Base URL for ${key} must be a valid URL`);
-        }
-    }
-    // Validate numeric bounds
-    if (key === 'maxIterations' && typeof value === 'number') {
-        if (value < 0 || value > 1000000) {
-            throw new Error('maxIterations must be between 0 and 1000000 (0 = unlimited)');
+            throw new Error(`Base URL for ${provider} must be a valid URL`);
         }
     }
-    if (key === 'sessionLogLimit' && typeof value === 'number') {
-        if (value < 0 || value > 100000) {
-            throw new Error('sessionLogLimit must be between 0 and 100000 (0 = unlimited)');
+    const all = { ...(config.get('providers') ?? {}) };
+    const merged = { ...(all[provider] ?? {}) };
+    for (const [key, value] of Object.entries(patch)) {
+        if (value !== undefined) {
+            merged[key] = value;
         }
     }
+    all[provider] = merged;
+    config.set('providers', all);
+}
+/**
+ * The credential environment variable(s) a provider reads, surfaced in the
+ * "how to fix" hint when an explicitly-selected provider has no credential
+ * (see providers/index.ts ProviderUnavailableError). `region`/`profile` arrays
+ * are intentionally omitted — only the primary apiKey/baseUrl var is a hint.
+ */
+export function getProviderEnvVars(provider) {
+    const env = PROVIDER_ENV[provider] ?? {};
+    return { apiKey: env.apiKey, baseUrl: env.baseUrl };
+}
+/**
+ * Get the full config object
+ */
+export function getConfig() {
+    return config.store;
+}
+/**
+ * Get a specific config value
+ */
+export function get(key) {
+    return config.get(key);
+}
+/**
+ * Set a config value with validation
+ */
+export function set(key, value) {
+    validateConfigValue(key, value);
     config.set(key, value);
 }
 /**
  * Set multiple config values with validation
  */
+export function unset(key) {
+    config.delete(key);
+}
 export function setMultiple(values) {
     // Validate all values first before setting any
     for (const [key, value] of Object.entries(values)) {
-        const typedKey = key;
-        // Will throw if validation fails
-        validateConfigValue(typedKey, value);
+        validateConfigValue(key, value);
     }
     // All validations passed, now set values
     for (const [key, value] of Object.entries(values)) {
@@ -196,22 +204,6 @@ export function setMultiple(values) {
  * Validate a single config value without setting it
  */
 function validateConfigValue(key, value) {
-    if (key.toString().endsWith('ApiKey') && value !== undefined) {
-        if (typeof value !== 'string' || value.trim().length === 0) {
-            throw new Error(`API key for ${key} must be a non-empty string`);
-        }
-    }
-    if (key.toString().endsWith('BaseUrl') && value !== undefined && value !== null) {
-        if (typeof value !== 'string') {
-            throw new Error(`Base URL for ${key} must be a string`);
-        }
-        try {
-            new URL(value);
-        }
-        catch {
-            throw new Error(`Base URL for ${key} must be a valid URL`);
-        }
-    }
     if (key === 'maxIterations' && typeof value === 'number') {
         if (value < 0 || value > 1000000) {
             throw new Error('maxIterations must be between 0 and 1000000 (0 = unlimited)');
@@ -252,33 +244,34 @@ export function resetConfig() {
  */
 export function getConfiguredProviders() {
     const providers = [];
-    if (config.get('anthropicApiKey') || process.env.ANTHROPIC_API_KEY)
+    if (getProviderCred('anthropic').apiKey)
         providers.push('anthropic');
-    if (config.get('googleApiKey') || process.env.GOOGLE_API_KEY)
+    if (getProviderCred('google').apiKey)
         providers.push('google');
-    if (config.get('openaiApiKey') || process.env.OPENAI_API_KEY)
+    if (getProviderCred('openai').apiKey)
         providers.push('openai');
-    if (config.get('togetherApiKey') || process.env.TOGETHER_API_KEY)
+    if (getProviderCred('together').apiKey)
         providers.push('together');
-    if (config.get('openrouterApiKey') || process.env.OPENROUTER_API_KEY)
+    if (getProviderCred('openrouter').apiKey)
         providers.push('openrouter');
-    if (config.get('groqApiKey') || process.env.GROQ_API_KEY)
+    if (getProviderCred('groq').apiKey)
         providers.push('groq');
-    if (config.get('fireworksApiKey') || process.env.FIREWORKS_API_KEY)
+    if (getProviderCred('fireworks').apiKey)
         providers.push('fireworks');
-    if (config.get('mistralApiKey') || process.env.MISTRAL_API_KEY)
+    if (getProviderCred('mistral').apiKey)
         providers.push('mistral');
-    if (config.get('ollamaBaseUrl') || process.env.OLLAMA_BASE_URL)
+    if (getProviderCred('ollama').baseUrl)
         providers.push('ollama');
-    if (config.get('ai21ApiKey') || process.env.AI21_API_KEY)
+    if (getProviderCred('ai21').apiKey)
         providers.push('ai21');
-    if (config.get('huggingfaceApiKey') || process.env.HUGGINGFACE_API_KEY)
+    if (getProviderCred('huggingface').apiKey)
         providers.push('huggingface');
-    if (config.get('litellmBaseUrl') || process.env.LITELLM_BASE_URL)
+    if (getProviderCred('litellm').baseUrl)
         providers.push('litellm');
-    if (config.get('bedrockApiKey') || process.env.BEDROCK_API_KEY || config.get('bedrockBaseUrl') || process.env.BEDROCK_BASE_URL || process.env.AWS_ACCESS_KEY_ID || process.env.AWS_PROFILE)
+    const bedrock = getProviderCred('bedrock');
+    if (bedrock.apiKey || bedrock.baseUrl || process.env.AWS_ACCESS_KEY_ID || process.env.AWS_PROFILE)
         providers.push('bedrock');
-    if (config.get('openaiCompatBaseUrl') || process.env.OPENAI_COMPAT_BASE_URL)
+    if (getProviderCred('openai-compat').baseUrl)
         providers.push('openai-compat');
     return providers;
 }
@@ -286,172 +279,111 @@ export function getConfiguredProviders() {
  * Get API key for a provider
  */
 export function getApiKey(provider) {
-    // Special handling for openai-compat: check env/config, default to 'openai-compat'
-    if (provider === 'openai-compat') {
-        return process.env.OPENAI_COMPAT_API_KEY || config.get('openaiCompatApiKey') || 'openai-compat';
-    }
-    const keyMap = {
-        anthropic: 'anthropicApiKey',
-        google: 'googleApiKey',
-        openai: 'openaiApiKey',
-        together: 'togetherApiKey',
-        openrouter: 'openrouterApiKey',
-        groq: 'groqApiKey',
-        fireworks: 'fireworksApiKey',
-        mistral: 'mistralApiKey',
-        ollama: 'ollamaBaseUrl', // Returns base URL for Ollama
-        ai21: 'ai21ApiKey',
-        huggingface: 'huggingfaceApiKey',
-        litellm: 'litellmApiKey',
-        bedrock: 'bedrockApiKey',
-        'openai-compat': undefined, // handled above
-        auto: undefined,
-    };
-    const key = keyMap[provider];
-    if (!key)
-        return undefined;
-    // Check environment variable first, then config
-    const envMap = {
-        anthropicApiKey: 'ANTHROPIC_API_KEY',
-        googleApiKey: 'GOOGLE_API_KEY',
-        openaiApiKey: 'OPENAI_API_KEY',
-        togetherApiKey: 'TOGETHER_API_KEY',
-        openrouterApiKey: 'OPENROUTER_API_KEY',
-        groqApiKey: 'GROQ_API_KEY',
-        fireworksApiKey: 'FIREWORKS_API_KEY',
-        mistralApiKey: 'MISTRAL_API_KEY',
-        ollamaBaseUrl: 'OLLAMA_BASE_URL',
-        ai21ApiKey: 'AI21_API_KEY',
-        huggingfaceApiKey: 'HUGGINGFACE_API_KEY',
-        litellmApiKey: 'LITELLM_API_KEY',
-        bedrockApiKey: 'BEDROCK_API_KEY',
-        bedrockBaseUrl: 'BEDROCK_BASE_URL',
-    };
-    const envVar = envMap[key];
-    if (envVar && process.env[envVar]) {
-        return process.env[envVar];
-    }
-    return config.get(key);
+    // Ollama has no API key — its "key" is the base URL.
+    if (provider === 'ollama')
+        return getProviderCred('ollama').baseUrl;
+    // openai-compat defaults to a placeholder key when none is configured.
+    if (provider === 'openai-compat')
+        return getProviderCred('openai-compat').apiKey || 'openai-compat';
+    return getProviderCred(provider).apiKey;
 }
 /**
- * Get base URL for a provider (for Ollama/LiteLLM)
+ * Get base URL for a provider (for Ollama/LiteLLM/Bedrock/openai-compat)
  */
 export function getBaseUrl(provider) {
-    if (provider === 'ollama') {
-        return process.env.OLLAMA_BASE_URL || config.get('ollamaBaseUrl') || 'http://localhost:11434';
-    }
-    if (provider === 'litellm') {
-        return process.env.LITELLM_BASE_URL || config.get('litellmBaseUrl') || 'http://localhost:4000';
-    }
-    if (provider === 'bedrock') {
-        return process.env.BEDROCK_BASE_URL || config.get('bedrockBaseUrl') || undefined;
-    }
-    if (provider === 'openai-compat') {
-        return config.get('openaiCompatBaseUrl') || process.env.OPENAI_COMPAT_BASE_URL;
-    }
+    if (provider === 'ollama')
+        return getProviderCred('ollama').baseUrl || 'http://localhost:11434';
+    if (provider === 'litellm')
+        return getProviderCred('litellm').baseUrl || 'http://localhost:4000';
+    if (provider === 'bedrock')
+        return getProviderCred('bedrock').baseUrl;
+    if (provider === 'openai-compat')
+        return getProviderCred('openai-compat').baseUrl;
     return undefined;
 }
-// Built-in profiles
-const BUILTIN_PROFILES = {
-    fast: {
-        provider: 'groq',
-        model: 'llama-3.3-70b-versatile',
-        persona: 'minimal',
-        confirmMode: false,
-    },
-    smart: {
-        provider: 'anthropic',
-        model: 'claude-sonnet-4-20250514',
-        persona: 'calliope',
-        confirmMode: true,
-    },
-    cheap: {
-        provider: 'google',
-        model: 'gemini-2.0-flash',
-        persona: 'calliope',
-        confirmMode: true,
-    },
-    local: {
-        provider: 'ollama',
-        model: 'llama3.3',
-        persona: 'calliope',
-        confirmMode: true,
-    },
-};
-/**
- * Get a profile by name (built-in or custom)
- */
-export function getProfile(name) {
-    // Check built-in profiles first
-    if (BUILTIN_PROFILES[name]) {
-        return BUILTIN_PROFILES[name];
-    }
-    // Check custom profiles
-    const profiles = config.get('profiles') || {};
-    return profiles[name];
-}
-/**
- * Save a custom profile
- */
-export function saveProfile(name, profile) {
-    const profiles = config.get('profiles') || {};
-    profiles[name] = profile;
-    config.set('profiles', profiles);
-}
+// ---------------------------------------------------------------------------
+// One-time migration to the nested provider-credential config format (#193)
+// ---------------------------------------------------------------------------
+// Old flat credential keys → [nested provider, field].
+const LEGACY_FLAT_CREDS = [
+    ['anthropicApiKey', 'anthropic', 'apiKey'],
+    ['googleApiKey', 'google', 'apiKey'],
+    ['openaiApiKey', 'openai', 'apiKey'],
+    ['togetherApiKey', 'together', 'apiKey'],
+    ['openrouterApiKey', 'openrouter', 'apiKey'],
+    ['groqApiKey', 'groq', 'apiKey'],
+    ['fireworksApiKey', 'fireworks', 'apiKey'],
+    ['mistralApiKey', 'mistral', 'apiKey'],
+    ['ai21ApiKey', 'ai21', 'apiKey'],
+    ['huggingfaceApiKey', 'huggingface', 'apiKey'],
+    ['ollamaBaseUrl', 'ollama', 'baseUrl'],
+    ['litellmBaseUrl', 'litellm', 'baseUrl'],
+    ['litellmApiKey', 'litellm', 'apiKey'],
+    ['bedrockApiKey', 'bedrock', 'apiKey'],
+    ['bedrockBaseUrl', 'bedrock', 'baseUrl'],
+    ['awsRegion', 'bedrock', 'region'],
+    ['awsProfile', 'bedrock', 'profile'],
+    ['openaiCompatBaseUrl', 'openai-compat', 'baseUrl'],
+    ['openaiCompatApiKey', 'openai-compat', 'apiKey'],
+    ['openaiCompatModel', 'openai-compat', 'model'],
+];
+// The complete set of keys the current schema recognises. Anything else in a
+// stored config is legacy (old flat creds, renamed routing keys, or junk from
+// removed subsystems) and is dropped by the migration.
+const SURVIVOR_KEYS = new Set([
+    'setupComplete', 'defaultProvider', 'defaultModel', 'providers', 'fleet',
+    'maxIterations', 'maxIterationTime', 'autoSaveHistory', 'autoUpgrade',
+    'collapseTools', 'toolDisplayLimit', 'diffStyle', 'circuitBreakersEnabled',
+    'sandboxMode', 'routing', 'sessionLogLimit',
+    // Governance (#189)
+    'audit', 'budget', 'policy',
+    // Plugin trust (#137)
+    'plugins',
+]);
 /**
- * Delete a custom profile
+ * Migrate a stored config from the pre-#193 flat format to the nested format.
+ * Runs once at startup and is idempotent — a second run is a no-op.
+ *
+ * Steps: (1) fold the old flat credential keys into `providers`, (2) rename the
+ * smart-routing keys into `routing`, (3) drop every remaining non-survivor key
+ * (cut settings + junk from removed subsystems). Values are read from a snapshot
+ * so the live deletes below don't disturb the reads.
  */
-export function deleteProfile(name) {
-    if (BUILTIN_PROFILES[name]) {
-        return false; // Can't delete built-in profiles
+export function migrateV3() {
+    const store = { ...config.store };
+    const raw = config;
+    let hadFlatCred = false;
+    const providers = { ...(store.providers ?? {}) };
+    for (const [flatKey, provider, field] of LEGACY_FLAT_CREDS) {
+        if (flatKey in store) {
+            hadFlatCred = true;
+            const value = store[flatKey];
+            if (typeof value === 'string' && value.length > 0) {
+                providers[provider] = { ...(providers[provider] ?? {}), [field]: value };
+            }
+        }
     }
-    const profiles = config.get('profiles') || {};
-    if (profiles[name]) {
-        delete profiles[name];
-        config.set('profiles', profiles);
-        return true;
+    // Fold the old smart-routing keys into the nested `routing` object.
+    if (('smartRoutingEnabled' in store || 'smartRoutingCostSensitivity' in store) && !('routing' in store)) {
+        const enabled = store.smartRoutingEnabled === true;
+        const costSensitivity = typeof store.smartRoutingCostSensitivity === 'number'
+            ? store.smartRoutingCostSensitivity
+            : 0.3;
+        config.set('routing', { enabled, costSensitivity });
     }
-    return false;
-}
-/**
- * List all available profiles
- */
-export function listProfiles() {
-    const result = [];
-    // Add built-in profiles
-    for (const [name, profile] of Object.entries(BUILTIN_PROFILES)) {
-        result.push({ name, profile, builtin: true });
+    if (hadFlatCred && Object.keys(providers).length > 0) {
+        config.set('providers', providers);
     }
-    // Add custom profiles
-    const customProfiles = config.get('profiles') || {};
-    for (const [name, profile] of Object.entries(customProfiles)) {
-        result.push({ name, profile, builtin: false });
+    // Drop every stored key not in the current schema: old flat creds, the renamed
+    // routing keys, cut display settings, and junk from removed subsystems.
+    for (const key of Object.keys(store)) {
+        if (!SURVIVOR_KEYS.has(key))
+            raw.delete(key);
     }
-    return result;
-}
-/**
- * Set the active profile
- */
-export function setActiveProfile(name) {
-    config.set('activeProfile', name);
-}
-/**
- * Get the active profile name
- */
-export function getActiveProfile() {
-    return config.get('activeProfile');
-}
-/**
- * Get or generate the API server Bearer token.
- * Generated once using crypto.randomUUID() and persisted in config.
- */
-export function getOrCreateApiToken() {
-    let token = config.get('apiToken');
-    if (!token) {
-        token = randomUUID();
-        config.set('apiToken', token);
+    if (hadFlatCred) {
+        console.error('calliope: migrated provider credentials to the new config format.');
     }
-    return token;
 }
+migrateV3();
 export default config;
 //# sourceMappingURL=config.js.map