@codevector/cli 0.4.0 → 0.5.0

package/dist/index.js

@@ -1995,15 +1995,12 @@ var ApiClientError = class extends Error {
 };
 function gatewayClient(gatewayUrl, apiKey, timeoutMs = 15e3) {
   const client = hc(trimRightSlash(gatewayUrl), {
-    init: {
-      headers: {
-        "x-api-key": apiKey
-      }
-    },
     fetch: (input, init) => {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), timeoutMs);
-      return fetch(input, { ...init, signal: controller.signal }).finally(
+      const headers = new Headers(init?.headers);
+      headers.set("x-api-key", apiKey);
+      return fetch(input, { ...init, headers, signal: controller.signal }).finally(
         () => clearTimeout(timer)
       );
     }
@@ -17532,124 +17529,25 @@ function assertHttpsUrl(urlString) {
   } catch {
     throw new Error(`Invalid gateway URL: "${urlString}"`);
   }
-  if (parsed.protocol !== "https:" && parsed.hostname !== "localhost" && parsed.hostname !== "127.0.0.1") {
+  if (process.env.CODEVECTOR_SANDBOX === "1") return;
+  if (parsed.protocol !== "https:" && parsed.hostname !== "localhost" && parsed.hostname !== "127.0.0.1" && parsed.hostname !== "host.docker.internal") {
     throw new Error(
-      `Gateway URL must be https:// (got ${parsed.protocol}). Only localhost is allowed over http.`
+      `Gateway URL must be https:// (got ${parsed.protocol}). Only localhost / 127.0.0.1 / host.docker.internal are allowed over http.`
     );
   }
 }
 
-// src/commands/configure.ts
-import { homedir as homedir5 } from "os";
-
-// src/lib/hooks.ts
-import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-import { fileURLToPath } from "url";
-function bundledHookSource() {
-  const here = dirname4(fileURLToPath(import.meta.url));
-  const candidates = [
-    join5(here, "hooks", "acceptance.sh"),
-    // production — dist/hooks/…
-    join5(here, "..", "hooks", "acceptance.sh")
-    // dev — src/hooks/…
-  ];
-  for (const candidate of candidates) {
-    if (existsSync4(candidate)) return candidate;
-  }
-  throw new Error(
-    "Could not locate the bundled acceptance hook script (acceptance.sh). Reinstall @codevector/cli to repair the installation."
-  );
-}
-function installAcceptanceHook() {
-  mkdirSync4(HOOKS_DIR, { recursive: true, mode: 448 });
-  copyFileSync(bundledHookSource(), ACCEPTANCE_HOOK_FILE);
-  try {
-    chmodSync3(ACCEPTANCE_HOOK_FILE, 493);
-  } catch {
-  }
-  return ACCEPTANCE_HOOK_FILE;
-}
-
-// src/lib/project-context.ts
-import { execFileSync } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
-import { join as join6 } from "path";
-var DEFAULT_TICKET_PATTERN = /[A-Z]+-\d+/;
-function safeGit(args, cwd) {
-  try {
-    const out = execFileSync("git", args, {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      cwd,
-      timeout: 2e3
-    });
-    return out.trim() || null;
-  } catch {
-    return null;
-  }
-}
-function repoSlugFromRemote(remote) {
-  const trimmed = remote.trim().replace(/\.git$/i, "");
-  const lastSegment = trimmed.split(/[:/]/).pop();
-  if (!lastSegment) return null;
-  return lastSegment.length > 0 ? lastSegment : null;
-}
-function resolveProjectContext(cwd = process.cwd(), ticketPattern = DEFAULT_TICKET_PATTERN) {
-  let project = null;
-  let ticket = null;
-  const override = readLocalConfig(cwd);
-  if (override?.projectName) project = override.projectName;
-  const effectivePattern = override?.ticketPattern ? safeCompileTicketPattern(override.ticketPattern) ?? ticketPattern : ticketPattern;
-  if (!project) {
-    const remote = safeGit(["remote", "get-url", "origin"], cwd);
-    if (remote) project = repoSlugFromRemote(remote);
-  }
-  const branch = safeGit(["branch", "--show-current"], cwd);
-  if (branch) {
-    const match = effectivePattern.exec(branch);
-    if (match) ticket = match[0];
-  }
-  return { project, ticket };
-}
-function readLocalConfig(cwd) {
-  const path = join6(cwd, ".codevector.json");
-  if (!existsSync5(path)) return null;
-  try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const p2 = parsed;
-    const result = {};
-    if (typeof p2.projectName === "string" && p2.projectName.length > 0) {
-      result.projectName = p2.projectName;
-    }
-    if (typeof p2.ticketPattern === "string" && p2.ticketPattern.length > 0) {
-      result.ticketPattern = p2.ticketPattern;
-    }
-    return result;
-  } catch {
-    return null;
-  }
-}
-function safeCompileTicketPattern(pattern) {
-  try {
-    return new RegExp(pattern);
-  } catch {
-    return null;
-  }
-}
-
 // src/config-writers/codex.ts
 import {
-  chmodSync as chmodSync4,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync7,
+  chmodSync as chmodSync3,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync6,
   renameSync as renameSync3,
   statSync as statSync4,
   writeFileSync as writeFileSync5
 } from "fs";
-import { dirname as dirname5, join as join7 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 import { homedir as homedir4 } from "os";
 
 // ../../node_modules/.pnpm/smol-toml@1.6.1/node_modules/smol-toml/dist/error.js
@@ -18489,6 +18387,7 @@ var PROVIDER_ID = "codevector";
 var writeCodexConfig = ({
   gatewayUrl,
   scope,
+  project,
   model,
   availableModels = []
 }) => {
@@ -18502,7 +18401,8 @@ var writeCodexConfig = ({
     name: "CodeVector Gateway",
     base_url: `${gateway}/gateway/openai/v1`,
     env_key: ENV_VAR_NAME2,
-    wire_api: "responses"
+    wire_api: "responses",
+    http_headers: buildHttpHeaders(scope, project)
   };
   merged.model_providers = providers;
   if (model) {
@@ -18540,15 +18440,15 @@ var writeCodexConfig = ({
 function codexConfigPath(scope = "user") {
   switch (scope) {
     case "user":
-      return join7(homedir4(), ".codex", "config.toml");
+      return join5(homedir4(), ".codex", "config.toml");
     case "project":
     case "local":
-      return join7(userCwd(), ".codex", "config.toml");
+      return join5(userCwd(), ".codex", "config.toml");
   }
 }
 function readTomlOrEmpty(path) {
-  if (!existsSync6(path)) return {};
-  const raw = readFileSync7(path, "utf8");
+  if (!existsSync4(path)) return {};
+  const raw = readFileSync6(path, "utf8");
   if (raw.trim().length === 0) return {};
   const parsed = parse3(raw);
   if (!isObject4(parsed)) {
@@ -18557,10 +18457,10 @@ function readTomlOrEmpty(path) {
   return parsed;
 }
 function writeTomlAtomic(path, value) {
-  const dir = dirname5(path);
-  mkdirSync5(dir, { recursive: true, mode: 448 });
+  const dir = dirname4(path);
+  mkdirSync4(dir, { recursive: true, mode: 448 });
   let mode;
-  if (existsSync6(path)) {
+  if (existsSync4(path)) {
     mode = statSync4(path).mode & 511;
   }
   const tmp = `${path}.${process.pid}.tmp`;
@@ -18568,7 +18468,7 @@ function writeTomlAtomic(path, value) {
 `);
   if (mode !== void 0) {
     try {
-      chmodSync4(tmp, mode);
+      chmodSync3(tmp, mode);
     } catch {
     }
   }
@@ -18580,127 +18480,172 @@ function isObject4(v2) {
 function trimRightSlash4(url2) {
   return url2.endsWith("/") ? url2.slice(0, -1) : url2;
 }
+function buildHttpHeaders(scope, project) {
+  const safe = (v2) => v2.replace(/[\r\n]/g, "").trim();
+  const headers = {
+    "x-client-app": "codex"
+  };
+  if (scope !== "user" && project) {
+    const slug = safe(project);
+    if (slug) {
+      headers["x-project"] = slug;
+    }
+  }
+  return headers;
+}
 
-// src/commands/configure.ts
+// src/lib/hooks.ts
+import { chmodSync as chmodSync4, copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync5 } from "fs";
+import { dirname as dirname5, join as join6 } from "path";
+import { fileURLToPath } from "url";
+function bundledHookSource() {
+  const here = dirname5(fileURLToPath(import.meta.url));
+  const candidates = [
+    join6(here, "hooks", "acceptance.sh"),
+    // production — dist/hooks/…
+    join6(here, "..", "hooks", "acceptance.sh")
+    // dev — src/hooks/…
+  ];
+  for (const candidate of candidates) {
+    if (existsSync5(candidate)) return candidate;
+  }
+  throw new Error(
+    "Could not locate the bundled acceptance hook script (acceptance.sh). Reinstall @codevector/cli to repair the installation."
+  );
+}
+function installAcceptanceHook() {
+  mkdirSync5(HOOKS_DIR, { recursive: true, mode: 448 });
+  copyFileSync(bundledHookSource(), ACCEPTANCE_HOOK_FILE);
+  try {
+    chmodSync4(ACCEPTANCE_HOOK_FILE, 493);
+  } catch {
+  }
+  return ACCEPTANCE_HOOK_FILE;
+}
+
+// src/lib/project-config.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join7, parse as parsePath, resolve } from "path";
+var PROJECT_CONFIG_FILENAME = ".codevector.json";
+var ProjectConfigSchema = external_exports.object({
+  projectName: external_exports.string().min(1).optional(),
+  ticketPattern: external_exports.string().min(1).optional(),
+  gateway: external_exports.url().optional(),
+  tools: external_exports.array(ToolConfigSchema).optional()
+});
+function findProjectConfigPath(startDir) {
+  let dir = resolve(startDir);
+  const root = parsePath(dir).root;
+  while (true) {
+    const candidate = join7(dir, PROJECT_CONFIG_FILENAME);
+    if (existsSync6(candidate)) return candidate;
+    if (dir === root) return null;
+    const parent = dirname6(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function readProjectConfigAt(path) {
+  let raw;
+  try {
+    raw = readFileSync7(path, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const result = ProjectConfigSchema.safeParse(parsed);
+  return result.success ? result.data : null;
+}
+function readProjectConfig(startDir) {
+  const path = findProjectConfigPath(startDir);
+  if (!path) return null;
+  const config2 = readProjectConfigAt(path);
+  if (!config2) return null;
+  return { config: config2, path };
+}
+function writeProjectConfig(path, config2) {
+  const parsed = ProjectConfigSchema.parse(config2);
+  writeFileSync6(path, `${JSON.stringify(parsed, null, 2)}
+`, { mode: 420 });
+}
+
+// src/commands/config/sync.ts
 var WRITERS = {
   "claude-code": writeClaudeCodeConfig,
   opencode: writeOpencodeConfig,
   codex: writeCodexConfig
 };
-var ALL_TOOLS = ["claude-code", "opencode", "codex"];
-var SCOPES = ["local", "project"];
-var configureCommand = defineCommand({
+var configSyncCommand = defineCommand({
   meta: {
-    name: "configure",
-    description: "Configure coding tools to route through the gateway."
+    name: "sync",
+    description: "Re-apply the tool configuration recorded in .codevector.json. Use this when on-disk IDE config files have drifted from the manifest."
   },
-  args: {
-    tool: {
-      type: "positional",
-      required: false,
-      description: "Tool to configure. Prompted if omitted. One of: claude-code, opencode, codex, all."
-    },
-    scope: {
-      type: "string",
-      description: "Settings scope: local (default, per-repo, gitignored) or project (committed). For user-scope (global) setup, use `codevector system configure`.",
-      valueHint: "local|project"
-    },
-    all: {
-      type: "boolean",
-      description: "Configure every supported tool."
+  async run() {
+    ge("codevector sync");
+    const found = readProjectConfig(userCwd());
+    if (!found) {
+      throw new Error(
+        "No .codevector.json on the path to root. Run `codevector init` first."
+      );
     }
-  },
-  async run({ args }) {
-    const initialProfiles = await readProfiles();
-    if (!initialProfiles) {
+    const { config: config2, path: manifestPath } = found;
+    R2.info(`Manifest: ${manifestPath}`);
+    const tools = config2.tools ?? [];
+    if (tools.length === 0) {
+      R2.warn(
+        "Manifest has no `tools` to sync. Run `codevector configure` to set up tools for this repo."
+      );
+      ye("Nothing to do.");
+      return;
+    }
+    const profiles = await readProfiles();
+    if (!profiles) {
       throw new Error("Not signed in. Run `codevector auth login` first.");
     }
-    const activeProfileName = initialProfiles.activeProfile;
-    const creds = initialProfiles.profiles[activeProfileName];
+    const creds = profiles.profiles[profiles.activeProfile];
     if (!creds) {
       throw new Error(
-        `Active profile "${activeProfileName}" is missing from credentials. Run \`codevector auth login\` to recover.`
+        `Active profile "${profiles.activeProfile}" is missing from credentials. Run \`codevector auth login\`.`
       );
     }
-    ge("codevector configure");
-    const tools = await resolveTools(args);
-    const scope = await resolveScope(args.scope, tools);
-    const project = scope === "user" ? void 0 : resolveProjectContext(userCwd()).project ?? void 0;
-    if (scope !== "user") {
-      R2.info(
-        project ? `Project: ${project} (used for x-project attribution header)` : "No project detected (no git remote and no .codevector.json)."
+    if (config2.gateway && trimRightSlash5(creds.gatewayUrl) !== trimRightSlash5(config2.gateway)) {
+      R2.warn(
+        `Active profile points at ${creds.gatewayUrl} but manifest pins ${config2.gateway}. Sync will use the active profile.`
       );
     }
     const reachable = await fetchReachableChatModels(creds);
-    const model = await pickPinnedModel(reachable);
     const hookPath = installAcceptanceHook();
+    const project = config2.projectName;
     const results = [];
     for (const tool of tools) {
-      const writer = WRITERS[tool];
+      const writer = WRITERS[tool.tool];
       if (!writer) {
         results.push({
-          tool,
+          tool: tool.tool,
           status: "skipped",
           path: "",
-          scope,
-          notes: `Unsupported tool "${tool}". Known: ${Object.keys(WRITERS).join(", ")}.`
+          scope: tool.scope,
+          notes: `Unsupported tool "${tool.tool}". Known: ${Object.keys(WRITERS).join(", ")}.`
         });
         continue;
       }
       try {
-        results.push(
-          writer({
-            gatewayUrl: creds.gatewayUrl,
-            apiKey: creds.apiKey,
-            hookScriptPath: hookPath,
-            scope,
-            ...project ? { project } : {},
-            ...model ? { model } : {},
-            availableModels: reachable.map((m2) => ({
-              slug: m2.slug,
-              displayName: m2.displayName,
-              contextWindow: m2.contextWindow,
-              maxOutputTokens: m2.maxOutputTokens,
-              maxInputTokens: m2.maxInputTokens,
-              inputPricePerMtok: m2.inputPricePerMtok,
-              cachedInputPricePerMtok: m2.cachedInputPricePerMtok,
-              cacheWritePricePerMtok: m2.cacheWritePricePerMtok,
-              reasoningPricePerMtok: m2.reasoningPricePerMtok,
-              outputPricePerMtok: m2.outputPricePerMtok,
-              supportsReasoning: m2.supportsReasoning,
-              supportsAttachment: m2.supportsAttachment,
-              supportsToolCall: m2.supportsToolCall,
-              supportsTemperature: m2.supportsTemperature,
-              inputModalities: m2.inputModalities,
-              outputModalities: m2.outputModalities,
-              releaseDate: m2.releaseDate,
-              family: m2.family
-            }))
-          })
-        );
+        results.push(writer(buildWriterInput(tool, creds, hookPath, project, reachable)));
       } catch (err) {
         results.push({
-          tool,
+          tool: tool.tool,
           status: "skipped",
           path: "",
-          scope,
+          scope: tool.scope,
           notes: err instanceof Error ? err.message : String(err)
         });
       }
     }
-    const persisted = [];
-    for (const r of results) {
-      if (r.status === "configured") {
-        persisted.push({
-          tool: r.tool,
-          scope: r.scope,
-          ...model ? { modelSlug: model.slug } : {}
-        });
-      }
-    }
-    if (persisted.length > 0) {
-      updateProfileToolConfigs(activeProfileName, persisted);
-    }
     for (const r of results) {
       if (r.status === "configured") {
         R2.success(`${r.tool} \u2192 ${r.path}  [${r.scope}]`);
@@ -18709,37 +18654,320 @@ var configureCommand = defineCommand({
         R2.warn(`${r.tool}: skipped \u2014 ${r.notes ?? "unknown reason"}`);
       }
     }
-    if (scope === "local" && tools.includes("claude-code")) {
-      Se(
-        "Claude Code auto-ignores .claude/settings.local.json in git; your API key stays on this machine.",
-        "Local scope"
-      );
-    }
-    ye("Done.");
+    ye("Sync complete.");
   }
 });
-async function resolveTools(args) {
-  if (args.all) return [...ALL_TOOLS];
-  if (args.tool) {
-    if (args.tool === "all") return [...ALL_TOOLS];
-    if (isTool(args.tool)) return [args.tool];
-    throw new Error(
-      `Unsupported tool "${args.tool}". Known: ${ALL_TOOLS.join(", ")}, or pass --all.`
-    );
-  }
-  Se(
-    "Use arrow keys to move, space to toggle, a to toggle all, enter to confirm.",
-    "Controls"
-  );
-  const picked = unwrap(
-    await ve({
-      message: "Which tools do you want to configure? (space to select/deselect, enter to confirm)",
-      options: ALL_TOOLS.map((t) => ({ value: t, label: t })),
-      initialValues: ["claude-code"],
-      required: true
-    })
-  );
-  return picked;
+function buildWriterInput(tool, creds, hookPath, project, reachable) {
+  const model = pickModel(tool.modelSlug, reachable);
+  return {
+    gatewayUrl: creds.gatewayUrl,
+    apiKey: creds.apiKey,
+    hookScriptPath: hookPath,
+    scope: tool.scope,
+    ...project ? { project } : {},
+    ...model ? { model } : {},
+    availableModels: reachable.map((m2) => ({
+      slug: m2.slug,
+      displayName: m2.displayName,
+      contextWindow: m2.contextWindow,
+      maxOutputTokens: m2.maxOutputTokens,
+      maxInputTokens: m2.maxInputTokens,
+      inputPricePerMtok: m2.inputPricePerMtok,
+      cachedInputPricePerMtok: m2.cachedInputPricePerMtok,
+      cacheWritePricePerMtok: m2.cacheWritePricePerMtok,
+      reasoningPricePerMtok: m2.reasoningPricePerMtok,
+      outputPricePerMtok: m2.outputPricePerMtok,
+      supportsReasoning: m2.supportsReasoning,
+      supportsAttachment: m2.supportsAttachment,
+      supportsToolCall: m2.supportsToolCall,
+      supportsTemperature: m2.supportsTemperature,
+      inputModalities: m2.inputModalities,
+      outputModalities: m2.outputModalities,
+      releaseDate: m2.releaseDate,
+      family: m2.family
+    }))
+  };
+}
+function pickModel(modelSlug, reachable) {
+  if (!modelSlug) return void 0;
+  const found = reachable.find((m2) => m2.slug === modelSlug);
+  if (!found) return void 0;
+  return { slug: found.slug, providerKind: found.providerKind };
+}
+async function fetchReachableChatModels(creds) {
+  const client = gatewayClient(creds.gatewayUrl, creds.apiKey, 1e4);
+  const s = ft();
+  s.start("Loading reachable models\u2026");
+  try {
+    const res = await call(parseResponse(client.models.$get()));
+    const models = res.data.filter((m2) => m2.kind === "chat").map((m2) => ({
+      slug: m2.slug,
+      providerKind: m2.providerKind,
+      displayName: m2.displayName,
+      contextWindow: m2.contextWindow,
+      maxOutputTokens: m2.maxOutputTokens,
+      maxInputTokens: m2.maxInputTokens,
+      inputPricePerMtok: m2.inputPricePerMtok,
+      cachedInputPricePerMtok: m2.cachedInputPricePerMtok,
+      cacheWritePricePerMtok: m2.cacheWritePricePerMtok,
+      reasoningPricePerMtok: m2.reasoningPricePerMtok,
+      outputPricePerMtok: m2.outputPricePerMtok,
+      supportsReasoning: m2.supportsReasoning,
+      supportsAttachment: m2.supportsAttachment,
+      supportsToolCall: m2.supportsToolCall,
+      supportsTemperature: m2.supportsTemperature,
+      inputModalities: m2.inputModalities,
+      outputModalities: m2.outputModalities,
+      releaseDate: m2.releaseDate,
+      family: m2.family
+    }));
+    s.stop(`${models.length} model${models.length === 1 ? "" : "s"} reachable`);
+    return models;
+  } catch (err) {
+    s.stop("Could not load models");
+    R2.warn(
+      `Continuing without model list \u2014 ${err instanceof ApiClientError ? err.message : String(err)}.`
+    );
+    return [];
+  }
+}
+function trimRightSlash5(url2) {
+  return url2.endsWith("/") ? url2.slice(0, -1) : url2;
+}
+
+// src/commands/config/index.ts
+var configCommand = defineCommand({
+  meta: {
+    name: "config",
+    description: "Inspect and re-apply this repo's .codevector.json configuration."
+  },
+  subCommands: {
+    sync: configSyncCommand
+  }
+});
+
+// src/commands/configure.ts
+import { homedir as homedir5 } from "os";
+
+// src/lib/project-context.ts
+import { execFileSync } from "child_process";
+import { join as join8 } from "path";
+var DEFAULT_TICKET_PATTERN = /[A-Z]+-\d+/;
+function safeGit(args, cwd) {
+  try {
+    const out = execFileSync("git", args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      cwd,
+      timeout: 2e3
+    });
+    return out.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function repoSlugFromRemote(remote) {
+  const trimmed = remote.trim().replace(/\.git$/i, "");
+  const lastSegment = trimmed.split(/[:/]/).pop();
+  if (!lastSegment) return null;
+  return lastSegment.length > 0 ? lastSegment : null;
+}
+function resolveProjectContext(cwd = process.cwd(), ticketPattern = DEFAULT_TICKET_PATTERN) {
+  let project = null;
+  let ticket = null;
+  const override = readLocalConfig(cwd);
+  if (override?.projectName) project = override.projectName;
+  const effectivePattern = override?.ticketPattern ? safeCompileTicketPattern(override.ticketPattern) ?? ticketPattern : ticketPattern;
+  if (!project) {
+    const remote = safeGit(["remote", "get-url", "origin"], cwd);
+    if (remote) project = repoSlugFromRemote(remote);
+  }
+  const branch = safeGit(["branch", "--show-current"], cwd);
+  if (branch) {
+    const match = effectivePattern.exec(branch);
+    if (match) ticket = match[0];
+  }
+  return { project, ticket };
+}
+function readLocalConfig(cwd) {
+  const config2 = readProjectConfigAt(join8(cwd, PROJECT_CONFIG_FILENAME));
+  if (!config2) return null;
+  const result = {};
+  if (config2.projectName) result.projectName = config2.projectName;
+  if (config2.ticketPattern) result.ticketPattern = config2.ticketPattern;
+  return result;
+}
+function safeCompileTicketPattern(pattern) {
+  try {
+    return new RegExp(pattern);
+  } catch {
+    return null;
+  }
+}
+
+// src/commands/configure.ts
+import { join as join9 } from "path";
+var WRITERS2 = {
+  "claude-code": writeClaudeCodeConfig,
+  opencode: writeOpencodeConfig,
+  codex: writeCodexConfig
+};
+var ALL_TOOLS = ["claude-code", "opencode", "codex"];
+var SCOPES = ["local", "project"];
+var configureCommand = defineCommand({
+  meta: {
+    name: "configure",
+    description: "Configure coding tools to route through the gateway."
+  },
+  args: {
+    tool: {
+      type: "positional",
+      required: false,
+      description: "Tool to configure. Prompted if omitted. One of: claude-code, opencode, codex, all."
+    },
+    scope: {
+      type: "string",
+      description: "Settings scope: local (default, per-repo, gitignored) or project (committed). For user-scope (global) setup, use `codevector system configure`.",
+      valueHint: "local|project"
+    },
+    all: {
+      type: "boolean",
+      description: "Configure every supported tool."
+    }
+  },
+  async run({ args }) {
+    const initialProfiles = await readProfiles();
+    if (!initialProfiles) {
+      throw new Error("Not signed in. Run `codevector auth login` first.");
+    }
+    const activeProfileName = initialProfiles.activeProfile;
+    const creds = initialProfiles.profiles[activeProfileName];
+    if (!creds) {
+      throw new Error(
+        `Active profile "${activeProfileName}" is missing from credentials. Run \`codevector auth login\` to recover.`
+      );
+    }
+    ge("codevector configure");
+    const tools = await resolveTools(args);
+    const scope = await resolveScope(args.scope, tools);
+    const project = scope === "user" ? void 0 : resolveProjectContext(userCwd()).project ?? void 0;
+    if (scope !== "user") {
+      R2.info(
+        project ? `Project: ${project} (used for x-project attribution header)` : "No project detected (no git remote and no .codevector.json)."
+      );
+    }
+    const reachable = await fetchReachableChatModels2(creds);
+    const model = await pickPinnedModel(reachable);
+    const hookPath = installAcceptanceHook();
+    const results = [];
+    for (const tool of tools) {
+      const writer = WRITERS2[tool];
+      if (!writer) {
+        results.push({
+          tool,
+          status: "skipped",
+          path: "",
+          scope,
+          notes: `Unsupported tool "${tool}". Known: ${Object.keys(WRITERS2).join(", ")}.`
+        });
+        continue;
+      }
+      try {
+        results.push(
+          writer({
+            gatewayUrl: creds.gatewayUrl,
+            apiKey: creds.apiKey,
+            hookScriptPath: hookPath,
+            scope,
+            ...project ? { project } : {},
+            ...model ? { model } : {},
+            availableModels: reachable.map((m2) => ({
+              slug: m2.slug,
+              displayName: m2.displayName,
+              contextWindow: m2.contextWindow,
+              maxOutputTokens: m2.maxOutputTokens,
+              maxInputTokens: m2.maxInputTokens,
+              inputPricePerMtok: m2.inputPricePerMtok,
+              cachedInputPricePerMtok: m2.cachedInputPricePerMtok,
+              cacheWritePricePerMtok: m2.cacheWritePricePerMtok,
+              reasoningPricePerMtok: m2.reasoningPricePerMtok,
+              outputPricePerMtok: m2.outputPricePerMtok,
+              supportsReasoning: m2.supportsReasoning,
+              supportsAttachment: m2.supportsAttachment,
+              supportsToolCall: m2.supportsToolCall,
+              supportsTemperature: m2.supportsTemperature,
+              inputModalities: m2.inputModalities,
+              outputModalities: m2.outputModalities,
+              releaseDate: m2.releaseDate,
+              family: m2.family
+            }))
+          })
+        );
+      } catch (err) {
+        results.push({
+          tool,
+          status: "skipped",
+          path: "",
+          scope,
+          notes: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+    const persisted = [];
+    for (const r of results) {
+      if (r.status === "configured") {
+        persisted.push({
+          tool: r.tool,
+          scope: r.scope,
+          ...model ? { modelSlug: model.slug } : {}
+        });
+      }
+    }
+    if (persisted.length > 0) {
+      updateProfileToolConfigs(activeProfileName, persisted);
+      if (scope !== "user") {
+        mergeToolsIntoProjectConfig(userCwd(), persisted, creds.gatewayUrl);
+      }
+    }
+    for (const r of results) {
+      if (r.status === "configured") {
+        R2.success(`${r.tool} \u2192 ${r.path}  [${r.scope}]`);
+        if (r.notes) R2.info(r.notes);
+      } else {
+        R2.warn(`${r.tool}: skipped \u2014 ${r.notes ?? "unknown reason"}`);
+      }
+    }
+    if (scope === "local" && tools.includes("claude-code")) {
+      Se(
+        "Claude Code auto-ignores .claude/settings.local.json in git; your API key stays on this machine.",
+        "Local scope"
+      );
+    }
+    ye("Done.");
+  }
+});
+async function resolveTools(args) {
+  if (args.all) return [...ALL_TOOLS];
+  if (args.tool) {
+    if (args.tool === "all") return [...ALL_TOOLS];
+    if (isTool(args.tool)) return [args.tool];
+    throw new Error(
+      `Unsupported tool "${args.tool}". Known: ${ALL_TOOLS.join(", ")}, or pass --all.`
+    );
+  }
+  Se(
+    "Use arrow keys to move, space to toggle, a to toggle all, enter to confirm.",
+    "Controls"
+  );
+  const picked = unwrap(
+    await ve({
+      message: "Which tools do you want to configure? (space to select/deselect, enter to confirm)",
+      options: ALL_TOOLS.map((t) => ({ value: t, label: t })),
+      initialValues: ["claude-code"],
+      required: true
+    })
+  );
+  return picked;
 }
 async function resolveScope(raw, tools) {
   if (raw === "user") {
@@ -18798,10 +19026,22 @@ function relativizeHomeAndCwd(absolutePath) {
 function isTool(value) {
   return ALL_TOOLS.includes(value);
 }
+function mergeToolsIntoProjectConfig(cwd, tools, gatewayUrl) {
+  const path = join9(cwd, PROJECT_CONFIG_FILENAME);
+  const existing = readProjectConfigAt(path) ?? {};
+  const byTool = new Map((existing.tools ?? []).map((c) => [c.tool, c]));
+  for (const cfg of tools) byTool.set(cfg.tool, cfg);
+  const next = {
+    ...existing,
+    ...existing.gateway ? {} : { gateway: gatewayUrl },
+    tools: [...byTool.values()]
+  };
+  writeProjectConfig(path, next);
+}
 function isScope(value) {
   return SCOPES.includes(value);
 }
-async function fetchReachableChatModels(creds) {
+async function fetchReachableChatModels2(creds) {
   const client = gatewayClient(creds.gatewayUrl, creds.apiKey, 1e4);
   const s = ft();
   s.start("Loading reachable models\u2026");
@@ -18918,6 +19158,7 @@ var doctorCommand = defineCommand({
       checks.push({ level: "fail", label: "gateway /me", detail: message });
     }
     checks.push(inspectClaudeSettings());
+    checks.push(...inspectManifestDrift());
     if (!existsSync7(ACCEPTANCE_HOOK_FILE)) {
       checks.push({
         level: "warn",
@@ -18967,6 +19208,80 @@ function inspectClaudeSettings() {
     detail: "ANTHROPIC_BASE_URL not set at any scope \u2014 run `codevector configure claude-code`"
   };
 }
+function inspectManifestDrift() {
+  const found = readProjectConfig(userCwd());
+  if (!found) return [];
+  const { config: config2 } = found;
+  const tools = config2.tools ?? [];
+  if (tools.length === 0) return [];
+  const gateway = config2.gateway?.replace(/\/$/, "") ?? null;
+  if (!gateway) {
+    return [
+      {
+        level: "warn",
+        label: "manifest drift",
+        detail: ".codevector.json lists tools but has no `gateway` \u2014 run `codevector init`"
+      }
+    ];
+  }
+  const checks = [];
+  for (const tool of tools) {
+    const path = manifestToolPath(tool.tool, tool.scope);
+    if (!path) {
+      checks.push({
+        level: "warn",
+        label: `manifest drift: ${tool.tool}`,
+        detail: `unknown tool "${tool.tool}"`
+      });
+      continue;
+    }
+    if (!existsSync7(path)) {
+      checks.push({
+        level: "fail",
+        label: `manifest drift: ${tool.tool}`,
+        detail: `${path} missing \u2014 run \`codevector config sync\``
+      });
+      continue;
+    }
+    let raw;
+    try {
+      raw = readFileSync8(path, "utf8");
+    } catch (err) {
+      checks.push({
+        level: "fail",
+        label: `manifest drift: ${tool.tool}`,
+        detail: `cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`
+      });
+      continue;
+    }
+    if (!raw.includes(gateway)) {
+      checks.push({
+        level: "fail",
+        label: `manifest drift: ${tool.tool}`,
+        detail: `${path} does not reference ${gateway} \u2014 run \`codevector config sync\``
+      });
+      continue;
+    }
+    checks.push({
+      level: "ok",
+      label: `manifest: ${tool.tool}`,
+      detail: `[${tool.scope}] ${path}`
+    });
+  }
+  return checks;
+}
+function manifestToolPath(tool, scope) {
+  switch (tool) {
+    case "claude-code":
+      return claudeSettingsPath(scope);
+    case "opencode":
+      return opencodeSettingsPath(scope);
+    case "codex":
+      return codexConfigPath(scope);
+    default:
+      return null;
+  }
+}
 function emit(checks) {
   Se(
     checks.map((c) => {
@@ -18982,15 +19297,244 @@ function emit(checks) {
   }
 }
 
+// src/commands/env.ts
+var SHELLS = ["bash", "zsh", "fish"];
+var envCommand = defineCommand({
+  meta: {
+    name: "env",
+    description: "Print shell exports to activate / deactivate codevector credentials for the current directory. Intended to be eval'd by the shell hook (see `codevector hook`)."
+  },
+  args: {
+    shell: {
+      type: "string",
+      description: "Output dialect: bash, zsh, or fish.",
+      valueHint: "bash|zsh|fish"
+    }
+  },
+  async run({ args }) {
+    const shell = resolveShell(args.shell);
+    const cwd = userCwd();
+    const previousDir = process.env.CODEVECTOR_ACTIVE_DIR ?? null;
+    const found = readProjectConfig(cwd);
+    const repoDir = found?.path ? dirOf(found.path) : null;
+    const gateway = found?.config.gateway ?? null;
+    const projectName = found?.config.projectName ?? null;
+    const lines = [];
+    if (!gateway || !repoDir) {
+      if (previousDir) emitDeactivate(lines, shell, previousDir);
+      process.stdout.write(lines.join("\n") + (lines.length > 0 ? "\n" : ""));
+      return;
+    }
+    if (previousDir === repoDir) {
+      return;
+    }
+    const profiles = await readProfiles();
+    const match = pickProfileForGateway(
+      profiles?.profiles ?? {},
+      profiles?.activeProfile ?? null,
+      gateway
+    );
+    if (!match) {
+      if (previousDir) emitDeactivate(lines, shell, previousDir);
+      emitEcho(
+        lines,
+        shell,
+        `codevector: no matching profile for gateway ${gateway}. Run \`codevector auth login --gateway ${gateway}\`.`
+      );
+      process.stdout.write(lines.join("\n") + "\n");
+      return;
+    }
+    const { name: profileName, profile } = match;
+    const headers = buildAnthropicCustomHeaders(projectName);
+    emitExport(lines, shell, "ANTHROPIC_BASE_URL", `${trimRightSlash6(profile.gatewayUrl)}/gateway/anthropic`);
+    emitExport(lines, shell, "ANTHROPIC_API_KEY", profile.apiKey);
+    if (headers) emitExport(lines, shell, "ANTHROPIC_CUSTOM_HEADERS", headers);
+    emitExport(lines, shell, "OPENAI_BASE_URL", `${trimRightSlash6(profile.gatewayUrl)}/gateway/openai/v1`);
+    emitExport(lines, shell, "OPENAI_API_KEY", profile.apiKey);
+    emitExport(lines, shell, "CODEVECTOR_ACTIVE_DIR", repoDir);
+    emitExport(lines, shell, "CODEVECTOR_ACTIVE_PROFILE", profileName);
+    const projectSuffix = projectName ? ` (project: ${projectName})` : "";
+    emitEcho(
+      lines,
+      shell,
+      `codevector: ${profileName} -> ${trimRightSlash6(profile.gatewayUrl)}${projectSuffix}`
+    );
+    process.stdout.write(lines.join("\n") + "\n");
+  }
+});
+function resolveShell(raw) {
+  if (!raw) return detectShell();
+  if (!SHELLS.includes(raw)) {
+    throw new Error(`Invalid --shell "${raw}". Use one of: ${SHELLS.join(", ")}.`);
+  }
+  return raw;
+}
+function detectShell() {
+  const shellPath = process.env.SHELL ?? "";
+  if (shellPath.endsWith("/fish")) return "fish";
+  if (shellPath.endsWith("/zsh")) return "zsh";
+  return "bash";
+}
+function emitExport(lines, shell, name, value) {
+  const quoted = shellQuote(value);
+  if (shell === "fish") {
+    lines.push(`set -gx ${name} ${quoted}`);
+  } else {
+    lines.push(`export ${name}=${quoted}`);
+  }
+}
+function emitUnset(lines, shell, name) {
+  if (shell === "fish") {
+    lines.push(`set -e ${name}`);
+  } else {
+    lines.push(`unset ${name}`);
+  }
+}
+function emitEcho(lines, _shell, message) {
+  lines.push(`echo ${shellQuote(message)} 1>&2`);
+}
+function emitDeactivate(lines, shell, previousDir) {
+  for (const name of [
+    "ANTHROPIC_BASE_URL",
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_CUSTOM_HEADERS",
+    "OPENAI_BASE_URL",
+    "OPENAI_API_KEY",
+    "CODEVECTOR_ACTIVE_DIR",
+    "CODEVECTOR_ACTIVE_PROFILE"
+  ]) {
+    emitUnset(lines, shell, name);
+  }
+  emitEcho(lines, shell, `codevector: left ${previousDir}, credentials cleared.`);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function trimRightSlash6(url2) {
+  return url2.endsWith("/") ? url2.slice(0, -1) : url2;
+}
+function dirOf(filePath) {
+  const idx = filePath.lastIndexOf("/");
+  return idx === -1 ? filePath : filePath.slice(0, idx);
+}
+function buildAnthropicCustomHeaders(projectName) {
+  if (!projectName) return null;
+  const safe = projectName.replace(/[\r\n]/g, "").trim();
+  if (!safe) return null;
+  return `x-project: ${safe}`;
+}
+function pickProfileForGateway(profiles, activeProfile, gateway) {
+  const target = trimRightSlash6(gateway);
+  const matches = Object.entries(profiles).filter(
+    ([, p2]) => trimRightSlash6(p2.gatewayUrl) === target
+  );
+  if (matches.length === 0) return null;
+  if (activeProfile) {
+    const active = matches.find(([name]) => name === activeProfile);
+    if (active) return { name: active[0], profile: active[1] };
+  }
+  const sorted = [...matches].sort((a, b2) => a[0].localeCompare(b2[0]));
+  const picked = sorted[0];
+  return { name: picked[0], profile: picked[1] };
+}
+
+// src/commands/hook.ts
+var SHELLS2 = ["bash", "zsh", "fish"];
+var hookCommand = defineCommand({
+  meta: {
+    name: "hook",
+    description: 'Print the shell snippet that auto-activates codevector credentials on cd. Add `eval "$(codevector hook bash)"` (or zsh / fish) to your shell\'s rc file.'
+  },
+  args: {
+    shell: {
+      type: "positional",
+      required: false,
+      description: "Target shell: bash, zsh, or fish.",
+      valueHint: "bash|zsh|fish"
+    }
+  },
+  run({ args }) {
+    const shell = resolveShell2(args.shell);
+    process.stdout.write(snippetFor(shell));
+  }
+});
+function resolveShell2(raw) {
+  if (!raw) {
+    const detected = detectShell2();
+    if (!detected) {
+      throw new Error(
+        `Could not detect shell from $SHELL. Pass one explicitly: ${SHELLS2.join(", ")}.`
+      );
+    }
+    return detected;
+  }
+  if (!SHELLS2.includes(raw)) {
+    throw new Error(`Invalid shell "${raw}". Use one of: ${SHELLS2.join(", ")}.`);
+  }
+  return raw;
+}
+function detectShell2() {
+  const shellPath = process.env.SHELL ?? "";
+  if (shellPath.endsWith("/fish")) return "fish";
+  if (shellPath.endsWith("/zsh")) return "zsh";
+  if (shellPath.endsWith("/bash")) return "bash";
+  return null;
+}
+function snippetFor(shell) {
+  switch (shell) {
+    case "bash":
+      return BASH_SNIPPET;
+    case "zsh":
+      return ZSH_SNIPPET;
+    case "fish":
+      return FISH_SNIPPET;
+  }
+}
+var BASH_SNIPPET = `# codevector shell hook (bash) \u2014 auto-activates credentials on cd
+_codevector_on_prompt() {
+  if [ "$PWD" = "\${_CODEVECTOR_LAST_PWD:-}" ]; then return; fi
+  _CODEVECTOR_LAST_PWD="$PWD"
+  local _codevector_out
+  _codevector_out="$(command codevector env --shell bash 2>/dev/null)"
+  if [ -n "$_codevector_out" ]; then eval "$_codevector_out"; fi
+}
+case "\${PROMPT_COMMAND:-}" in
+  *_codevector_on_prompt*) ;;
+  "") PROMPT_COMMAND="_codevector_on_prompt" ;;
+  *) PROMPT_COMMAND="_codevector_on_prompt;$PROMPT_COMMAND" ;;
+esac
+`;
+var ZSH_SNIPPET = `# codevector shell hook (zsh) \u2014 auto-activates credentials on cd
+_codevector_on_chpwd() {
+  local _codevector_out
+  _codevector_out="$(command codevector env --shell zsh 2>/dev/null)"
+  if [ -n "$_codevector_out" ]; then eval "$_codevector_out"; fi
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook chpwd _codevector_on_chpwd
+# Run once for the current directory at shell startup.
+_codevector_on_chpwd
+`;
+var FISH_SNIPPET = `# codevector shell hook (fish) \u2014 auto-activates credentials on cd
+function _codevector_on_pwd --on-variable PWD
+    set -l out (command codevector env --shell fish 2>/dev/null)
+    if test -n "$out"
+        eval $out
+    end
+end
+# Run once for the current directory at shell startup.
+_codevector_on_pwd
+`;
+
 // src/commands/init.ts
-import { existsSync as existsSync8, writeFileSync as writeFileSync6 } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
-import { join as join8 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { join as join10 } from "path";
 var DEFAULT_TICKET_PATTERN2 = "[A-Z]+-\\d+";
 var initCommand = defineCommand({
   meta: {
     name: "init",
-    description: "Write .codevector.json in the current repo."
+    description: "Set this repo up for codevector: write .codevector.json (gateway + project) and optionally configure coding tools."
   },
   args: {
     project: {
@@ -19001,33 +19545,147 @@ var initCommand = defineCommand({
       type: "string",
       description: "Override the ticket-extraction regex."
     },
+    gateway: {
+      type: "string",
+      description: "Gateway URL to pin for this repo (e.g. https://gateway.acme.com)."
+    },
     force: {
       type: "boolean",
-      description: "Overwrite an existing .codevector.json."
+      description: "Overwrite an existing .codevector.json without prompting."
+    },
+    "skip-configure": {
+      type: "boolean",
+      description: "Don't run `codevector configure` after writing the file."
     }
   },
-  run({ args }) {
+  async run({ args }) {
     const cwd = userCwd();
-    const target = join8(cwd, ".codevector.json");
-    if (existsSync8(target) && !args.force) {
-      throw new Error(`.codevector.json already exists in ${cwd}. Pass --force to overwrite.`);
-    }
-    const projectName = args.project ?? deriveProjectName(cwd);
-    if (!projectName) {
+    const target = join10(cwd, PROJECT_CONFIG_FILENAME);
+    const existing = existsSync8(target) ? readProjectConfigAt(target) : null;
+    const interactive = isInteractive(args);
+    if (existing && !args.force && !interactive) {
       throw new Error(
-        "Could not derive projectName from git remote. Pass --project <name> explicitly."
+        `${PROJECT_CONFIG_FILENAME} already exists in ${cwd}. Pass --force to overwrite, or run without flags for the interactive update flow.`
       );
     }
-    const ticketPattern = args["ticket-pattern"] ?? DEFAULT_TICKET_PATTERN2;
-    writeFileSync6(target, `${JSON.stringify({ projectName, ticketPattern }, null, 2)}
-`, {
-      mode: 420
-    });
-    R2.success(`Wrote ${target}`);
-    R2.info(`projectName:   ${projectName}`);
-    R2.info(`ticketPattern: ${ticketPattern}`);
+    if (interactive) ge("codevector init");
+    if (existing && interactive && !args.force) {
+      R2.info(`Found existing ${PROJECT_CONFIG_FILENAME} \u2014 updating in place.`);
+    }
+    const projectName = await resolveProjectName(args.project, existing, cwd, interactive);
+    const gateway = await resolveGateway(args.gateway, existing, interactive);
+    const ticketPattern = args["ticket-pattern"] ?? existing?.ticketPattern ?? DEFAULT_TICKET_PATTERN2;
+    const next = {
+      ...projectName ? { projectName } : {},
+      ticketPattern,
+      ...gateway ? { gateway } : {},
+      ...existing?.tools ? { tools: existing.tools } : {}
+    };
+    writeProjectConfig(target, next);
+    if (interactive) {
+      R2.success(`Wrote ${target}`);
+      R2.info(`projectName:   ${projectName ?? "(unset)"}`);
+      R2.info(`gateway:       ${gateway ?? "(unset)"}`);
+      R2.info(`ticketPattern: ${ticketPattern}`);
+    } else {
+      R2.success(`Wrote ${target}`);
+    }
+    if (!args["skip-configure"] && interactive && gateway) {
+      const run = unwrap(
+        await ue({
+          message: "Configure coding tools (Claude Code, Codex, OpenCode) for this repo now?",
+          initialValue: true
+        })
+      );
+      if (run) {
+        await runCommand(configureCommand, { rawArgs: [] });
+      } else {
+        Se("Run `codevector configure` when you're ready.", "Skipped");
+      }
+    }
+    if (interactive) {
+      Se(
+        'Add `eval "$(codevector hook bash)"` (or zsh / fish) to your shell rc so credentials auto-activate on cd.',
+        "Shell hook"
+      );
+      ye("Done.");
+    }
   }
 });
+function isInteractive(args) {
+  if (!process.stdout.isTTY) return false;
+  return !args.gateway;
+}
+async function resolveProjectName(fromArgs, existing, cwd, interactive) {
+  if (fromArgs) return fromArgs;
+  const derived = deriveProjectName(cwd) ?? existing?.projectName ?? null;
+  if (!interactive) return derived;
+  const initial = derived ?? "";
+  const entered = unwrap(
+    await Pe({
+      message: "Project name (used for x-project attribution header):",
+      placeholder: initial || "my-project",
+      defaultValue: initial
+    })
+  );
+  const trimmed = entered.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+async function resolveGateway(fromArgs, existing, interactive) {
+  if (fromArgs) return fromArgs;
+  if (!interactive) return existing?.gateway ?? null;
+  const profiles = await readProfiles();
+  const knownUrls = uniqueGatewayUrls(profiles?.profiles ?? {});
+  const initialUrl = existing?.gateway ?? profiles?.profiles[profiles.activeProfile]?.gatewayUrl;
+  const CUSTOM = "__custom__";
+  const options = [
+    ...knownUrls.map((url2) => ({ value: url2, label: url2 })),
+    { value: CUSTOM, label: "Enter a different URL\u2026" }
+  ];
+  if (knownUrls.length === 0) {
+    const entered2 = unwrap(
+      await Pe({
+        message: "Gateway URL (e.g. https://gateway.acme.com):",
+        placeholder: "https://gateway.acme.com",
+        validate: validateUrl
+      })
+    );
+    return entered2.trim();
+  }
+  const picked = unwrap(
+    await xe({
+      message: "Pin a gateway for this repo (auto-activates on cd):",
+      options,
+      ...initialUrl && knownUrls.includes(initialUrl) ? { initialValue: initialUrl } : {}
+    })
+  );
+  if (picked !== CUSTOM) return picked;
+  const entered = unwrap(
+    await Pe({
+      message: "Gateway URL:",
+      placeholder: "https://gateway.acme.com",
+      validate: validateUrl
+    })
+  );
+  return entered.trim();
+}
+function uniqueGatewayUrls(profiles) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const p2 of Object.values(profiles)) {
+    seen.add(p2.gatewayUrl);
+  }
+  return [...seen].sort();
+}
+function validateUrl(value) {
+  const trimmed = (value ?? "").trim();
+  if (!trimmed) return "Required.";
+  try {
+    new URL(trimmed);
+  } catch {
+    return "Must be a valid URL (e.g. https://gateway.acme.com).";
+  }
+  return void 0;
+}
 function deriveProjectName(cwd) {
   try {
     const out = execFileSync2("git", ["remote", "get-url", "origin"], {
@@ -19236,7 +19894,7 @@ var modelsCommand = defineCommand({
 
 // src/commands/profile.ts
 import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
-var WRITERS2 = {
+var WRITERS3 = {
   "claude-code": writeClaudeCodeConfig,
   opencode: writeOpencodeConfig,
   codex: writeCodexConfig
@@ -19333,7 +19991,7 @@ Key:    ${maskApiKey(active.apiKey)}`,
     const persisted = [];
     for (const tc of toolConfigs) {
       const tool = tc.tool;
-      const writer = WRITERS2[tool];
+      const writer = WRITERS3[tool];
       if (!writer) {
         results.push({
           tool: tc.tool,
@@ -19501,6 +20159,178 @@ function asObject(value) {
   return isObject5(value) ? value : void 0;
 }
 
+// src/commands/skills.ts
+import { readFile, writeFile } from "fs/promises";
+import { resolve as resolve2 } from "path";
+import { spawn } from "child_process";
+async function getClient() {
+  const creds = await readCredentials();
+  if (!creds) {
+    R2.warn("Not signed in. Run `codevector auth login` to get started.");
+    process.exitCode = 1;
+    return null;
+  }
+  return gatewayClient(creds.gatewayUrl, creds.apiKey, 1e4);
+}
+var skillsListCommand = defineCommand({
+  meta: {
+    name: "list",
+    description: "List skill packs available on the gateway."
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Emit raw JSON (for scripting)."
+    }
+  },
+  async run({ args }) {
+    const client = await getClient();
+    if (!client) return;
+    const s = args.json ? null : ft();
+    s?.start("Loading skill packs\u2026");
+    try {
+      const res = await call(parseResponse(client["skill-packs"].$get()));
+      s?.stop(`${res.data.length} skill pack${res.data.length === 1 ? "" : "s"}`);
+      if (args.json) {
+        process.stdout.write(`${JSON.stringify(res.data, null, 2)}
+`);
+        return;
+      }
+      if (res.data.length === 0) {
+        R2.info("No skill packs found. Ask an admin to upload one with `codevector skills upload <name>`.");
+        return;
+      }
+      const headers = ["NAME", "UPDATED"];
+      const cells = res.data.map((p2) => [
+        p2.name,
+        new Date(p2.updatedAt).toLocaleString()
+      ]);
+      Se(renderTable(headers, cells), "Skill packs");
+    } catch (err) {
+      s?.stop("Could not load skill packs");
+      R2.error(err instanceof ApiClientError ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  }
+});
+var skillsUploadCommand = defineCommand({
+  meta: {
+    name: "upload",
+    description: "Upload the local skills-lock.json as a named skill pack."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Name for the skill pack.",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const client = await getClient();
+    if (!client) return;
+    const lockfilePath = resolve2("skills-lock.json");
+    let lockfile;
+    try {
+      const raw = await readFile(lockfilePath, "utf-8");
+      lockfile = JSON.parse(raw);
+    } catch {
+      R2.error(`No lockfile found at ${lockfilePath}. Run \`npx skills install\` first.`);
+      process.exitCode = 1;
+      return;
+    }
+    const s = ft();
+    s.start("Uploading skill pack\u2026");
+    try {
+      await call(
+        parseResponse(
+          client["skill-packs"].$post({
+            json: { name: args.name, lockfile }
+          })
+        )
+      );
+      s.stop(`Skill pack "${args.name}" uploaded.`);
+    } catch (err) {
+      s.stop("Upload failed");
+      R2.error(err instanceof ApiClientError ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  }
+});
+var skillsSyncCommand = defineCommand({
+  meta: {
+    name: "sync",
+    description: "Fetch a skill pack's lockfile, write skills-lock.json, and run npx skills install."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Name of the skill pack to sync.",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const client = await getClient();
+    if (!client) return;
+    const s = ft();
+    s.start(`Fetching skill pack "${args.name}"\u2026`);
+    let pack;
+    try {
+      pack = await call(
+        parseResponse(
+          client["skill-packs"][":name"].$get({ param: { name: args.name } })
+        )
+      );
+    } catch (err) {
+      s.stop("Fetch failed");
+      R2.error(err instanceof ApiClientError ? err.message : String(err));
+      process.exitCode = 1;
+      return;
+    }
+    s.stop("Fetched");
+    const lockfilePath = resolve2("skills-lock.json");
+    s.start("Writing skills-lock.json\u2026");
+    try {
+      await writeFile(lockfilePath, `${JSON.stringify(pack.lockfile, null, 2)}
+`, "utf-8");
+    } catch (err) {
+      s.stop("Write failed");
+      R2.error(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
+      return;
+    }
+    s.stop("skills-lock.json written");
+    s.start("Running npx skills install\u2026");
+    try {
+      await new Promise((resolve3, reject) => {
+        const child = spawn("npx", ["skills", "experimental_install"], {
+          stdio: "inherit"
+        });
+        child.on("close", (code) => {
+          if (code === 0) resolve3();
+          else reject(new Error(`npx skills experimental_install exited with code ${code}`));
+        });
+        child.on("error", reject);
+      });
+      s.stop("Skills installed");
+    } catch (err) {
+      s.stop("Install failed");
+      R2.error(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  }
+});
+var skillsCommand = defineCommand({
+  meta: {
+    name: "skills",
+    description: "Upload and sync skill packs."
+  },
+  subCommands: {
+    list: skillsListCommand,
+    upload: skillsUploadCommand,
+    sync: skillsSyncCommand
+  }
+});
+
 // src/commands/status.ts
 var statusCommand = defineCommand({
   meta: {
@@ -19548,17 +20378,17 @@ import {
   readdirSync,
   statSync as statSync6
 } from "fs";
-import { basename, dirname as dirname6, join as join9 } from "path";
+import { basename, dirname as dirname7, join as join11 } from "path";
 import { homedir as homedir6 } from "os";
-var BACKUP_ROOT = process.env.CODEVECTOR_BACKUP_ROOT ?? join9(homedir6(), ".codevector", "backups");
+var BACKUP_ROOT = process.env.CODEVECTOR_BACKUP_ROOT ?? join11(homedir6(), ".codevector", "backups");
 function backupTimestamp(d = /* @__PURE__ */ new Date()) {
   return d.toISOString().replace(/:/g, "-");
 }
 function backupFile(sourcePath, tool, timestamp) {
   if (!existsSync10(sourcePath)) return void 0;
-  const destDir = join9(BACKUP_ROOT, timestamp, tool);
+  const destDir = join11(BACKUP_ROOT, timestamp, tool);
   mkdirSync6(destDir, { recursive: true, mode: 448 });
-  const dest = join9(destDir, basename(sourcePath));
+  const dest = join11(destDir, basename(sourcePath));
   copyFileSync2(sourcePath, dest);
   return dest;
 }
@@ -19567,18 +20397,18 @@ function listBackupRuns() {
   const entries = readdirSync(BACKUP_ROOT, { withFileTypes: true }).filter((e2) => e2.isDirectory()).map((e2) => e2.name).sort().reverse();
   const runs = [];
   for (const ts of entries) {
-    const dir = join9(BACKUP_ROOT, ts);
+    const dir = join11(BACKUP_ROOT, ts);
     const tools = readdirSync(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory());
     const collected = [];
     for (const toolDir of tools) {
-      const toolPath = join9(dir, toolDir.name);
+      const toolPath = join11(dir, toolDir.name);
       for (const file2 of readdirSync(toolPath, { withFileTypes: true })) {
         if (!file2.isFile()) continue;
         collected.push({
           tool: toolDir.name,
           original: "",
           // resolved by caller per tool — see restoreBackup()
-          backup: join9(toolPath, file2.name)
+          backup: join11(toolPath, file2.name)
         });
       }
     }
@@ -19591,7 +20421,7 @@ function restoreBackup(backupPath, originalPath) {
   if (!existsSync10(backupPath)) {
     throw new Error(`Backup file missing: ${backupPath}`);
   }
-  mkdirSync6(dirname6(originalPath), { recursive: true });
+  mkdirSync6(dirname7(originalPath), { recursive: true });
   copyFileSync2(backupPath, originalPath);
 }
 function backupRunMtime(dir) {
@@ -19600,7 +20430,7 @@ function backupRunMtime(dir) {
 
 // src/commands/system.ts
 var TOOLS = ["claude-code", "opencode", "codex"];
-var WRITERS3 = {
+var WRITERS4 = {
   "claude-code": writeClaudeCodeConfig,
   opencode: writeOpencodeConfig,
   codex: writeCodexConfig
@@ -19647,11 +20477,11 @@ var systemConfigureCommand = defineCommand({
     } else {
       R2.info("No pre-existing user-scope config files to back up.");
     }
-    const reachable = await fetchReachableChatModels2(creds);
+    const reachable = await fetchReachableChatModels3(creds);
     const hookPath = installAcceptanceHook();
     const results = [];
     for (const tool of TOOLS) {
-      const writer = WRITERS3[tool];
+      const writer = WRITERS4[tool];
       try {
         results.push(
           writer({
@@ -19786,7 +20616,7 @@ async function confirmRestore() {
 function isTool2(value) {
   return TOOLS.includes(value);
 }
-async function fetchReachableChatModels2(creds) {
+async function fetchReachableChatModels3(creds) {
   const client = gatewayClient(creds.gatewayUrl, creds.apiKey, 1e4);
   const s = ft();
   s.start("Loading reachable models\u2026");
@@ -19839,7 +20669,7 @@ import { spawnSync } from "child_process";
 // package.json
 var package_default = {
   name: "@codevector/cli",
-  version: "0.4.0",
+  version: "0.5.0",
   description: "CodeVector CLI \u2014 installs and configures first-party coding-tool integrations.",
   license: "UNLICENSED",
   bin: {
@@ -19886,8 +20716,8 @@ var package_default = {
 
 // src/lib/install-pref.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync as renameSync4, writeFileSync as writeFileSync7 } from "fs";
-import { join as join10 } from "path";
-var INSTALL_PREF_FILE = join10(CODEVECTOR_CONFIG_DIR, "install.json");
+import { join as join12 } from "path";
+var INSTALL_PREF_FILE = join12(CODEVECTOR_CONFIG_DIR, "install.json");
 var PACKAGE_MANAGERS = ["npm", "pnpm", "yarn"];
 function isPackageManager(v2) {
   return typeof v2 === "string" && PACKAGE_MANAGERS.includes(v2);
@@ -20104,10 +20934,10 @@ var versionCommand = defineCommand({
 
 // src/lib/update-notifier.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { join as join13 } from "path";
 var PKG_NAME2 = "@codevector/cli";
 var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME2}/latest`;
-var CHECK_CACHE_FILE = join11(CODEVECTOR_CONFIG_DIR, "update-check.json");
+var CHECK_CACHE_FILE = join13(CODEVECTOR_CONFIG_DIR, "update-check.json");
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 2e3;
 function readCache() {
@@ -20194,13 +21024,17 @@ var main = defineCommand({
   },
   subCommands: {
     auth: authCommand,
+    config: configCommand,
     configure: configureCommand,
     init: initCommand,
     doctor: doctorCommand,
+    env: envCommand,
+    hook: hookCommand,
     status: statusCommand,
     system: systemCommand,
     models: modelsCommand,
     profile: profileCommand,
+    skills: skillsCommand,
     update: updateCommand,
     usage: usageCommand,
     version: versionCommand