@codevector/cli 0.8.1 → 0.10.0

package/dist/index.js

@@ -2084,7 +2084,72 @@ var init_client2 = __esm({
   }
 });
 
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "@codevector/cli",
+      version: "0.10.0",
+      description: "CodeVector CLI \u2014 installs and configures first-party coding-tool integrations.",
+      license: "UNLICENSED",
+      bin: {
+        codevector: "./bin/codevector.mjs"
+      },
+      files: [
+        "bin",
+        "dist",
+        "scripts",
+        "src/hooks"
+      ],
+      type: "module",
+      publishConfig: {
+        access: "public"
+      },
+      scripts: {
+        dev: "tsx src/index.ts",
+        build: "tsup",
+        "type-check": "tsc --noEmit",
+        test: "vitest run",
+        "test:watch": "vitest",
+        postinstall: "node scripts/postinstall.mjs"
+      },
+      dependencies: {
+        "@clack/prompts": "1.4.0",
+        citty: "^0.2.2",
+        hono: "4.12.16",
+        "smol-toml": "^1.6.1"
+      },
+      devDependencies: {
+        "@codevector/api": "workspace:*",
+        "@codevector/common": "workspace:*",
+        "@types/node": "25.6.0",
+        tsup: "^8.5.1",
+        tsx: "4.21.0",
+        typescript: "6.0.3",
+        vitest: "4.1.5",
+        zod: "4.4.2"
+      },
+      engines: {
+        node: ">=20"
+      }
+    };
+  }
+});
+
 // src/lib/api-client.ts
+function healthClient(baseUrl, timeoutMs = 5e3) {
+  const client = hc(trimRightSlash(baseUrl), {
+    fetch: (input, init) => {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), timeoutMs);
+      return fetch(input, { ...init, signal: controller.signal }).finally(
+        () => clearTimeout(timer)
+      );
+    }
+  });
+  return client.health;
+}
 function gatewayClient(gatewayUrl, apiKey, timeoutMs = 15e3) {
   const client = hc(trimRightSlash(gatewayUrl), {
     fetch: (input, init) => {
@@ -2092,6 +2157,7 @@ function gatewayClient(gatewayUrl, apiKey, timeoutMs = 15e3) {
       const timer = setTimeout(() => controller.abort(), timeoutMs);
       const headers = new Headers(init?.headers);
       headers.set("x-api-key", apiKey);
+      headers.set("x-codevector-cli-version", package_default.version);
       return fetch(input, { ...init, headers, signal: controller.signal }).finally(
         () => clearTimeout(timer)
       );
@@ -2108,7 +2174,10 @@ async function call(promise2) {
       throw new ApiClientError(
         err.statusCode,
         errShape?.code ?? `HTTP_${err.statusCode}`,
-        err.message
+        // Prefer the server's human-facing description (e.g. the UPGRADE_REQUIRED
+        // "run `codevector update`" text) over hono/client's generic
+        // "<status> <statusText>" message.
+        errShape?.description ?? err.message
       );
     }
     const asError = err;
@@ -2130,6 +2199,7 @@ var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     "use strict";
     init_client2();
+    init_package();
     ApiClientError = class extends Error {
       constructor(status, code, message) {
         super(message);
@@ -17513,17 +17583,128 @@ var init_gitignore = __esm({
   }
 });
 
-// src/config-writers/opencode.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+// src/config-writers/cline.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
+function clineDataDir() {
+  const home = homedir3();
+  return join4(home, ".cline", "data", "settings");
+}
+function clineSettingsPath(scope) {
+  switch (scope) {
+    case "user":
+      return join4(clineDataDir(), PROVIDERS_FILE);
+    case "project":
+      return join4(userCwd(), CLINE_CONFIG_DIR, PROVIDERS_FILE);
+    case "local":
+      return join4(userCwd(), CLINE_CONFIG_DIR, PROVIDERS_FILE);
+  }
+}
+function detectClineConfig() {
+  const scopes = ["local", "project", "user"];
+  for (const scope of scopes) {
+    const path = clineSettingsPath(scope);
+    if (!existsSync3(path)) continue;
+    try {
+      const raw = JSON.parse(readFileSync4(path, "utf8"));
+      const providers = raw.providers;
+      if (Array.isArray(providers)) {
+        for (const p2 of providers) {
+          if (typeof p2.baseUrl === "string" && p2.baseUrl.includes("/gateway/")) {
+            return { scope, modelSlug: p2.defaultModel };
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+function readProvidersFile(path) {
+  try {
+    const raw = readFileSync4(path, "utf8").trim();
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return {};
+  } catch {
+    return {};
+  }
+}
+function trimRightSlash3(url2) {
+  return url2.endsWith("/") ? url2.slice(0, -1) : url2;
+}
+var CLINE_CONFIG_DIR, PROVIDERS_FILE, writeClineConfig;
+var init_cline = __esm({
+  "src/config-writers/cline.ts"() {
+    "use strict";
+    init_gitignore();
+    init_paths();
+    CLINE_CONFIG_DIR = ".cline";
+    PROVIDERS_FILE = "providers.json";
+    writeClineConfig = ({
+      gatewayUrl,
+      apiKey,
+      scope,
+      project,
+      model
+    }) => {
+      const path = clineSettingsPath(scope);
+      const baseUrl = `${trimRightSlash3(gatewayUrl)}/gateway/openai/v1`;
+      mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+      const existing = readProvidersFile(path);
+      const providers = (existing.providers ?? []).filter(
+        (p2) => p2.id !== "codevector" && p2.baseUrl !== baseUrl
+      );
+      providers.push({
+        type: "openai-compatible",
+        id: "codevector",
+        apiKey,
+        baseUrl,
+        ...model?.slug ? { defaultModel: model.slug } : {}
+      });
+      writeFileSync3(path, `${JSON.stringify({ ...existing, providers }, null, 2)}
+`);
+      const notes = [];
+      if (scope === "local") {
+        if (ensureGitignored(join4(CLINE_CONFIG_DIR, PROVIDERS_FILE))) {
+          notes.push(`Added \`${CLINE_CONFIG_DIR}/${PROVIDERS_FILE}\` to .gitignore.`);
+        }
+      }
+      const authCmd = `cline auth --provider openai-compatible --apikey "${apiKey.slice(0, 8)}\u2026" --baseurl "${baseUrl}"${model?.slug ? ` --modelid "${model.slug}"` : ""}`;
+      notes.push(
+        `Alternatively, run \`${authCmd}\` (requires cline CLI: \`npm i -g cline\`).`
+      );
+      if (scope !== "user" && !project) {
+        notes.push(
+          "Project slug could not be derived (no git remote and no .codevector.json). Per-project usage attribution will be blank until you set one."
+        );
+      }
+      return {
+        tool: "cline",
+        status: "configured",
+        path,
+        scope,
+        notes: notes.length > 0 ? notes.join(" ") : void 0
+      };
+    };
+  }
+});
+
+// src/config-writers/opencode.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
 function syncOpencodeModels(path, availableModels) {
-  if (!existsSync3(path)) {
+  if (!existsSync4(path)) {
     throw new Error(
       `No opencode config found at ${path}. Run \`codevector configure opencode\` first.`
     );
   }
-  const raw = readFileSync4(path, "utf8");
+  const raw = readFileSync5(path, "utf8");
   let parsed;
   try {
     parsed = raw.trim().length === 0 ? {} : JSON.parse(raw);
@@ -17542,7 +17723,7 @@ function syncOpencodeModels(path, availableModels) {
   }
   const models = buildModelEntries(availableModels);
   codevector.models = models;
-  writeFileSync3(path, `${JSON.stringify(parsed, null, 2)}
+  writeFileSync4(path, `${JSON.stringify(parsed, null, 2)}
 `);
   return Object.keys(models).length;
 }
@@ -17591,10 +17772,10 @@ function parsePrice(raw) {
   return Number.isFinite(n) ? n : void 0;
 }
 function forceReplaceCgwModels(path, models) {
-  if (!existsSync3(path)) return;
+  if (!existsSync4(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(path, "utf8"));
+    parsed = JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return;
   }
@@ -17604,25 +17785,25 @@ function forceReplaceCgwModels(path, models) {
   const codevector = provider[PROVIDER_PREFIX];
   if (!isObject3(codevector)) return;
   codevector.models = models;
-  writeFileSync3(path, `${JSON.stringify(parsed, null, 2)}
+  writeFileSync4(path, `${JSON.stringify(parsed, null, 2)}
 `);
 }
 function opencodeSettingsPath(scope) {
   switch (scope) {
     case "user":
-      return join4(homedir3(), ".config", "opencode", "opencode.json");
+      return join5(homedir4(), ".config", "opencode", "opencode.json");
     case "project":
     case "local":
-      return join4(userCwd(), "opencode.json");
+      return join5(userCwd(), "opencode.json");
   }
 }
 function detectOpencodeConfig() {
   const scopes = ["local", "project", "user"];
   for (const scope of scopes) {
     const path = opencodeSettingsPath(scope);
-    if (!existsSync3(path)) continue;
+    if (!existsSync4(path)) continue;
     try {
-      const raw = JSON.parse(readFileSync4(path, "utf8"));
+      const raw = JSON.parse(readFileSync5(path, "utf8"));
       if (raw.provider?.codevector?.options?.baseURL) {
         const modelSlug = raw.model?.startsWith("codevector/") ? raw.model.slice("codevector/".length) : raw.model;
         return { scope, modelSlug };
@@ -17633,10 +17814,10 @@ function detectOpencodeConfig() {
   return void 0;
 }
 function removeStaleGatewayProviders(path, gateway) {
-  if (!existsSync3(path)) return;
+  if (!existsSync4(path)) return;
   let parsed;
   try {
-    const raw = readFileSync4(path, "utf8");
+    const raw = readFileSync5(path, "utf8");
     if (raw.trim().length === 0) return;
     parsed = JSON.parse(raw);
   } catch {
@@ -17659,7 +17840,7 @@ function removeStaleGatewayProviders(path, gateway) {
     }
   }
   if (mutated) {
-    writeFileSync3(path, `${JSON.stringify(parsed, null, 2)}
+    writeFileSync4(path, `${JSON.stringify(parsed, null, 2)}
 `);
   }
 }
@@ -17679,7 +17860,7 @@ function buildCustomHeaders2(scope, project) {
   }
   return headers;
 }
-function trimRightSlash3(url2) {
+function trimRightSlash4(url2) {
   return url2.endsWith("/") ? url2.slice(0, -1) : url2;
 }
 var ENV_VAR_NAME, PROVIDER_PREFIX, writeOpencodeConfig;
@@ -17700,7 +17881,7 @@ var init_opencode = __esm({
       availableModels = []
     }) => {
       const path = opencodeSettingsPath(scope);
-      const gateway = trimRightSlash3(gatewayUrl);
+      const gateway = trimRightSlash4(gatewayUrl);
       const keyLiteral = scope === "project" ? `{env:${ENV_VAR_NAME}}` : apiKey;
       removeStaleGatewayProviders(path, gateway);
       const models = buildModelEntries(availableModels);
@@ -17749,8 +17930,8 @@ var init_opencode = __esm({
 });
 
 // src/lib/credentials-lock.ts
-import { closeSync, constants, mkdirSync as mkdirSync2, openSync, statSync as statSync2, unlinkSync } from "fs";
-import { dirname as dirname2 } from "path";
+import { closeSync, constants, mkdirSync as mkdirSync3, openSync, statSync as statSync2, unlinkSync } from "fs";
+import { dirname as dirname3 } from "path";
 function syncSleep(ms) {
   Atomics.wait(sleepView, 0, 0, ms);
 }
@@ -17773,7 +17954,7 @@ function withCredentialsLockSync(fn) {
   }
 }
 function acquireLock() {
-  mkdirSync2(dirname2(LOCK_FILE), { recursive: true, mode: 448 });
+  mkdirSync3(dirname3(LOCK_FILE), { recursive: true, mode: 448 });
   for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
     try {
       const fd = openSync(
@@ -17827,24 +18008,24 @@ var init_credentials_lock = __esm({
 // src/lib/credentials.ts
 import {
   chmodSync as chmodSync2,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync5,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync6,
   renameSync as renameSync2,
   rmSync,
   statSync as statSync3,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 function writeProfilesFile(payload) {
   const parsed = ProfilesFileSchema.parse(payload);
-  const dir = dirname3(CREDENTIALS_FILE);
-  mkdirSync3(dir, { recursive: true, mode: 448 });
+  const dir = dirname4(CREDENTIALS_FILE);
+  mkdirSync4(dir, { recursive: true, mode: 448 });
   try {
     chmodSync2(dir, 448);
   } catch {
   }
   const tmp = `${CREDENTIALS_FILE}.${process.pid}.tmp`;
-  writeFileSync4(tmp, JSON.stringify(parsed, null, 2), { mode: 384 });
+  writeFileSync5(tmp, JSON.stringify(parsed, null, 2), { mode: 384 });
   try {
     chmodSync2(tmp, 384);
   } catch {
@@ -17854,7 +18035,7 @@ function writeProfilesFile(payload) {
 function readProfilesSync() {
   let raw;
   try {
-    raw = readFileSync5(CREDENTIALS_FILE, "utf8");
+    raw = readFileSync6(CREDENTIALS_FILE, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -17873,7 +18054,7 @@ function readProfilesSync() {
   return withCredentialsLockSync(() => {
     let lockedRaw;
     try {
-      lockedRaw = readFileSync5(CREDENTIALS_FILE, "utf8");
+      lockedRaw = readFileSync6(CREDENTIALS_FILE, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") {
         return null;
@@ -17885,7 +18066,7 @@ function readProfilesSync() {
       return ProfilesFileSchema.parse(lockedParsed);
     }
     const oldProfile = ProfileSchema.parse(lockedParsed);
-    const seeded = seedToolConfigsFromDisk();
+    const seeded = detectOnDiskToolConfigs();
     const defaultProfile = {
       ...oldProfile,
       ...seeded.length > 0 ? { toolConfigs: seeded } : {}
@@ -17901,7 +18082,7 @@ function readProfilesSync() {
     return migrated;
   });
 }
-function seedToolConfigsFromDisk() {
+function detectOnDiskToolConfigs() {
   const out = [];
   const claude = detectClaudeCodeConfig();
   if (claude) {
@@ -17919,6 +18100,14 @@ function seedToolConfigsFromDisk() {
       ...opencode.modelSlug ? { modelSlug: opencode.modelSlug } : {}
     });
   }
+  const cline = detectClineConfig();
+  if (cline) {
+    out.push({
+      tool: "cline",
+      scope: cline.scope,
+      ...cline.modelSlug ? { modelSlug: cline.modelSlug } : {}
+    });
+  }
   return out;
 }
 async function readProfiles() {
@@ -18020,6 +18209,7 @@ var init_credentials = __esm({
     "use strict";
     init_zod();
     init_claude_code();
+    init_cline();
     init_opencode();
     init_credentials_lock();
     init_paths();
@@ -18034,7 +18224,18 @@ var init_credentials = __esm({
       userId: external_exports.uuid(),
       email: external_exports.email(),
       savedAt: external_exports.iso.datetime(),
-      toolConfigs: external_exports.array(ToolConfigSchema).optional()
+      toolConfigs: external_exports.array(ToolConfigSchema).optional(),
+      // Group-scoped profile: the group this profile's key bills/records against.
+      // Attribution is server-side (bound to the key); these are persisted only so
+      // `profile list` / `status` / `doctor` can show the billed group without a
+      // round-trip. `groupId` is the stable key (survives a rename); `groupName` is
+      // display only. Absent for a personal profile.
+      groupId: external_exports.uuid().optional(),
+      groupName: external_exports.string().min(1).optional(),
+      // Server-side id of the API key this profile holds. Stored on mint so
+      // `sync` can match a local profile to a server key record exactly (prefix
+      // is non-unique). Absent on legacy profiles (matched by prefix instead).
+      keyId: external_exports.uuid().optional()
     });
     ProfilesFileSchema = external_exports.object({
       activeProfile: external_exports.string().min(1),
@@ -18076,16 +18277,16 @@ var init_prompt = __esm({
 });
 
 // src/lib/project-config.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join5, parse as parsePath, resolve } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join6, parse as parsePath, resolve } from "path";
 function findProjectConfigPath(startDir) {
   let dir = resolve(startDir);
   const root = parsePath(dir).root;
   while (true) {
-    const candidate = join5(dir, PROJECT_CONFIG_FILENAME);
-    if (existsSync4(candidate)) return candidate;
+    const candidate = join6(dir, PROJECT_CONFIG_FILENAME);
+    if (existsSync5(candidate)) return candidate;
     if (dir === root) return null;
-    const parent = dirname4(dir);
+    const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -18093,7 +18294,7 @@ function findProjectConfigPath(startDir) {
 function readProjectConfigAt(path) {
   let raw;
   try {
-    raw = readFileSync6(path, "utf8");
+    raw = readFileSync7(path, "utf8");
   } catch {
     return null;
   }
@@ -18115,7 +18316,7 @@ function readProjectConfig(startDir) {
 }
 function writeProjectConfig(path, config2) {
   const parsed = ProjectConfigSchema.parse(config2);
-  writeFileSync5(path, `${JSON.stringify(parsed, null, 2)}
+  writeFileSync6(path, `${JSON.stringify(parsed, null, 2)}
 `, { mode: 420 });
 }
 var PROJECT_CONFIG_FILENAME, ProjectConfigSchema;
@@ -18129,14 +18330,18 @@ var init_project_config = __esm({
       projectName: external_exports.string().min(1).optional(),
       ticketPattern: external_exports.string().min(1).optional(),
       gateway: external_exports.url().optional(),
-      tools: external_exports.array(ToolConfigSchema).optional()
+      tools: external_exports.array(ToolConfigSchema).optional(),
+      // Candidate groups this repo bills. The shell hook resolves them to the one
+      // local key the developer holds (see resolveProfileForRepo). A list, not a
+      // single pin: a repo shared by two teams lists both; each dev bills their own.
+      groups: external_exports.array(external_exports.string().min(1)).optional()
     });
   }
 });
 
 // src/lib/project-context.ts
 import { execFileSync } from "child_process";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 function safeGit(args, cwd) {
   try {
     const out = execFileSync("git", args, {
@@ -18174,7 +18379,7 @@ function resolveProjectContext(cwd = process.cwd(), ticketPattern = DEFAULT_TICK
   return { project, ticket };
 }
 function readLocalConfig(cwd) {
-  const config2 = readProjectConfigAt(join6(cwd, PROJECT_CONFIG_FILENAME));
+  const config2 = readProjectConfigAt(join7(cwd, PROJECT_CONFIG_FILENAME));
   if (!config2) return null;
   const result = {};
   if (config2.projectName) result.projectName = config2.projectName;
@@ -18216,9 +18421,9 @@ var init_shell = __esm({
 });
 
 // src/lib/shell-hook.ts
-import { existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join8 } from "path";
 function shellHookRecipe(shell) {
   return RECIPES[shell];
 }
@@ -18251,19 +18456,19 @@ function shellHookOneLiner(shell = detectShell()) {
   return `Optional: add \`${line}\` to ${rc} so credentials auto-activate on cd.`;
 }
 function rcCandidates(shell, platform = process.platform) {
-  const home = homedir4();
+  const home = homedir5();
   switch (shell) {
     case "bash":
-      return platform === "darwin" ? [join7(home, ".bash_profile"), join7(home, ".bashrc")] : [join7(home, ".bashrc")];
+      return platform === "darwin" ? [join8(home, ".bash_profile"), join8(home, ".bashrc")] : [join8(home, ".bashrc")];
     case "zsh":
-      return [join7(home, ".zshrc")];
+      return [join8(home, ".zshrc")];
     case "fish":
-      return [join7(home, ".config", "fish", "config.fish")];
+      return [join8(home, ".config", "fish", "config.fish")];
     case "powershell": {
-      const docs = join7(home, "Documents");
+      const docs = join8(home, "Documents");
       return [
-        join7(docs, "PowerShell", "Microsoft.PowerShell_profile.ps1"),
-        join7(docs, "WindowsPowerShell", "Microsoft.PowerShell_profile.ps1")
+        join8(docs, "PowerShell", "Microsoft.PowerShell_profile.ps1"),
+        join8(docs, "WindowsPowerShell", "Microsoft.PowerShell_profile.ps1")
       ];
     }
   }
@@ -18271,7 +18476,7 @@ function rcCandidates(shell, platform = process.platform) {
 function isHookInstalled(shell, platform = process.platform) {
   for (const path of rcCandidates(shell, platform)) {
     try {
-      if (existsSync5(path) && /codevector hook/.test(readFileSync7(path, "utf8"))) return true;
+      if (existsSync6(path) && /codevector hook/.test(readFileSync8(path, "utf8"))) return true;
     } catch {
     }
   }
@@ -18297,8 +18502,8 @@ __export(init_exports, {
   initCommand: () => initCommand
 });
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync6 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { join as join9 } from "path";
 function isInteractive(args) {
   if (!process.stdout.isTTY) return false;
   return !args.gateway;
@@ -18429,8 +18634,8 @@ var init_init = __esm({
       },
       async run({ args }) {
         const cwd = userCwd();
-        const target = join8(cwd, PROJECT_CONFIG_FILENAME);
-        const existing = existsSync6(target) ? readProjectConfigAt(target) : null;
+        const target = join9(cwd, PROJECT_CONFIG_FILENAME);
+        const existing = existsSync7(target) ? readProjectConfigAt(target) : null;
         const interactive = isInteractive(args);
         if (existing && !args.force && !interactive) {
           throw new Error(
@@ -18482,9 +18687,9 @@ var init_init = __esm({
 });
 
 // src/commands/configure.ts
-import { homedir as homedir5 } from "os";
-import { existsSync as existsSync7 } from "fs";
-import { join as join9, sep } from "path";
+import { homedir as homedir6 } from "os";
+import { existsSync as existsSync8 } from "fs";
+import { join as join10, sep } from "path";
 async function resolveTools(args) {
   if (args.all) return [...ALL_TOOLS];
   if (args.tool) {
@@ -18545,12 +18750,14 @@ function pathHint(tools, scope) {
   switch (tool) {
     case "claude-code":
       return relativizeHomeAndCwd(claudeSettingsPath(scope));
+    case "cline":
+      return relativizeHomeAndCwd(clineSettingsPath(scope));
     case "opencode":
       return relativizeHomeAndCwd(opencodeSettingsPath(scope));
   }
 }
 function relativizeHomeAndCwd(absolutePath) {
-  const home = homedir5();
+  const home = homedir6();
   const cwd = userCwd();
   if (home && absolutePath.startsWith(`${home}${sep}`)) {
     return `~${absolutePath.slice(home.length)}`;
@@ -18564,7 +18771,7 @@ function isTool(value) {
   return ALL_TOOLS.includes(value);
 }
 function mergeToolsIntoProjectConfig(cwd, tools, gatewayUrl) {
-  const path = join9(cwd, PROJECT_CONFIG_FILENAME);
+  const path = join10(cwd, PROJECT_CONFIG_FILENAME);
   const existing = readProjectConfigAt(path) ?? {};
   const byTool = new Map((existing.tools ?? []).map((c) => [c.tool, c]));
   for (const cfg of tools) byTool.set(cfg.tool, cfg);
@@ -18584,7 +18791,7 @@ async function fetchReachableChatModels2(creds) {
   s.start("Loading reachable models\u2026");
   try {
     const res = await call(parseResponse(client.models.$get()));
-    const models = res.data.filter((m2) => m2.kind === "chat").map((m2) => ({
+    const models = res.data.filter((m2) => m2.kind === "chat" && m2.callable).map((m2) => ({
       slug: m2.slug,
       providerKind: m2.providerKind,
       displayName: m2.displayName,
@@ -18658,12 +18865,14 @@ var init_configure = __esm({
     init_project_config();
     init_shell_hook();
     init_claude_code();
+    init_cline();
     init_opencode();
     WRITERS2 = {
       "claude-code": writeClaudeCodeConfig,
+      cline: writeClineConfig,
       opencode: writeOpencodeConfig
     };
-    ALL_TOOLS = ["claude-code", "opencode"];
+    ALL_TOOLS = ["claude-code", "cline", "opencode"];
     SCOPES = ["local", "project"];
     configureCommand = defineCommand({
       meta: {
@@ -18699,7 +18908,7 @@ var init_configure = __esm({
           );
         }
         const cwd = userCwd();
-        if (process.stdout.isTTY && !existsSync7(join9(cwd, PROJECT_CONFIG_FILENAME))) {
+        if (process.stdout.isTTY && !existsSync8(join10(cwd, PROJECT_CONFIG_FILENAME))) {
           const runInit = unwrap(
             await ue({
               message: `No ${PROJECT_CONFIG_FILENAME} in this repo yet. Run \`codevector init\` first to set it up (project name, ticket pattern, gateway)?`,
@@ -18907,12 +19116,15 @@ var authLoginCommand = defineCommand({
         apiKey,
         gatewayUrl: config2.gatewayPublicUrl,
         userId: me2.user.id,
-        email: me2.user.email
+        email: me2.user.email,
+        ...me2.attributionGroupId ? { groupId: me2.attributionGroupId, groupName: me2.attributionGroupName ?? void 0 } : {}
       });
+      const billingNote = stored.groupName ? `Billing: group "${stored.groupName}"` : "Billing: personal";
       s.stop(`Signed in as ${stored.email} (${profileName})`);
       Se(
         `Gateway: ${stored.gatewayUrl}
 Profile: ${profileName}
+${billingNote}
 Next: run \`codevector configure claude-code\`.`,
         "Credentials saved"
       );
@@ -19074,9 +19286,7 @@ var configSyncCommand = defineCommand({
     ge("codevector sync");
     const found = readProjectConfig(userCwd());
     if (!found) {
-      throw new Error(
-        "No .codevector.json on the path to root. Run `codevector init` first."
-      );
+      throw new Error("No .codevector.json on the path to root. Run `codevector init` first.");
     }
     const { config: config2, path: manifestPath } = found;
     R2.info(`Manifest: ${manifestPath}`);
@@ -19098,7 +19308,7 @@ var configSyncCommand = defineCommand({
         `Active profile "${profiles.activeProfile}" is missing from credentials. Run \`codevector auth login\`.`
       );
     }
-    if (config2.gateway && trimRightSlash4(creds.gatewayUrl) !== trimRightSlash4(config2.gateway)) {
+    if (config2.gateway && trimRightSlash5(creds.gatewayUrl) !== trimRightSlash5(config2.gateway)) {
       R2.warn(
         `Active profile points at ${creds.gatewayUrl} but manifest pins ${config2.gateway}. Sync will use the active profile.`
       );
@@ -19183,7 +19393,7 @@ async function fetchReachableChatModels(creds) {
   s.start("Loading reachable models\u2026");
   try {
     const res = await call(parseResponse(client.models.$get()));
-    const models = res.data.filter((m2) => m2.kind === "chat").map((m2) => ({
+    const models = res.data.filter((m2) => m2.kind === "chat" && m2.callable).map((m2) => ({
       slug: m2.slug,
       providerKind: m2.providerKind,
       displayName: m2.displayName,
@@ -19214,7 +19424,7 @@ async function fetchReachableChatModels(creds) {
     return [];
   }
 }
-function trimRightSlash4(url2) {
+function trimRightSlash5(url2) {
   return url2.endsWith("/") ? url2.slice(0, -1) : url2;
 }
 
@@ -19237,25 +19447,26 @@ init_dist();
 init_dist5();
 init_api_client();
 init_claude_code();
+init_cline();
 init_opencode();
 init_credentials();
-import { existsSync as existsSync9, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync11, rmSync as rmSync2, writeFileSync as writeFileSync9 } from "fs";
+import { join as join13 } from "path";
 
 // src/lib/install-pref.ts
 init_paths();
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync8, realpathSync, renameSync as renameSync3, writeFileSync as writeFileSync6 } from "fs";
-import { join as join10, sep as sep2 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync9, realpathSync, renameSync as renameSync3, writeFileSync as writeFileSync7 } from "fs";
+import { join as join11, sep as sep2 } from "path";
 import { fileURLToPath } from "url";
-var INSTALL_PREF_FILE = join10(CODEVECTOR_CONFIG_DIR, "install.json");
+var INSTALL_PREF_FILE = join11(CODEVECTOR_CONFIG_DIR, "install.json");
 var PACKAGE_MANAGERS = ["npm", "pnpm", "yarn"];
 function isPackageManager(v2) {
   return typeof v2 === "string" && PACKAGE_MANAGERS.includes(v2);
 }
 function readInstallPref() {
-  if (!existsSync8(INSTALL_PREF_FILE)) return void 0;
+  if (!existsSync9(INSTALL_PREF_FILE)) return void 0;
   try {
-    const raw = readFileSync8(INSTALL_PREF_FILE, "utf8");
+    const raw = readFileSync9(INSTALL_PREF_FILE, "utf8");
     const parsed = JSON.parse(raw);
     if (!isPackageManager(parsed.packageManager)) return void 0;
     const source = parsed.source === "user" ? "user" : "auto";
@@ -19269,9 +19480,9 @@ function readInstallPref() {
   }
 }
 function writeInstallPref(pref) {
-  mkdirSync4(CODEVECTOR_CONFIG_DIR, { recursive: true, mode: 448 });
+  mkdirSync5(CODEVECTOR_CONFIG_DIR, { recursive: true, mode: 448 });
   const tmp = `${INSTALL_PREF_FILE}.${process.pid}.tmp`;
-  writeFileSync6(tmp, JSON.stringify(pref, null, 2));
+  writeFileSync7(tmp, JSON.stringify(pref, null, 2));
   renameSync3(tmp, INSTALL_PREF_FILE);
 }
 function packageManagerFromPath(installPath) {
@@ -19314,6 +19525,147 @@ init_project_config();
 init_paths();
 init_shell();
 init_shell_hook();
+
+// src/lib/version-check.ts
+init_api_client();
+
+// src/lib/update-notifier.ts
+init_paths();
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { join as join12 } from "path";
+var PKG_NAME = "@codevector/cli";
+var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
+var CHECK_CACHE_FILE = join12(CODEVECTOR_CONFIG_DIR, "update-check.json");
+var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 2e3;
+function readCache() {
+  if (!existsSync10(CHECK_CACHE_FILE)) return void 0;
+  try {
+    const raw = readFileSync10(CHECK_CACHE_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.checkedAt !== "number") return void 0;
+    return {
+      latest: typeof parsed.latest === "string" ? parsed.latest : null,
+      checkedAt: parsed.checkedAt
+    };
+  } catch {
+    return void 0;
+  }
+}
+function readCachedLatestVersion() {
+  return readCache()?.latest ?? null;
+}
+function writeCache(cache) {
+  try {
+    mkdirSync6(CODEVECTOR_CONFIG_DIR, { recursive: true, mode: 448 });
+    writeFileSync8(CHECK_CACHE_FILE, JSON.stringify(cache));
+  } catch {
+  }
+}
+function isNewer(current, latest) {
+  const a = current.split(".").map((p2) => Number.parseInt(p2, 10));
+  const b2 = latest.split(".").map((p2) => Number.parseInt(p2, 10));
+  for (let i = 0; i < Math.max(a.length, b2.length); i++) {
+    const ai = a[i] ?? 0;
+    const bi = b2[i] ?? 0;
+    if (Number.isNaN(ai) || Number.isNaN(bi)) return latest > current;
+    if (bi > ai) return true;
+    if (bi < ai) return false;
+  }
+  return false;
+}
+function printUpdateNoticeIfCached(currentVersion) {
+  if (process.env.CODEVECTOR_NO_UPDATE_CHECK === "1") return;
+  try {
+    const cache = readCache();
+    if (!cache || !cache.latest) return;
+    if (isNewer(currentVersion, cache.latest)) {
+      process.stderr.write(
+        `\x1B[33m\u203A\x1B[0m A new version of @codevector/cli is available: ${currentVersion} \u2192 ${cache.latest}. Run \`codevector update\` to install.
+`
+      );
+    }
+  } catch {
+  }
+}
+function scheduleUpdateCheck() {
+  if (process.env.CODEVECTOR_NO_UPDATE_CHECK === "1") return;
+  const cache = readCache();
+  const now = Date.now();
+  if (cache && now - cache.checkedAt < CHECK_TTL_MS) return;
+  void fetchLatestVersion().then((latest) => {
+    writeCache({ latest, checkedAt: Date.now() });
+  }).catch(() => {
+    writeCache({ latest: cache?.latest ?? null, checkedAt: Date.now() });
+  });
+}
+async function fetchLatestVersion() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  timer.unref?.();
+  try {
+    const res = await fetch(REGISTRY_URL, {
+      signal: controller.signal,
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return typeof body.version === "string" ? body.version : null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/lib/version-check.ts
+init_package();
+var MIN_SERVER_VERSION = "";
+var IncompatibleVersionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IncompatibleVersionError";
+  }
+};
+function evaluateCompatibility(input) {
+  const { cliVersion, minServerVersion, health } = input;
+  if (health.minCliVersion && isNewer(cliVersion, health.minCliVersion)) {
+    return `This CLI (${cliVersion}) is too old for the gateway, which requires >= ${health.minCliVersion}. Run \`codevector update\` to upgrade.`;
+  }
+  if (minServerVersion) {
+    if (!health.version) {
+      return `This CLI requires a gateway >= ${minServerVersion}, but the gateway is too old to report its version. Ask your admin to upgrade the gateway.`;
+    }
+    if (isNewer(health.version, minServerVersion)) {
+      return `This CLI requires a gateway >= ${minServerVersion}, but the gateway is ${health.version}. Ask your admin to upgrade the gateway.`;
+    }
+  }
+  return null;
+}
+async function fetchHealthVersion(baseUrl) {
+  try {
+    const res = await healthClient(baseUrl).$get();
+    if (!res.ok) return null;
+    const body = await res.json();
+    return {
+      version: typeof body.version === "string" ? body.version : void 0,
+      minCliVersion: typeof body.minCliVersion === "string" ? body.minCliVersion : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+async function checkServerCompatibility(baseUrl) {
+  const health = await fetchHealthVersion(baseUrl);
+  if (!health) return void 0;
+  const problem = evaluateCompatibility({
+    cliVersion: package_default.version,
+    minServerVersion: MIN_SERVER_VERSION,
+    health
+  });
+  if (problem) throw new IncompatibleVersionError(problem);
+  return health.version;
+}
+
+// src/commands/doctor.ts
 var CLAUDE_SCOPE_ORDER = ["local", "project", "user"];
 var doctorCommand = defineCommand({
   meta: {
@@ -19335,6 +19687,21 @@ var doctorCommand = defineCommand({
         label: "credentials",
         detail: `${creds.email} @ ${creds.gatewayUrl} (${maskApiKey(creds.apiKey)})`
       });
+      checks.push({
+        level: "ok",
+        label: "billing",
+        detail: creds.groupName ? `group "${creds.groupName}"` : "personal"
+      });
+      const pinned = readProjectConfig(userCwd())?.config.groups ?? [];
+      if (pinned.length > 0) {
+        const activeGroup = creds.groupName ?? null;
+        const matches = activeGroup != null && pinned.includes(activeGroup);
+        checks.push({
+          level: matches ? "ok" : "warn",
+          label: "repo group binding",
+          detail: matches ? `active key bills "${activeGroup}" (pinned: ${pinned.join(", ")})` : `pinned ${pinned.join(", ")} but active key bills ${activeGroup ?? "personal"} \u2014 run \`codevector use\``
+        });
+      }
       if (process.platform !== "win32") {
         checks.push(
           credentialsFileModeOk() ? { level: "ok", label: "credentials permissions", detail: "chmod 600" } : {
@@ -19360,6 +19727,22 @@ var doctorCommand = defineCommand({
         const message = err instanceof ApiClientError ? `${err.code}: ${err.message}` : String(err);
         checks.push({ level: "fail", label: "gateway /me", detail: message });
       }
+      try {
+        const serverVersion = await checkServerCompatibility(creds.gatewayUrl);
+        checks.push(
+          serverVersion ? { level: "ok", label: "gateway version", detail: serverVersion } : {
+            level: "warn",
+            label: "gateway version",
+            detail: "gateway did not report a version \u2014 it predates version reporting"
+          }
+        );
+      } catch (err) {
+        checks.push({
+          level: "fail",
+          label: "gateway version",
+          detail: err instanceof Error ? err.message : String(err)
+        });
+      }
     }
     checks.push(inspectClaudeSettings());
     checks.push(inspectShellHook());
@@ -19391,9 +19774,9 @@ function inspectUpdateManager() {
 function inspectClaudeSettings() {
   for (const scope of CLAUDE_SCOPE_ORDER) {
     const path = claudeSettingsPath(scope);
-    if (!existsSync9(path)) continue;
+    if (!existsSync11(path)) continue;
     try {
-      const raw = JSON.parse(readFileSync9(path, "utf8"));
+      const raw = JSON.parse(readFileSync11(path, "utf8"));
       if (typeof raw.env?.ANTHROPIC_BASE_URL === "string") {
         return {
           level: "ok",
@@ -19461,7 +19844,7 @@ function inspectManifestDrift() {
       });
       continue;
     }
-    if (!existsSync9(path)) {
+    if (!existsSync11(path)) {
       checks.push({
         level: "fail",
         label: `manifest drift: ${tool.tool}`,
@@ -19471,7 +19854,7 @@ function inspectManifestDrift() {
     }
     let raw;
     try {
-      raw = readFileSync9(path, "utf8");
+      raw = readFileSync11(path, "utf8");
     } catch (err) {
       checks.push({
         level: "fail",
@@ -19501,7 +19884,7 @@ function pruneAcceptanceHook() {
   const cleaned = [];
   for (const scope of CLAUDE_SCOPE_ORDER) {
     const path = claudeSettingsPath(scope);
-    if (!existsSync9(path)) continue;
+    if (!existsSync11(path)) continue;
     try {
       if (removeAcceptanceHookFromSettings(path)) cleaned.push(scope);
     } catch {
@@ -19514,8 +19897,8 @@ function pruneAcceptanceHook() {
       detail: `cleared stale hook from claude-code settings [${cleaned.join(", ")}]`
     });
   }
-  const legacyHooksDir = join11(CODEVECTOR_CONFIG_DIR, "hooks");
-  if (existsSync9(legacyHooksDir)) {
+  const legacyHooksDir = join13(CODEVECTOR_CONFIG_DIR, "hooks");
+  if (existsSync11(legacyHooksDir)) {
     try {
       rmSync2(legacyHooksDir, { recursive: true, force: true });
       checks.push({
@@ -19529,7 +19912,7 @@ function pruneAcceptanceHook() {
   return checks;
 }
 function removeAcceptanceHookFromSettings(path) {
-  const parsed = JSON.parse(readFileSync9(path, "utf8"));
+  const parsed = JSON.parse(readFileSync11(path, "utf8"));
   const hooks = parsed.hooks;
   if (!isPlainObject3(hooks)) return false;
   let mutated = false;
@@ -19543,7 +19926,7 @@ function removeAcceptanceHookFromSettings(path) {
     else hooks[event] = entries;
   }
   if (Object.keys(hooks).length === 0) delete parsed.hooks;
-  if (mutated) writeFileSync7(path, `${JSON.stringify(parsed, null, 2)}
+  if (mutated) writeFileSync9(path, `${JSON.stringify(parsed, null, 2)}
 `);
   return mutated;
 }
@@ -19584,6 +19967,8 @@ function manifestToolPath(tool, scope) {
   switch (tool) {
     case "claude-code":
       return claudeSettingsPath(scope);
+    case "cline":
+      return clineSettingsPath(scope);
     case "opencode":
       return opencodeSettingsPath(scope);
     default:
@@ -19611,7 +19996,7 @@ init_credentials();
 init_paths();
 init_project_config();
 init_shell();
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 var envCommand = defineCommand({
   meta: {
     name: "env",
@@ -19629,7 +20014,7 @@ var envCommand = defineCommand({
     const cwd = userCwd();
     const previousDir = process.env.CODEVECTOR_ACTIVE_DIR ?? null;
     const found = readProjectConfig(cwd);
-    const repoDir = found?.path ? dirname5(found.path) : null;
+    const repoDir = found?.path ? dirname6(found.path) : null;
     const gateway = found?.config.gateway ?? null;
     const projectName = found?.config.projectName ?? null;
     const lines = [];
@@ -19638,16 +20023,25 @@ var envCommand = defineCommand({
       process.stdout.write(lines.join("\n") + (lines.length > 0 ? "\n" : ""));
       return;
     }
-    if (previousDir === repoDir) {
-      return;
-    }
     const profiles = await readProfiles();
-    const match = pickProfileForGateway(
+    const repoGroups = found?.config.groups ?? null;
+    const resolution = resolveProfileForRepo(
       profiles?.profiles ?? {},
       profiles?.activeProfile ?? null,
-      gateway
+      gateway,
+      repoGroups
     );
-    if (!match) {
+    if (resolution.kind === "no-group-key") {
+      if (previousDir) emitDeactivate(lines, shell, previousDir);
+      emitEcho(
+        lines,
+        shell,
+        `codevector: this repo bills group(s) "${resolution.groups.join(", ")}" but you have no key for any. Run \`codevector sync\` or \`codevector use\`.`
+      );
+      process.stdout.write(lines.join("\n") + "\n");
+      return;
+    }
+    if (resolution.kind === "none") {
       if (previousDir) emitDeactivate(lines, shell, previousDir);
       emitEcho(
         lines,
@@ -19657,12 +20051,26 @@ var envCommand = defineCommand({
       process.stdout.write(lines.join("\n") + "\n");
       return;
     }
-    const { name: profileName, profile } = match;
+    const { name: profileName, profile } = resolution;
+    const previousProfile = process.env.CODEVECTOR_ACTIVE_PROFILE ?? null;
+    if (!shouldReexport(previousDir, repoDir, previousProfile, profileName)) {
+      return;
+    }
     const headers = buildAnthropicCustomHeaders(projectName);
-    emitExport(lines, shell, "ANTHROPIC_BASE_URL", `${trimRightSlash5(profile.gatewayUrl)}/gateway/anthropic`);
+    emitExport(
+      lines,
+      shell,
+      "ANTHROPIC_BASE_URL",
+      `${trimRightSlash6(profile.gatewayUrl)}/gateway/anthropic`
+    );
     emitExport(lines, shell, "ANTHROPIC_API_KEY", profile.apiKey);
     if (headers) emitExport(lines, shell, "ANTHROPIC_CUSTOM_HEADERS", headers);
-    emitExport(lines, shell, "OPENAI_BASE_URL", `${trimRightSlash5(profile.gatewayUrl)}/gateway/openai/v1`);
+    emitExport(
+      lines,
+      shell,
+      "OPENAI_BASE_URL",
+      `${trimRightSlash6(profile.gatewayUrl)}/gateway/openai/v1`
+    );
     emitExport(lines, shell, "OPENAI_API_KEY", profile.apiKey);
     emitExport(lines, shell, "CODEVECTOR_ACTIVE_DIR", repoDir);
     emitExport(lines, shell, "CODEVECTOR_ACTIVE_PROFILE", profileName);
@@ -19670,11 +20078,14 @@ var envCommand = defineCommand({
     emitEcho(
       lines,
       shell,
-      `codevector: ${profileName} -> ${trimRightSlash5(profile.gatewayUrl)}${projectSuffix}`
+      `codevector: ${profileName} -> ${trimRightSlash6(profile.gatewayUrl)}${projectSuffix}`
     );
     process.stdout.write(lines.join("\n") + "\n");
   }
 });
+function shouldReexport(previousDir, repoDir, previousProfile, pickedProfile) {
+  return !(previousDir === repoDir && previousProfile === pickedProfile);
+}
 function resolveShell(raw) {
   if (!raw) return detectShell() ?? "bash";
   if (!SHELLS.includes(raw)) {
@@ -19728,7 +20139,7 @@ function quoteForShell(shell, value) {
   }
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-function trimRightSlash5(url2) {
+function trimRightSlash6(url2) {
   return url2.endsWith("/") ? url2.slice(0, -1) : url2;
 }
 function buildAnthropicCustomHeaders(projectName) {
@@ -19737,19 +20148,24 @@ function buildAnthropicCustomHeaders(projectName) {
   if (!safe) return null;
   return `x-project: ${safe}`;
 }
-function pickProfileForGateway(profiles, activeProfile, gateway) {
-  const target = trimRightSlash5(gateway);
-  const matches = Object.entries(profiles).filter(
-    ([, p2]) => trimRightSlash5(p2.gatewayUrl) === target
+function resolveProfileForRepo(profiles, activeProfile, gateway, repoGroups) {
+  const target = trimRightSlash6(gateway);
+  const gatewayMatches = Object.entries(profiles).filter(
+    ([, p2]) => trimRightSlash6(p2.gatewayUrl) === target
   );
-  if (matches.length === 0) return null;
+  if (gatewayMatches.length === 0) return { kind: "none" };
+  const groups = repoGroups?.filter((g) => g.length > 0) ?? [];
+  const pool = groups.length === 0 ? gatewayMatches : gatewayMatches.filter(([, p2]) => p2.groupName != null && groups.includes(p2.groupName));
+  if (pool.length === 0) return { kind: "no-group-key", groups };
+  const picked = preferActive(pool, activeProfile);
+  return { kind: "match", name: picked[0], profile: picked[1] };
+}
+function preferActive(pool, activeProfile) {
   if (activeProfile) {
-    const active = matches.find(([name]) => name === activeProfile);
-    if (active) return { name: active[0], profile: active[1] };
+    const active = pool.find(([name]) => name === activeProfile);
+    if (active) return active;
   }
-  const sorted = [...matches].sort((a, b2) => a[0].localeCompare(b2[0]));
-  const picked = sorted[0];
-  return { name: picked[0], profile: picked[1] };
+  return [...pool].sort((a, b2) => a[0].localeCompare(b2[0]))[0];
 }
 
 // src/commands/github/index.ts
@@ -19762,46 +20178,42 @@ init_api_client();
 init_credentials();
 init_paths();
 init_prompt();
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10 } from "fs";
+import { join as join14 } from "path";
 
 // src/commands/github/workflow-yaml.ts
 function generateWorkflowYaml(opts) {
   const baseUrl = opts.gatewayUrl.replace(/\/$/, "");
   const sanitized = { ...opts, gatewayUrl: baseUrl };
-  return sanitized.tool === "claude-code" ? claudeCodeWorkflow(sanitized) : opencodeWorkflow(sanitized);
+  switch (sanitized.tool) {
+    case "claude-code":
+      return claudeCodeWorkflow(sanitized);
+    case "cline":
+      return clineWorkflow(sanitized);
+    case "opencode":
+      return opencodeWorkflow(sanitized);
+  }
+}
+function prNumberExpr() {
+  return "${{ github.event.pull_request.number || github.event.issue.number }}";
+}
+function baseRefExpr() {
+  return "${{ github.base_ref }}";
 }
 function claudeCodeWorkflow(opts) {
-  const modelEnv = opts.model ? `          ANTHROPIC_MODEL: ${opts.model}
-` : "";
-  return [
-    `# Generated by codevector github init. Do not edit manually.`,
-    `# Routes all PR review requests through the CodeVector gateway.`,
-    `name: CodeVector PR Review (Claude Code)`,
-    ``,
-    `on:`,
-    `  pull_request:`,
-    `    types: [opened, synchronize]`,
-    `  issue_comment:`,
-    `    types: [created]`,
-    `  pull_request_review_comment:`,
-    `    types: [created]`,
-    ``,
-    `concurrency:`,
-    `  group: codevector-pr-review-claude-code-\${{ github.event.pull_request.number || github.event.issue.number }}`,
-    `  cancel-in-progress: true`,
-    ``,
-    `permissions:`,
-    `  contents: read`,
-    `  pull-requests: write`,
-    ``,
-    `jobs:`,
+  const modelEnv = `          ANTHROPIC_MODEL: ${opts.model || "claude-sonnet-4-6"}
+`;
+  const concurrencyGroup = `codevector-pr-review-claude-code-${prNumberExpr()}`;
+  const reviewJob = [
     `  review:`,
     `    if: |`,
     `      github.event_name == 'pull_request' ||`,
     `      (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@claude')) ||`,
     `      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude'))`,
     `    runs-on: ubuntu-latest`,
+    `    concurrency:`,
+    `      group: ${concurrencyGroup}`,
+    `      cancel-in-progress: true`,
     `    steps:`,
     `      - uses: actions/checkout@v4`,
     `      - uses: actions/setup-node@v4`,
@@ -19816,14 +20228,153 @@ function claudeCodeWorkflow(opts) {
     `        run: |`,
     `          claude --dangerously-skip-permissions -p "Review this PR and provide concise, actionable feedback. Focus on bugs, security issues, and code quality." \\`,
     `            --output-format text \\`,
-    `            --allowedTools "Bash(git diff origin/\${{ github.base_ref }}...HEAD),Bash(git log origin/\${{ github.base_ref }}..HEAD),Read" \\`,
+    `            --allowedTools "Bash(git diff origin/${baseRefExpr()}...HEAD),Bash(git log origin/${baseRefExpr()}..HEAD),Read" \\`,
     `            > review.md`,
     `      - name: Post review comment`,
     `        env:`,
     `          GH_TOKEN: \${{ github.token }}`,
     `        run: |`,
-    `          gh pr comment \${{ github.event.pull_request.number || github.event.issue.number }} --body-file review.md`
-  ].join("\n").trimEnd() + "\n";
+    `          gh pr comment ${prNumberExpr()} --body-file review.md`
+  ].join("\n");
+  const skillJobs = (opts.skills ?? []).map(
+    (name) => claudeCodeSkillJob(opts, name)
+  );
+  return workflowHeader("Claude Code", [reviewJob, ...skillJobs]);
+}
+function claudeCodeSkillJob(opts, skillName) {
+  const outputFile = `skill-${skillName}.md`;
+  const modelEnv = `          ANTHROPIC_MODEL: ${opts.model || "claude-sonnet-4-6"}
+`;
+  return [
+    `  skill-${skillName}:`,
+    `    if: |`,
+    `      github.event_name == 'pull_request' ||`,
+    `      (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@skill:${skillName}')) ||`,
+    `      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@skill:${skillName}'))`,
+    `    runs-on: ubuntu-latest`,
+    `    concurrency:`,
+    `      group: codevector-skill-${skillName}-${prNumberExpr()}`,
+    `      cancel-in-progress: true`,
+    `    steps:`,
+    `      - uses: actions/checkout@v4`,
+    `      - uses: actions/setup-node@v4`,
+    `        with:`,
+    `          node-version: '24'`,
+    `      - run: npm install -g @anthropic-ai/claude-code @codevector/cli`,
+    `      - name: Authenticate with CodeVector`,
+    `        env:`,
+    `          CODEVECTOR_API_KEY: \${{ secrets.${opts.secretName} }}`,
+    `        run: |`,
+    `          codevector auth login \\`,
+    `            --gateway-url ${opts.gatewayUrl} \\`,
+    `            --api-key "$CODEVECTOR_API_KEY" \\`,
+    `            --profile ci`,
+    `      - name: Sync skill pack`,
+    `        run: codevector skills sync ${skillName}`,
+    `      - name: Review PR with skill`,
+    `        env:`,
+    `          ANTHROPIC_API_KEY: \${{ secrets.${opts.secretName} }}`,
+    `          ANTHROPIC_BASE_URL: ${opts.gatewayUrl}/gateway/anthropic`,
+    `${modelEnv}`,
+    `        run: |`,
+    `          claude --dangerously-skip-permissions -p "Review this PR using the ${skillName} skill. Write your findings to ${outputFile}." \\`,
+    `            --output-format text \\`,
+    `            --allowedTools "Bash(git diff origin/${baseRefExpr()}...HEAD),Bash(git log origin/${baseRefExpr()}..HEAD),Read" \\`,
+    `            > ${outputFile}`,
+    `      - name: Post review comment`,
+    `        env:`,
+    `          GH_TOKEN: \${{ github.token }}`,
+    `        run: |`,
+    `          gh pr comment ${prNumberExpr()} --body-file ${outputFile}`
+  ].join("\n");
+}
+function clineWorkflow(opts) {
+  const modelFlag = opts.model ? ` --modelid "${opts.model}"` : "";
+  const concurrencyGroup = `codevector-pr-review-cline-${prNumberExpr()}`;
+  const reviewJob = [
+    `  review:`,
+    `    if: |`,
+    `      github.event_name == 'pull_request' ||`,
+    `      (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@cline')) ||`,
+    `      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@cline'))`,
+    `    runs-on: ubuntu-latest`,
+    `    concurrency:`,
+    `      group: ${concurrencyGroup}`,
+    `      cancel-in-progress: true`,
+    `    steps:`,
+    `      - uses: actions/checkout@v4`,
+    `      - uses: actions/setup-node@v4`,
+    `        with:`,
+    `          node-version: '24'`,
+    `      - run: npm install -g cline`,
+    `      - name: Configure Cline auth`,
+    `        run: |`,
+    `          cline auth --provider openai-compatible --apikey "\${{ secrets.${opts.secretName} }}" --baseurl "${opts.gatewayUrl}/gateway/openai/v1"${modelFlag}`,
+    `      - name: Review PR`,
+    `        env:`,
+    `          GH_TOKEN: \${{ github.token }}`,
+    `          CLINE_COMMAND_PERMISSIONS: |`,
+    `            {`,
+    `              "allow": ["gh pr diff *", "gh pr view *", "git log *"],`,
+    `              "deny": ["rm -rf *", "sudo *"]`,
+    `            }`,
+    `        run: |`,
+    `          cline --auto-approve true "Review this PR. Fetch the diff with \`gh pr diff \${{ github.event.pull_request.number }}\`, analyze the changes, and post a single comprehensive review comment using \`gh pr comment\`."`
+  ].join("\n");
+  const skillJobs = (opts.skills ?? []).map(
+    (name) => clineSkillJob(opts, name)
+  );
+  return workflowHeader("Cline", [reviewJob, ...skillJobs]);
+}
+function clineSkillJob(opts, skillName) {
+  const modelFlag = opts.model ? ` --modelid "${opts.model}"` : "";
+  const outputFile = `skill-${skillName}.md`;
+  return [
+    `  skill-${skillName}:`,
+    `    if: |`,
+    `      github.event_name == 'pull_request' ||`,
+    `      (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@skill:${skillName}')) ||`,
+    `      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@skill:${skillName}'))`,
+    `    runs-on: ubuntu-latest`,
+    `    concurrency:`,
+    `      group: codevector-skill-${skillName}-${prNumberExpr()}`,
+    `      cancel-in-progress: true`,
+    `    steps:`,
+    `      - uses: actions/checkout@v4`,
+    `      - uses: actions/setup-node@v4`,
+    `        with:`,
+    `          node-version: '24'`,
+    `      - run: npm install -g cline @codevector/cli`,
+    `      - name: Authenticate with CodeVector`,
+    `        env:`,
+    `          CODEVECTOR_API_KEY: \${{ secrets.${opts.secretName} }}`,
+    `        run: |`,
+    `          codevector auth login \\`,
+    `            --gateway-url ${opts.gatewayUrl} \\`,
+    `            --api-key "$CODEVECTOR_API_KEY" \\`,
+    `            --profile ci`,
+    `      - name: Sync skill pack`,
+    `        run: codevector skills sync ${skillName}`,
+    `      - name: Configure Cline auth`,
+    `        run: |`,
+    `          cline auth --provider openai-compatible --apikey "\${{ secrets.${opts.secretName} }}" --baseurl "${opts.gatewayUrl}/gateway/openai/v1"${modelFlag}`,
+    `      - name: Review PR with skill`,
+    `        env:`,
+    `          GH_TOKEN: \${{ github.token }}`,
+    `          CLINE_COMMAND_PERMISSIONS: |`,
+    `            {`,
+    `              "allow": ["gh pr diff *", "gh pr view *", "git log *"],`,
+    `              "deny": ["rm -rf *", "sudo *"]`,
+    `            }`,
+    `        run: |`,
+    `          cline --auto-approve true "Review this PR using the ${skillName} skill. Write your findings to ${outputFile}." \\`,
+    `            > ${outputFile}`,
+    `      - name: Post review comment`,
+    `        env:`,
+    `          GH_TOKEN: \${{ github.token }}`,
+    `        run: |`,
+    `          gh pr comment ${prNumberExpr()} --body-file ${outputFile}`
+  ].join("\n");
 }
 function opencodeModelEntryLines(model) {
   const name = model.split("-").map((w3) => w3.charAt(0).toUpperCase() + w3.slice(1)).join(" ");
@@ -19837,34 +20388,17 @@ function opencodeModelEntryLines(model) {
 }
 function opencodeWorkflow(opts) {
   const model = opts.model || "deepseek-pro";
-  return [
-    `# Generated by codevector github init. Do not edit manually.`,
-    `# Routes all PR review requests through the CodeVector gateway via OpenCode CLI.`,
-    `name: CodeVector PR Review (OpenCode)`,
-    ``,
-    `on:`,
-    `  pull_request:`,
-    `    types: [opened, synchronize]`,
-    `  issue_comment:`,
-    `    types: [created]`,
-    `  pull_request_review_comment:`,
-    `    types: [created]`,
-    ``,
-    `concurrency:`,
-    `  group: codevector-pr-review-opencode-\${{ github.event.pull_request.number || github.event.issue.number }}`,
-    `  cancel-in-progress: true`,
-    ``,
-    `permissions:`,
-    `  contents: read`,
-    `  pull-requests: write`,
-    ``,
-    `jobs:`,
+  const concurrencyGroup = `codevector-pr-review-opencode-${prNumberExpr()}`;
+  const reviewJob = [
     `  review:`,
     `    if: |`,
     `      github.event_name == 'pull_request' ||`,
     `      (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@opencode')) ||`,
     `      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@opencode'))`,
     `    runs-on: ubuntu-latest`,
+    `    concurrency:`,
+    `      group: ${concurrencyGroup}`,
+    `      cancel-in-progress: true`,
     `    steps:`,
     `      - uses: actions/checkout@v4`,
     `      - name: Install OpenCode CLI`,
@@ -19894,7 +20428,7 @@ function opencodeWorkflow(opts) {
     `        env:`,
     `          GH_TOKEN: \${{ github.token }}`,
     `        run: |`,
-    `          PR_NUMBER=\${{ github.event.pull_request.number || github.event.issue.number }}`,
+    `          PR_NUMBER=${prNumberExpr()}`,
     `          gh pr diff $PR_NUMBER > pr_diff.txt`,
     `      - name: Fetch AI Review`,
     `        env:`,
@@ -19910,15 +20444,114 @@ function opencodeWorkflow(opts) {
     `        env:`,
     `          GH_TOKEN: \${{ github.token }}`,
     `        run: |`,
-    `          PR_NUMBER=\${{ github.event.pull_request.number || github.event.issue.number }}`,
+    `          PR_NUMBER=${prNumberExpr()}`,
     `          gh pr comment $PR_NUMBER --body-file review.md`
+  ].join("\n");
+  const skillJobs = (opts.skills ?? []).map(
+    (name) => opencodeSkillJob(opts, name, model)
+  );
+  return workflowHeader("OpenCode", [reviewJob, ...skillJobs]);
+}
+function opencodeSkillJob(opts, skillName, model) {
+  const outputFile = `skill-${skillName}.md`;
+  return [
+    `  skill-${skillName}:`,
+    `    if: |`,
+    `      github.event_name == 'pull_request' ||`,
+    `      (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@skill:${skillName}')) ||`,
+    `      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@skill:${skillName}'))`,
+    `    runs-on: ubuntu-latest`,
+    `    concurrency:`,
+    `      group: codevector-skill-${skillName}-${prNumberExpr()}`,
+    `      cancel-in-progress: true`,
+    `    steps:`,
+    `      - uses: actions/checkout@v4`,
+    `      - name: Install OpenCode CLI`,
+    `        run: curl -fsSL https://opencode.ai/install | bash`,
+    `      - run: npm install -g @codevector/cli`,
+    `      - name: Authenticate with CodeVector`,
+    `        env:`,
+    `          CODEVECTOR_API_KEY: \${{ secrets.${opts.secretName} }}`,
+    `        run: |`,
+    `          codevector auth login \\`,
+    `            --gateway-url ${opts.gatewayUrl} \\`,
+    `            --api-key "$CODEVECTOR_API_KEY" \\`,
+    `            --profile ci`,
+    `      - name: Sync skill pack`,
+    `        run: codevector skills sync ${skillName}`,
+    `      - name: Configure OpenCode`,
+    `        run: |`,
+    `          cat > opencode.json << 'OPEOF'`,
+    `          {`,
+    `            "$schema": "https://opencode.ai/config.json",`,
+    `            "provider": {`,
+    `              "codevector": {`,
+    `                "options": {`,
+    `                  "apiKey": "{env:CODEVECTOR_API_KEY}",`,
+    `                  "baseURL": "${opts.gatewayUrl}/gateway/openai/v1",`,
+    `                  "headers": {`,
+    `                    "x-client-app": "opencode",`,
+    `                    "x-project": "codevector"`,
+    `                  }`,
+    `                },`,
+    ...opencodeModelEntryLines(model),
+    `              }`,
+    `            },`,
+    `            "model": "codevector/${model}"`,
+    `          }`,
+    `          OPEOF`,
+    `      - name: Generate PR Diff`,
+    `        env:`,
+    `          GH_TOKEN: \${{ github.token }}`,
+    `        run: |`,
+    `          PR_NUMBER=${prNumberExpr()}`,
+    `          gh pr diff $PR_NUMBER > pr_diff.txt`,
+    `      - name: Fetch AI Review with skill`,
+    `        env:`,
+    `          CODEVECTOR_API_KEY: \${{ secrets.${opts.secretName} }}`,
+    `        run: |`,
+    `          export PATH="$HOME/.opencode/bin:$PATH"`,
+    `          opencode run --model codevector/${model} \\`,
+    `            --dangerously-skip-permissions \\`,
+    `            "Review this PR using the ${skillName} skill. Write your findings to ${outputFile}." \\`,
+    `            -f pr_diff.txt \\`,
+    `            > ${outputFile}`,
+    `      - name: Post review comment`,
+    `        env:`,
+    `          GH_TOKEN: \${{ github.token }}`,
+    `        run: |`,
+    `          PR_NUMBER=${prNumberExpr()}`,
+    `          gh pr comment $PR_NUMBER --body-file ${outputFile}`
+  ].join("\n");
+}
+function workflowHeader(toolLabel, jobs) {
+  return [
+    `# Generated by codevector github init. Do not edit manually.`,
+    `# Routes all PR review requests through the CodeVector gateway.`,
+    `name: CodeVector PR Review (${toolLabel})`,
+    ``,
+    `on:`,
+    `  pull_request:`,
+    `    types: [opened, synchronize]`,
+    `  issue_comment:`,
+    `    types: [created]`,
+    `  pull_request_review_comment:`,
+    `    types: [created]`,
+    ``,
+    `permissions:`,
+    `  contents: read`,
+    `  pull-requests: write`,
+    ``,
+    `jobs:`,
+    ...jobs
   ].join("\n").trimEnd() + "\n";
 }
 
 // src/commands/github/init.ts
-var ALL_TOOLS2 = ["claude-code", "opencode"];
+var ALL_TOOLS2 = ["claude-code", "cline", "opencode"];
 var WORKFLOW_FILENAMES = {
   "claude-code": "codevector-pr-review-claude-code.yml",
+  cline: "codevector-pr-review-cline.yml",
   opencode: "codevector-pr-review-opencode.yml"
 };
 var githubInitCommand = defineCommand({
@@ -19929,8 +20562,8 @@ var githubInitCommand = defineCommand({
   args: {
     tool: {
       type: "string",
-      description: "Tool: claude-code or opencode. Prompted if omitted.",
-      valueHint: "claude-code|opencode"
+      description: "Tool: claude-code, cline, or opencode. Prompted if omitted.",
+      valueHint: "claude-code|cline|opencode"
     },
     model: {
       type: "string",
@@ -19954,6 +20587,10 @@ var githubInitCommand = defineCommand({
       type: "boolean",
       default: false,
       description: "Print the workflow to stdout instead of writing to disk."
+    },
+    skills: {
+      type: "string",
+      description: "Comma-separated list of skill pack names to generate CI jobs for."
     }
   },
   async run({ args }) {
@@ -19964,11 +20601,13 @@ var githubInitCommand = defineCommand({
     const tool = await resolveTool(args, interactive);
     const model = await resolveModel(args, tool, gatewayUrl, profile, interactive);
     const secretName = args["secret-name"] ?? "CODEVECTOR_API_KEY";
+    const skills = args.skills ? args.skills.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
     const yaml = generateWorkflowYaml({
       tool,
       gatewayUrl: gatewayUrl.replace(/\/$/, ""),
       secretName,
-      ...model ? { model } : {}
+      ...model ? { model } : {},
+      ...skills ? { skills } : {}
     });
     if (args["dry-run"]) {
       process.stdout.write(yaml);
@@ -19982,9 +20621,9 @@ var githubInitCommand = defineCommand({
       return;
     }
     const cwd = userCwd();
-    const workflowsDir = join12(cwd, ".github", "workflows");
-    const filePath = join12(workflowsDir, WORKFLOW_FILENAMES[tool]);
-    if (existsSync10(filePath) && !args.force) {
+    const workflowsDir = join14(cwd, ".github", "workflows");
+    const filePath = join14(workflowsDir, WORKFLOW_FILENAMES[tool]);
+    if (existsSync12(filePath) && !args.force) {
       if (!interactive) {
         throw new Error(
           `${filePath} already exists. Pass --force to overwrite.`
@@ -20001,8 +20640,8 @@ var githubInitCommand = defineCommand({
         return;
       }
     }
-    mkdirSync5(workflowsDir, { recursive: true });
-    writeFileSync8(filePath, yaml, { mode: 420 });
+    mkdirSync7(workflowsDir, { recursive: true });
+    writeFileSync10(filePath, yaml, { mode: 420 });
     if (interactive) {
       R2.success(`Wrote ${filePath}`);
       Se(
@@ -20018,7 +20657,7 @@ var githubInitCommand = defineCommand({
 });
 function isInteractive2(args) {
   if (!process.stdout.isTTY) return false;
-  return !args.tool || !args["gateway-url"];
+  return !args.tool || !args["gateway-url"] || !args.model;
 }
 function resolveGatewayUrl(args, profile, interactive) {
   if (args["gateway-url"]) {
@@ -20057,14 +20696,17 @@ async function resolveTool(args, interactive) {
       message: "Which tool should the workflow use for PR review?",
       options: [
         { value: "claude-code", label: "Claude Code", hint: "uses the @anthropic-ai/claude-code CLI" },
+        { value: "cline", label: "Cline", hint: "uses the cline CLI (npm i -g cline)" },
         { value: "opencode", label: "OpenCode", hint: "uses the OpenCode CLI" }
       ],
       initialValue: "claude-code"
     })
   );
 }
-async function resolveModel(args, _tool, gatewayUrl, profile, interactive) {
+async function resolveModel(args, tool, gatewayUrl, profile, interactive) {
   if (args.model) return args.model;
+  const configuredModel = profile?.toolConfigs?.find((c) => c.tool === tool)?.modelSlug;
+  if (configuredModel) return configuredModel;
   if (!interactive) return void 0;
   const models = profile ? await fetchReachableChatModels3(gatewayUrl, profile.apiKey) : [];
   if (models.length === 0) {
@@ -20094,7 +20736,7 @@ async function fetchReachableChatModels3(gatewayUrl, apiKey) {
   s.start("Loading reachable models\u2026");
   try {
     const res = await call(parseResponse(client.models.$get()));
-    const models = res.data.filter((m2) => m2.kind === "chat").map((m2) => ({
+    const models = res.data.filter((m2) => m2.kind === "chat" && m2.callable).map((m2) => ({
       slug: m2.slug,
       providerKind: m2.providerKind,
       displayName: m2.displayName
@@ -20124,6 +20766,82 @@ var githubCommand = defineCommand({
   }
 });
 
+// src/commands/groups.ts
+init_dist();
+init_dist5();
+init_api_client();
+init_credentials();
+
+// src/lib/table.ts
+function renderTable(headers, rows) {
+  const widths = headers.map(
+    (h2, i) => Math.max(h2.length, ...rows.map((row) => (row[i] ?? "").length))
+  );
+  const pad = (s, i) => s.padEnd(widths[i] ?? 0);
+  const divider = widths.map((w3) => "\u2500".repeat(w3)).join("  ");
+  return [headers.map(pad).join("  "), divider, ...rows.map((row) => row.map(pad).join("  "))].join(
+    "\n"
+  );
+}
+
+// src/commands/groups.ts
+var groupsListCommand = defineCommand({
+  meta: {
+    name: "list",
+    description: "List groups you can mint a key for."
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Emit raw JSON (for scripting)."
+    }
+  },
+  async run({ args }) {
+    const active = await getActiveProfile();
+    if (!active) {
+      R2.warn("Not signed in. Run `codevector auth login` to get started.");
+      process.exitCode = 1;
+      return;
+    }
+    const client = gatewayClient(active.gatewayUrl, active.apiKey, 1e4);
+    const s = args.json ? null : ft();
+    s?.start("Loading groups\u2026");
+    try {
+      const res = await call(parseResponse(client.groups.$get()));
+      s?.stop(`${res.data.length} group${res.data.length === 1 ? "" : "s"}`);
+      if (args.json) {
+        process.stdout.write(`${JSON.stringify(res.data, null, 2)}
+`);
+        return;
+      }
+      if (res.data.length === 0) {
+        R2.info("You are not a member of any groups. Ask an admin to add you.");
+        return;
+      }
+      Se(
+        renderTable(
+          ["NAME", "ID"],
+          res.data.map((g) => [g.name, g.id])
+        ),
+        "Your groups"
+      );
+    } catch (err) {
+      s?.stop("Could not load groups");
+      R2.error(err instanceof ApiClientError ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  }
+});
+var groupsCommand = defineCommand({
+  meta: {
+    name: "groups",
+    description: "List the groups you can mint keys for."
+  },
+  subCommands: {
+    list: groupsListCommand
+  }
+});
+
 // src/commands/hook.ts
 init_dist();
 init_shell();
@@ -20228,23 +20946,132 @@ if (-not $global:_CODEVECTOR_PROMPT_WRAPPED) {
 // src/index.ts
 init_init();
 
-// src/commands/models.ts
+// src/commands/keys.ts
 init_dist();
 init_dist5();
 init_api_client();
 init_credentials();
+var sortProfileNames = (names) => names.sort((a, b2) => {
+  if (a === "default") return -1;
+  if (b2 === "default") return 1;
+  return a.localeCompare(b2);
+});
+var keysCreateCommand = defineCommand({
+  meta: {
+    name: "create",
+    description: "Mint a group-scoped key and save it as a profile."
+  },
+  args: {
+    group: {
+      type: "string",
+      description: "Name of the group to bill (you must be a member).",
+      required: true
+    },
+    name: {
+      type: "string",
+      description: "Optional label for the new key."
+    }
+  },
+  async run({ args }) {
+    const active = await getActiveProfile();
+    if (!active) {
+      R2.warn("Not signed in. Run `codevector auth login` to get started.");
+      process.exitCode = 1;
+      return;
+    }
+    const client = gatewayClient(active.gatewayUrl, active.apiKey, 1e4);
+    const s = ft();
+    s.start(`Minting a key for group "${args.group}"\u2026`);
+    try {
+      const groupsRes = await call(parseResponse(client.groups.$get()));
+      const group = groupsRes.data.find((g) => g.name === args.group);
+      if (!group) {
+        s.stop("Group not found");
+        R2.error(
+          `You are not a member of a group named "${args.group}". Run \`codevector groups list\` to see yours.`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const res = await call(
+        parseResponse(
+          client.keys.$post({
+            json: { groupId: group.id, ...args.name ? { name: args.name } : {} }
+          })
+        )
+      );
+      const minted = res.key;
+      const profiles = await readProfiles();
+      const previousActive = profiles?.activeProfile;
+      writeProfile(group.name, {
+        apiKey: minted.plaintext,
+        gatewayUrl: active.gatewayUrl,
+        userId: active.userId,
+        email: active.email,
+        groupId: group.id,
+        groupName: group.name,
+        keyId: minted.id
+      });
+      if (previousActive && previousActive !== group.name) {
+        await setActiveProfile(previousActive);
+      }
+      s.stop(`Minted a group key and saved profile "${group.name}".`);
+      Se(
+        `Profile "${group.name}" bills group "${group.name}".
+Run \`codevector profile switch\` and pick "${group.name}" to point your editors at it.`,
+        "Group key created"
+      );
+    } catch (err) {
+      s.stop("Could not mint group key");
+      R2.error(err instanceof ApiClientError ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  }
+});
+var keysListCommand = defineCommand({
+  meta: {
+    name: "list",
+    description: "List saved keys/profiles and the group each one bills."
+  },
+  async run() {
+    const profiles = await readProfiles();
+    if (!profiles || Object.keys(profiles.profiles).length === 0) {
+      R2.info(
+        "No keys saved. Run `codevector auth login`, or `codevector keys create --group <name>`."
+      );
+      return;
+    }
+    const names = sortProfileNames(Object.keys(profiles.profiles));
+    const headers = ["", "PROFILE", "GROUP", "KEY", "GATEWAY"];
+    const cells = names.map((name) => {
+      const p2 = profiles.profiles[name];
+      return [
+        name === profiles.activeProfile ? "*" : "",
+        name,
+        p2.groupName ?? "personal",
+        maskApiKey(p2.apiKey),
+        p2.gatewayUrl
+      ];
+    });
+    Se(renderTable(headers, cells), "Keys");
+  }
+});
+var keysCommand = defineCommand({
+  meta: {
+    name: "keys",
+    description: "Mint and list group-scoped API keys."
+  },
+  subCommands: {
+    create: keysCreateCommand,
+    list: keysListCommand
+  }
+});
 
-// src/lib/table.ts
-function renderTable(headers, rows) {
-  const widths = headers.map(
-    (h2, i) => Math.max(h2.length, ...rows.map((row) => (row[i] ?? "").length))
-  );
-  const pad = (s, i) => s.padEnd(widths[i] ?? 0);
-  const divider = widths.map((w3) => "\u2500".repeat(w3)).join("  ");
-  return [headers.map(pad).join("  "), divider, ...rows.map((row) => row.map(pad).join("  "))].join(
-    "\n"
-  );
-}
+// src/commands/models.ts
+init_dist();
+init_dist5();
+init_api_client();
+init_credentials();
 
 // src/commands/sync-models.ts
 init_dist();
@@ -20252,12 +21079,14 @@ init_dist5();
 init_api_client();
 init_opencode();
 init_credentials();
+init_paths();
+init_project_config();
 init_prompt();
 var SCOPES2 = ["local", "project", "user"];
 var modelsSyncCommand = defineCommand({
   meta: {
     name: "sync",
-    description: "Refresh the model list (with names, costs, context limits) in an existing opencode.json."
+    description: "Refresh the configured group's model list (names, costs, context limits) in an existing opencode.json."
   },
   args: {
     scope: {
@@ -20272,19 +21101,53 @@ var modelsSyncCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const creds = await readCredentials();
-    if (!creds) {
-      throw new Error("Not signed in. Run `codevector auth login` first.");
+    const found = readProjectConfig(userCwd());
+    if (!found || !found.config.gateway) {
+      R2.warn("No .codevector.json with a `gateway` here. Run `codevector init` first.");
+      process.exitCode = 1;
+      return;
+    }
+    const repoGroups = found.config.groups ?? [];
+    if (repoGroups.length === 0) {
+      R2.info(
+        "Model sync is available only when a group is configured for this repo. Run `codevector use <group>` to bind one."
+      );
+      return;
+    }
+    const profiles = await readProfiles();
+    if (!profiles) {
+      R2.warn("Not signed in. Run `codevector auth login` first.");
+      process.exitCode = 1;
+      return;
+    }
+    const resolution = resolveProfileForRepo(
+      profiles.profiles,
+      profiles.activeProfile,
+      found.config.gateway,
+      repoGroups
+    );
+    if (resolution.kind === "no-group-key") {
+      R2.warn(
+        `No local key for this repo's group${resolution.groups.length === 1 ? "" : "s"} (${resolution.groups.join(", ")}). Run \`codevector use <group>\` first.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (resolution.kind === "none") {
+      R2.warn("No profile matches this repo's gateway. Run `codevector auth login` for it.");
+      process.exitCode = 1;
+      return;
     }
-    ge("Sync models");
+    const profile = resolution.profile;
+    ge(`Sync models for group "${profile.groupName ?? "group"}"`);
     const target = await resolveTarget(args);
-    const client = gatewayClient(creds.gatewayUrl, creds.apiKey, 1e4);
+    const client = gatewayClient(profile.gatewayUrl, profile.apiKey, 1e4);
     const s = ft();
-    s.start("Loading reachable models\u2026");
+    s.start("Loading group models\u2026");
     let reachable;
     try {
       const res = await call(parseResponse(client.models.$get()));
-      reachable = res.data.filter((m2) => m2.kind === "chat").map((m2) => ({
+      reachable = res.data.filter((m2) => m2.kind === "chat" && m2.callable).map((m2) => ({
         slug: m2.slug,
         displayName: m2.displayName,
         contextWindow: m2.contextWindow,
@@ -20304,7 +21167,7 @@ var modelsSyncCommand = defineCommand({
         releaseDate: m2.releaseDate,
         family: m2.family
       }));
-      s.stop(`${reachable.length} model${reachable.length === 1 ? "" : "s"} reachable`);
+      s.stop(`${reachable.length} model${reachable.length === 1 ? "" : "s"} in group`);
     } catch (err) {
       s.stop("Could not load models");
       R2.error(err instanceof ApiClientError ? err.message : String(err));
@@ -20393,20 +21256,25 @@ var modelsListCommand = defineCommand({
         );
         return;
       }
+      const ordered = [...filtered].sort((a, b2) => Number(b2.callable) - Number(a.callable));
       const headers = [
         "SLUG",
         "KIND",
         "STATUS",
+        "SOURCE",
+        "USABLE",
         "PROVIDER",
         "CONTEXT",
         "IN $/MTOK",
         "OUT $/MTOK",
         "NAME"
       ];
-      const cells = filtered.map((m2) => [
+      const cells = ordered.map((m2) => [
         m2.slug,
         m2.kind,
         m2.status,
+        m2.sources.length ? m2.sources.join(", ") : "\u2014",
+        m2.callable ? "yes" : "",
         m2.providerKind ?? "\u2014",
         m2.contextWindow ? m2.contextWindow.toLocaleString() : "\u2014",
         m2.inputPricePerMtok ?? "\u2014",
@@ -20414,6 +21282,11 @@ var modelsListCommand = defineCommand({
         m2.displayName
       ]);
       Se(renderTable(headers, cells), "Reachable models");
+      if (ordered.some((m2) => !m2.callable)) {
+        R2.info(
+          "Models without USABLE are reachable through another profile. Run `codevector use <group>` to switch."
+        );
+      }
     } catch (err) {
       s?.stop("Could not load models");
       R2.error(err instanceof ApiClientError ? err.message : String(err));
@@ -20436,6 +21309,7 @@ var modelsCommand = defineCommand({
 init_dist();
 init_dist5();
 init_claude_code();
+init_cline();
 init_opencode();
 init_api_client();
 init_credentials();
@@ -20444,8 +21318,77 @@ init_prompt();
 init_project_context();
 var WRITERS3 = {
   "claude-code": writeClaudeCodeConfig,
+  cline: writeClineConfig,
   opencode: writeOpencodeConfig
 };
+async function applyProfileToolConfigs(profileName, active) {
+  const toolConfigs = active.toolConfigs?.length ? active.toolConfigs : detectOnDiskToolConfigs();
+  if (toolConfigs.length === 0) {
+    return { kind: "no-tools" };
+  }
+  const fetched = await fetchReachableModels(active.gatewayUrl, active.apiKey);
+  if (!fetched.ok) {
+    return { kind: "unreachable", reason: fetched.reason };
+  }
+  const reachable = fetched.models;
+  const project = resolveProjectContext(userCwd()).project ?? void 0;
+  const results = [];
+  const persisted = [];
+  for (const tc of toolConfigs) {
+    const tool = tc.tool;
+    const writer = WRITERS3[tool];
+    if (!writer) {
+      results.push({
+        tool: tc.tool,
+        status: "skipped",
+        path: "",
+        scope: tc.scope,
+        notes: `Unsupported tool "${tc.tool}".`
+      });
+      continue;
+    }
+    const storedModelSlug = tc.modelSlug;
+    const reachableModel = storedModelSlug ? reachable.find((m2) => m2.slug === storedModelSlug) : void 0;
+    const modelArg = reachableModel ? { slug: reachableModel.slug, providerKind: reachableModel.providerKind } : void 0;
+    let extraNote;
+    if (storedModelSlug && !reachableModel) {
+      extraNote = `Pinned model "${tc.modelSlug}" is not reachable with this profile; model pin removed.`;
+    }
+    try {
+      const result = writer({
+        gatewayUrl: active.gatewayUrl,
+        apiKey: active.apiKey,
+        scope: tc.scope,
+        ...project ? { project } : {},
+        ...modelArg ? { model: modelArg } : {},
+        availableModels: reachable
+      });
+      if (extraNote) {
+        result.notes = result.notes ? `${result.notes} ${extraNote}` : extraNote;
+      }
+      results.push(result);
+      if (result.status === "configured") {
+        persisted.push({
+          tool: result.tool,
+          scope: result.scope,
+          ...modelArg ? { modelSlug: modelArg.slug } : {}
+        });
+      }
+    } catch (err) {
+      results.push({
+        tool: tc.tool,
+        status: "skipped",
+        path: "",
+        scope: tc.scope,
+        notes: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  if (persisted.length > 0) {
+    updateProfileToolConfigs(profileName, persisted);
+  }
+  return { kind: "applied", results };
+}
 var profileListCommand = defineCommand({
   meta: {
     name: "list",
@@ -20501,7 +21444,9 @@ var profileSwitchCommand = defineCommand({
     await setActiveProfile(selected);
     const active = await getActiveProfile();
     if (!active) {
-      R2.error(`Profile "${selected}" disappeared mid-switch. Re-run \`codevector profile switch\`.`);
+      R2.error(
+        `Profile "${selected}" disappeared mid-switch. Re-run \`codevector profile switch\`.`
+      );
       process.exitCode = 1;
       return;
     }
@@ -20512,86 +21457,76 @@ Gateway: ${active.gatewayUrl}
 Key:    ${maskApiKey(active.apiKey)}`,
       `Profile: ${selected}`
     );
-    const toolConfigs = active.toolConfigs ?? [];
-    if (toolConfigs.length === 0) {
-      R2.info("No stored tool configurations for this profile; nothing to reapply.");
-    }
-    const fetched = await fetchReachableModels(active.gatewayUrl, active.apiKey);
-    if (!fetched.ok) {
-      R2.warn(
-        `Could not reach the gateway to verify reachable models: ${fetched.reason}.`
+    const outcome = await applyProfileToolConfigs(selected, active);
+    if (outcome.kind === "no-tools") {
+      R2.info(
+        "No tool configurations found for this profile and none detected on disk; nothing to reapply."
       );
+      return;
+    }
+    if (outcome.kind === "unreachable") {
+      R2.warn(`Could not reach the gateway to verify reachable models: ${outcome.reason}.`);
       R2.info(
         "Stored tool configurations were left unchanged. Re-run `codevector profile switch` once the gateway is reachable to reapply them."
       );
       return;
     }
-    const reachable = fetched.models;
-    const project = resolveProjectContext(userCwd()).project ?? void 0;
-    const results = [];
-    const persisted = [];
-    for (const tc of toolConfigs) {
-      const tool = tc.tool;
-      const writer = WRITERS3[tool];
-      if (!writer) {
-        results.push({
-          tool: tc.tool,
-          status: "skipped",
-          path: "",
-          scope: tc.scope,
-          notes: `Unsupported tool "${tc.tool}".`
-        });
-        continue;
-      }
-      const storedModelSlug = tc.modelSlug;
-      const reachableModel = storedModelSlug ? reachable.find((m2) => m2.slug === storedModelSlug) : void 0;
-      const modelArg = reachableModel ? { slug: reachableModel.slug, providerKind: reachableModel.providerKind } : void 0;
-      let extraNote;
-      if (storedModelSlug && !reachableModel) {
-        extraNote = `Pinned model "${tc.modelSlug}" is not reachable with this profile; model pin removed.`;
-      }
-      try {
-        const result = writer({
-          gatewayUrl: active.gatewayUrl,
-          apiKey: active.apiKey,
-          scope: tc.scope,
-          ...project ? { project } : {},
-          ...modelArg ? { model: modelArg } : {},
-          availableModels: reachable
-        });
-        if (extraNote) {
-          result.notes = result.notes ? `${result.notes} ${extraNote}` : extraNote;
-        }
-        results.push(result);
-        if (result.status === "configured") {
-          persisted.push({
-            tool: result.tool,
-            scope: result.scope,
-            ...modelArg ? { modelSlug: modelArg.slug } : {}
-          });
-        }
-      } catch (err) {
-        results.push({
-          tool: tc.tool,
-          status: "skipped",
-          path: "",
-          scope: tc.scope,
-          notes: err instanceof Error ? err.message : String(err)
-        });
+    const lines = outcome.results.map((r) => {
+      if (r.status === "configured") {
+        const noteStr = r.notes ? `
+    ${r.notes}` : "";
+        return `  \u2713 ${r.tool} \u2192 ${r.path} [${r.scope}]${noteStr}`;
       }
+      return `  ! ${r.tool}: skipped \u2014 ${r.notes ?? "unknown reason"}`;
+    });
+    Se(lines.join("\n"), "Tool configurations updated");
+  }
+});
+var profileDeleteCommand = defineCommand({
+  meta: {
+    name: "delete",
+    description: "Delete a saved profile."
+  },
+  args: {
+    name: {
+      type: "string",
+      description: "Profile name to delete. Prompts with a picker if omitted."
+    }
+  },
+  async run({ args }) {
+    const profiles = await readProfiles();
+    if (!profiles || Object.keys(profiles.profiles).length === 0) {
+      R2.warn("No profiles configured. Nothing to delete.");
+      process.exitCode = 1;
+      return;
+    }
+    let target = args.name;
+    if (!target) {
+      const names = Object.keys(profiles.profiles).sort((a, b2) => {
+        if (a === "default") return -1;
+        if (b2 === "default") return 1;
+        return a.localeCompare(b2);
+      });
+      const options = names.map((n) => ({
+        value: n,
+        label: n,
+        hint: n === profiles.activeProfile ? "active" : void 0
+      }));
+      target = unwrap(
+        await xe({
+          message: "Select profile to delete",
+          options,
+          initialValue: profiles.activeProfile
+        })
+      );
     }
-    if (persisted.length > 0) {
-      updateProfileToolConfigs(selected, persisted);
+    const removed = deleteProfile(target);
+    if (removed) {
+      R2.success(`Deleted profile "${target}".`);
+    } else {
+      R2.error(`Profile "${target}" does not exist.`);
+      process.exitCode = 1;
     }
-    const lines = results.map((r) => {
-      if (r.status === "configured") {
-        const noteStr = r.notes ? `
-    ${r.notes}` : "";
-        return `  \u2713 ${r.tool} \u2192 ${r.path} [${r.scope}]${noteStr}`;
-      }
-      return `  ! ${r.tool}: skipped \u2014 ${r.notes ?? "unknown reason"}`;
-    });
-    Se(lines.join("\n"), "Tool configurations updated");
   }
 });
 var profileCommand = defineCommand({
@@ -20601,14 +21536,15 @@ var profileCommand = defineCommand({
   },
   subCommands: {
     list: profileListCommand,
-    switch: profileSwitchCommand
+    switch: profileSwitchCommand,
+    delete: profileDeleteCommand
   }
 });
 async function fetchReachableModels(gatewayUrl, apiKey) {
   const client = gatewayClient(gatewayUrl, apiKey, 1e4);
   try {
     const res = await call(parseResponse(client.models.$get()));
-    const models = res.data.filter((m2) => m2.kind === "chat").map((m2) => ({
+    const models = res.data.filter((m2) => m2.kind === "chat" && m2.callable).map((m2) => ({
       slug: m2.slug,
       providerKind: m2.providerKind,
       displayName: m2.displayName,
@@ -20640,8 +21576,8 @@ init_dist();
 init_dist5();
 init_api_client();
 init_credentials();
-import { readFile, writeFile } from "fs/promises";
-import { resolve as resolve2 } from "path";
+import { mkdir, readdir, readFile, symlink, writeFile } from "fs/promises";
+import { join as join15, resolve as resolve2 } from "path";
 import { spawn } from "child_process";
 async function getClient() {
   const creds = await readCredentials();
@@ -20736,6 +21672,37 @@ var skillsUploadCommand = defineCommand({
     }
   }
 });
+var skillsDeleteCommand = defineCommand({
+  meta: {
+    name: "delete",
+    description: "Delete a skill pack from the gateway."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Name of the skill pack to delete.",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const client = await getClient();
+    if (!client) return;
+    const s = ft();
+    s.start(`Deleting skill pack "${args.name}"\u2026`);
+    try {
+      await call(
+        parseResponse(
+          client["skill-packs"][":name"].$delete({ param: { name: args.name } })
+        )
+      );
+      s.stop(`Skill pack "${args.name}" deleted.`);
+    } catch (err) {
+      s.stop("Delete failed");
+      R2.error(err instanceof ApiClientError ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  }
+});
 var skillsSyncCommand = defineCommand({
   meta: {
     name: "sync",
@@ -20792,6 +21759,28 @@ var skillsSyncCommand = defineCommand({
         child.on("error", reject);
       });
       s.stop("Skills installed");
+      const agentsDir = resolve2(".agents/skills");
+      let entries = [];
+      try {
+        entries = await readdir(agentsDir, { withFileTypes: true }).then((list) => list.filter((d) => d.isDirectory()).map((d) => d.name));
+      } catch {
+      }
+      if (entries.length > 0) {
+        for (const tool of ["claude", "opencode"]) {
+          const toolDir = resolve2(`.${tool}/skills`);
+          await mkdir(toolDir, { recursive: true });
+          for (const name of entries) {
+            const linkPath = join15(toolDir, name);
+            try {
+              await symlink(join15(agentsDir, name), linkPath, "dir");
+            } catch (e2) {
+              if (e2.code !== "EEXIST") {
+                R2.warn(`Could not link ${name} into .${tool}/skills/: ${e2 instanceof Error ? e2.message : String(e2)}`);
+              }
+            }
+          }
+        }
+      }
     } catch (err) {
       s.stop("Install failed");
       R2.error(err instanceof Error ? err.message : String(err));
@@ -20807,6 +21796,7 @@ var skillsCommand = defineCommand({
   subCommands: {
     list: skillsListCommand,
     upload: skillsUploadCommand,
+    delete: skillsDeleteCommand,
     sync: skillsSyncCommand
   }
 });
@@ -20816,6 +21806,8 @@ init_dist();
 init_dist5();
 init_api_client();
 init_credentials();
+init_paths();
+init_project_config();
 var statusCommand = defineCommand({
   meta: {
     name: "status",
@@ -20832,20 +21824,151 @@ var statusCommand = defineCommand({
       `Signed in as ${creds.email}
 Gateway: ${creds.gatewayUrl}
 API key: ${maskApiKey(creds.apiKey)}
+Billing: ${creds.groupName ? `group "${creds.groupName}"` : "personal"}
 Last saved: ${creds.savedAt}`,
       "Credentials"
     );
+    const pinned = readProjectConfig(userCwd())?.config.groups ?? [];
+    if (pinned.length > 0) {
+      R2.info(`This repo bills group(s): ${pinned.join(", ")}`);
+    }
     const client = gatewayClient(creds.gatewayUrl, creds.apiKey, 1e4);
     const s = ft();
     s.start("Reaching gateway\u2026");
     try {
+      const serverVersion = await checkServerCompatibility(creds.gatewayUrl);
       const res = await call(parseResponse(client.models.$get()));
+      const versionSuffix = serverVersion ? ` (server ${serverVersion})` : "";
       s.stop(
-        res.data.length === 0 ? "Gateway reachable \u2014 no models granted. Ask your admin for access." : `Gateway reachable \u2014 ${res.data.length} model${res.data.length === 1 ? "" : "s"} available. Run \`codevector models\` to list them.`
+        res.data.length === 0 ? `Gateway reachable${versionSuffix} \u2014 no models granted. Ask your admin for access.` : `Gateway reachable${versionSuffix} \u2014 ${res.data.length} model${res.data.length === 1 ? "" : "s"} available. Run \`codevector models\` to list them.`
       );
     } catch (err) {
-      s.stop("Gateway unreachable");
-      R2.error(err instanceof ApiClientError ? err.message : String(err));
+      s.stop(err instanceof ApiClientError ? "Gateway unreachable" : "Gateway incompatible");
+      R2.error(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  }
+});
+
+// src/commands/sync.ts
+init_dist();
+init_dist5();
+init_api_client();
+init_credentials();
+
+// src/lib/sync-plan.ts
+function keyUsable(k2, now) {
+  if (!k2.isActive) return false;
+  if (k2.expiresAt && new Date(k2.expiresAt).getTime() <= now.getTime()) return false;
+  return true;
+}
+function findServerKey(profile, serverKeys) {
+  if (profile.keyId) {
+    const byId = serverKeys.find((k2) => k2.id === profile.keyId);
+    if (byId) return byId;
+  }
+  return serverKeys.find((k2) => profile.apiKey.startsWith(k2.prefix));
+}
+function computeSyncActions(memberships, serverKeys, localProfiles, now) {
+  const mints = [];
+  const reminds = [];
+  const prunes = [];
+  const memberIds = new Set(memberships.map((m2) => m2.id));
+  for (const m2 of memberships) {
+    const profile = localProfiles.find((p2) => p2.groupId === m2.id);
+    if (!profile) {
+      mints.push({ type: "mint", groupId: m2.id, groupName: m2.name });
+      continue;
+    }
+    const key = findServerKey(profile, serverKeys);
+    if (!key || !keyUsable(key, now)) {
+      reminds.push({ type: "remint", profileName: profile.name, groupId: m2.id, groupName: m2.name });
+    }
+  }
+  for (const p2 of localProfiles) {
+    if (!memberIds.has(p2.groupId)) {
+      prunes.push({ type: "prune", profileName: p2.name, groupName: p2.groupName ?? p2.name });
+    }
+  }
+  return [...mints, ...reminds, ...prunes];
+}
+
+// src/commands/sync.ts
+var syncCommand = defineCommand({
+  meta: {
+    name: "sync",
+    description: "Reconcile local group keys with your server memberships + key status."
+  },
+  args: {
+    prune: {
+      type: "boolean",
+      description: "Also delete local profiles for groups you've left (destructive)."
+    }
+  },
+  async run({ args }) {
+    const active = await getActiveProfile();
+    if (!active) {
+      R2.warn("Not signed in. Run `codevector auth login` first.");
+      process.exitCode = 1;
+      return;
+    }
+    const client = gatewayClient(active.gatewayUrl, active.apiKey, 1e4);
+    const s = ft();
+    s.start("Reconciling\u2026");
+    try {
+      const [groupsRes, keysRes] = await Promise.all([
+        call(parseResponse(client.groups.$get())),
+        call(parseResponse(client.keys.$get()))
+      ]);
+      const profiles = await readProfiles();
+      const previousActive = profiles?.activeProfile ?? null;
+      const local = Object.entries(profiles?.profiles ?? {}).filter(([, p2]) => p2.groupId).map(([name, p2]) => ({
+        name,
+        groupId: p2.groupId,
+        groupName: p2.groupName,
+        keyId: p2.keyId,
+        apiKey: p2.apiKey
+      }));
+      const actions = computeSyncActions(groupsRes.data, keysRes.data, local, /* @__PURE__ */ new Date());
+      s.stop(`${actions.length} change${actions.length === 1 ? "" : "s"}`);
+      const summary = [];
+      for (const a of actions) {
+        if (a.type === "mint" || a.type === "remint") {
+          const res = await call(
+            parseResponse(client.keys.$post({ json: { groupId: a.groupId } }))
+          );
+          writeProfile(a.groupName, {
+            apiKey: res.key.plaintext,
+            gatewayUrl: active.gatewayUrl,
+            userId: active.userId,
+            email: active.email,
+            groupId: a.groupId,
+            groupName: a.groupName,
+            keyId: res.key.id
+          });
+          summary.push(`${a.type === "mint" ? "minted" : "re-minted"} "${a.groupName}"`);
+        } else if (a.type === "prune") {
+          if (args.prune) {
+            deleteProfile(a.profileName);
+            summary.push(`pruned "${a.profileName}"`);
+          } else {
+            summary.push(`stale "${a.profileName}" \u2014 run with --prune to delete`);
+          }
+        }
+      }
+      if (previousActive) {
+        const stillExists = (await readProfiles())?.profiles[previousActive];
+        if (stillExists) await setActiveProfile(previousActive);
+      }
+      Se(summary.length ? summary.join("\n") : "Everything is up to date.", "Sync");
+    } catch (err) {
+      s.stop("Sync failed");
+      const e2 = err instanceof ApiClientError ? err : null;
+      if (e2?.code === "FORBIDDEN") {
+        R2.warn("Group budgets are not enabled on this gateway \u2014 nothing to sync.");
+        return;
+      }
+      R2.error(e2 ? e2.message : String(err));
       process.exitCode = 1;
     }
   }
@@ -20855,47 +21978,47 @@ Last saved: ${creds.savedAt}`,
 init_dist();
 init_dist5();
 init_api_client();
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 
 // src/lib/backup.ts
 import {
   copyFileSync,
-  existsSync as existsSync11,
-  mkdirSync as mkdirSync6,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync8,
   readdirSync,
   statSync as statSync4
 } from "fs";
-import { basename, dirname as dirname6, join as join13 } from "path";
-import { homedir as homedir6 } from "os";
-var BACKUP_ROOT = process.env.CODEVECTOR_BACKUP_ROOT ?? join13(homedir6(), ".codevector", "backups");
+import { basename, dirname as dirname7, join as join16 } from "path";
+import { homedir as homedir7 } from "os";
+var BACKUP_ROOT = process.env.CODEVECTOR_BACKUP_ROOT ?? join16(homedir7(), ".codevector", "backups");
 function backupTimestamp(d = /* @__PURE__ */ new Date()) {
   return d.toISOString().replace(/:/g, "-");
 }
 function backupFile(sourcePath, tool, timestamp) {
-  if (!existsSync11(sourcePath)) return void 0;
-  const destDir = join13(BACKUP_ROOT, timestamp, tool);
-  mkdirSync6(destDir, { recursive: true, mode: 448 });
-  const dest = join13(destDir, basename(sourcePath));
+  if (!existsSync13(sourcePath)) return void 0;
+  const destDir = join16(BACKUP_ROOT, timestamp, tool);
+  mkdirSync8(destDir, { recursive: true, mode: 448 });
+  const dest = join16(destDir, basename(sourcePath));
   copyFileSync(sourcePath, dest);
   return dest;
 }
 function listBackupRuns() {
-  if (!existsSync11(BACKUP_ROOT)) return [];
+  if (!existsSync13(BACKUP_ROOT)) return [];
   const entries = readdirSync(BACKUP_ROOT, { withFileTypes: true }).filter((e2) => e2.isDirectory()).map((e2) => e2.name).sort().reverse();
   const runs = [];
   for (const ts of entries) {
-    const dir = join13(BACKUP_ROOT, ts);
+    const dir = join16(BACKUP_ROOT, ts);
     const tools = readdirSync(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory());
     const collected = [];
     for (const toolDir of tools) {
-      const toolPath = join13(dir, toolDir.name);
+      const toolPath = join16(dir, toolDir.name);
       for (const file2 of readdirSync(toolPath, { withFileTypes: true })) {
         if (!file2.isFile()) continue;
         collected.push({
           tool: toolDir.name,
           original: "",
           // resolved by caller per tool — see restoreBackup()
-          backup: join13(toolPath, file2.name)
+          backup: join16(toolPath, file2.name)
         });
       }
     }
@@ -20905,10 +22028,10 @@ function listBackupRuns() {
   return runs;
 }
 function restoreBackup(backupPath, originalPath) {
-  if (!existsSync11(backupPath)) {
+  if (!existsSync13(backupPath)) {
     throw new Error(`Backup file missing: ${backupPath}`);
   }
-  mkdirSync6(dirname6(originalPath), { recursive: true });
+  mkdirSync8(dirname7(originalPath), { recursive: true });
   copyFileSync(backupPath, originalPath);
 }
 function backupRunMtime(dir) {
@@ -20920,16 +22043,20 @@ init_credentials();
 init_prompt();
 init_shell_hook();
 init_claude_code();
+init_cline();
 init_opencode();
-var TOOLS = ["claude-code", "opencode"];
+var TOOLS = ["claude-code", "cline", "opencode"];
 var WRITERS4 = {
   "claude-code": writeClaudeCodeConfig,
+  cline: writeClineConfig,
   opencode: writeOpencodeConfig
 };
 function userPathFor(tool) {
   switch (tool) {
     case "claude-code":
       return claudeSettingsPath("user");
+    case "cline":
+      return clineSettingsPath("user");
     case "opencode":
       return opencodeSettingsPath("user");
   }
@@ -20945,10 +22072,11 @@ var systemConfigureCommand = defineCommand({
     if (!profiles) {
       throw new Error("Not signed in. Run `codevector auth login` first.");
     }
-    const creds = profiles.profiles[profiles.activeProfile];
+    const activeProfileName = profiles.activeProfile;
+    const creds = profiles.profiles[activeProfileName];
     if (!creds) {
       throw new Error(
-        `Active profile "${profiles.activeProfile}" is missing from credentials. Run \`codevector auth login\` to recover.`
+        `Active profile "${activeProfileName}" is missing from credentials. Run \`codevector auth login\` to recover.`
       );
     }
     ge("codevector system configure");
@@ -20997,6 +22125,10 @@ var systemConfigureCommand = defineCommand({
         R2.warn(`${r.tool}: skipped \u2014 ${r.notes ?? "unknown reason"}`);
       }
     }
+    const persisted = results.filter((r) => r.status === "configured").map((r) => ({ tool: r.tool, scope: "user" }));
+    if (persisted.length > 0) {
+      updateProfileToolConfigs(activeProfileName, persisted);
+    }
     if (backups.length > 0) {
       Se(
         `To roll back: codevector system restore --timestamp ${timestamp}`,
@@ -21068,7 +22200,7 @@ var systemRestoreCommand = defineCommand({
       }
       const target = userPathFor(e2.tool);
       plan.push({ tool: e2.tool, backup: e2.backup, target });
-      R2.info(`  ${e2.tool} \u2192 ${target}${existsSync12(target) ? " (will overwrite)" : " (new)"}`);
+      R2.info(`  ${e2.tool} \u2192 ${target}${existsSync14(target) ? " (will overwrite)" : " (new)"}`);
     }
     if (plan.length === 0) {
       ye("Nothing to restore.");
@@ -21110,7 +22242,7 @@ async function fetchReachableChatModels4(creds) {
   s.start("Loading reachable models\u2026");
   try {
     const res = await call(parseResponse(client.models.$get()));
-    const models = res.data.filter((m2) => m2.kind === "chat").map((m2) => ({
+    const models = res.data.filter((m2) => m2.kind === "chat" && m2.callable).map((m2) => ({
       slug: m2.slug,
       displayName: m2.displayName,
       contextWindow: m2.contextWindow,
@@ -21154,147 +22286,9 @@ var systemCommand = defineCommand({
 // src/commands/update.ts
 init_dist();
 init_dist5();
+init_package();
 import { spawnSync } from "child_process";
-
-// package.json
-var package_default = {
-  name: "@codevector/cli",
-  version: "0.8.1",
-  description: "CodeVector CLI \u2014 installs and configures first-party coding-tool integrations.",
-  license: "UNLICENSED",
-  bin: {
-    codevector: "./bin/codevector.mjs"
-  },
-  files: [
-    "bin",
-    "dist",
-    "scripts",
-    "src/hooks"
-  ],
-  type: "module",
-  publishConfig: {
-    access: "public"
-  },
-  scripts: {
-    dev: "tsx src/index.ts",
-    build: "tsup",
-    "type-check": "tsc --noEmit",
-    test: "vitest run",
-    "test:watch": "vitest",
-    postinstall: "node scripts/postinstall.mjs"
-  },
-  dependencies: {
-    "@clack/prompts": "1.4.0",
-    citty: "^0.2.2",
-    hono: "4.12.16",
-    "smol-toml": "^1.6.1"
-  },
-  devDependencies: {
-    "@codevector/api": "workspace:*",
-    "@codevector/common": "workspace:*",
-    "@types/node": "25.6.0",
-    tsup: "^8.5.1",
-    tsx: "4.21.0",
-    typescript: "6.0.3",
-    vitest: "4.1.5",
-    zod: "4.4.2"
-  },
-  engines: {
-    node: ">=20"
-  }
-};
-
-// src/commands/update.ts
 init_prompt();
-
-// src/lib/update-notifier.ts
-init_paths();
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
-import { join as join14 } from "path";
-var PKG_NAME = "@codevector/cli";
-var REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
-var CHECK_CACHE_FILE = join14(CODEVECTOR_CONFIG_DIR, "update-check.json");
-var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
-var FETCH_TIMEOUT_MS = 2e3;
-function readCache() {
-  if (!existsSync13(CHECK_CACHE_FILE)) return void 0;
-  try {
-    const raw = readFileSync10(CHECK_CACHE_FILE, "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.checkedAt !== "number") return void 0;
-    return {
-      latest: typeof parsed.latest === "string" ? parsed.latest : null,
-      checkedAt: parsed.checkedAt
-    };
-  } catch {
-    return void 0;
-  }
-}
-function readCachedLatestVersion() {
-  return readCache()?.latest ?? null;
-}
-function writeCache(cache) {
-  try {
-    mkdirSync7(CODEVECTOR_CONFIG_DIR, { recursive: true, mode: 448 });
-    writeFileSync9(CHECK_CACHE_FILE, JSON.stringify(cache));
-  } catch {
-  }
-}
-function isNewer(current, latest) {
-  const a = current.split(".").map((p2) => Number.parseInt(p2, 10));
-  const b2 = latest.split(".").map((p2) => Number.parseInt(p2, 10));
-  for (let i = 0; i < Math.max(a.length, b2.length); i++) {
-    const ai = a[i] ?? 0;
-    const bi = b2[i] ?? 0;
-    if (Number.isNaN(ai) || Number.isNaN(bi)) return latest > current;
-    if (bi > ai) return true;
-    if (bi < ai) return false;
-  }
-  return false;
-}
-function printUpdateNoticeIfCached(currentVersion) {
-  if (process.env.CODEVECTOR_NO_UPDATE_CHECK === "1") return;
-  try {
-    const cache = readCache();
-    if (!cache || !cache.latest) return;
-    if (isNewer(currentVersion, cache.latest)) {
-      process.stderr.write(
-        `\x1B[33m\u203A\x1B[0m A new version of @codevector/cli is available: ${currentVersion} \u2192 ${cache.latest}. Run \`codevector update\` to install.
-`
-      );
-    }
-  } catch {
-  }
-}
-function scheduleUpdateCheck() {
-  if (process.env.CODEVECTOR_NO_UPDATE_CHECK === "1") return;
-  const cache = readCache();
-  const now = Date.now();
-  if (cache && now - cache.checkedAt < CHECK_TTL_MS) return;
-  void fetchLatestVersion().then((latest) => {
-    writeCache({ latest, checkedAt: Date.now() });
-  }).catch(() => {
-    writeCache({ latest: cache?.latest ?? null, checkedAt: Date.now() });
-  });
-}
-async function fetchLatestVersion() {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-  timer.unref?.();
-  try {
-    const res = await fetch(REGISTRY_URL, {
-      signal: controller.signal,
-      headers: { accept: "application/json" }
-    });
-    if (!res.ok) return null;
-    const body = await res.json();
-    return typeof body.version === "string" ? body.version : null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-// src/commands/update.ts
 var PKG_NAME2 = "@codevector/cli";
 var updateCommand = defineCommand({
   meta: {
@@ -21414,6 +22408,117 @@ function installCommand(manager) {
   }
 }
 
+// src/commands/use.ts
+init_dist();
+init_dist5();
+init_api_client();
+init_credentials();
+init_paths();
+init_prompt();
+init_project_config();
+function addGroupToConfig(config2, groupName) {
+  const existing = config2.groups ?? [];
+  if (existing.includes(groupName)) return config2;
+  return { ...config2, groups: [...existing, groupName] };
+}
+var useCommand = defineCommand({
+  meta: {
+    name: "use",
+    description: "Bind this repo to a group: pin it in .codevector.json and activate its key."
+  },
+  args: {
+    group: {
+      type: "positional",
+      required: false,
+      description: "Group name to bill for this repo. Prompted if omitted."
+    }
+  },
+  async run({ args }) {
+    const active = await getActiveProfile();
+    if (!active) {
+      R2.warn("Not signed in. Run `codevector auth login` first.");
+      process.exitCode = 1;
+      return;
+    }
+    const found = readProjectConfig(userCwd());
+    if (!found || !found.config.gateway) {
+      R2.error("No .codevector.json with a `gateway` here. Run `codevector init` first.");
+      process.exitCode = 1;
+      return;
+    }
+    const client = gatewayClient(active.gatewayUrl, active.apiKey, 1e4);
+    const s = ft();
+    s.start("Loading your groups\u2026");
+    try {
+      const groupsRes = await call(parseResponse(client.groups.$get()));
+      s.stop(`${groupsRes.data.length} group${groupsRes.data.length === 1 ? "" : "s"}`);
+      if (groupsRes.data.length === 0) {
+        R2.info("You are not a member of any groups. Ask an admin to add you.");
+        return;
+      }
+      const chosenName = args.group ?? unwrap(
+        await xe({
+          message: "Which group should this repo bill?",
+          options: groupsRes.data.map((g) => ({ value: g.name, label: g.name }))
+        })
+      );
+      const group = groupsRes.data.find((g) => g.name === chosenName);
+      if (!group) {
+        R2.error(
+          `You are not a member of a group named "${chosenName}". Run \`codevector groups list\` to see yours.`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const [keysRes, profiles] = await Promise.all([
+        call(parseResponse(client.keys.$get())),
+        readProfiles()
+      ]);
+      const localForGroup = Object.entries(profiles?.profiles ?? {}).filter(([, p2]) => p2.groupId === group.id).map(([name, p2]) => ({
+        name,
+        groupId: p2.groupId,
+        groupName: p2.groupName,
+        keyId: p2.keyId,
+        apiKey: p2.apiKey
+      }));
+      const [action] = computeSyncActions(
+        [{ id: group.id, name: group.name }],
+        keysRes.data,
+        localForGroup,
+        /* @__PURE__ */ new Date()
+      );
+      if (action && (action.type === "mint" || action.type === "remint")) {
+        const mintS = ft();
+        mintS.start(`Minting a key for "${group.name}"\u2026`);
+        const res = await call(parseResponse(client.keys.$post({ json: { groupId: group.id } })));
+        writeProfile(group.name, {
+          apiKey: res.key.plaintext,
+          gatewayUrl: active.gatewayUrl,
+          userId: active.userId,
+          email: active.email,
+          groupId: group.id,
+          groupName: group.name,
+          keyId: res.key.id
+        });
+        mintS.stop(`Minted profile "${group.name}".`);
+      }
+      writeProjectConfig(found.path, addGroupToConfig(found.config, group.name));
+      await setActiveProfile(group.name);
+      const nowActive = (await readProfiles())?.profiles[group.name];
+      if (nowActive) await applyProfileToolConfigs(group.name, nowActive);
+      Se(
+        `This repo now bills group "${group.name}".
+The shell hook will export its key on the next prompt.`,
+        "Repo bound"
+      );
+    } catch (err) {
+      s.stop("Failed");
+      R2.error(err instanceof ApiClientError ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  }
+});
+
 // src/commands/usage.ts
 init_dist();
 init_dist5();
@@ -21507,6 +22612,7 @@ function buildQuery(args) {
 
 // src/commands/version.ts
 init_dist();
+init_package();
 var versionCommand = defineCommand({
   meta: {
     name: "version",
@@ -21518,6 +22624,7 @@ var versionCommand = defineCommand({
 });
 
 // src/index.ts
+init_package();
 var main = defineCommand({
   meta: {
     name: "codevector",
@@ -21532,13 +22639,17 @@ var main = defineCommand({
     github: githubCommand,
     doctor: doctorCommand,
     env: envCommand,
+    groups: groupsCommand,
     hook: hookCommand,
+    keys: keysCommand,
     status: statusCommand,
+    sync: syncCommand,
     system: systemCommand,
     models: modelsCommand,
     profile: profileCommand,
     skills: skillsCommand,
     update: updateCommand,
+    use: useCommand,
     usage: usageCommand,
     version: versionCommand
   }