@devstationlabs/cli 0.1.1 → 0.1.3

package/README.md

@@ -27,16 +27,33 @@ Either way, check the install:
 devstation doctor
 ```
 
-## A key
+## Set up a model
 
-The agent needs a model. Set one of these and `doctor` will go green:
+```sh
+devstation login
+```
+
+Pick a provider, paste a key (it is hidden as you type), choose a model. It is
+stored in `~/.devstation/credentials.json`, readable only by you, so every new
+terminal just works. Anthropic, OpenRouter, OpenAI, and any OpenAI-compatible
+server — Ollama, LM Studio, Groq — are supported:
+
+```sh
+devstation login openai        # then give it http://localhost:11434/v1 for Ollama
+devstation config              # what it will use, and where each value came from
+```
+
+Exporting `ANTHROPIC_API_KEY` or `OPENROUTER_API_KEY` still works, and is what a
+server or CI job should do.
+
+## Upgrade
 
 ```sh
-export ANTHROPIC_API_KEY=...     # preferred: prompt caching, native tool use
-export OPENROUTER_API_KEY=...    # also works
+devstation upgrade
 ```
 
-Put it in your shell profile so it survives a new terminal.
+It upgrades however it was installed: through npm for an npm install, or by
+downloading and verifying the new binary for the standalone one.
 
 ## Use it
 

package/devstation.js

@@ -12504,12 +12504,13 @@ var init_sdk = __esm(() => {
 
 // src/lib/agent/cli/index.ts
 import { createInterface as createInterface2 } from "readline/promises";
+import { Writable } from "stream";
 import { resolve as resolve4 } from "path";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 
 // src/lib/agent/cli/args.ts
 var CLI_NAME = "devstation";
-var VERSION = "0.1.1";
+var VERSION = "0.1.3";
 var COMMANDS = new Set([
   "chat",
   "run",
@@ -12525,6 +12526,9 @@ var COMMANDS = new Set([
   "diff",
   "tools",
   "config",
+  "login",
+  "logout",
+  "upgrade",
   "doctor",
   "version",
   "help"
@@ -12537,6 +12541,9 @@ var OFFLINE_COMMANDS = new Set([
   "diff",
   "tools",
   "config",
+  "login",
+  "logout",
+  "upgrade",
   "doctor",
   "version",
   "help",
@@ -12552,6 +12559,8 @@ function parseArgs(argv, cwd = process.cwd()) {
     yes: false,
     json: false,
     sandbox: (process.env.DEVSTATION_SANDBOX ?? "").toLowerCase() !== "off",
+    project: false,
+    check: false,
     root: cwd
   };
   const words = [];
@@ -12576,6 +12585,12 @@ function parseArgs(argv, cwd = process.cwd()) {
       case "--no-sandbox":
         parsed.sandbox = false;
         break;
+      case "--project":
+        parsed.project = true;
+        break;
+      case "--check":
+        parsed.check = true;
+        break;
       case "-h":
       case "--help":
         parsed.command = "help";
@@ -12664,7 +12679,13 @@ var HELP = `DevStation, the coding agent.
   ${CLI_NAME} memory               show what it has been told about this project
   ${CLI_NAME} mcp                  the MCP servers configured here, and their tools
   ${CLI_NAME} tools                list the tools it can use, and which ones ask first
-  ${CLI_NAME} config               show the settings this run would use
+  ${CLI_NAME} login [provider]     store an API key and choose a model
+  ${CLI_NAME} logout [provider]    remove stored API keys
+  ${CLI_NAME} upgrade [--check]    update to the latest version (--check only reports)
+  ${CLI_NAME} config               show the settings a run would use, and where each came from
+  ${CLI_NAME} config set <key> <value> [--project]
+                               set provider, model or baseUrl
+  ${CLI_NAME} config get|unset <key>, config path
   ${CLI_NAME} doctor               check this machine is set up to run it
   ${CLI_NAME} version              print the version
   ${CLI_NAME} help                 this
@@ -12681,12 +12702,15 @@ Options
   -f, --follow        keep watching (status only)
   --json              JSON from config, sessions, checkpoints and tools
   --no-sandbox        run commands on this machine instead of in a container
+  --project           with config set/unset: write this workspace's config, not the global one
+  --check             with upgrade: say whether a newer version exists, change nothing
   -h, --help          this
   -v, --version       the version
 
 The repo command also needs GITHUB_TOKEN, with permission to push to that repository.
 
-Set ANTHROPIC_API_KEY, or OPENROUTER_API_KEY, before running.
+Set up a model with \`${CLI_NAME} login\`, or export ANTHROPIC_API_KEY or OPENROUTER_API_KEY.
+Settings live in ~/.devstation/config.json, keys in ~/.devstation/credentials.json.
 `;
 var SESSION_HELP = `  /undo          rewind the last checkpoint
   /status        what this session has done so far
@@ -12704,7 +12728,7 @@ var SESSION_HELP = `  /undo          rewind the last checkpoint
 `;
 
 // src/lib/agent/cli/commands.ts
-import { accessSync, constants as constants2, existsSync as existsSync9 } from "fs";
+import { accessSync, constants as constants2, existsSync as existsSync10 } from "fs";
 
 // src/lib/agent/git.ts
 import { existsSync } from "fs";
@@ -17877,7 +17901,10 @@ class AnthropicProvider {
   model;
   client;
   constructor(opts = {}) {
-    this.client = new Anthropic(opts.apiKey ? { apiKey: opts.apiKey } : {});
+    this.client = new Anthropic({
+      ...opts.apiKey ? { apiKey: opts.apiKey } : {},
+      ...opts.baseUrl ? { baseURL: opts.baseUrl } : {}
+    });
     this.model = opts.model || DEFAULT_MODEL;
   }
   async generate(input) {
@@ -17929,7 +17956,7 @@ class AnthropicProvider {
 }
 
 // src/lib/agent/providers/openrouter.ts
-var ENDPOINT = "https://openrouter.ai/api/v1/chat/completions";
+var OPENROUTER_BASE = "https://openrouter.ai/api/v1";
 function stopReasonOf2(raw) {
   switch (raw) {
     case "stop":
@@ -17980,20 +18007,24 @@ function parseArguments(raw) {
 
 class OpenRouterProvider {
   apiKey;
-  name = "openrouter";
+  name;
   model;
-  constructor(apiKey, model) {
+  endpoint;
+  constructor(apiKey, model, opts = {}) {
     this.apiKey = apiKey;
-    this.model = model || process.env.AI_MODEL || "anthropic/claude-sonnet-5";
+    this.name = opts.name ?? "openrouter";
+    const base = (opts.baseUrl || OPENROUTER_BASE).replace(/\/+$/, "");
+    this.endpoint = `${base}/chat/completions`;
+    this.model = model || process.env.AI_MODEL || (this.name === "openrouter" ? "anthropic/claude-sonnet-5" : "");
   }
   async generate(input) {
-    const res = await fetch(ENDPOINT, {
+    const openRouter = this.name === "openrouter";
+    const res = await fetch(this.endpoint, {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        authorization: `Bearer ${this.apiKey}`,
-        "HTTP-Referer": "https://devstation.online",
-        "X-Title": "DevStation"
+        ...this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {},
+        ...openRouter ? { "HTTP-Referer": "https://devstation.online", "X-Title": "DevStation" } : {}
       },
       body: JSON.stringify({
         model: this.model,
@@ -18011,13 +18042,14 @@ class OpenRouterProvider {
             }
           }))
         } : {},
-        ...process.env.AI_REASONING === "on" ? {} : { reasoning: { enabled: false } }
+        ...openRouter && process.env.AI_REASONING !== "on" ? { reasoning: { enabled: false } } : {}
       }),
       signal: input.signal
     });
     if (!res.ok || !res.body) {
       const detail = await res.text().catch(() => "");
-      throw new Error(`OpenRouter request failed (${res.status}). ${detail.slice(0, 200)}`);
+      const label = openRouter ? "OpenRouter" : `The endpoint ${this.endpoint}`;
+      throw new Error(`${label} request failed (${res.status}). ${detail.slice(0, 200)}`);
     }
     let text = "";
     let finish = null;
@@ -18085,21 +18117,247 @@ class OpenRouterProvider {
     };
   }
 }
-// src/lib/agent/providers/index.ts
-function providerFromEnv(env2 = process.env, model) {
-  if (env2.ANTHROPIC_API_KEY)
-    return new AnthropicProvider({ apiKey: env2.ANTHROPIC_API_KEY, model });
-  const openRouter = env2.OPENROUTER_API_KEY || env2.AI_API_KEY;
-  if (openRouter)
-    return new OpenRouterProvider(openRouter, model);
-  return null;
+// src/lib/agent/providers/settings.ts
+import {
+  chmodSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  renameSync,
+  statSync as statSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { dirname as dirname4, join as join5 } from "path";
+var PROVIDER_IDS = ["anthropic", "openrouter", "openai"];
+var SETTING_KEYS = ["provider", "model", "baseUrl"];
+var KEY_ENV = {
+  anthropic: ["ANTHROPIC_API_KEY"],
+  openrouter: ["OPENROUTER_API_KEY", "AI_API_KEY"],
+  openai: ["OPENAI_API_KEY"]
+};
+var DEFAULT_BASE_URL = {
+  anthropic: "https://api.anthropic.com",
+  openrouter: "https://openrouter.ai/api/v1",
+  openai: "https://api.openai.com/v1"
+};
+function globalDir(home) {
+  return join5(home, ".devstation");
 }
-function configuredProviderName(env2 = process.env) {
-  if (env2.ANTHROPIC_API_KEY)
-    return "anthropic";
-  if (env2.OPENROUTER_API_KEY || env2.AI_API_KEY)
-    return "openrouter";
-  return null;
+function globalConfigPath(home) {
+  return join5(globalDir(home), "config.json");
+}
+function projectConfigPath(root) {
+  return join5(root, ".devstation", "config.json");
+}
+function credentialsPath(home) {
+  return join5(globalDir(home), "credentials.json");
+}
+function isProvider(value) {
+  return typeof value === "string" && PROVIDER_IDS.includes(value);
+}
+function readSettingsFile(path4, problems = []) {
+  if (!existsSync4(path4))
+    return {};
+  try {
+    const raw = JSON.parse(readFileSync3(path4, "utf8"));
+    const out = {};
+    if (raw.provider !== undefined) {
+      const named = typeof raw.provider === "string" ? raw.provider.toLowerCase() : raw.provider;
+      if (isProvider(named))
+        out.provider = named;
+      else
+        problems.push(`${path4}: unknown provider "${String(raw.provider)}".`);
+    }
+    if (typeof raw.model === "string" && raw.model.trim())
+      out.model = raw.model.trim();
+    if (typeof raw.baseUrl === "string" && raw.baseUrl.trim()) {
+      out.baseUrl = raw.baseUrl.trim().replace(/\/+$/, "");
+    }
+    if ("apiKey" in raw) {
+      problems.push(`${path4} contains "apiKey", which is ignored. Keys belong in ${"~/.devstation/credentials.json"}: run \`devstation login\`.`);
+    }
+    return out;
+  } catch {
+    problems.push(`${path4} is not valid JSON, so it was ignored.`);
+    return {};
+  }
+}
+function writeJson(path4, value, mode) {
+  mkdirSync3(dirname4(path4), { recursive: true, mode: 448 });
+  const partial = `${path4}.partial`;
+  writeFileSync3(partial, `${JSON.stringify(value, null, 2)}
+`, { mode });
+  chmodSync(partial, mode);
+  renameSync(partial, path4);
+}
+function writeSettingsFile(path4, settings) {
+  const clean = {};
+  for (const key of SETTING_KEYS) {
+    if (settings[key] !== undefined && settings[key] !== "") {
+      clean[key] = settings[key];
+    }
+  }
+  writeJson(path4, clean, 420);
+}
+function readCredentials(home, problems = []) {
+  const path4 = credentialsPath(home);
+  if (!existsSync4(path4))
+    return {};
+  try {
+    const mode = statSync2(path4).mode & 511;
+    if (mode & 63) {
+      problems.push(`${path4} is readable by other users (mode ${mode.toString(8)}). Fix it: chmod 600 ${path4}`);
+    }
+    const raw = JSON.parse(readFileSync3(path4, "utf8"));
+    const out = {};
+    for (const id of PROVIDER_IDS) {
+      if (typeof raw[id] === "string" && raw[id].trim())
+        out[id] = raw[id].trim();
+    }
+    return out;
+  } catch {
+    problems.push(`${path4} is not valid JSON, so no stored keys were read.`);
+    return {};
+  }
+}
+function writeCredentials(home, credentials) {
+  mkdirSync3(globalDir(home), { recursive: true, mode: 448 });
+  chmodSync(globalDir(home), 448);
+  writeJson(credentialsPath(home), credentials, 384);
+}
+function resolveSettings(opts) {
+  const env2 = opts.env ?? process.env;
+  const home = opts.home ?? env2.HOME ?? "";
+  const warnings = [];
+  const project = readSettingsFile(projectConfigPath(opts.root), warnings);
+  const global = home ? readSettingsFile(globalConfigPath(home), warnings) : {};
+  const stored = home ? readCredentials(home, warnings) : {};
+  const projectLabel = ".devstation/config.json";
+  const globalLabel = "~/.devstation/config.json";
+  let provider = null;
+  let providerSource = "not set";
+  if (env2.DEVSTATION_PROVIDER) {
+    const named = env2.DEVSTATION_PROVIDER.toLowerCase();
+    if (isProvider(named)) {
+      provider = named;
+      providerSource = "DEVSTATION_PROVIDER";
+    } else {
+      warnings.push(`DEVSTATION_PROVIDER="${env2.DEVSTATION_PROVIDER}" is not a provider, so it was ignored.`);
+    }
+  }
+  if (!provider && project.provider) {
+    provider = project.provider;
+    providerSource = projectLabel;
+  }
+  if (!provider && global.provider) {
+    provider = global.provider;
+    providerSource = globalLabel;
+  }
+  if (!provider) {
+    for (const id of ["anthropic", "openrouter", "openai"]) {
+      const hit = KEY_ENV[id].find((name) => env2[name]);
+      if (hit) {
+        provider = id;
+        providerSource = `inferred from ${hit}`;
+        break;
+      }
+    }
+  }
+  if (!provider) {
+    const only = PROVIDER_IDS.filter((id) => stored[id]);
+    if (only.length >= 1) {
+      provider = only[0];
+      providerSource = "inferred from ~/.devstation/credentials.json";
+    }
+  }
+  let model = null;
+  let modelSource = "provider default";
+  if (opts.model) {
+    model = opts.model;
+    modelSource = "--model";
+  } else if (env2.DEVSTATION_MODEL) {
+    model = env2.DEVSTATION_MODEL;
+    modelSource = "DEVSTATION_MODEL";
+  } else if (project.model) {
+    model = project.model;
+    modelSource = projectLabel;
+  } else if (global.model) {
+    model = global.model;
+    modelSource = globalLabel;
+  }
+  let baseUrl = null;
+  let baseUrlSource = "provider default";
+  if (env2.DEVSTATION_BASE_URL) {
+    baseUrl = env2.DEVSTATION_BASE_URL.replace(/\/+$/, "");
+    baseUrlSource = "DEVSTATION_BASE_URL";
+  } else if (project.baseUrl) {
+    baseUrl = project.baseUrl;
+    baseUrlSource = projectLabel;
+  } else if (global.baseUrl) {
+    baseUrl = global.baseUrl;
+    baseUrlSource = globalLabel;
+  }
+  let apiKey = null;
+  let keySource = "none";
+  if (provider) {
+    const hit = KEY_ENV[provider].find((name) => env2[name]);
+    if (hit) {
+      apiKey = env2[hit];
+      keySource = hit;
+    } else if (stored[provider]) {
+      apiKey = stored[provider];
+      keySource = "~/.devstation/credentials.json";
+    }
+  }
+  let problem = null;
+  if (!provider) {
+    problem = "No model provider is configured. Run `devstation login`, or set ANTHROPIC_API_KEY or OPENROUTER_API_KEY.";
+  } else if (!apiKey && provider !== "openai") {
+    problem = `No API key for ${provider}. Run \`devstation login ${provider}\`, or set ${KEY_ENV[provider][0]}.`;
+  } else if (provider === "openai" && !apiKey && !baseUrl) {
+    problem = "No API key for openai. Run `devstation login openai`, set OPENAI_API_KEY, or point baseUrl at a local server that needs none.";
+  } else if (provider === "openai" && !model) {
+    problem = "The openai provider needs a model name, because every compatible server names them differently. Run `devstation config set model <name>`.";
+  }
+  return {
+    provider,
+    model,
+    baseUrl,
+    apiKey,
+    source: {
+      provider: providerSource,
+      model: modelSource,
+      baseUrl: baseUrlSource,
+      apiKey: keySource
+    },
+    problem,
+    warnings
+  };
+}
+function maskKey(key) {
+  if (!key)
+    return "none";
+  if (key.length <= 8)
+    return "set";
+  return `${key.slice(0, 4)}\u2026${key.slice(-4)}`;
+}
+// src/lib/agent/providers/index.ts
+function providerFromSettings(resolved) {
+  if (resolved.problem || !resolved.provider)
+    return null;
+  const model = resolved.model ?? undefined;
+  const baseUrl = resolved.baseUrl ?? undefined;
+  switch (resolved.provider) {
+    case "anthropic":
+      return new AnthropicProvider({ apiKey: resolved.apiKey ?? undefined, model, baseUrl });
+    case "openrouter":
+      return new OpenRouterProvider(resolved.apiKey ?? "", model, { name: "openrouter", baseUrl });
+    case "openai":
+      return new OpenRouterProvider(resolved.apiKey ?? "", model, {
+        name: "openai",
+        baseUrl: baseUrl ?? "https://api.openai.com/v1"
+      });
+  }
 }
 
 // src/lib/agent/memory/embeddings.ts
@@ -18195,11 +18453,11 @@ async function embedMissing(store, provider, options = {}) {
 }
 
 // src/lib/agent/memory/workspace-index.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/lib/agent/repo-session.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
-import { join as join5, relative as relative2, sep as sep2 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
+import { join as join6, relative as relative2, sep as sep2 } from "path";
 var SKIP_DIRS = new Set([
   ".git",
   ".agent",
@@ -18233,7 +18491,7 @@ function readWorkspace(root, maxFileBytes = 1024 * 1024) {
     for (const item of readdirSync3(dir, { withFileTypes: true })) {
       if (item.isSymbolicLink())
         continue;
-      const full = join5(dir, item.name);
+      const full = join6(dir, item.name);
       if (item.isDirectory()) {
         if (SKIP_DIRS.has(item.name))
           continue;
@@ -18242,9 +18500,9 @@ function readWorkspace(root, maxFileBytes = 1024 * 1024) {
       }
       if (!item.isFile())
         continue;
-      if (statSync2(full).size > maxFileBytes)
+      if (statSync3(full).size > maxFileBytes)
         continue;
-      const buffer = readFileSync3(full);
+      const buffer = readFileSync4(full);
       if (looksBinary(buffer))
         continue;
       files[relative2(root, full).split(sep2).join("/")] = buffer.toString("utf8");
@@ -18281,8 +18539,8 @@ ${goal}` };
 // src/lib/agent/memory/store.ts
 import { Database } from "bun:sqlite";
 import { createHash } from "crypto";
-import { mkdirSync as mkdirSync3 } from "fs";
-import { dirname as dirname4 } from "path";
+import { mkdirSync as mkdirSync4 } from "fs";
+import { dirname as dirname5 } from "path";
 
 // src/lib/agent/memory/chunk.ts
 var BRACE_LANGUAGES = new Set([
@@ -18542,7 +18800,7 @@ class MemoryStore {
   constructor(path4) {
     this.path = path4;
     if (path4 !== ":memory:")
-      mkdirSync3(dirname4(path4), { recursive: true });
+      mkdirSync4(dirname5(path4), { recursive: true });
     this.db = new Database(path4);
     this.db.run("PRAGMA journal_mode = WAL");
     this.migrate();
@@ -18715,7 +18973,7 @@ function toChunk(row) {
 
 // src/lib/agent/memory/workspace-index.ts
 function storePath(root) {
-  return join6(root, ".agent", "memory.db");
+  return join7(root, ".agent", "memory.db");
 }
 function openStore(root) {
   return new MemoryStore(storePath(root));
@@ -18735,8 +18993,8 @@ async function indexWorkspace(root, options = {}) {
 }
 
 // src/lib/agent/memory/project-memory.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname5, join as join7 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname6, join as join8 } from "path";
 var DEFAULT_FILE = "PROJECT_MEMORY.md";
 var HEADER = `# Project memory
 
@@ -18745,16 +19003,16 @@ things about this project that are not in the code. Safe to edit or delete by
 hand: the agent only ever appends.
 `;
 function memoryPath(root) {
-  const atRoot = join7(root, DEFAULT_FILE);
-  if (existsSync4(atRoot))
+  const atRoot = join8(root, DEFAULT_FILE);
+  if (existsSync5(atRoot))
     return atRoot;
-  return join7(root, ".agent", DEFAULT_FILE);
+  return join8(root, ".agent", DEFAULT_FILE);
 }
 function readMemory(root) {
   const path4 = memoryPath(root);
-  if (!existsSync4(path4))
+  if (!existsSync5(path4))
     return [];
-  return parseMemory(readFileSync4(path4, "utf8"));
+  return parseMemory(readFileSync5(path4, "utf8"));
 }
 var ENTRY = /^- \[([^\]]+)\](?:\s*\(([^)]*)\))?\s+([\s\S]*)$/;
 function parseMemory(text) {
@@ -18778,16 +19036,16 @@ function remember(root, note, tag = null, now = new Date) {
   if (!text) {
     return { ok: false, path: path4, message: "There was nothing to remember." };
   }
-  const existing = existsSync4(path4) ? readFileSync4(path4, "utf8") : "";
+  const existing = existsSync5(path4) ? readFileSync5(path4, "utf8") : "";
   const entries = parseMemory(existing);
   const normal = (value) => value.toLowerCase().replace(/\s+/g, " ").trim();
   if (entries.some((entry) => normal(entry.note) === normal(text))) {
     return { ok: true, path: path4, duplicate: true, message: "Already remembered; nothing was added." };
   }
   const line = formatEntry({ note: text, tag, at: now.toISOString() });
-  mkdirSync4(dirname5(path4), { recursive: true });
+  mkdirSync5(dirname6(path4), { recursive: true });
   const body = existing || HEADER;
-  writeFileSync3(path4, `${body.replace(/\n+$/, "")}
+  writeFileSync4(path4, `${body.replace(/\n+$/, "")}
 ${line}
 `);
   return { ok: true, path: path4, message: `Remembered, in ${DEFAULT_FILE}.` };
@@ -18814,22 +19072,22 @@ function renderMemory(entries) {
 
 // src/lib/agent/mcp.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { join as join9 } from "path";
 function configPaths(root, home = process.env.HOME ?? "") {
   return [
-    join8(root, ".devstation", "mcp.json"),
-    join8(root, ".mcp.json"),
-    ...home ? [join8(home, ".devstation", "mcp.json")] : []
+    join9(root, ".devstation", "mcp.json"),
+    join9(root, ".mcp.json"),
+    ...home ? [join9(home, ".devstation", "mcp.json")] : []
   ];
 }
 function loadConfig(root, home = process.env.HOME ?? "") {
   const merged = { mcpServers: {} };
   for (const path4 of configPaths(root, home).reverse()) {
-    if (!existsSync5(path4))
+    if (!existsSync6(path4))
       continue;
     try {
-      const parsed = JSON.parse(readFileSync5(path4, "utf8"));
+      const parsed = JSON.parse(readFileSync6(path4, "utf8"));
       for (const [name, server] of Object.entries(parsed.mcpServers ?? {})) {
         if (server && typeof server.command === "string")
           merged.mcpServers[name] = server;
@@ -19089,12 +19347,12 @@ function failedResult(message) {
 
 // src/lib/agent/sandbox-exec.ts
 import { randomBytes } from "crypto";
-import { existsSync as existsSync7, statSync as statSync4, unlinkSync } from "fs";
-import { isAbsolute as isAbsolute3, join as join10, relative as relative4, resolve as resolve3, sep as sep4 } from "path";
+import { existsSync as existsSync8, statSync as statSync5, unlinkSync } from "fs";
+import { isAbsolute as isAbsolute3, join as join11, relative as relative4, resolve as resolve3, sep as sep4 } from "path";
 
 // src/lib/agent/project.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync3 } from "fs";
-import { dirname as dirname6, join as join9, relative as relative3, sep as sep3 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { dirname as dirname7, join as join10, relative as relative3, sep as sep3 } from "path";
 var SKIP = new Set([
   "node_modules",
   ".git",
@@ -19120,7 +19378,7 @@ var MANIFESTS = [
 var MAX_DEPTH = 2;
 function readScripts(absolute) {
   try {
-    const parsed = JSON.parse(readFileSync6(absolute, "utf8"));
+    const parsed = JSON.parse(readFileSync7(absolute, "utf8"));
     return parsed.scripts ?? {};
   } catch {
     return {};
@@ -19130,8 +19388,8 @@ function detectManifests(root) {
   const found = [];
   const scan = (dir, depth) => {
     for (const { file, ecosystem } of MANIFESTS) {
-      const absolute = join9(dir, file);
-      if (!existsSync6(absolute))
+      const absolute = join10(dir, file);
+      if (!existsSync7(absolute))
         continue;
       found.push({
         dir: relative3(root, dir).split(sep3).join("/"),
@@ -19151,9 +19409,9 @@ function detectManifests(root) {
     for (const entry of entries) {
       if (SKIP.has(entry) || entry.startsWith("."))
         continue;
-      const child = join9(dir, entry);
+      const child = join10(dir, entry);
       try {
-        if (statSync3(child).isDirectory())
+        if (statSync4(child).isDirectory())
           scan(child, depth + 1);
       } catch {}
     }
@@ -19240,7 +19498,7 @@ function lockfilesFor(manifest) {
   }
 }
 function cwdFor(root, manifest) {
-  return manifest.dir ? join9(root, manifest.dir) : root;
+  return manifest.dir ? join10(root, manifest.dir) : root;
 }
 
 // src/lib/agent/sandbox-exec.ts
@@ -19294,7 +19552,7 @@ var NEEDS = {
   go: ["go"]
 };
 async function probeImage(workspace, image, runtime) {
-  const ecosystems = [...new Set(detectManifests(workspace).map((m) => m.ecosystem))];
+  const ecosystems = gatingEcosystems(detectManifests(workspace));
   const wanted = [...new Set(ecosystems.flatMap((e) => NEEDS[e]))];
   if (wanted.length === 0)
     return { ok: true, missing: [], ecosystems };
@@ -19306,10 +19564,13 @@ async function probeImage(workspace, image, runtime) {
 `).map((l) => l.trim()).filter(Boolean);
   return { ok: missing.length === 0, missing, ecosystems };
 }
+function gatingEcosystems(manifests) {
+  return [...new Set(manifests.filter((m) => m.dir === "").map((m) => m.ecosystem))];
+}
 function probeProblem(probe, image) {
   if (probe.ok)
     return null;
-  return `This is a ${probe.ecosystems.join(" and ")} project, and the sandbox image ${image} has no ` + `${probe.missing.join(", ")}. Build an image that does and set DEVSTATION_SANDBOX_IMAGE, ` + "or run with --no-sandbox.";
+  return `The sandbox image ${image} has no ${probe.missing.join(", ")}, which this ${probe.ecosystems.join(" and ")} ` + "project uses, so commands that need it will fail inside the sandbox. Build an image that has it " + "and set DEVSTATION_SANDBOX_IMAGE, or run with --no-sandbox.";
 }
 function quote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -19415,16 +19676,16 @@ function sandboxExecutor(options) {
   };
   const verifyOwnership = async (name) => {
     const probe = `.devstation-uid-probe-${session}`;
-    const path4 = join10(options.workspace, probe);
+    const path4 = join11(options.workspace, probe);
     const written = await runShell(execCommand(name, `touch ${quote2(probe)}`, 20), {
       cwd: options.workspace,
       timeoutMs: 30000
     });
-    if (!written.ok || !existsSync7(path4)) {
+    if (!written.ok || !existsSync8(path4)) {
       return "The sandbox could not write to the workspace. Check the mount and try --no-sandbox.";
     }
     try {
-      const stat2 = statSync4(path4);
+      const stat2 = statSync5(path4);
       const [uid, gid] = user.split(":").map(Number);
       if (stat2.uid !== uid || stat2.gid !== gid) {
         return `The sandbox writes files as ${stat2.uid}:${stat2.gid} but this account is ${user}. ` + "Files it creates would not be yours to edit, and git would stop trusting the " + "repository, so it was not started. Run with --no-sandbox, or set " + "DEVSTATION_SANDBOX_USER.";
@@ -20475,37 +20736,37 @@ function summarise(call, outcome) {
 // src/lib/agent/session-store.ts
 import {
   appendFileSync,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync7,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync8,
   readdirSync as readdirSync6,
-  renameSync,
-  statSync as statSync5,
-  writeFileSync as writeFileSync4
+  renameSync as renameSync2,
+  statSync as statSync6,
+  writeFileSync as writeFileSync5
 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-var SESSIONS_DIR = join11(".agent", "sessions");
+var SESSIONS_DIR = join12(".agent", "sessions");
 
 class SessionStore {
   root;
   dir;
   constructor(root) {
     this.root = root;
-    this.dir = join11(root, SESSIONS_DIR);
+    this.dir = join12(root, SESSIONS_DIR);
   }
   ensure() {
-    mkdirSync5(this.dir, { recursive: true });
-    const ignore = join11(this.dir, "..", ".gitignore");
-    if (!existsSync8(ignore))
-      writeFileSync4(ignore, `*
+    mkdirSync6(this.dir, { recursive: true });
+    const ignore = join12(this.dir, "..", ".gitignore");
+    if (!existsSync9(ignore))
+      writeFileSync5(ignore, `*
 `);
   }
   jsonPath(id) {
-    return join11(this.dir, `${id}.json`);
+    return join12(this.dir, `${id}.json`);
   }
   eventPath(id) {
-    return join11(this.dir, `${id}.jsonl`);
+    return join12(this.dir, `${id}.jsonl`);
   }
   create(goal, meta) {
     this.ensure();
@@ -20535,21 +20796,21 @@ class SessionStore {
     record.updatedAt = new Date().toISOString();
     const target = this.jsonPath(record.id);
     const temporary = `${target}.tmp`;
-    writeFileSync4(temporary, JSON.stringify(record, null, 2));
-    renameSync(temporary, target);
+    writeFileSync5(temporary, JSON.stringify(record, null, 2));
+    renameSync2(temporary, target);
   }
   load(id) {
     const path4 = this.jsonPath(id);
-    if (!existsSync8(path4))
+    if (!existsSync9(path4))
       return null;
     try {
-      return JSON.parse(readFileSync7(path4, "utf8"));
+      return JSON.parse(readFileSync8(path4, "utf8"));
     } catch {
       return null;
     }
   }
   list() {
-    if (!existsSync8(this.dir))
+    if (!existsSync9(this.dir))
       return [];
     return readdirSync6(this.dir).filter((name) => name.endsWith(".json")).map((name) => this.load(name.slice(0, -".json".length))).filter((record) => record !== null).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   }
@@ -20563,12 +20824,12 @@ class SessionStore {
   }
   readEvents(id, fromByte = 0) {
     const path4 = this.eventPath(id);
-    if (!existsSync8(path4))
+    if (!existsSync9(path4))
       return { events: [], offset: 0 };
-    const size = statSync5(path4).size;
+    const size = statSync6(path4).size;
     if (size <= fromByte)
       return { events: [], offset: size };
-    const text = readFileSync7(path4, "utf8").slice(fromByte);
+    const text = readFileSync8(path4, "utf8").slice(fromByte);
     const events = [];
     let consumed = 0;
     for (const line of text.split(`
@@ -20663,7 +20924,8 @@ function renderSessions(records) {
 }
 
 // src/lib/agent/cli/commands.ts
-async function buildExecutor(root, sandbox) {
+async function buildExecutor(root, sandbox, warn = (message) => process.stderr.write(`warning: ${message}
+`)) {
   if (!sandbox)
     return { executor: hostExecutor() };
   const readiness = await sandboxReadiness();
@@ -20673,7 +20935,7 @@ async function buildExecutor(root, sandbox) {
   const probe = await probeImage(root, readiness.imageName, readiness.runtimeName);
   const mismatch = probeProblem(probe, readiness.imageName);
   if (mismatch)
-    return { problem: mismatch };
+    warn(mismatch);
   return { executor: sandboxExecutor({ workspace: root }) };
 }
 function isYes(answer) {
@@ -20962,7 +21224,17 @@ function configCommand(context) {
     context.terminal.out(JSON.stringify({
       workspace: context.root,
       git: isRepo(context.root),
-      provider: context.provider ? { name: context.provider.name, model: context.provider.model } : configuredProviderName() ?? null,
+      provider: context.provider ? { name: context.provider.name, model: context.provider.model } : (() => {
+        const r2 = resolveSettings({ root: context.root });
+        return {
+          name: r2.provider,
+          model: r2.model,
+          baseUrl: r2.baseUrl,
+          key: maskKey(r2.apiKey),
+          source: r2.source,
+          problem: r2.problem
+        };
+      })(),
       autonomy: context.autonomy ?? "ask_sensitive",
       maxSteps: context.maxSteps ?? 40,
       budgetUsd: context.maxCostUsd ?? null,
@@ -20971,10 +21243,14 @@ function configCommand(context) {
     }, null, 2));
     return 0;
   }
+  const r = resolveSettings({ root: context.root });
   const lines = [
     `workspace   ${context.root}`,
     `git         ${isRepo(context.root) ? "yes" : "no, so checkpoints are file snapshots under .devstation/"}`,
-    `provider    ${context.provider ? `${context.provider.name}/${context.provider.model}` : configuredProviderName() ?? "none configured, set ANTHROPIC_API_KEY or OPENROUTER_API_KEY"}`,
+    context.provider ? `provider    ${context.provider.name}/${context.provider.model}  (this session)` : `provider    ${r.provider ?? "none"}  (${r.source.provider})`,
+    `model       ${context.provider ? context.provider.model : r.model ?? "provider default"}  (${context.provider ? "this session" : r.source.model})`,
+    `endpoint    ${r.baseUrl ?? (r.provider ? DEFAULT_BASE_URL[r.provider] : "none")}  (${r.source.baseUrl})`,
+    `api key     ${maskKey(r.apiKey)}  (${r.source.apiKey})`,
     `autonomy    ${context.autonomy ?? "ask_sensitive"}`,
     `max steps   ${context.maxSteps ?? 40}`,
     `budget      ${context.maxCostUsd ? `$${context.maxCostUsd}` : "none set"}`,
@@ -20982,16 +21258,171 @@ function configCommand(context) {
   ];
   for (const line of lines)
     context.terminal.out(line);
+  if (r.problem && !context.provider)
+    context.terminal.err(`
+${r.problem}`);
+  for (const warning of r.warnings)
+    context.terminal.err(`warning: ${warning}`);
+  return 0;
+}
+function home() {
+  return process.env.HOME ?? "";
+}
+function homeDirectoryWarning(root, homeDir = process.env.HOME ?? "") {
+  if (!homeDir)
+    return null;
+  const strip2 = (p) => p.replace(/\/+$/, "");
+  if (strip2(root) !== strip2(homeDir))
+    return null;
+  return "You are in your home directory, so the agent treats everything under it as one project, " + "every repository inside it included. cd into the project you mean first.";
+}
+function configEditCommand(context, rest, opts = {}) {
+  const [action, key, ...valueWords] = rest.trim().split(/\s+/);
+  const value = valueWords.join(" ").trim();
+  const path4 = opts.project ? projectConfigPath(context.root) : globalConfigPath(home());
+  if (action === "path") {
+    context.terminal.out(`global       ${globalConfigPath(home())}`);
+    context.terminal.out(`project      ${projectConfigPath(context.root)}`);
+    context.terminal.out(`credentials  ${credentialsPath(home())}`);
+    return 0;
+  }
+  if (key === "apiKey" || key === "key") {
+    context.terminal.err(`API keys are not stored in config. Run \`devstation login\` to store one in ${credentialsPath(home())}.`);
+    return 2;
+  }
+  if (!key || !SETTING_KEYS.includes(key)) {
+    context.terminal.err(`Unknown setting "${key ?? ""}". Settings: ${SETTING_KEYS.join(", ")}.`);
+    return 2;
+  }
+  const name = key;
+  const current = readSettingsFile(path4);
+  if (action === "get") {
+    context.terminal.out(current[name] ?? "");
+    return 0;
+  }
+  if (action === "unset") {
+    delete current[name];
+    writeSettingsFile(path4, current);
+    context.terminal.out(`Removed ${name} from ${path4}.`);
+    return 0;
+  }
+  if (action === "set") {
+    if (!value) {
+      context.terminal.err(`Give it a value: devstation config set ${name} <value>`);
+      return 2;
+    }
+    if (name === "provider" && !PROVIDER_IDS.includes(value.toLowerCase())) {
+      context.terminal.err(`Unknown provider "${value}". Providers: ${PROVIDER_IDS.join(", ")}.`);
+      return 2;
+    }
+    if (name === "baseUrl" && !/^https?:\/\//.test(value)) {
+      context.terminal.err("baseUrl must start with http:// or https://.");
+      return 2;
+    }
+    current[name] = name === "baseUrl" ? value.replace(/\/+$/, "") : name === "provider" ? value.toLowerCase() : value;
+    writeSettingsFile(path4, current);
+    context.terminal.out(`Set ${name} = ${current[name]} in ${path4}.`);
+    return 0;
+  }
+  context.terminal.err("Use: devstation config set <key> <value> | get <key> | unset <key> | path   (add --project for this workspace)");
+  return 2;
+}
+async function loginCommand(context, rest) {
+  const t = context.terminal;
+  const secret = t.askSecret ? (q) => t.askSecret(q) : (q) => t.ask(q);
+  let provider = (rest.trim().split(/\s+/)[0] ?? "").toLowerCase();
+  if (!provider) {
+    t.out("Which provider?");
+    t.out("  anthropic   Claude, directly (prompt caching, native tool use)");
+    t.out("  openrouter  one key for Claude, GPT, Gemini, DeepSeek and more");
+    t.out("  openai      OpenAI, or any compatible server: Ollama, LM Studio, Groq, Together");
+    provider = (await t.ask("provider [anthropic]: ")).trim().toLowerCase() || "anthropic";
+  }
+  if (!PROVIDER_IDS.includes(provider)) {
+    t.err(`Unknown provider "${provider}". Providers: ${PROVIDER_IDS.join(", ")}.`);
+    return 2;
+  }
+  const id = provider;
+  let baseUrl = "";
+  if (id === "openai") {
+    baseUrl = (await t.ask(`endpoint [${DEFAULT_BASE_URL.openai}]: `)).trim();
+    if (baseUrl && !/^https?:\/\//.test(baseUrl)) {
+      t.err("The endpoint must start with http:// or https://.");
+      return 2;
+    }
+  }
+  const key = (await secret(id === "openai" ? "API key (blank for a local server): " : "API key: ")).trim();
+  if (!key && id !== "openai") {
+    t.err("No key entered, so nothing was saved.");
+    return 2;
+  }
+  const modelHint = id === "anthropic" ? "claude-sonnet-5" : id === "openrouter" ? "anthropic/claude-sonnet-5" : "required";
+  const model = (await t.ask(`model [${modelHint}]: `)).trim();
+  if (id === "openai" && !model) {
+    t.err("The openai provider needs a model name, because every compatible server names them differently.");
+    return 2;
+  }
+  const h = home();
+  if (!h) {
+    t.err("HOME is not set, so there is nowhere to store settings.");
+    return 2;
+  }
+  if (key) {
+    const credentials = readCredentials(h);
+    credentials[id] = key;
+    writeCredentials(h, credentials);
+  }
+  const settings2 = readSettingsFile(globalConfigPath(h));
+  settings2.provider = id;
+  if (model)
+    settings2.model = model;
+  else
+    delete settings2.model;
+  if (baseUrl)
+    settings2.baseUrl = baseUrl.replace(/\/+$/, "");
+  else if (id !== "openai")
+    delete settings2.baseUrl;
+  writeSettingsFile(globalConfigPath(h), settings2);
+  t.out("");
+  t.out(`Saved. provider ${id}, model ${model || "provider default"}${baseUrl ? `, endpoint ${baseUrl}` : ""}`);
+  if (key)
+    t.out(`key ${maskKey(key)} in ${credentialsPath(h)} (readable only by you)`);
+  t.out(`settings in ${globalConfigPath(h)}`);
+  t.out("");
+  t.out("Check it with: devstation doctor");
+  return 0;
+}
+function logoutCommand(context, rest) {
+  const h = home();
+  const target = (rest.trim().split(/\s+/)[0] ?? "").toLowerCase();
+  if (target && !PROVIDER_IDS.includes(target)) {
+    context.terminal.err(`Unknown provider "${target}". Providers: ${PROVIDER_IDS.join(", ")}.`);
+    return 2;
+  }
+  const credentials = readCredentials(h);
+  const removed = target ? credentials[target] ? [target] : [] : Object.keys(credentials);
+  if (removed.length === 0) {
+    context.terminal.out(target ? `No stored key for ${target}.` : "No stored keys.");
+    return 0;
+  }
+  if (target)
+    delete credentials[target];
+  writeCredentials(h, target ? credentials : {});
+  context.terminal.out(`Removed the stored key for ${removed.join(", ")}.`);
+  context.terminal.out("Keys exported in your shell (ANTHROPIC_API_KEY, OPENROUTER_API_KEY, OPENAI_API_KEY) are not touched.");
   return 0;
 }
 async function runChecks(root, env2 = process.env) {
   const checks = [];
-  const provider = configuredProviderName(env2);
+  const settings2 = resolveSettings({ root, env: env2 });
   checks.push({
     name: "model provider",
-    ok: provider !== null,
-    detail: provider ?? "set ANTHROPIC_API_KEY, or OPENROUTER_API_KEY"
+    ok: settings2.problem === null,
+    detail: settings2.problem ?? `${settings2.provider}${settings2.model ? `/${settings2.model}` : ""}, key from ${settings2.source.apiKey}`
   });
+  for (const warning of settings2.warnings) {
+    checks.push({ name: "settings", ok: false, detail: warning });
+  }
   const git2 = await runShell("git --version", { cwd: root, timeoutMs: 15000 });
   checks.push({
     name: "git",
@@ -21000,7 +21431,7 @@ async function runChecks(root, env2 = process.env) {
   });
   checks.push({
     name: "workspace",
-    ok: existsSync9(root),
+    ok: existsSync10(root),
     detail: isRepo(root) ? `${root} (a git repository)` : `${root} (not a git repository)`
   });
   let writable = false;
@@ -21133,11 +21564,11 @@ function wordmark(ink = "\u2588") {
   return rows;
 }
 var WORDMARK_WIDTH = wordmark()[0].length;
-function shortPath(path4, home = process.env.HOME ?? "") {
-  if (home && path4 === home)
+function shortPath(path4, home2 = process.env.HOME ?? "") {
+  if (home2 && path4 === home2)
     return "~";
-  if (home && path4.startsWith(`${home}/`))
-    return `~${path4.slice(home.length)}`;
+  if (home2 && path4.startsWith(`${home2}/`))
+    return `~${path4.slice(home2.length)}`;
   return path4;
 }
 function banner(facts, options = {}) {
@@ -21301,8 +21732,8 @@ async function chatCommand(context, opening = "") {
 }
 
 // src/lib/agent/cli/repo-command.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync5, existsSync as existsSync10 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync6, existsSync as existsSync11 } from "fs";
+import { join as join13 } from "path";
 
 // src/lib/github-repos.ts
 var API = "https://api.github.com";
@@ -21546,11 +21977,11 @@ function filesFromArchive(entries, limits = {}) {
 // src/lib/agent/cli/repo-command.ts
 function workspaceFor(root, owner, name, now) {
   const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\..*/, "").replace("T", "-");
-  const dir = join12(root, ".devstation", "repos", `${owner}-${name}-${stamp}`);
-  mkdirSync6(dir, { recursive: true });
-  const ignore = join12(root, ".devstation", ".gitignore");
-  if (!existsSync10(ignore))
-    writeFileSync5(ignore, `*
+  const dir = join13(root, ".devstation", "repos", `${owner}-${name}-${stamp}`);
+  mkdirSync7(dir, { recursive: true });
+  const ignore = join13(root, ".devstation", ".gitignore");
+  if (!existsSync11(ignore))
+    writeFileSync6(ignore, `*
 `);
   return dir;
 }
@@ -21726,6 +22157,169 @@ function lineReader(rl, write) {
   };
 }
 
+// src/lib/agent/cli/upgrade.ts
+import { spawnSync } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync8, readFileSync as readFileSync9, renameSync as renameSync3, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname8, join as join14 } from "path";
+var PACKAGE = "@devstationlabs/cli";
+var REPO = "linoxbt/dev-shipyard";
+var DAY_MS = 24 * 60 * 60 * 1000;
+function installMethod(execPath = process.execPath, script = process.argv[1] ?? "") {
+  const slash = (p) => p.replace(/\\/g, "/");
+  const marker = `node_modules/${PACKAGE}/`;
+  if (slash(execPath).includes(marker) || slash(script).includes(marker))
+    return "npm";
+  if (/\.(ts|tsx)$/.test(script) && /(^|\/)bun(\.exe)?$/.test(slash(execPath)))
+    return "source";
+  return "binary";
+}
+function compareVersions(a, b) {
+  const parts = (v) => v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const [x, y] = [parts(a), parts(b)];
+  for (let i = 0;i < Math.max(x.length, y.length); i++) {
+    const d = (x[i] ?? 0) - (y[i] ?? 0);
+    if (d !== 0)
+      return d > 0 ? 1 : -1;
+  }
+  return 0;
+}
+async function latestVersion(fetchImpl = fetch, timeoutMs = 4000) {
+  try {
+    const res = await fetchImpl(`https://registry.npmjs.org/${PACKAGE.replace("/", "%2f")}/latest`, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok)
+      return null;
+    const body = await res.json();
+    return typeof body.version === "string" ? body.version : null;
+  } catch {
+    return null;
+  }
+}
+function targetFor(platform = process.platform, arch = process.arch) {
+  const map = {
+    "linux-x64": "devstation-linux-x64",
+    "linux-arm64": "devstation-linux-arm64",
+    "darwin-arm64": "devstation-darwin-arm64",
+    "darwin-x64": "devstation-darwin-x64",
+    "win32-x64": "devstation-windows-x64.exe"
+  };
+  return map[`${platform}-${arch}`] ?? null;
+}
+function runInherit(command, args) {
+  const result = spawnSync(command, args, { stdio: "inherit" });
+  if (result.error)
+    return 127;
+  return result.status ?? 1;
+}
+async function upgradeCommand(context, opts = {}) {
+  const t = context.terminal;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const latest = await latestVersion(fetchImpl);
+  if (!latest) {
+    t.err("Could not reach the npm registry to check for a newer version. Nothing was changed.");
+    return 1;
+  }
+  if (compareVersions(latest, VERSION) <= 0) {
+    t.out(`devstation ${VERSION} is the latest version.`);
+    return 0;
+  }
+  t.out(`devstation ${latest} is available (you have ${VERSION}).`);
+  const method = installMethod(opts.execPath, opts.script);
+  if (opts.check) {
+    t.out(method === "source" ? "This is a source checkout: update it with git pull." : "Upgrade with: devstation upgrade");
+    return 0;
+  }
+  switch (method) {
+    case "npm": {
+      t.out(`Installed through npm, so upgrading through npm: npm install -g ${PACKAGE}@${latest}`);
+      const code = (opts.run ?? runInherit)("npm", ["install", "-g", `${PACKAGE}@${latest}`]);
+      if (code !== 0) {
+        t.err(`npm exited with ${code}. Nothing else was changed. Run it yourself: npm install -g ${PACKAGE}@latest`);
+        return code === 0 ? 1 : code;
+      }
+      t.out(`Upgraded to ${latest}. If your shell still runs the old one, run: hash -r`);
+      return 0;
+    }
+    case "source":
+      t.out("This is running from a source checkout. Update it with git pull, not upgrade.");
+      return 0;
+    case "binary":
+      return replaceBinary(t, latest, opts.execPath ?? process.execPath, fetchImpl);
+  }
+}
+async function replaceBinary(t, latest, execPath, fetchImpl) {
+  const target = targetFor();
+  if (!target) {
+    t.err(`There is no prebuilt binary for ${process.platform}-${process.arch}.`);
+    return 1;
+  }
+  if (process.platform === "win32") {
+    t.err(`A running .exe cannot replace itself on Windows. Download ${target} from https://github.com/${REPO}/releases/latest and swap it in.`);
+    return 1;
+  }
+  const base = `https://github.com/${REPO}/releases/download/v${latest}`;
+  t.out(`Downloading ${target} ${latest}\u2026`);
+  try {
+    const sums = await fetchImpl(`${base}/SHA256SUMS`, { redirect: "follow" });
+    if (!sums.ok)
+      throw new Error(`${sums.status} fetching the checksums`);
+    const expected = (await sums.text()).split(`
+`).map((line) => line.trim().split(/\s+/)).find(([, name]) => name === target)?.[0];
+    if (!expected)
+      throw new Error(`no checksum is published for ${target}`);
+    const bin = await fetchImpl(`${base}/${target}`, { redirect: "follow" });
+    if (!bin.ok)
+      throw new Error(`${bin.status} downloading ${target}`);
+    const body = Buffer.from(await bin.arrayBuffer());
+    const actual = createHash2("sha256").update(body).digest("hex");
+    if (actual !== expected) {
+      throw new Error(`the download does not match its checksum (expected ${expected}, got ${actual})`);
+    }
+    const partial = `${execPath}.partial`;
+    writeFileSync7(partial, body);
+    chmodSync2(partial, 493);
+    renameSync3(partial, execPath);
+  } catch (error2) {
+    const message2 = error2 instanceof Error ? error2.message : String(error2);
+    const permission = /EACCES|EPERM/.test(message2) ? " Run it with sudo, since the binary is in a system directory." : "";
+    t.err(`Upgrade failed and the installed version was left untouched: ${message2}.${permission}`);
+    return 1;
+  }
+  t.out(`Upgraded ${execPath} to ${latest}.`);
+  return 0;
+}
+function notifyIfOutdated(terminal, opts = {}) {
+  const env2 = opts.env ?? process.env;
+  if (env2.DEVSTATION_NO_UPDATE_CHECK === "1" || env2.CI)
+    return Promise.resolve();
+  const homeDir = opts.home ?? env2.HOME ?? "";
+  if (!homeDir)
+    return Promise.resolve();
+  const path4 = join14(homeDir, ".devstation", "update-check.json");
+  let cached = {};
+  try {
+    cached = JSON.parse(readFileSync9(path4, "utf8"));
+  } catch {}
+  if (cached.latest && compareVersions(cached.latest, VERSION) > 0) {
+    terminal.err(`devstation ${cached.latest} is available (you have ${VERSION}). Run: devstation upgrade`);
+  }
+  const now = opts.now ?? Date.now();
+  if (cached.checkedAt && now - cached.checkedAt < DAY_MS)
+    return Promise.resolve();
+  return latestVersion(opts.fetchImpl ?? fetch, 2500).then((latest) => {
+    if (!latest)
+      return;
+    try {
+      mkdirSync8(dirname8(path4), { recursive: true, mode: 448 });
+      writeFileSync7(path4, `${JSON.stringify({ checkedAt: now, latest })}
+`);
+    } catch {}
+  });
+}
+
 // src/lib/agent/cli/index.ts
 async function main(argv) {
   const parsed = parseArgs(argv);
@@ -21745,12 +22339,24 @@ ${HELP}`);
     return 0;
   }
   const root = resolve4(parsed.root);
-  if (!existsSync11(root)) {
+  if (!existsSync12(root)) {
     process.stderr.write(`There is no directory at ${root}.
 `);
     return 2;
   }
-  const readline2 = createInterface2({ input: process.stdin, output: process.stdout });
+  let muted = false;
+  const output = new Writable({
+    write(chunk, encoding, done) {
+      if (!muted)
+        process.stdout.write(chunk, encoding);
+      done();
+    }
+  });
+  const readline2 = createInterface2({
+    input: process.stdin,
+    output,
+    terminal: Boolean(process.stdin.isTTY)
+  });
   const input = lineReader(readline2, (text) => process.stdout.write(text));
   const terminal = {
     out: (text) => process.stdout.write(`${text}
@@ -21758,6 +22364,18 @@ ${HELP}`);
     err: (text) => process.stderr.write(`${text}
 `),
     ask: (question) => input.ask(question),
+    askSecret: async (question) => {
+      process.stdout.write(question);
+      muted = true;
+      try {
+        return await input.ask("");
+      } finally {
+        muted = false;
+        if (process.stdin.isTTY)
+          process.stdout.write(`
+`);
+      }
+    },
     write: process.stdout.isTTY ? (text) => process.stdout.write(text) : undefined,
     colour: colourEnabled()
   };
@@ -21784,7 +22402,13 @@ Stopping. The session is saved; resume it with \`${CLI_NAME} resume\`.`);
       case "tools":
         return toolsCommand(offline);
       case "config":
-        return configCommand(offline);
+        return parsed.rest.trim() ? configEditCommand(offline, parsed.rest, { project: parsed.project }) : configCommand(offline);
+      case "login":
+        return await loginCommand(offline, parsed.rest);
+      case "logout":
+        return logoutCommand(offline, parsed.rest);
+      case "upgrade":
+        return await upgradeCommand(offline, { check: parsed.check });
       case "doctor":
         return await doctorCommand(offline);
       case "index":
@@ -21796,12 +22420,19 @@ Stopping. The session is saved; resume it with \`${CLI_NAME} resume\`.`);
       default:
         break;
     }
-    const provider = providerFromEnv(process.env, parsed.model);
+    const settings2 = resolveSettings({ root, model: parsed.model });
+    for (const warning of settings2.warnings)
+      terminal.err(`warning: ${warning}`);
+    const provider = providerFromSettings(settings2);
     if (!provider) {
-      terminal.err("No model provider is configured. Set ANTHROPIC_API_KEY (or OPENROUTER_API_KEY) and try again.");
+      terminal.err(settings2.problem ?? "No model provider is configured.");
       terminal.err(`Run \`${CLI_NAME} doctor\` to see what else is missing.`);
       return 2;
     }
+    const atHome = homeDirectoryWarning(root);
+    if (atHome)
+      terminal.err(`warning: ${atHome}`);
+    notifyIfOutdated(terminal);
     const ctx = context(root, terminal, parsed, provider);
     ctx.signal = controller.signal;
     if (parsed.command === "repo") {
@@ -21824,7 +22455,7 @@ Stopping. The session is saved; resume it with \`${CLI_NAME} resume\`.`);
       terminal.err(`Give it something to do: ${CLI_NAME} run "fix the failing test in src/lib"`);
       return 2;
     }
-    terminal.out(`using ${configuredProviderName()}`);
+    terminal.out(`using ${provider.name}/${provider.model}`);
     const { code } = await runCommand(ctx, parsed.rest);
     return code;
   } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devstationlabs/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "The DevStation coding agent, in your terminal.",
   "license": "MIT",
   "type": "module",