@garuda-agent/garuda 0.15.0 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.16.1 (2026-10-06)
+
+- `garuda acp` offers its sign-in (Terminal Auth) also to clients that declare the capability in
+  its older form, `_meta["terminal-auth"]`. The ACP Registry's checker sends only that form, so
+  0.16.0 answered it with no sign-in method and failed the registry's auth check.
+
+## 0.16.0 (2026-10-06)
+
+Setup for editors and the ACP Registry (design: [docs/lld/setup.md](docs/lld/setup.md)).
+
+- Stored provider keys: Garuda reads `~/.garuda/credentials` (JSON, key name → key) when no
+  environment variable sets the key. It reads the file only when it is a regular file (not a link),
+  owned by you, with mode 0600; else it ignores the file with a warning. The key never enters
+  Garuda's environment, and the redactor knows it. `garuda setup` writes this file.
+- Commands in the OS sandbox cannot read `~/.garuda/credentials` (macOS and Linux).
+- `"default"` in `~/.garuda/models.json`: the model when neither `--model` nor `GARUDA_MODEL` names
+  one.
+- The redactor removes every provider key that Garuda keeps, also one whose variable name does not
+  look secret (a custom provider's `apiKeyEnv`).
+- `garuda setup`: choose a provider and a model, enter the key once (hidden input), check it with
+  one free request to the provider, then store the model as the default and the key in
+  `~/.garuda/credentials`. `--show` shows where each key comes from (masked); `--forget [NAME]`
+  removes stored keys. With no terminal, it stops with a message.
+- The messages for a missing model or key name `garuda setup`.
+- `garuda acp`: Terminal Auth. An editor that can run it (`auth.terminal`) gets a "Set up Garuda"
+  method; it runs `garuda acp setup` in a terminal. A session with no model or no key fails with
+  ACP's "auth required", so the editor offers the setup. The setup is read again for each new
+  session: no restart after `garuda setup`.
+- Native Windows: `garuda acp` sessions and `garuda setup` stop with a message to use WSL.
+- Docs: `garuda setup` in the quick start, the landing page, the README and the Editors page; editor
+  entries need no API key in their settings. Tested live in Zed 1.22: with no model and no key, Zed
+  offered the setup, ran it in a terminal, and the next thread worked with no restart.
+- `-p --output-format stream-json`: `apiKeySource` in `system/init` is `credentials` for a stored
+  Claude key.
+
 ## 0.15.0 (2026-10-06)
 
 Garuda in your editor. Version 0.15.0 is not the old "0.15" branch label of the status table (code

package/README.md

@@ -4,8 +4,9 @@
 
 Website and docs: https://madhu-sv.github.io/garuda/
 
-Garuda is a terminal coding agent. This is version 0.15.0: Garuda in your editor over the Agent Client
-Protocol (`garuda acp`), on top of 0.14.1 (the 0.14–0.17 branches after the merge gate and Garuda's own
+Garuda is a terminal coding agent. This is version 0.16.1: `garuda setup` (choose a model and store
+its key once) and the sign-in from editors, on top of 0.15.0 (Garuda in your editor over the Agent
+Client Protocol, `garuda acp`) and 0.14.1 (the 0.14–0.17 branches after the merge gate and Garuda's own
 review; see the notes under the status table). Release notes: [CHANGELOG.md](CHANGELOG.md).
 Design documents: [docs/](docs/README.md) (architecture, high-level design, low-level design per component).
 The requirements doc defines the scope. Code, tests and commits refer to its IDs (F1–F26, N1–N8).
@@ -36,9 +37,10 @@ The requirements doc defines the scope. Code, tests and commits refer to its IDs
 | 0.16: language plugins (Go and Rust built in, user plugins in ~/.garuda/languages, /languages; project plugins not loaded) | Done (0.14.0) |
 | 0.17: Mixture-of-Experts subagents (opt-in), team policy and audit log (W5) | Done (0.14.0) |
 | Editors over the Agent Client Protocol (`garuda acp`: VS Code with an extension, Zed, JetBrains, Neovim, Emacs) | Done (0.15.0) |
+| `garuda setup` (model and stored key) and the editor sign-in (ACP Terminal Auth) | Done (0.16.0) |
 
-The rows labelled 0.14–0.17 are branch labels, not versions: the "0.15" branch (code intelligence)
-shipped in 0.14.0. The editors row is version 0.15.0.
+The rows labelled 0.14–0.17 are branch labels, not versions: the "0.15" and "0.16" branches (code
+intelligence, language plugins) shipped in 0.14.0. The last two rows are versions 0.15.0 and 0.16.0.
 
 The 0.14–0.17 rows were built on stacked branches that were never released. They ship together as
 0.14.0 after the merge gate: the high findings of the branch review are fixed (policy source, audit
@@ -50,7 +52,7 @@ headings below keep the branch labels (0.14–0.17).
 Before 0.14.0, Garuda reviewed its own code with Fable 5.1, one area at a time (knowledge,
 permissions, tools, sandbox, audit, loop, agents), in plan mode. 0.14.1 adds the cli and extensions
 areas and fixes the open findings of all nine areas (see [CHANGELOG.md](CHANGELOG.md)). Known limits
-in 0.15.0:
+in 0.16.1:
 
 - G09: project language plugins are not loaded (no consent flow for their imports yet).
 - Subagents: each child has its own step and token budget (capped by the team policy); it does not
@@ -65,6 +67,9 @@ in 0.15.0:
 - Editors (`garuda acp`): Garuda's session history is not in the editor (no `session/load`), the
   editor's MCP servers are not started, Garuda reads saved files (not unsaved buffers), the terminal's
   own commands (`/undo`, `/diff` …) are not available, and an edit is approved as a whole (no hunks).
+- Stored keys are in a file (`~/.garuda/credentials`, mode 0600, hidden from the sandbox), not in the
+  OS keychain yet. Keep the file out of backups and dotfile sync.
+- Native Windows is not supported; use WSL.
 
 ## Use
 
@@ -98,8 +103,7 @@ pnpm link --global  # optional: puts `garuda` on your PATH (run `pnpm setup` onc
 Then:
 
 ```sh
-export ANTHROPIC_API_KEY=...
-export GARUDA_MODEL=<model-id>
+garuda setup                            # once: pick a provider and model, enter the key
 garuda                                  # chat in the current folder
 garuda -p "Explain what this repo does" # run one task and exit
 echo "Explain this repo" | garuda       # the same, from stdin
@@ -107,6 +111,13 @@ echo "Explain this repo" | garuda       # the same, from stdin
 
 From a source build without `pnpm link`, use `node dist/cli/index.js` in place of `garuda`.
 
+`garuda setup` (0.16) asks for the provider, the model and the key (hidden input), checks the key
+with one free request to the provider, and stores the model as `"default"` in
+`~/.garuda/models.json` and the key in `~/.garuda/credentials` (mode 0600; commands in the sandbox
+cannot read it). `garuda setup --show` shows the model and where each key comes from (masked);
+`garuda setup --forget [NAME]` removes stored keys. Environment variables still work and win:
+`ANTHROPIC_API_KEY`, `GARUDA_MODEL`. Do not sync or back up `~/.garuda/credentials` to other places.
+
 Tools: read_file, glob and grep run with no question.
 write_file, edit_file and bash show a diff or the command first. You pick: allow once, allow for this session, or deny.
 Commands run in an OS sandbox when your machine has one (see Sandbox below). Without a sandbox,
@@ -150,13 +161,15 @@ Set the context window, price and output limit per model, and add providers, in
 ```json
 {
   "providers": { "lab": { "type": "openai-compatible", "baseUrl": "https://llm.example.com/v1", "apiKeyEnv": "LAB_KEY" } },
-  "models": { "ollama/qwen3-coder:30b": { "contextWindow": 65536, "maxTokens": 8192 } }
+  "models": { "ollama/qwen3-coder:30b": { "contextWindow": 65536, "maxTokens": 8192 } },
+  "default": "ollama/qwen3-coder:30b"
 }
 ```
 
 - Only this file in your home folder can define providers; a project cannot send your code elsewhere.
   Keys come from environment variables. Plain http works only to this machine (or with
   `"allowInsecureHttp": true`).
+- `"default"` is the model when neither `--model` nor `GARUDA_MODEL` names one.
 - Some small models write a tool call as JSON text. When the whole reply is such a call to a known
   tool, Garuda runs it as a real call, with the usual approvals. For a model that also writes
   sentences around the call (for example `qwen2.5-coder:7b`), set `"textToolCalls": "lines"` for that
@@ -252,12 +265,14 @@ Set the context window, price and output limit per model, and add providers, in
 
 Model text goes to stdout; tool activity and notes go to stderr. So `garuda -p "…" > answer.md` keeps only the answer.
 
-## Editors (ACP, 0.15)
+## Editors (ACP, 0.15; sign-in 0.16)
 
 `garuda acp` runs Garuda as an agent for editors that speak the Agent Client Protocol. The editor
 starts it, shows the conversation, the tool calls and the questions, and Garuda does the work with
 the same permission engine, OS sandbox, team policy, hooks and audit log as in the terminal.
 
+Run `garuda setup` once in a terminal (see Use): then the editor needs no key in its settings.
+
 VS Code, with the extension "ACP Client" (`formulahendry.acp-client`), in the user settings
 (Cmd+Shift+P, **Preferences: Open User Settings (JSON)**). Use the full path from `which garuda`:
 VS Code started from the Dock does not get your shell's `PATH`.
@@ -265,18 +280,16 @@ VS Code started from the Dock does not get your shell's `PATH`.
 ```json
 {
   "acp.agents": {
-    "Garuda": {
-      "command": "/opt/homebrew/bin/garuda",
-      "args": ["acp"],
-      "env": { "GARUDA_MODEL": "claude-sonnet-5", "ANTHROPIC_API_KEY": "..." }
-    }
+    "Garuda": { "command": "/opt/homebrew/bin/garuda", "args": ["acp"] }
   }
 }
 ```
 
-Zed: the same command, argument and environment under `agent_servers` (with `"type": "custom"`).
-The website's [Editors](https://madhu-sv.github.io/garuda/docs/editors/) page has the steps, a way
-to keep the API key out of `settings.json`, and what the editor shows.
+Zed: the same command and argument under `agent_servers` (with `"type": "custom"`). With no model
+or key, Zed offers **Set up Garuda** (ACP Terminal Auth, 0.16): it runs `garuda acp setup` in a
+terminal, and the next thread works. The website's
+[Editors](https://madhu-sv.github.io/garuda/docs/editors/) page has the steps and what the editor
+shows.
 
 - Each edit asks in the editor, with the editor's diff view; "Allow for this session" lasts for this
   session only. Keep an extension's auto-approve off: it answers Garuda's questions for you.

package/dist/{acpCommand-FZ2P5JFO.js → acpCommand-OTAYW7BS.js}

@@ -1,46 +1,65 @@
 #!/usr/bin/env node
-import {
-  keepProviderKey,
-  loadModelsConfig,
-  resolveModel
-} from "./chunk-YFQJXRIJ.js";
 import {
   FileSessionStore,
   Runtime,
   auditDirFor
-} from "./chunk-K7KK7U44.js";
-import "./chunk-A2QAIRQL.js";
-import "./chunk-HRGX53VC.js";
+} from "./chunk-TILFPYWO.js";
 import "./chunk-G2AX7MGS.js";
+import "./chunk-A2QAIRQL.js";
+import "./chunk-ULAJPMY7.js";
+import {
+  chooseModel,
+  keepProviderKeys,
+  loadModelsConfig,
+  providerKeySource,
+  resolveModel
+} from "./chunk-NP6RIC25.js";
+import "./chunk-EIXUSVFX.js";
+import "./chunk-R7I2NBPX.js";
 import {
   loadSearchConfig
 } from "./chunk-B25VL4RU.js";
 import "./chunk-23FXBNBB.js";
 import {
   VERSION
-} from "./chunk-EPKWDCV4.js";
+} from "./chunk-VBZCNMUD.js";
 import "./chunk-5DEWP3YX.js";
 import "./chunk-ZAE25JM2.js";
 import "./chunk-ATW7BNIG.js";
 import "./chunk-PZS3V6P3.js";
 import "./chunk-OUCV3FCT.js";
-import "./chunk-SI2QJYCR.js";
+import "./chunk-GXZACJUI.js";
 import "./chunk-WMOLXTBU.js";
+import "./chunk-3EQU2GUX.js";
 import "./chunk-HUIK3WXO.js";
 import "./chunk-3NJNVZTK.js";
 
 // src/cli/acpCommand.ts
 import { homedir } from "os";
 import { Readable } from "stream";
+var WINDOWS_MESSAGE = "Garuda supports macOS and Linux. On Windows, run Garuda in WSL (Windows Subsystem for Linux).";
 async function acpCommand(options) {
+  if (options.action !== void 0) {
+    if (options.action !== "setup") {
+      process.stderr.write(`Unknown argument "${options.action}". Use: garuda acp [setup]
+`);
+      return 1;
+    }
+    const { setupCommand, terminalIO } = await import("./setupCommand-VA7D5MZK.js");
+    return setupCommand({}, { io: await terminalIO() });
+  }
   const output = protocolOutput(process.stdout, process.stderr);
   const input = Readable.toWeb(process.stdin);
-  const setup = await prepare(options);
-  const { acpServer } = await import("./server-R3GNIC33.js");
+  const { acpServer, setupNeeded } = await import("./server-NGKVIQEV.js");
   const server = acpServer({
     version: VERSION,
+    // Not on native Windows: the setup there could not keep a key private (no 0600).
+    ...process.platform === "win32" ? {} : { terminalAuth: { args: ["setup"] } },
     createRuntime: async ({ root, approver, onEvent, onNotice }) => {
-      if (typeof setup === "string") throw new Error(setup);
+      const setup = await prepare(options);
+      if ("problem" in setup) {
+        throw setup.setupNeeded ? setupNeeded(setup.problem) : new Error(setup.problem);
+      }
       return createRuntime(setup, { root, approver, onEvent, onNotice });
     }
   });
@@ -64,11 +83,15 @@ function protocolOutput(stdout, stderr) {
     })
   });
 }
-async function prepare(options) {
-  const spec = options.model ?? process.env.GARUDA_MODEL;
-  if (!spec) return "Set a model with --model <id> or the GARUDA_MODEL variable.";
-  const models = await loadModelsConfig();
-  if (models.problem !== void 0) return models.problem;
+var SETUP_HINT = "Run `garuda setup` in a terminal, or use the editor's sign-in for Garuda.";
+async function prepare(options, from = {}) {
+  const fail = (problem, setupNeeded = false) => ({ problem, setupNeeded });
+  if ((from.platform ?? process.platform) === "win32") return fail(WINDOWS_MESSAGE);
+  const home = from.home ?? homedir();
+  const models = await loadModelsConfig(home);
+  if (models.problem !== void 0) return fail(models.problem);
+  const spec = chooseModel(models.config, options.model, process.env.GARUDA_MODEL);
+  if (!spec) return fail(`Garuda has no model. ${SETUP_HINT}`, true);
   let resolved;
   let sub;
   try {
@@ -76,25 +99,35 @@ async function prepare(options) {
     const subSpec = process.env.GARUDA_SUBAGENT_MODEL;
     if (subSpec) sub = resolveModel(subSpec, models.config);
   } catch (error) {
-    return error.message;
+    return fail(error.message);
   }
-  const search = await loadSearchConfig();
-  for (const name of [resolved.def.apiKeyEnv, sub?.def.apiKeyEnv, "ANTHROPIC_API_KEY"]) {
-    if (name !== void 0) keepProviderKey(name);
+  const search = await loadSearchConfig(home);
+  const credentialsWarning = await keepProviderKeys(
+    [resolved.def.apiKeyEnv, sub?.def.apiKeyEnv, "ANTHROPIC_API_KEY"],
+    home
+  );
+  if (credentialsWarning !== void 0) process.stderr.write(`garuda acp: ${credentialsWarning}
+`);
+  const keyName = resolved.def.type === "anthropic" ? resolved.def.apiKeyEnv ?? "ANTHROPIC_API_KEY" : resolved.def.apiKeyEnv;
+  const sdkToken = resolved.def.type === "anthropic" && (process.env.ANTHROPIC_AUTH_TOKEN ?? "") !== "";
+  if (keyName !== void 0 && providerKeySource(keyName) === void 0 && !sdkToken) {
+    const why = credentialsWarning === void 0 ? "" : ` ${credentialsWarning}`;
+    return fail(`Garuda has no key for ${resolved.spec} (${keyName}).${why} ${SETUP_HINT}`, true);
   }
   const { loadTeamPolicy } = await import("./policy-EJPLEEXP.js");
   let team;
   try {
-    team = await loadTeamPolicy();
+    team = await loadTeamPolicy("managed" in from ? { home, managed: from.managed } : { home });
   } catch (error) {
-    return `Team policy: ${error.message}`;
+    return fail(`Team policy: ${error.message}`);
   }
   return {
     resolved,
     ...sub === void 0 ? {} : { sub },
     models: models.config,
     ...team === void 0 ? {} : { team: { policy: team.policy, sources: team.sources } },
-    search
+    search,
+    ...credentialsWarning === void 0 ? {} : { credentialsWarning }
   };
 }
 function createRuntime(setup, input) {
@@ -144,10 +177,15 @@ function createRuntime(setup, input) {
     },
     ...input.onEvent === void 0 ? {} : { onEvent: input.onEvent },
     onNotice: input.onNotice
+  }).then((runtime) => {
+    if (setup.credentialsWarning !== void 0) input.onNotice(setup.credentialsWarning);
+    return runtime;
   });
 }
 export {
+  WINDOWS_MESSAGE,
   acpCommand,
+  prepare,
   protocolOutput
 };
-//# sourceMappingURL=acpCommand-FZ2P5JFO.js.map
+//# sourceMappingURL=acpCommand-OTAYW7BS.js.map

package/dist/chunk-3EQU2GUX.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+// src/model/types.ts
+var EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+var ZERO_USAGE = {
+  inputTokens: 0,
+  outputTokens: 0,
+  cacheReadTokens: 0,
+  cacheWriteTokens: 0
+};
+function addUsage(a, b) {
+  const searches = (a.webSearches ?? 0) + (b.webSearches ?? 0);
+  return {
+    inputTokens: a.inputTokens + b.inputTokens,
+    outputTokens: a.outputTokens + b.outputTokens,
+    cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+    cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens,
+    ...searches === 0 ? {} : { webSearches: searches }
+  };
+}
+
+export {
+  EFFORTS,
+  ZERO_USAGE,
+  addUsage
+};
+//# sourceMappingURL=chunk-3EQU2GUX.js.map

package/dist/{chunk-K3SIUOAG.js → chunk-44QN5SWZ.js}

@@ -2,7 +2,7 @@
 import {
   JobGitError,
   git
-} from "./chunk-2TAXSFWN.js";
+} from "./chunk-TUUEBHG2.js";
 
 // src/jobs/worktree.ts
 import { createHash } from "crypto";
@@ -135,4 +135,4 @@ export {
   commitJob,
   jobChanges
 };
-//# sourceMappingURL=chunk-K3SIUOAG.js.map
+//# sourceMappingURL=chunk-44QN5SWZ.js.map

package/dist/{chunk-INRZR772.js → chunk-B6FA4I7Q.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-EU7PA45O.js";
 import {
   DEFAULT_ENV_ALLOWLIST
-} from "./chunk-SI2QJYCR.js";
+} from "./chunk-GXZACJUI.js";
 
 // src/lsp/install.ts
 import { mkdir } from "fs/promises";
@@ -70,4 +70,4 @@ export {
   installCommand,
   installServer
 };
-//# sourceMappingURL=chunk-INRZR772.js.map
+//# sourceMappingURL=chunk-B6FA4I7Q.js.map

package/dist/{chunk-PQNT34LY.js → chunk-BQTUOO4G.js}

@@ -17,11 +17,11 @@ import {
   repoMapText,
   repoMapTool,
   verifyAuditFile
-} from "./chunk-K7KK7U44.js";
+} from "./chunk-TILFPYWO.js";
 import {
   WEB_SEARCH_USD,
   totalTokens
-} from "./chunk-HRGX53VC.js";
+} from "./chunk-R7I2NBPX.js";
 import {
   BUILTIN_COMMANDS
 } from "./chunk-23FXBNBB.js";
@@ -489,7 +489,7 @@ async function jobsCommand(runtime, renderer, id) {
     return;
   }
   const jobs = await listJobs2(runtime.root);
-  const { defaultAgentEnv, nightAgentTime } = await import("./launchd-QVHQ3VNN.js");
+  const { defaultAgentEnv, nightAgentTime } = await import("./launchd-SSX362VG.js");
   const night = nightAgentTime(runtime.root, defaultAgentEnv());
   const nightLine = night === void 0 ? [] : [
     `Night shift: launchd starts the queue at ${night.toTimeString().slice(0, 5)} on ${night.toDateString()} (/jobs cancel night removes it).`
@@ -1244,4 +1244,4 @@ export {
   statusOf,
   CommandArgs
 };
-//# sourceMappingURL=chunk-PQNT34LY.js.map
+//# sourceMappingURL=chunk-BQTUOO4G.js.map

package/dist/chunk-EIXUSVFX.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+
+// src/session/redact.ts
+var REDACTED = "[REDACTED]";
+var PATTERNS = [
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
+  /sk-ant-[A-Za-z0-9_-]{16,}/g,
+  /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g,
+  /\bgithub_pat_[A-Za-z0-9_]{30,}\b/g,
+  /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
+  /\bAIza[0-9A-Za-z_-]{35}\b/g,
+  /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var ASSIGNMENT = /\b([A-Za-z0-9_]*(?:api[_-]?key|secret|token|password|passwd)[A-Za-z0-9_]*)(["']?\s*[:=]\s*["']?)([^\s"'`,;]{8,})/gi;
+var OPAQUE_KEYS = /* @__PURE__ */ new Set(["encrypted_content", "encrypted_index", "signature"]);
+function looksLikeCode(name, value, next) {
+  if (/^[\d_.]+$/.test(value)) return !/pass|secret/i.test(name);
+  if (value.includes("(") || next === "(") return true;
+  return /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/.test(value) && !/\d{4,}/.test(value);
+}
+var SECRET_ENV_NAME = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL)/i;
+var movedSecrets = /* @__PURE__ */ new Map();
+function keepSecretForRedaction(name, value) {
+  movedSecrets.set(name, value);
+}
+var Redactor = class {
+  literals;
+  /**
+   * `env`: variables whose names look secret have their values removed wherever they appear.
+   * Default: this process's environment and the secrets moved out of it.
+   */
+  constructor(env = { ...process.env, ...Object.fromEntries(movedSecrets) }) {
+    this.literals = Object.entries(env).filter(
+      ([name, value]) => (SECRET_ENV_NAME.test(name) || value !== void 0 && movedSecrets.get(name) === value) && (value?.length ?? 0) >= 8
+    ).map(([, value]) => value).sort((a, b) => b.length - a.length);
+  }
+  text(input) {
+    let out = input;
+    for (const literal of this.literals) out = out.split(literal).join(REDACTED);
+    for (const pattern of PATTERNS) out = out.replace(pattern, REDACTED);
+    return out.replace(
+      ASSIGNMENT,
+      (all, name, sep, value, at) => looksLikeCode(name, value, out[at + all.length]) ? all : `${name}${sep}${REDACTED}`
+    );
+  }
+  /** A copy of `value` with every string redacted. */
+  value(value) {
+    return this.walk(value);
+  }
+  walk(value) {
+    if (typeof value === "string") return this.text(value);
+    if (Array.isArray(value)) return value.map((item) => this.walk(item));
+    if (value !== null && typeof value === "object") {
+      const redactedThinking = value.type === "redacted_thinking";
+      return Object.fromEntries(
+        Object.entries(value).map(([k, v]) => [
+          k,
+          (OPAQUE_KEYS.has(k) || redactedThinking && k === "data") && typeof v === "string" ? v : this.walk(v)
+        ])
+      );
+    }
+    return value;
+  }
+};
+
+// src/tools/atomicWrite.ts
+import { randomBytes } from "crypto";
+import { chmod, link, realpath, rename, stat, unlink, writeFile } from "fs/promises";
+import { basename, dirname, join } from "path";
+async function writeFileAtomic(path, content, { createOnly }) {
+  const target = createOnly ? path : await realpath(path);
+  const temp = join(
+    dirname(target),
+    `.${basename(target)}.garuda-${randomBytes(4).toString("hex")}.tmp`
+  );
+  const mode = createOnly ? void 0 : (await stat(target)).mode & 4095;
+  await writeFile(temp, content, { flag: "wx", ...mode === void 0 ? {} : { mode } });
+  try {
+    if (createOnly) {
+      try {
+        await link(temp, target);
+      } catch (error) {
+        const code = error.code;
+        if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EXDEV") throw error;
+        if (await exists(target)) throw Object.assign(new Error("EEXIST"), { code: "EEXIST" });
+        await rename(temp, target);
+        return;
+      }
+    } else {
+      await chmod(temp, mode ?? 420);
+      await rename(temp, target);
+      return;
+    }
+  } finally {
+    await unlink(temp).catch(() => {
+    });
+  }
+}
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export {
+  REDACTED,
+  keepSecretForRedaction,
+  Redactor,
+  writeFileAtomic
+};
+//# sourceMappingURL=chunk-EIXUSVFX.js.map

package/dist/{chunk-SI2QJYCR.js → chunk-GXZACJUI.js}

@@ -2,6 +2,9 @@
 import {
   realRelative
 } from "./chunk-WMOLXTBU.js";
+import {
+  EFFORTS
+} from "./chunk-3EQU2GUX.js";
 import {
   isCommandDisallowedByPolicy,
   isHostBlockedByPolicy,
@@ -86,6 +89,8 @@ var DENY_READ_IN_HOME = [
   // Garuda's OAuth tokens for remote MCP servers (0.4). The rest of ~/.garuda stays readable:
   // skills and their scripts live there (0.5).
   ".garuda/mcp-auth.json",
+  // Provider keys that `garuda setup` stored (0.16).
+  ".garuda/credentials",
   // Claude Code: its config can hold MCP server tokens in env values; its credentials on Linux.
   ".claude.json",
   ".claude/.credentials.json"
@@ -698,27 +703,6 @@ function onPath(program) {
 import { readFile } from "fs/promises";
 import { join as join3 } from "path";
 import { z } from "zod";
-
-// src/model/types.ts
-var EFFORTS = ["low", "medium", "high", "xhigh", "max"];
-var ZERO_USAGE = {
-  inputTokens: 0,
-  outputTokens: 0,
-  cacheReadTokens: 0,
-  cacheWriteTokens: 0
-};
-function addUsage(a, b) {
-  const searches = (a.webSearches ?? 0) + (b.webSearches ?? 0);
-  return {
-    inputTokens: a.inputTokens + b.inputTokens,
-    outputTokens: a.outputTokens + b.outputTokens,
-    cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
-    cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens,
-    ...searches === 0 ? {} : { webSearches: searches }
-  };
-}
-
-// src/permissions/settings.ts
 var SETTINGS_FILE = join3(".garuda", "settings.json");
 var NOTIFY_CHOICES = ["auto", "osc9", "bell", "off"];
 var schema = z.strictObject({
@@ -1320,9 +1304,6 @@ function describeTarget(target) {
 }
 
 export {
-  EFFORTS,
-  ZERO_USAGE,
-  addUsage,
   isSensitive,
   NETWORK_PORTS,
   expandAllowlist,
@@ -1338,4 +1319,4 @@ export {
   JOB_DENIAL,
   PermissionEngine
 };
-//# sourceMappingURL=chunk-SI2QJYCR.js.map
+//# sourceMappingURL=chunk-GXZACJUI.js.map

package/dist/{chunk-2S62ZNTC.js → chunk-HE2K657U.js}

@@ -4,9 +4,11 @@ import {
   pickChannel
 } from "./chunk-N4I6YS3E.js";
 import {
-  gateProjectSettings,
+  gateProjectSettings
+} from "./chunk-ULAJPMY7.js";
+import {
   totalTokens
-} from "./chunk-HRGX53VC.js";
+} from "./chunk-R7I2NBPX.js";
 import {
   TrustStore
 } from "./chunk-5DEWP3YX.js";
@@ -15,11 +17,11 @@ import {
   commitJob,
   jobChanges,
   prepareWorktree
-} from "./chunk-K3SIUOAG.js";
+} from "./chunk-44QN5SWZ.js";
 import {
   defaultAgentEnv,
   removeAgent
-} from "./chunk-S77XDSD4.js";
+} from "./chunk-USCUXCAU.js";
 import {
   jobReport
 } from "./chunk-YQTGMCU6.js";
@@ -36,11 +38,11 @@ import {
   JobGitError,
   git,
   hostCommand
-} from "./chunk-2TAXSFWN.js";
+} from "./chunk-TUUEBHG2.js";
 import {
   createExecutor,
   loadSettings
-} from "./chunk-SI2QJYCR.js";
+} from "./chunk-GXZACJUI.js";
 import {
   JOBS_DIR,
   loadJob,
@@ -317,4 +319,4 @@ export {
   msUntil,
   finishJob
 };
-//# sourceMappingURL=chunk-2S62ZNTC.js.map
+//# sourceMappingURL=chunk-HE2K657U.js.map