@metabase/rde 0.1.2 → 0.1.3-alpha.rde-fixes.59b956e

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { defineCommand, runMain, showUsage } from "citty";
 import { createWriteStream, promises } from "node:fs";
-import { delimiter, dirname, join, resolve } from "node:path";
+import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { ZodError, z } from "zod";
 import { homedir, tmpdir, userInfo } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -11,6 +11,7 @@ import { confirm, intro, isCancel, log, multiselect, note, outro, password, sele
 import { spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import semver from "semver";
+import { randomBytes } from "node:crypto";
 //#region src/errors.ts
 var AbortError = class extends Error {
 	constructor(message = "interrupted") {
@@ -56,6 +57,10 @@ var MetabaseApiError = class extends Error {
 		this.errors = failure.errors;
 	}
 };
+const UNAUTHORIZED_STATUS = 401;
+function isRejectedCredential(error) {
+	return error instanceof MetabaseApiError && error.status === UNAUTHORIZED_STATUS;
+}
 var MetabaseInitializingError = class extends Error {
 	progress;
 	constructor(progress) {
@@ -117,6 +122,17 @@ function installInterruptHandler(exit) {
 		setTimeout(() => exit(130), FORCED_EXIT_GRACE_MS).unref();
 	});
 }
+//#endregion
+//#region src/output/print.ts
+function printLines(lines) {
+	process.stdout.write(lines.join("\n") + "\n");
+}
+function stdoutIsTty() {
+	return process.stdout.isTTY === true;
+}
+function printJson(value) {
+	process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+}
 const StepId = z.enum([
 	"preflight",
 	"install-mb",
@@ -157,14 +173,36 @@ const JarRuntimeState = z.object({
 });
 const RuntimeState = z.discriminatedUnion("kind", [DockerRuntimeState, JarRuntimeState]);
 const RuntimeKind = z.enum(["docker", "jar"]);
-const AdminCredentials = z.discriminatedUnion("kind", [z.object({
-	kind: z.literal("prompted"),
-	email: z.string()
-}), z.object({
-	kind: z.literal("default"),
+const AdminCredentials = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("generated"),
+		email: z.string()
+	}),
+	z.object({
+		kind: z.literal("prompted"),
+		email: z.string()
+	}),
+	z.object({
+		kind: z.literal("legacy-default"),
+		email: z.string()
+	})
+]);
+const AdminLogin = z.object({
 	email: z.string(),
 	password: z.string()
-})]);
+});
+const InstanceSecrets = z.object({
+	schemaVersion: z.literal(1),
+	admin: AdminLogin.nullable(),
+	apiKey: z.string().nullable()
+});
+function emptyInstanceSecrets() {
+	return {
+		schemaVersion: 1,
+		admin: null,
+		apiKey: null
+	};
+}
 const LicenseState = z.discriminatedUnion("activated", [z.object({ activated: z.literal(false) }), z.object({
 	activated: z.literal(true),
 	features: z.array(z.string()),
@@ -202,13 +240,12 @@ const StepRecord = z.object({
 	completedAt: z.string()
 });
 const InstanceState = z.object({
-	schemaVersion: z.literal(3),
+	schemaVersion: z.literal(4),
 	name: z.string(),
 	runtime: RuntimeState.nullable(),
 	url: z.string().nullable(),
 	version: z.string().nullable(),
 	admin: AdminCredentials.nullable(),
-	apiKey: z.string().nullable(),
 	mbProfile: z.string(),
 	license: LicenseState,
 	databases: z.array(DatabaseRecord),
@@ -230,20 +267,22 @@ function requireConfiguredRuntime(state) {
 }
 const DEFAULT_INSTANCE_NAME = "default";
 const DEFAULT_MB_PROFILE = "default";
-const MbProfileChoice = z.enum([DEFAULT_MB_PROFILE, "rde"]);
+const RDE_MB_PROFILE = "rde";
+function mbProfileFor(instance) {
+	return instance === "default" ? RDE_MB_PROFILE : `${RDE_MB_PROFILE}-${instance}`;
+}
 function mbCommand(profile) {
 	return profile === "default" ? "mb" : `mb --profile ${profile}`;
 }
 function emptyInstanceState(name) {
 	return {
-		schemaVersion: 3,
+		schemaVersion: 4,
 		name,
 		runtime: null,
 		url: null,
 		version: null,
 		admin: null,
-		apiKey: null,
-		mbProfile: DEFAULT_MB_PROFILE,
+		mbProfile: mbProfileFor(name),
 		license: { activated: false },
 		databases: [],
 		sampleDatabase: null,
@@ -256,8 +295,22 @@ function emptyInstanceState(name) {
 const Versioned = z.object({ schemaVersion: z.int() });
 const V1 = 1;
 const V2 = 2;
+const V3 = 3;
 const StateV1 = z.object({ schemaVersion: z.literal(V1) }).loose();
 const StateV2 = z.object({ schemaVersion: z.literal(V2) }).loose();
+const AdminV3 = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("prompted"),
+	email: z.string()
+}), z.object({
+	kind: z.literal("default"),
+	email: z.string(),
+	password: z.string()
+})]);
+const StateV3 = z.object({
+	schemaVersion: z.literal(V3),
+	admin: AdminV3.nullable(),
+	apiKey: z.string().nullable()
+}).loose();
 function liftV1(raw) {
 	return {
 		...StateV1.parse(raw),
@@ -268,27 +321,67 @@ function liftV1(raw) {
 function liftV2(raw) {
 	return {
 		...StateV2.parse(raw),
-		schemaVersion: 3,
+		schemaVersion: V3,
 		sampleDatabase: null
 	};
 }
+function adminV4(admin) {
+	switch (admin.kind) {
+		case "default": return {
+			kind: "legacy-default",
+			email: admin.email
+		};
+		case "prompted": return {
+			kind: "prompted",
+			email: admin.email
+		};
+	}
+}
+function liftV3(raw) {
+	const { admin, apiKey, ...rest } = StateV3.parse(raw);
+	const login = admin?.kind === "default" ? {
+		email: admin.email,
+		password: admin.password
+	} : null;
+	return {
+		state: InstanceState.parse({
+			...rest,
+			schemaVersion: 4,
+			admin: admin === null ? null : adminV4(admin)
+		}),
+		movedSecrets: {
+			schemaVersion: 1,
+			admin: login,
+			apiKey
+		}
+	};
+}
 function migrateInstanceState(raw) {
 	const { schemaVersion } = Versioned.parse(raw);
 	switch (schemaVersion) {
 		case V1: return migrateInstanceState(liftV1(raw));
 		case V2: return migrateInstanceState(liftV2(raw));
-		case 3: return InstanceState.parse(raw);
-		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 3)`);
+		case V3: return liftV3(raw);
+		case 4: return {
+			state: InstanceState.parse(raw),
+			movedSecrets: null
+		};
+		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 4)`);
 	}
 }
 //#endregion
 //#region src/env.ts
 const ENV_RDE_HOME = "RDE_HOME";
+const ENV_RDE_SKILL_SOURCE = "RDE_SKILL_SOURCE";
 function readEnv(name) {
 	return process.env[name];
 }
 const ENV_PATH = "PATH";
+const ENV_XDG_STATE_HOME = "XDG_STATE_HOME";
 const ENV_JAVA_HOME = "JAVA_HOME";
+const ENV_MB_PROFILE = "MB_PROFILE";
+const ENV_MB_URL = "MB_URL";
+const ENV_MB_API_KEY = "MB_API_KEY";
 function environmentWith(overrides) {
 	return {
 		...process.env,
@@ -302,6 +395,7 @@ const INSTANCES_DIR = "instances";
 const DATA_DIR = "data";
 const BACKUPS_DIR = "backups";
 const STATE_FILE = "state.json";
+const SECRETS_FILE = "secrets.json";
 const GLOBAL_CONFIG_FILE = "config.json";
 const JARS_DIR = "jars";
 const JAR_FILE$1 = "metabase.jar";
@@ -322,8 +416,17 @@ function instanceDataDir(name) {
 function instanceBackupsDir(name) {
 	return join(instanceDir(name), BACKUPS_DIR);
 }
+function stateFileIn(dir) {
+	return join(dir, STATE_FILE);
+}
+function secretsFileIn(dir) {
+	return join(dir, SECRETS_FILE);
+}
 function instanceStatePath(name) {
-	return join(instanceDir(name), STATE_FILE);
+	return stateFileIn(instanceDir(name));
+}
+function instanceSecretsPath(name) {
+	return secretsFileIn(instanceDir(name));
 }
 function globalConfigPath() {
 	return join(rdeHome(), GLOBAL_CONFIG_FILE);
@@ -337,21 +440,21 @@ function jarReleaseDir(version) {
 function releaseJarIn(jarsDirectory, version) {
 	return join(jarsDirectory, version, JAR_FILE$1);
 }
-//#endregion
-//#region src/state/store.ts
-const FILE_MODE$1 = 384;
-const DIR_MODE = 448;
+const PERMISSION_BITS = 511;
 function isFileNotFound$1(error) {
 	return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
-async function readJsonFile(path) {
-	let raw;
+async function readTextFile(path) {
 	try {
-		raw = await promises.readFile(path, "utf8");
+		return await promises.readFile(path, "utf8");
 	} catch (error) {
 		if (isFileNotFound$1(error)) return null;
 		throw error;
 	}
+}
+async function readJsonFile(path) {
+	const raw = await readTextFile(path);
+	if (raw === null) return null;
 	try {
 		return JSON.parse(raw);
 	} catch (error) {
@@ -370,11 +473,11 @@ function parseAt(path, parse) {
 async function writeJsonFile(path, value) {
 	await promises.mkdir(dirname(path), {
 		recursive: true,
-		mode: DIR_MODE
+		mode: 448
 	});
 	const tmpPath = `${path}.${process.pid}.tmp`;
-	await promises.writeFile(tmpPath, JSON.stringify(value, null, 2) + "\n", { mode: FILE_MODE$1 });
-	await promises.chmod(tmpPath, FILE_MODE$1);
+	await promises.writeFile(tmpPath, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
+	await promises.chmod(tmpPath, 384);
 	try {
 		await promises.rename(tmpPath, path);
 	} catch (error) {
@@ -386,7 +489,12 @@ async function readInstanceState(name) {
 	const path = instanceStatePath(name);
 	const raw = await readJsonFile(path);
 	if (raw === null) return null;
-	return parseAt(path, () => migrateInstanceState(raw));
+	const migrated = parseAt(path, () => migrateInstanceState(raw));
+	if (migrated.movedSecrets !== null) {
+		await writeInstanceSecrets(name, migrated.movedSecrets);
+		await writeInstanceState(migrated.state);
+	}
+	return migrated.state;
 }
 async function writeInstanceState(state) {
 	await writeJsonFile(instanceStatePath(state.name), state);
@@ -396,6 +504,35 @@ async function requireInstanceState(name) {
 	if (state === null) throw new ConfigError(`no instance named ${name}; run \`rde init\` first`);
 	return state;
 }
+async function readInstanceSecrets(name) {
+	const path = instanceSecretsPath(name);
+	const raw = await readJsonFile(path);
+	if (raw === null) return null;
+	return parseAt(path, () => InstanceSecrets.parse(raw));
+}
+async function writeInstanceSecrets(name, secrets) {
+	await writeJsonFile(instanceSecretsPath(name), secrets);
+	await promises.chmod(instanceDir(name), 448);
+}
+async function modeOf(path) {
+	try {
+		return (await promises.stat(path)).mode & PERMISSION_BITS;
+	} catch (error) {
+		if (isFileNotFound$1(error)) return null;
+		throw error;
+	}
+}
+const StateWithApiKey = z.object({ apiKey: z.string() }).loose();
+const StateWithPassword = z.object({ admin: z.object({ password: z.string() }).loose() }).loose();
+async function inspectCredentialFiles(dir) {
+	const raw = await readJsonFile(stateFileIn(dir));
+	const secretsInState = [...StateWithApiKey.safeParse(raw).success ? ["apiKey"] : [], ...StateWithPassword.safeParse(raw).success ? ["admin.password"] : []];
+	return {
+		dirMode: await modeOf(dir),
+		secretsMode: await modeOf(secretsFileIn(dir)),
+		secretsInState
+	};
+}
 async function readGlobalConfig() {
 	const path = globalConfigPath();
 	const raw = await readJsonFile(path);
@@ -406,6 +543,91 @@ async function writeGlobalConfig(config) {
 	await writeJsonFile(globalConfigPath(), config);
 }
 //#endregion
+//#region src/steps/credentials.ts
+const TERMINAL_ONLY = "rde credentials prints only to a terminal; run it in your own terminal";
+function storedPasswordLines(state, secrets, email) {
+	if (secrets === null || secrets.admin === null) throw new ConfigError(`the secrets file of instance ${state.name} holds no admin password; \`rde doctor\` says what to do`);
+	return [`Email: ${email}`, `Password: ${secrets.admin.password}`];
+}
+function credentialsLines(state, secrets) {
+	const admin = state.admin;
+	if (admin === null) throw new ConfigError(`instance ${state.name} has no admin user yet; run \`rde init\``);
+	const url = state.url === null ? [] : [`Metabase: ${state.url}`];
+	switch (admin.kind) {
+		case "generated": return [...url, ...storedPasswordLines(state, secrets, admin.email)];
+		case "legacy-default": return [
+			...url,
+			...storedPasswordLines(state, secrets, admin.email),
+			"This is the public default password; when the instance holds nothing you need, `rde uninstall` then `rde init` recreates it with a generated one"
+		];
+		case "prompted": return [
+			...url,
+			`Email: ${admin.email}`,
+			"Password: the one you entered during `rde init`; rde never stored it"
+		];
+	}
+}
+//#endregion
+//#region src/commands/define.ts
+function repeatedValues(rawArgs, flag) {
+	const values = [];
+	const inline = `${flag}=`;
+	for (let index = 0; index < rawArgs.length; index += 1) {
+		const arg = rawArgs[index];
+		if (arg === void 0) continue;
+		if (arg.startsWith(inline)) values.push(arg.slice(inline.length));
+		else if (arg === flag) {
+			const next = rawArgs[index + 1];
+			if (next !== void 0) {
+				values.push(next);
+				index += 1;
+			}
+		}
+	}
+	return values;
+}
+function defineRdeCommand(def) {
+	return defineCommand({
+		meta: def.meta,
+		...def.args !== void 0 && { args: def.args },
+		async run({ args, rawArgs }) {
+			try {
+				await def.run(args, rawArgs);
+			} catch (error) {
+				reportError(error);
+			}
+		}
+	});
+}
+//#endregion
+//#region src/commands/instance.ts
+async function defaultInstanceName() {
+	const config = await readGlobalConfig();
+	if (config === null) throw new ConfigError("no Metabase instance yet; run `rde init` first");
+	return config.defaultInstance;
+}
+async function instanceNameOrDefault() {
+	try {
+		return (await readGlobalConfig())?.defaultInstance ?? "default";
+	} catch (error) {
+		if (error instanceof ConfigError) return DEFAULT_INSTANCE_NAME;
+		throw error;
+	}
+}
+//#endregion
+//#region src/commands/credentials.ts
+const credentials = defineRdeCommand({
+	meta: {
+		name: "credentials",
+		description: "Print the admin login of the instance; only to a terminal"
+	},
+	async run() {
+		if (!stdoutIsTty()) throw new ConfigError(TERMINAL_ONLY);
+		const name = await defaultInstanceName();
+		printLines(credentialsLines(await requireInstanceState(name), await readInstanceSecrets(name)));
+	}
+});
+//#endregion
 //#region src/connections/parse-uri.ts
 var UriParseError = class extends Error {
 	engine;
@@ -1072,6 +1294,18 @@ function tokenStatusResource(http) {
 	return { get };
 }
 //#endregion
+//#region src/metabase/domain/user.ts
+const CurrentUser = z.object({ id: z.int() }).loose();
+//#endregion
+//#region src/metabase/resources/user.ts
+function userResource(http) {
+	/** GET /api/user/current */
+	async function current() {
+		return http.requestJson("GET", "/api/user/current", { schema: CurrentUser });
+	}
+	return { current };
+}
+//#endregion
 //#region src/metabase/client.ts
 const HEALTH_POLL_INTERVAL_MS = 2e3;
 function createMetabaseClient(baseUrl, auth, signal, options = {}) {
@@ -1092,7 +1326,8 @@ function createMetabaseClient(baseUrl, auth, signal, options = {}) {
 		setting: settingResource(http),
 		tokenStatus: tokenStatusResource(http),
 		database: databaseResource(http),
-		remoteSync: remoteSyncResource(http)
+		remoteSync: remoteSyncResource(http),
+		user: userResource(http)
 	};
 }
 function isNotReadyYet(error) {
@@ -2214,9 +2449,9 @@ function hostDatabasesDeps(signal) {
 function isNotServingYet$1(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
-function requireApiKey$2(state) {
-	if (state.apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
-	return state.apiKey;
+function requireApiKey$2(state, apiKey) {
+	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
+	return apiKey;
 }
 function hostAliasOf(runtime) {
 	switch (runtime.kind) {
@@ -2232,15 +2467,15 @@ function toRecord$1(database, createdAt) {
 		createdAt
 	};
 }
-function authenticatedClient(state, deps) {
+function authenticatedClient(state, apiKey, deps) {
 	const configured = requireConfiguredRuntime(state);
 	return deps.client(configured.url, {
 		kind: "api-key",
-		key: requireApiKey$2(state)
+		key: requireApiKey$2(state, apiKey)
 	});
 }
-async function listDatabases(state, deps) {
-	const listed = await authenticatedClient(state, deps).database.list();
+async function listDatabases(state, apiKey, deps) {
+	const listed = await authenticatedClient(state, apiKey, deps).database.list();
 	const records = new Map(state.databases.map((record) => [record.id, record]));
 	const onServer = listed.data.map((database) => ({
 		id: database.id,
@@ -2261,7 +2496,7 @@ async function listDatabases(state, deps) {
 }
 async function addDatabases(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
-	const client = authenticatedClient(ctx.state, deps);
+	const client = authenticatedClient(ctx.state, ctx.secrets.apiKey, deps);
 	const properties = await client.session.properties();
 	const existing = await client.database.list();
 	if (existing.data.length > 0) ctx.ui.note(existingDatabaseLines(existing.data).join("\n"), "Connected databases");
@@ -2299,17 +2534,17 @@ function databasesStep(options, deps = hostDeps$12) {
 		title: "Connect your databases",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
-			if (configured === null || ctx.state.apiKey === null) return "todo";
+			if (configured === null || ctx.secrets.apiKey === null) return "todo";
 			const own = ownDatabaseIds(ctx.state);
 			if (own.size === 0) return sampleDatabaseId(ctx.state) !== null && !options.requested ? "done" : "todo";
 			const client = deps(ctx).client(configured.url, {
 				kind: "api-key",
-				key: ctx.state.apiKey
+				key: ctx.secrets.apiKey
 			});
 			try {
 				return (await client.database.list()).data.some((database) => own.has(database.id)) ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet$1(error)) return "todo";
+				if (isNotServingYet$1(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -2391,6 +2626,11 @@ async function createWizardContext(instanceName, options) {
 			await writeInstanceState(next);
 			ctx.state = next;
 		},
+		secrets: await readInstanceSecrets(instanceName) ?? emptyInstanceSecrets(),
+		saveSecrets: async (next) => {
+			await writeInstanceSecrets(instanceName, next);
+			ctx.secrets = next;
+		},
 		prompts: options.prompts ?? clackPrompts(),
 		ui: clackUi(),
 		signal: options.signal,
@@ -2399,53 +2639,6 @@ async function createWizardContext(instanceName, options) {
 	return ctx;
 }
 //#endregion
-//#region src/commands/define.ts
-function repeatedValues(rawArgs, flag) {
-	const values = [];
-	const inline = `${flag}=`;
-	for (let index = 0; index < rawArgs.length; index += 1) {
-		const arg = rawArgs[index];
-		if (arg === void 0) continue;
-		if (arg.startsWith(inline)) values.push(arg.slice(inline.length));
-		else if (arg === flag) {
-			const next = rawArgs[index + 1];
-			if (next !== void 0) {
-				values.push(next);
-				index += 1;
-			}
-		}
-	}
-	return values;
-}
-function defineRdeCommand(def) {
-	return defineCommand({
-		meta: def.meta,
-		...def.args !== void 0 && { args: def.args },
-		async run({ args, rawArgs }) {
-			try {
-				await def.run(args, rawArgs);
-			} catch (error) {
-				reportError(error);
-			}
-		}
-	});
-}
-//#endregion
-//#region src/commands/instance.ts
-async function defaultInstanceName() {
-	const config = await readGlobalConfig();
-	if (config === null) throw new ConfigError("no Metabase instance yet; run `rde init` first");
-	return config.defaultInstance;
-}
-async function instanceNameOrDefault() {
-	try {
-		return (await readGlobalConfig())?.defaultInstance ?? "default";
-	} catch (error) {
-		if (error instanceof ConfigError) return DEFAULT_INSTANCE_NAME;
-		throw error;
-	}
-}
-//#endregion
 //#region src/commands/db/add.ts
 const dbAdd = defineRdeCommand({
 	meta: {
@@ -2460,14 +2653,6 @@ const dbAdd = defineRdeCommand({
 	}
 });
 //#endregion
-//#region src/output/print.ts
-function printLines(lines) {
-	process.stdout.write(lines.join("\n") + "\n");
-}
-function printJson(value) {
-	process.stdout.write(JSON.stringify(value, null, 2) + "\n");
-}
-//#endregion
 //#region src/commands/db/list.ts
 const dbList = defineRdeCommand({
 	meta: {
@@ -2480,7 +2665,10 @@ const dbList = defineRdeCommand({
 		default: false
 	} },
 	async run(args) {
-		const listing = await listDatabases(await requireInstanceState(await defaultInstanceName()), hostDatabasesDeps(interruptSignal));
+		const name = await defaultInstanceName();
+		const state = await requireInstanceState(name);
+		const secrets = await readInstanceSecrets(name);
+		const listing = await listDatabases(state, secrets === null ? null : secrets.apiKey, hostDatabasesDeps(interruptSignal));
 		if (args.json) {
 			printJson(listing);
 			return;
@@ -2809,15 +2997,20 @@ async function isExecutable(path) {
 		return false;
 	}
 }
-async function whichCommand(name) {
+async function whichAll(name) {
 	const searchPath = readEnv(ENV_PATH);
-	if (searchPath === void 0) return null;
-	for (const dir of searchPath.split(delimiter)) {
+	if (searchPath === void 0) return [];
+	const found = [];
+	for (const dir of new Set(searchPath.split(delimiter))) {
 		if (dir.length === 0) continue;
 		const candidate = join(dir, name);
-		if (await isExecutable(candidate)) return candidate;
+		if (await isExecutable(candidate)) found.push(candidate);
 	}
-	return null;
+	return found;
+}
+async function whichCommand(name) {
+	const [first] = await whichAll(name);
+	return first ?? null;
 }
 //#endregion
 //#region src/tools/java.ts
@@ -3325,7 +3518,7 @@ function daemonTool(runner) {
 }
 //#endregion
 //#region src/runtime/docker.ts
-const DEFAULT_IMAGE = "metabase/metabase-dev:transform-tests-ee";
+const DEFAULT_IMAGE = "metabase/metabase-enterprise-head:latest";
 const CONTAINER_NAME_PREFIX$1 = "rde-metabase";
 const CONTAINER_PORT = 3e3;
 function containerName(instanceName) {
@@ -3661,44 +3854,117 @@ const GLOBAL_INSTALL = {
 function mbInstallCommand(packageManager) {
 	return GLOBAL_INSTALL[packageManager];
 }
+function ownerByMarker(path, markers) {
+	const normalized = path.replaceAll("\\", "/");
+	const found = markers.find(({ marker }) => normalized.includes(marker));
+	return found === void 0 ? null : found.owner;
+}
 const GLOBAL_MARKERS = [
 	{
 		marker: "/.bun/install/global/node_modules/",
-		packageManager: "bun"
+		owner: "bun"
 	},
 	{
 		marker: "/Library/pnpm/global/",
-		packageManager: "pnpm"
+		owner: "pnpm"
 	},
 	{
 		marker: "/.local/share/pnpm/global/",
-		packageManager: "pnpm"
+		owner: "pnpm"
 	},
 	{
 		marker: "/share/pnpm/global/",
-		packageManager: "pnpm"
+		owner: "pnpm"
 	},
 	{
 		marker: "/pnpm-global/node_modules/",
-		packageManager: "pnpm"
+		owner: "pnpm"
 	},
 	{
 		marker: "/.config/yarn/global/node_modules/",
-		packageManager: "yarn"
+		owner: "yarn"
 	},
 	{
 		marker: "/lib/node_modules/",
-		packageManager: "npm"
+		owner: "npm"
 	},
 	{
 		marker: "/.npm-global/node_modules/",
-		packageManager: "npm"
+		owner: "npm"
 	}
 ];
 function packageManagerFor(scriptPath) {
-	const normalized = scriptPath.replaceAll("\\", "/");
-	for (const { marker, packageManager } of GLOBAL_MARKERS) if (normalized.includes(marker)) return packageManager;
-	return "npm";
+	return ownerByMarker(scriptPath, GLOBAL_MARKERS) ?? "npm";
+}
+const MB_OWNER_NAMES = {
+	npm: "npm",
+	pnpm: "pnpm",
+	yarn: "Yarn",
+	bun: "Bun",
+	homebrew: "Homebrew"
+};
+const CELLAR = "/Cellar/";
+const NODE_MODULES = "/node_modules/";
+const OWNER_MARKERS = [
+	...GLOBAL_MARKERS,
+	{
+		marker: CELLAR,
+		owner: "homebrew"
+	},
+	{
+		marker: "/Library/pnpm/",
+		owner: "pnpm"
+	},
+	{
+		marker: "/.local/share/pnpm/",
+		owner: "pnpm"
+	}
+];
+async function locateMbOnPath() {
+	const paths = await whichAll(MB);
+	return Promise.all(paths.map(async (path) => ({
+		path,
+		resolved: await promises.realpath(path)
+	})));
+}
+function mbOwner(binary) {
+	return ownerByMarker(binary.resolved, OWNER_MARKERS) ?? ownerByMarker(binary.path, OWNER_MARKERS);
+}
+function firstSegmentAfter(path, marker) {
+	const at = path.lastIndexOf(marker);
+	if (at === -1) return null;
+	const [first] = path.slice(at + marker.length).split("/");
+	return first === void 0 || first.length === 0 ? null : first;
+}
+function packageName(resolved) {
+	const scopeOrName = firstSegmentAfter(resolved, NODE_MODULES);
+	if (scopeOrName === null || !scopeOrName.startsWith("@")) return scopeOrName;
+	const name = firstSegmentAfter(resolved, `${NODE_MODULES}${scopeOrName}/`);
+	return name === null ? null : `${scopeOrName}/${name}`;
+}
+const REMOVE_COMMANDS = {
+	npm: (name) => `npm uninstall -g ${name}`,
+	pnpm: (name) => `pnpm remove -g ${name}`,
+	yarn: (name) => `yarn global remove ${name}`,
+	bun: (name) => `bun remove -g ${name}`,
+	homebrew: (name) => `brew uninstall ${name}`
+};
+function mbRemoveCommand(binary) {
+	const owner = mbOwner(binary);
+	if (owner === null) return null;
+	const name = owner === "homebrew" ? firstSegmentAfter(binary.resolved, CELLAR) : packageName(binary.resolved);
+	return name === null ? null : REMOVE_COMMANDS[owner](name);
+}
+function setValue(name) {
+	const value = readEnv(name);
+	return value === void 0 || value.length === 0 ? null : value;
+}
+function mbEnvironment() {
+	return {
+		profile: setValue(ENV_MB_PROFILE),
+		url: setValue(ENV_MB_URL),
+		apiKeySet: setValue(ENV_MB_API_KEY) !== null
+	};
 }
 const ProbedUser = z.object({
 	id: z.int(),
@@ -3775,16 +4041,16 @@ function mbTool(runner) {
 		if (result.exitCode !== 0) throw toolFailure(MB, argv, result);
 		return parseJsonOutput(MB, argv, result.stdout, schema);
 	}
-	async function version() {
+	async function version(command = MB) {
 		const args = ["--version"];
 		let result;
 		try {
-			result = await runner.run(MB, args);
+			result = await runner.run(command, args);
 		} catch (error) {
 			if (error instanceof ProcessNotFoundError) return null;
 			throw error;
 		}
-		if (result.exitCode !== 0) throw toolFailure(MB, args, result);
+		if (result.exitCode !== 0) throw toolFailure(command, args, result);
 		return result.stdout.trim();
 	}
 	async function authLogin(options) {
@@ -3870,73 +4136,65 @@ function mbTool(runner) {
 	};
 }
 //#endregion
-//#region src/wizard/engine.ts
-function requireKnownStep(steps, id, flag) {
-	if (id === void 0) return;
-	if (!steps.some((step) => step.id === id)) throw new ConfigError(`${flag} ${id} is not one of the steps: ${steps.map((step) => step.id).join(", ")}`);
+//#region src/tools/skills-cli.ts
+const NPX = "npx";
+const SKILLS_PACKAGE = "skills@latest";
+const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/rde-skill";
+function rdeSkillSource() {
+	const override = readEnv(ENV_RDE_SKILL_SOURCE);
+	return override === void 0 || override.length === 0 ? DEFAULT_RDE_SKILL_SOURCE : override;
 }
-async function detectAll(steps, ctx, options) {
-	const detected = [];
-	let fromHere = false;
-	for (const step of steps) {
-		if (step.id === options.from) fromHere = true;
-		const forced = options.only !== void 0 ? step.id === options.only : fromHere;
-		detected.push({
-			step,
-			status: forced ? "todo" : await step.detect(ctx),
-			forced
-		});
-	}
-	return detected;
+const InstalledSkill = z.object({
+	name: z.string(),
+	path: z.string(),
+	scope: z.string(),
+	agents: z.array(z.string()),
+	source: z.string().nullable()
+}).loose();
+const InstalledSkillList = z.array(InstalledSkill);
+const SkillLock = z.object({ skills: z.record(z.string(), z.object({ ref: z.string().nullish() }).loose()) }).loose();
+const GLOBAL_LOCK_FILE = ".skill-lock.json";
+const PROJECT_LOCK_FILE = "skills-lock.json";
+function globalSkillLockPath(home, stateHome) {
+	return stateHome === null ? join(home, ".agents", GLOBAL_LOCK_FILE) : join(stateHome, "skills", GLOBAL_LOCK_FILE);
 }
-async function shouldRun(entry, ctx, options) {
-	if (entry.forced) return true;
-	if (options.only !== void 0 || entry.status === "done") return false;
-	return await entry.step.detect(ctx) === "todo";
+function projectSkillLockPath(project) {
+	return join(project, PROJECT_LOCK_FILE);
 }
-function recordFor(outcome, at) {
-	return {
-		status: outcome === "completed" ? "done" : "skipped",
-		completedAt: at.toISOString()
-	};
+function xdgStateHome() {
+	const value = readEnv(ENV_XDG_STATE_HOME);
+	return value === void 0 || value.length === 0 ? null : value;
 }
-function withStepRecord(state, id, record) {
-	return {
-		...state,
-		steps: {
-			...state.steps,
-			[id]: record
-		}
-	};
+function lockedRef(path, raw, skill) {
+	if (raw === null) return null;
+	const parsed = SkillLock.safeParse(raw);
+	if (!parsed.success) throw new ConfigError(`${path} is not a skills lock file: ${parsed.error.message}`);
+	return parsed.data.skills[skill]?.ref ?? null;
 }
-async function runWizard(steps, ctx, options = {}) {
-	requireKnownStep(steps, options.from, "--from");
-	requireKnownStep(steps, options.only, "--only");
-	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	const detected = await detectAll(steps, ctx, options);
-	ctx.ui.checklist(detected.map(({ step, status }) => ({
-		title: step.title,
-		status
-	})));
-	for (const entry of detected) {
-		if (!await shouldRun(entry, ctx, options)) continue;
-		const outcome = await entry.step.run(ctx);
-		await ctx.saveState(withStepRecord(ctx.state, entry.step.id, recordFor(outcome, now())));
+const hostSkillFiles = {
+	readJson: readJsonFile,
+	readText: readTextFile
+};
+const GITHUB_URL = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/tree\/([^/]+)(?:\/.*)?)?\/?$/;
+function skillOrigin(source, cwd) {
+	const github = GITHUB_URL.exec(source);
+	if (github !== null) {
+		const [, owner, repo, ref] = github;
+		return {
+			kind: "github",
+			repository: `${owner}/${repo}`,
+			ref: ref ?? null
+		};
 	}
+	if (isAbsolute(source) || source.startsWith(".")) return {
+		kind: "local",
+		path: resolve(cwd, source)
+	};
+	return {
+		kind: "other",
+		source
+	};
 }
-//#endregion
-//#region src/tools/skills-cli.ts
-const NPX = "npx";
-const SKILLS_PACKAGE = "skills@latest";
-const RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/rde-generic-skills";
-const InstalledSkill = z.object({
-	name: z.string(),
-	path: z.string(),
-	scope: z.string(),
-	agents: z.array(z.string()),
-	source: z.string().nullable()
-}).loose();
-const InstalledSkillList = z.array(InstalledSkill);
 function skillsCli(runner) {
 	async function add(options) {
 		const argv = [
@@ -3988,12 +4246,82 @@ function skillsCli(runner) {
 		if (result.exitCode !== 0) throw toolFailure(NPX, argv, result);
 		return parseJsonOutput(NPX, argv, result.stdout, InstalledSkillList);
 	}
+	async function listProject(cwd) {
+		const argv = [
+			"-y",
+			SKILLS_PACKAGE,
+			"list",
+			"--json"
+		];
+		const result = await runner.run(NPX, argv, {
+			cwd,
+			stdoutToFile: true
+		});
+		if (result.exitCode !== 0) throw toolFailure(NPX, argv, result);
+		return parseJsonOutput(NPX, argv, result.stdout, InstalledSkillList);
+	}
 	return {
 		add,
 		remove,
-		list
+		list,
+		listProject
+	};
+}
+//#endregion
+//#region src/wizard/engine.ts
+function requireKnownStep(steps, id, flag) {
+	if (id === void 0) return;
+	if (!steps.some((step) => step.id === id)) throw new ConfigError(`${flag} ${id} is not one of the steps: ${steps.map((step) => step.id).join(", ")}`);
+}
+async function detectAll(steps, ctx, options) {
+	const detected = [];
+	let fromHere = false;
+	for (const step of steps) {
+		if (step.id === options.from) fromHere = true;
+		const forced = options.only !== void 0 ? step.id === options.only : fromHere;
+		detected.push({
+			step,
+			status: forced ? "todo" : await step.detect(ctx),
+			forced
+		});
+	}
+	return detected;
+}
+async function shouldRun(entry, ctx, options) {
+	if (entry.forced) return true;
+	if (options.only !== void 0 || entry.status === "done") return false;
+	return await entry.step.detect(ctx) === "todo";
+}
+function recordFor(outcome, at) {
+	return {
+		status: outcome === "completed" ? "done" : "skipped",
+		completedAt: at.toISOString()
+	};
+}
+function withStepRecord(state, id, record) {
+	return {
+		...state,
+		steps: {
+			...state.steps,
+			[id]: record
+		}
 	};
 }
+async function runWizard(steps, ctx, options = {}) {
+	requireKnownStep(steps, options.from, "--from");
+	requireKnownStep(steps, options.only, "--only");
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const detected = await detectAll(steps, ctx, options);
+	ctx.ui.checklist(detected.map(({ step, status }) => ({
+		title: step.title,
+		status
+	})));
+	for (const entry of detected) {
+		if (!await shouldRun(entry, ctx, options)) continue;
+		const outcome = await entry.step.run(ctx);
+		await ctx.saveState(withStepRecord(ctx.state, entry.step.id, recordFor(outcome, now())));
+	}
+}
 //#endregion
 //#region src/steps/agents-skills.ts
 const STEP_ID$8 = "agents-skills";
@@ -4002,7 +4330,8 @@ const DETECT_AGENTS = { agents: null };
 function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
-		probe: hostAgentProbe()
+		probe: hostAgentProbe(),
+		skillSource: rdeSkillSource()
 	};
 }
 function detectedOnly(agents) {
@@ -4062,9 +4391,10 @@ function agentsSkillsStep(options, deps = hostDeps$11) {
 				ctx.ui.info(skipLine(all, selection.source));
 				return "skipped";
 			}
-			ctx.ui.info(`Installing the rde skill for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})`);
+			const from = resolved.skillSource === "https://github.com/metabase/agent-skills/tree/rde-skill" ? "" : ` from ${resolved.skillSource}`;
+			ctx.ui.info(`Installing the rde skill for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})${from}`);
 			await skillsCli(resolved.runner).add({
-				source: RDE_SKILL_SOURCE,
+				source: resolved.skillSource,
 				skill: "rde",
 				agents: selection.agents.map((agent) => agent.skillsCliName)
 			});
@@ -4090,7 +4420,8 @@ function rdeInstalledWith() {
 function hostDeps$10(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
-		installedWith: rdeInstalledWith()
+		installedWith: rdeInstalledWith(),
+		locate: locateMbOnPath
 	};
 }
 async function inspectMb(runner) {
@@ -4107,14 +4438,100 @@ async function inspectMb(runner) {
 function displayCommand(install) {
 	return [install.command, ...install.args].join(" ");
 }
-function stillWrong(install, after) {
-	const found = after.installed ? `mb ${after.version} is still what is on PATH (${MIN_MB_VERSION} or newer is required)` : "mb is not on PATH after the install";
-	return new ExternalToolError({
+async function versionAt(runner, path) {
+	try {
+		const raw = await mbTool(runner).version(path);
+		return raw === null ? null : semver.valid(raw);
+	} catch (error) {
+		if (error instanceof ExternalToolError) return null;
+		throw error;
+	}
+}
+async function inspectMbOnPath(runner, locate) {
+	const found = [];
+	for (const binary of await locate()) found.push({
+		path: binary.path,
+		version: await versionAt(runner, binary.path),
+		owner: mbOwner(binary),
+		removeCommand: mbRemoveCommand(binary)
+	});
+	return found;
+}
+function satisfiesMinimum(version) {
+	return version !== null && semver.satisfies(version, MB_RANGE, { includePrerelease: true });
+}
+function isNewer(candidate, than) {
+	if (candidate === null) return false;
+	return than === null || semver.gt(candidate, than);
+}
+function diagnoseMb(found, installer) {
+	const [running, ...later] = found;
+	if (running === void 0) return { kind: "missing" };
+	const sufficient = satisfiesMinimum(running.version);
+	const newer = later.find((candidate) => satisfiesMinimum(candidate.version) && isNewer(candidate.version, running.version));
+	if (newer !== void 0 && (!sufficient || running.owner !== installer)) return {
+		kind: "shadowed",
+		running,
+		newer
+	};
+	return sufficient ? {
+		kind: "current",
+		running
+	} : {
+		kind: "old",
+		running
+	};
+}
+function runningMbSuffices(diagnosis) {
+	return diagnosis.kind !== "missing" && satisfiesMinimum(diagnosis.running.version);
+}
+function versionText(entry) {
+	return entry.version ?? "an unknown version";
+}
+function describeEntry(entry) {
+	const owner = entry.owner === null ? "" : ` (${MB_OWNER_NAMES[entry.owner]})`;
+	return `${versionText(entry)} at ${entry.path}${owner}`;
+}
+function mbPathLines(found) {
+	return found.map((entry, index) => `${index === 0 ? "" : "then "}${describeEntry(entry)}`);
+}
+function removeClause(entry) {
+	if (entry.removeCommand !== null) return `remove the old one with \`${entry.removeCommand}\``;
+	if (entry.owner !== null) return `remove the old one with ${MB_OWNER_NAMES[entry.owner]}`;
+	return `remove ${entry.path}`;
+}
+function shadowedHint(diagnosis) {
+	const { running, newer } = diagnosis;
+	return [
+		`${running.path} (${versionText(running)}) runs before ${newer.path} (${versionText(newer)});`,
+		`${removeClause(running)}, or put ${dirname(newer.path)} before ${dirname(running.path)} on PATH,`,
+		"then open a new terminal"
+	].join(" ");
+}
+const NEW_TERMINAL = "open a new terminal and run rde init again";
+function stillWrongAdvice(diagnosis) {
+	switch (diagnosis.kind) {
+		case "shadowed": return `${shadowedHint(diagnosis)} and run rde init again`;
+		case "old": return `The install put no newer mb on PATH; ${removeClause(diagnosis.running)}, or ${NEW_TERMINAL}`;
+		case "missing":
+		case "current": return "Open a new terminal and run rde init again";
+	}
+}
+async function stillWrong(install, after, deps) {
+	const fail = (stderrTail) => new ExternalToolError({
 		tool: install.command,
 		argv: install.args,
 		exitCode: 0,
-		stderrTail: `${found}; open a new terminal and run rde init again`
+		stderrTail
 	});
+	if (!after.installed) return fail(`mb is not on PATH after the install; ${NEW_TERMINAL}`);
+	const found = await inspectMbOnPath(deps.runner, deps.locate);
+	const diagnosis = diagnoseMb(found, deps.installedWith);
+	return fail([
+		`mb ${after.version} still runs first (${MIN_MB_VERSION} or newer is required).`,
+		`Every mb on PATH, in order: ${mbPathLines(found).join("; ")}.`,
+		`${stillWrongAdvice(diagnosis)}.`
+	].join(" "));
 }
 function installMbStep(deps = hostDeps$10) {
 	return {
@@ -4142,7 +4559,7 @@ function installMbStep(deps = hostDeps$10) {
 				stderrTail: ""
 			});
 			const after = await inspectMb(resolved.runner);
-			if (!after.installed || !after.satisfies) throw stillWrong(install, after);
+			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
 			ctx.ui.success(`mb ${after.version} is installed`);
 			return "completed";
 		}
@@ -4463,7 +4880,15 @@ function hostDoctorDeps(instanceName, signal) {
 		runtime,
 		ports: hostPortProbe,
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
-		probe: hostAgentProbe()
+		probe: hostAgentProbe(),
+		locateMb: locateMbOnPath,
+		environment: mbEnvironment(),
+		skills: {
+			source: rdeSkillSource(),
+			cwd: process.cwd(),
+			stateHome: xdgStateHome(),
+			files: hostSkillFiles
+		}
 	};
 }
 const NOT_FOUND_STATUS$2 = 404;
@@ -4476,7 +4901,17 @@ function ok(id, label, detail) {
 		status: "ok",
 		detail,
 		hint: null,
-		fix: null
+		step: null
+	};
+}
+function note$1(id, label, detail, hint) {
+	return {
+		id,
+		label,
+		status: "ok",
+		detail,
+		hint,
+		step: null
 	};
 }
 function skipped(id, label, detail) {
@@ -4486,7 +4921,7 @@ function skipped(id, label, detail) {
 		status: "skipped",
 		detail,
 		hint: null,
-		fix: null
+		step: null
 	};
 }
 function failed(id, label, failure) {
@@ -4507,7 +4942,7 @@ function machineRow(check, needed) {
 	return failed(check.id, check.id, {
 		detail: check.label,
 		hint: check.hint,
-		fix: "preflight"
+		step: "preflight"
 	});
 }
 async function machineRows(deps, runtime) {
@@ -4519,19 +4954,48 @@ function installHint(installedWith) {
 	const install = mbInstallCommand(installedWith);
 	return `\`${[install.command, ...install.args].join(" ")}\``;
 }
-async function mbRow(deps) {
-	const found = await inspectMb(deps.runner);
-	if (!found.installed) return failed("mb", "mb", {
-		detail: "not installed",
-		hint: installHint(deps.installedWith),
-		fix: "install-mb"
-	});
-	if (!found.satisfies) return failed("mb", "mb", {
-		detail: `${found.version} (${MIN_MB_VERSION} or newer is required)`,
-		hint: installHint(deps.installedWith),
-		fix: "install-mb"
-	});
-	return ok("mb", "mb", found.version);
+const MB_LABEL = "mb";
+function mbUnusable(diagnosis) {
+	if (diagnosis.kind === "missing") return "mb is not installed";
+	return runningMbSuffices(diagnosis) ? null : "the mb that runs is too old";
+}
+function mbRow(diagnosis, lines, deps) {
+	switch (diagnosis.kind) {
+		case "missing": return failed("mb", MB_LABEL, {
+			detail: "not installed",
+			hint: installHint(deps.installedWith),
+			step: "install-mb"
+		});
+		case "old": {
+			const required = lines.map((line, index) => index === 0 ? `${line}; ${MIN_MB_VERSION} or newer is required` : line);
+			return failed("mb", MB_LABEL, {
+				detail: required.join("\n"),
+				hint: installHint(deps.installedWith),
+				step: "install-mb"
+			});
+		}
+		case "shadowed": return failed("mb", MB_LABEL, {
+			detail: lines.join("\n"),
+			hint: shadowedHint(diagnosis),
+			step: null
+		});
+		case "current": return ok("mb", MB_LABEL, lines.join("\n"));
+	}
+}
+async function mbFinding(deps) {
+	const found = await inspectMbOnPath(deps.runner, deps.locateMb);
+	const diagnosis = diagnoseMb(found, deps.installedWith);
+	return {
+		row: mbRow(diagnosis, mbPathLines(found), deps),
+		unusable: mbUnusable(diagnosis)
+	};
+}
+function sharedProfileList(deps) {
+	let listed = null;
+	return () => {
+		listed ??= mbTool(deps.runner).authList();
+		return listed;
+	};
 }
 function publishesOnLoopback(container, port) {
 	return container.ports.some((mapping) => mapping.host === port && mapping.hostIp === "127.0.0.1");
@@ -4549,7 +5013,7 @@ async function containerRow(runtime, deps, dockerOk) {
 		row: failed("container", label, {
 			detail: `${runtime.containerName} does not exist`,
 			hint: "`rde init` recreates it from the saved choices",
-			fix: "runtime"
+			step: "runtime"
 		}),
 		running: false,
 		holder: CONTAINER
@@ -4562,7 +5026,7 @@ async function containerRow(runtime, deps, dockerOk) {
 		row: failed("container", label, {
 			detail: `${runtime.containerName} runs ${inspection.image}, the state says ${runtime.image}`,
 			hint: `remove it with \`docker rm -f ${runtime.containerName}\` and run \`rde init\``,
-			fix: null
+			step: null
 		}),
 		...found
 	};
@@ -4570,7 +5034,7 @@ async function containerRow(runtime, deps, dockerOk) {
 		row: failed("container", label, {
 			detail: `${runtime.containerName} does not publish port ${runtime.port} on ${LOOPBACK_HOST}`,
 			hint: `remove it with \`docker rm -f ${runtime.containerName}\` and run \`rde init\``,
-			fix: null
+			step: null
 		}),
 		...found
 	};
@@ -4591,7 +5055,7 @@ async function processRow(runtime, deps) {
 			row: failed("process", label, {
 				detail: `${inspection.jarPath} does not exist`,
 				hint,
-				fix: "runtime"
+				step: "runtime"
 			}),
 			running: false,
 			holder: JAR_PROCESS
@@ -4618,13 +5082,13 @@ async function portRow(port, finding, ports) {
 	if (finding.running) return failed("port", "port", {
 		detail: `${port} is not answering although ${finding.holder} runs`,
 		hint: "`rde logs` shows what Metabase is doing",
-		fix: null
+		step: null
 	});
 	if (free) return ok("port", "port", `${port} is free`);
 	return failed("port", "port", {
 		detail: `${port} is in use by another program`,
 		hint: "stop that program before `rde start`",
-		fix: null
+		step: null
 	});
 }
 async function healthRow(url, deps) {
@@ -4639,7 +5103,7 @@ async function healthRow(url, deps) {
 			row: failed("health", "health", {
 				detail: `initializing (${Math.round(error.progress * 100)}%)`,
 				hint: "wait for it; `rde logs -f` shows progress",
-				fix: "start-metabase"
+				step: "start-metabase"
 			}),
 			healthy: false
 		};
@@ -4647,7 +5111,7 @@ async function healthRow(url, deps) {
 			row: failed("health", "health", {
 				detail: "unreachable",
 				hint: "`rde start`",
-				fix: "start-metabase"
+				step: "start-metabase"
 			}),
 			healthy: false
 		};
@@ -4655,7 +5119,7 @@ async function healthRow(url, deps) {
 			row: failed("health", "health", {
 				detail: `something other than Metabase answers at ${url} (HTTP ${error.status})`,
 				hint: "another program holds the port; stop it before `rde start`",
-				fix: null
+				step: null
 			}),
 			healthy: false
 		};
@@ -4666,7 +5130,7 @@ function adminRow(state, properties) {
 	if (!properties["has-user-setup"]) return failed("admin", "admin user", {
 		detail: "Metabase has no admin user yet",
 		hint: "`rde init --only admin-user`",
-		fix: "admin-user"
+		step: "admin-user"
 	});
 	return ok("admin", "admin user", state.admin?.email ?? "created outside rde");
 }
@@ -4678,36 +5142,204 @@ function versionRow(state, properties) {
 	if (state.version !== running) return failed("version", label, {
 		detail: `running ${running}, the state file says ${state.version}`,
 		hint: "`rde start` records the running version",
-		fix: VERSION_STEP
+		step: VERSION_STEP
 	});
 	return ok("version", label, running);
 }
-function apiKeyRow(state) {
-	if (state.apiKey === null) return failed("api-key", "API key", {
-		detail: "none in the state file",
-		hint: "`rde init --only api-key`",
-		fix: "api-key"
+const API_KEY_STEP = "api-key";
+const RECREATE_HINT = "when the instance holds nothing you need, `rde uninstall` then `rde init`";
+function adminPasswordRow(state, secrets) {
+	const id = "admin-password";
+	const label = "admin password";
+	const admin = state.admin;
+	if (admin === null) return skipped(id, label, "no admin user created by rde yet");
+	switch (admin.kind) {
+		case "prompted": return ok(id, label, "yours, entered during `rde init` and never stored");
+		case "generated":
+			if (secrets === null || secrets.admin === null) return failed(id, label, {
+				detail: "generated, but missing from the secrets file",
+				hint: `it cannot be recovered; ${RECREATE_HINT}`,
+				step: null
+			});
+			return ok(id, label, "generated and stored; `rde credentials` shows it in your terminal");
+		case "legacy-default": return failed(id, label, {
+			detail: "the public default password from an earlier rde (legacy-default)",
+			hint: `anyone who knows the default can log in; ${RECREATE_HINT} with a generated one`,
+			step: null
+		});
+	}
+}
+async function apiKeyFinding(secrets, url, healthy, deps) {
+	const id = "api-key";
+	const label = "API key";
+	const apiKey = secrets === null ? null : secrets.apiKey;
+	if (apiKey === null) return {
+		row: failed(id, label, {
+			detail: "none in the secrets file",
+			hint: "`rde init --only api-key`",
+			step: API_KEY_STEP
+		}),
+		access: {
+			kind: "unusable",
+			reason: "no API key"
+		}
+	};
+	if (url === null || !healthy) return {
+		row: ok(id, label, "in the secrets file"),
+		access: {
+			kind: "unusable",
+			reason: NOT_HEALTHY
+		}
+	};
+	const client = deps.client(url, {
+		kind: "api-key",
+		key: apiKey
 	});
-	return ok("api-key", "API key", "in the state file");
+	try {
+		await client.user.current();
+	} catch (error) {
+		if (!isRejectedCredential(error)) throw error;
+		return {
+			row: failed(id, label, {
+				detail: "in the secrets file, but Metabase rejects it",
+				hint: "`rde init --only api-key` replaces it",
+				step: API_KEY_STEP
+			}),
+			access: {
+				kind: "unusable",
+				reason: "Metabase rejects the API key"
+			}
+		};
+	}
+	return {
+		row: ok(id, label, "in the secrets file, accepted by Metabase"),
+		access: {
+			kind: "accepted",
+			client
+		}
+	};
+}
+function octal(mode) {
+	return `0${mode.toString(8)}`;
+}
+function expectsSecrets(state) {
+	return state.admin !== null && state.admin.kind !== "prompted" || state.steps[API_KEY_STEP]?.status === "done";
 }
-async function mbProfileRow(state, deps, mbInstalled, healthy) {
+function secretsFileRow(state, files, dir) {
+	const id = "secrets-file";
+	const label = "secrets file";
+	const path = secretsFileIn(dir);
+	if (files.secretsMode === null) {
+		if (!expectsSecrets(state)) return skipped(id, label, "nothing stored yet");
+		return failed(id, label, {
+			detail: `${path} is missing`,
+			hint: "`rde init --only api-key` stores a new API key",
+			step: API_KEY_STEP
+		});
+	}
+	if (files.secretsMode !== 384 || files.dirMode !== 448) {
+		const dirMode = files.dirMode === null ? "missing" : octal(files.dirMode);
+		return failed(id, label, {
+			detail: `${path} is ${octal(files.secretsMode)} in a ${dirMode} directory`,
+			hint: `\`chmod ${octal(384)} ${path} && chmod ${octal(448)} ${dir}\``,
+			step: null
+		});
+	}
+	return ok(id, label, `${path}, ${octal(384)} in a ${octal(448)} directory`);
+}
+function stateFileRow(files) {
+	const id = "state-file";
+	const label = "state file";
+	if (files.secretsInState.length > 0) return failed(id, label, {
+		detail: `carries ${files.secretsInState.join(", ")}`,
+		hint: "`rde init --only api-key` rewrites it without them",
+		step: API_KEY_STEP
+	});
+	return ok(id, label, "no secrets");
+}
+async function credentialRows(state, secrets, apiKey, deps) {
+	const dir = deps.runtime.instanceDir;
+	const files = await inspectCredentialFiles(dir);
+	return [
+		adminPasswordRow(state, secrets),
+		apiKey.row,
+		secretsFileRow(state, files, dir),
+		stateFileRow(files)
+	];
+}
+function withoutTrailingSlash(url) {
+	return url.replace(/\/+$/, "");
+}
+async function mbProfileRow(state, url, profiles, mbUnusableReason, healthy) {
 	const label = "mb profile";
-	if (!mbInstalled) return skipped("mb-profile", label, "mb is not installed");
+	if (mbUnusableReason !== null) return skipped("mb-profile", label, mbUnusableReason);
 	if (!healthy) return skipped("mb-profile", label, NOT_HEALTHY);
-	const entry = (await mbTool(deps.runner).authList()).find((candidate) => candidate.profile === state.mbProfile);
+	const entry = (await profiles()).find((candidate) => candidate.profile === state.mbProfile);
 	if (entry === void 0) return failed("mb-profile", label, {
 		detail: `${state.mbProfile} is not configured`,
 		hint: "`rde init --only api-key`",
-		fix: "api-key"
+		step: "api-key"
+	});
+	if (withoutTrailingSlash(entry.url) !== withoutTrailingSlash(url)) return failed("mb-profile", label, {
+		detail: `${state.mbProfile} points at ${entry.url}, not at this instance (${url})`,
+		hint: "`rde init --only api-key` logs it back in against the instance",
+		step: "api-key"
 	});
 	if (entry.status !== "ok") return failed("mb-profile", label, {
 		detail: `${state.mbProfile}: ${entry.status}`,
 		hint: "`rde init --only api-key` logs it in again",
-		fix: "api-key"
+		step: "api-key"
 	});
 	const user = entry.user === null ? "" : ` as ${entry.user.name}`;
 	return ok("mb-profile", label, `${state.mbProfile}: ok${user}`);
 }
+function hostOf(url) {
+	return URL.canParse(url) ? new URL(url).host : "an address that is not a URL";
+}
+function unsetHint(name) {
+	return `\`unset ${name}\`, remove it from your shell profile if it is exported there, then restart the agent session`;
+}
+async function mbProfileEnvRow(name, rdeProfile, profiles, mbUnusableReason) {
+	const id = `env.${ENV_MB_PROFILE}`;
+	if (name === rdeProfile) return ok(id, ENV_MB_PROFILE, `${name}: rde's own profile, so plain \`mb\` uses this instance`);
+	const rde = rdeProfile === null ? "rde's" : `rde's (${rdeProfile})`;
+	const detail = (where) => `${name}: \`mb\` and the rde skill will use profile ${name} (${where}) instead of ${rde}`;
+	if (mbUnusableReason !== null) return note$1(id, ENV_MB_PROFILE, detail(mbUnusableReason), unsetHint(ENV_MB_PROFILE));
+	const entry = (await profiles()).find((candidate) => candidate.profile === name);
+	const where = entry === void 0 ? "not configured" : hostOf(entry.url);
+	return note$1(id, ENV_MB_PROFILE, detail(where), unsetHint(ENV_MB_PROFILE));
+}
+async function environmentRows(env, rdeProfile, profiles, mbUnusableReason) {
+	const rows = [];
+	if (env.profile !== null) rows.push(await mbProfileEnvRow(env.profile, rdeProfile, profiles, mbUnusableReason));
+	if (env.url !== null) rows.push(note$1(`env.${ENV_MB_URL}`, ENV_MB_URL, `every \`mb\` call goes to ${hostOf(env.url)}, whatever \`--profile\` says, rde's own included`, unsetHint(ENV_MB_URL)));
+	if (env.apiKeySet) rows.push(note$1(`env.${ENV_MB_API_KEY}`, ENV_MB_API_KEY, "set (value not shown): every `mb` call sends it, whatever `--profile` says, rde's own included", unsetHint(ENV_MB_API_KEY)));
+	return rows;
+}
+const PROFILE_STATUS_WORDS = {
+	ok: "authenticates",
+	"auth-failed": "login rejected",
+	"network-error": "not answering",
+	"server-error": "answers with a server error",
+	"not-probed": "not checked"
+};
+function plainMbLine(env, rdeProfile, profiles) {
+	if (env.url !== null) return `plain \`mb\` goes to ${hostOf(env.url)} (${ENV_MB_URL})`;
+	const name = env.profile ?? "default";
+	const via = env.profile === null ? "" : ` (${ENV_MB_PROFILE})`;
+	const entry = profiles.find((candidate) => candidate.profile === name);
+	if (entry === void 0) return `plain \`mb\` uses ${name}${via}, which is not configured`;
+	const instance = name === rdeProfile ? ", this instance" : "";
+	return `plain \`mb\` uses ${name}${via}: ${hostOf(entry.url)}${instance}`;
+}
+async function otherMetabasesRow(env, rdeProfile, profiles, mbUnusableReason) {
+	const id = "other-metabases";
+	const label = "other Metabases";
+	if (mbUnusableReason !== null) return skipped(id, label, mbUnusableReason);
+	const all = await profiles();
+	const others = all.filter((entry) => entry.profile !== rdeProfile);
+	return ok(id, label, [...others.length === 0 ? ["none"] : others.map((entry) => `${entry.profile}: ${hostOf(entry.url)}, ${PROFILE_STATUS_WORDS[entry.status]}`), plainMbLine(env, rdeProfile, all)].join("\n"));
+}
 function isNotFound$2(error) {
 	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$2;
 }
@@ -4718,7 +5350,7 @@ async function licenseRow(client) {
 		if (!status.valid) return failed("license", label, {
 			detail: `invalid: ${status.status}`,
 			hint: "`rde init --from license` with a valid token",
-			fix: "license"
+			step: "license"
 		});
 		return ok("license", label, `valid, ${status.features.includes("remote-sync") ? `with ${REMOTE_SYNC_FEATURE}` : `without ${REMOTE_SYNC_FEATURE}, so git sync is unavailable`}`);
 	} catch (error) {
@@ -4735,47 +5367,47 @@ async function databasesRow(state, client) {
 	if (missing.length > 0) return failed("databases", label, {
 		detail: `not on the server any more: ${missing.map((record) => record.name).join(", ")}`,
 		hint: "`rde db add` connects them again",
-		fix: "databases"
+		step: "databases"
 	});
 	const names = state.databases.map((record) => record.name).join(", ");
 	return ok("databases", label, `${state.databases.length} connected: ${names}`);
 }
 const SAMPLE_DATABASE_STEP = "sample-database";
 const SAMPLE_LABEL = "sample database";
-async function sampleDatabaseRow(record, deps, dockerOk, client) {
+async function sampleDatabaseRow(record, deps, dockerOk, access) {
 	const id = "sample-database";
 	if (!dockerOk) return skipped(id, SAMPLE_LABEL, "Docker is not available");
 	const status = await sampleDatabaseContainer(record, deps.runtime.docker).status();
 	if (!status.installed) return failed(id, SAMPLE_LABEL, {
 		detail: `${record.containerName} does not exist`,
 		hint: "`rde init` recreates it",
-		fix: SAMPLE_DATABASE_STEP
+		step: SAMPLE_DATABASE_STEP
 	});
 	if (!status.running) return failed(id, SAMPLE_LABEL, {
 		detail: `${record.containerName} is stopped`,
 		hint: "`rde start`",
-		fix: "start-metabase"
+		step: "start-metabase"
 	});
 	if (await deps.ports.isFree(record.port)) return failed(id, SAMPLE_LABEL, {
 		detail: `${record.containerName} runs but port ${record.port} is not answering`,
 		hint: `\`docker logs ${record.containerName}\` shows what Postgres is doing`,
-		fix: null
+		step: null
 	});
 	const where = `${record.containerName} running on ${LOOPBACK_HOST}:${record.port}`;
 	if (record.databaseId === null) return failed(id, SAMPLE_LABEL, {
 		detail: `${where}; not connected to Metabase yet`,
 		hint: "`rde init` connects it",
-		fix: SAMPLE_DATABASE_STEP
+		step: SAMPLE_DATABASE_STEP
 	});
-	if (client === null) return skipped(id, SAMPLE_LABEL, `${where}; ${NOT_HEALTHY}, so the connection is unchecked`);
+	if (access.kind === "unusable") return skipped(id, SAMPLE_LABEL, `${where}; ${access.reason}, so the connection is unchecked`);
 	try {
-		const database = await client.database.get(record.databaseId);
+		const database = await access.client.database.get(record.databaseId);
 		return ok(id, SAMPLE_LABEL, `${where}, database ${database.id} sync ${database.initial_sync_status}`);
 	} catch (error) {
 		if (isNotFound$2(error)) return failed(id, SAMPLE_LABEL, {
 			detail: `${where}; database ${record.databaseId} is gone from Metabase`,
 			hint: "`rde init` connects it again",
-			fix: SAMPLE_DATABASE_STEP
+			step: SAMPLE_DATABASE_STEP
 		});
 		throw error;
 	}
@@ -4792,7 +5424,7 @@ async function gitSyncRow(state, deps) {
 		if (status.branch === null) return failed("git-sync", label, {
 			detail: "Metabase reports no branch",
 			hint: "`rde init --only git-sync`",
-			fix: "git-sync"
+			step: "git-sync"
 		});
 		const dirty = status.is_dirty ? "unsynced changes" : "in sync";
 		return ok("git-sync", label, `branch ${status.branch}, ${dirty}, ${state.gitRemote.workdir}`);
@@ -4800,15 +5432,100 @@ async function gitSyncRow(state, deps) {
 		if (isMbFailure$1(error)) return failed("git-sync", label, {
 			detail: error.message,
 			hint: `\`${mbCommand(state.mbProfile)} git-sync status\` shows the full answer`,
-			fix: null
+			step: null
 		});
 		throw error;
 	}
 }
 const SKILL_STEP = "agents-skills";
+const GLOBAL_SCOPE = "global";
+const SKILL_FILE = "SKILL.md";
+const CLAUDE_CODE = "Claude Code";
+const CLAUDE_CODE_SKILL_RULE = "a personal skill wins over a project one: https://code.claude.com/docs/en/skills";
 function skillRowId(agent) {
 	return `skill.${agent.id}`;
 }
+function withRef(source, ref) {
+	return ref === null ? source : `${source}#${ref}`;
+}
+async function copyRef(entry, deps) {
+	const path = entry.scope === GLOBAL_SCOPE ? globalSkillLockPath(deps.probe.home, deps.skills.stateHome) : projectSkillLockPath(deps.skills.cwd);
+	return lockedRef(path, await deps.skills.files.readJson(path), entry.name);
+}
+async function judgeCopy(entry, origin, deps) {
+	const where = `${entry.scope} ${entry.path}`;
+	switch (origin.kind) {
+		case "local": {
+			const installed = await deps.skills.files.readText(join(entry.path, SKILL_FILE));
+			const wanted = await deps.skills.files.readText(join(origin.path, SKILL_FILE));
+			const current = installed !== null && installed === wanted;
+			return {
+				entry,
+				current,
+				line: `${where}: ${current ? "same as" : "differs from"} ${origin.path}`
+			};
+		}
+		case "github": {
+			const wanted = withRef(origin.repository, origin.ref);
+			if (entry.source === null) return {
+				entry,
+				current: false,
+				line: `${where}: no recorded source, not ${wanted}`
+			};
+			const found = withRef(entry.source, await copyRef(entry, deps));
+			const current = found === wanted;
+			return {
+				entry,
+				current,
+				line: `${where}: from ${found}${current ? "" : `, not ${wanted}`}`
+			};
+		}
+		case "other": {
+			const current = entry.source === origin.source;
+			return {
+				entry,
+				current,
+				line: `${where}: from ${entry.source ?? "no recorded source"}${current ? "" : `, not ${origin.source}`}`
+			};
+		}
+	}
+}
+function loadedCopyLine(entries, cwd) {
+	if (entries.length < 2) return null;
+	const count = `${entries.length} copies are installed`;
+	const forClaude = entries.filter((entry) => entry.agents.includes(CLAUDE_CODE));
+	const loaded = forClaude.find((entry) => entry.scope === GLOBAL_SCOPE) ?? forClaude[0];
+	if (loaded === void 0) return count;
+	return `${count}; ${CLAUDE_CODE} started in ${cwd} loads ${loaded.path} (${CLAUDE_CODE_SKILL_RULE})`;
+}
+function staleCopiesRow(stale, detail, deps) {
+	const globalStale = stale.some((copy) => copy.entry.scope === GLOBAL_SCOPE);
+	const projectStale = stale.some((copy) => copy.entry.scope !== GLOBAL_SCOPE);
+	const repairs = [];
+	if (globalStale) repairs.push(`\`rde init --only ${SKILL_STEP}\` reinstalls the global copy from ${deps.skills.source}`);
+	if (projectStale) repairs.push(`remove the project copy with \`npx -y skills@latest remove rde -y\` in ${deps.skills.cwd}`);
+	return failed("skill-copies", "rde skill copies", {
+		detail,
+		hint: `${repairs.join("; ")}; then restart the agent session`,
+		step: globalStale ? SKILL_STEP : null
+	});
+}
+async function skillCopiesRow(globalEntries, deps) {
+	const id = "skill-copies";
+	const label = "rde skill copies";
+	const cwd = deps.skills.cwd;
+	const projectEntries = cwd === deps.probe.home ? [] : (await skillsCli(deps.runner).listProject(cwd)).filter((entry) => entry.name === "rde");
+	const entries = [...globalEntries, ...projectEntries];
+	if (entries.length === 0) return skipped(id, label, "no copy installed");
+	const origin = skillOrigin(deps.skills.source, cwd);
+	const judged = [];
+	for (const entry of entries) judged.push(await judgeCopy(entry, origin, deps));
+	const loaded = loadedCopyLine(entries, cwd);
+	const lines = judged.map((copy) => copy.line);
+	const detail = (loaded === null ? lines : [...lines, loaded]).join("\n");
+	const stale = judged.filter((copy) => !copy.current);
+	return stale.length === 0 ? ok(id, label, detail) : staleCopiesRow(stale, detail, deps);
+}
 async function skillRows(state, deps) {
 	const label = "rde skill";
 	if (state === null) return [skipped("skill", label, NO_INSTANCE)];
@@ -4816,17 +5533,18 @@ async function skillRows(state, deps) {
 	const detected = (await detectAgents(deps.probe)).filter((agent) => agent.detected);
 	if (detected.length === 0) return [skipped("skill", label, "no coding agents detected")];
 	const entries = await rdeSkillEntries(deps.runner);
+	const copies = await skillCopiesRow(entries, deps);
 	if (detected.filter((agent) => entries.some((entry) => skillCoversAgent(entry, agent))).length === 0) return [failed("skill", label, {
 		detail: `not installed for ${detected.map((agent) => agent.displayName).join(", ")}`,
 		hint: `\`rde init --only ${SKILL_STEP}\``,
-		fix: SKILL_STEP
-	})];
-	return detected.map((agent) => {
+		step: SKILL_STEP
+	}), copies];
+	return [...detected.map((agent) => {
 		const entry = entries.find((candidate) => skillCoversAgent(candidate, agent));
 		const agentLabel = `${label} (${agent.displayName})`;
 		if (entry === void 0) return skipped(skillRowId(agent), agentLabel, `not installed; \`rde init --only ${SKILL_STEP}\` adds it`);
 		return ok(skillRowId(agent), agentLabel, entry.path);
-	});
+	}), copies];
 }
 function noRuntimeRows() {
 	return [
@@ -4835,13 +5553,13 @@ function noRuntimeRows() {
 		"health"
 	].map((id) => skipped(id, id, NO_INSTANCE));
 }
-async function instanceRows(state, deps, dockerOk, mbInstalled) {
+async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusableReason) {
 	const configured = configuredRuntime(state);
 	if (configured === null) return [
 		...noRuntimeRows(),
 		skipped("version", "Metabase version", NO_INSTANCE),
 		skipped("admin", "admin user", NO_INSTANCE),
-		apiKeyRow(state),
+		...await credentialRows(state, secrets, await apiKeyFinding(secrets, null, false, deps), deps),
 		skipped("mb-profile", "mb profile", NO_INSTANCE),
 		skipped("license", "license", NO_INSTANCE),
 		skipped("databases", "databases", NO_INSTANCE),
@@ -4851,35 +5569,33 @@ async function instanceRows(state, deps, dockerOk, mbInstalled) {
 	const runtime = await runtimeRow(configured.runtime, deps, dockerOk);
 	const { row: health, healthy } = await healthRow(configured.url, deps);
 	const properties = healthy ? await deps.client(configured.url, NO_AUTH).session.properties() : null;
+	const apiKey = await apiKeyFinding(secrets, configured.url, healthy, deps);
 	const rows = [
 		runtime.row,
 		await portRow(configured.runtime.port, runtime, deps.ports),
 		health,
 		properties === null ? skipped("version", "Metabase version", NOT_HEALTHY) : versionRow(state, properties),
 		properties === null ? skipped("admin", "admin user", NOT_HEALTHY) : adminRow(state, properties),
-		apiKeyRow(state),
-		await mbProfileRow(state, deps, mbInstalled, healthy)
+		...await credentialRows(state, secrets, apiKey, deps),
+		await mbProfileRow(state, configured.url, profiles, mbUnusableReason, healthy)
 	];
-	const client = healthy && state.apiKey !== null ? deps.client(configured.url, {
-		kind: "api-key",
-		key: state.apiKey
-	}) : null;
-	if (client === null) {
-		const reason = healthy ? "no API key" : NOT_HEALTHY;
-		rows.push(skipped("license", "license", reason), skipped("databases", "databases", reason));
-	} else rows.push(await licenseRow(client), await databasesRow(state, client));
-	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, client));
+	const access = apiKey.access;
+	if (access.kind === "unusable") rows.push(skipped("license", "license", access.reason), skipped("databases", "databases", access.reason));
+	else rows.push(await licenseRow(access.client), await databasesRow(state, access.client));
+	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, access));
 	rows.push(await gitSyncRow(state, deps));
 	return rows;
 }
-async function collectDoctor(instance, state, deps) {
+async function collectDoctor(instance, state, secrets, deps) {
 	const machine = await machineRows(deps, state?.runtime ?? null);
 	const dockerOk = machine.some((row) => row.id === "docker" && row.status === "ok");
-	const mb = await mbRow(deps);
-	const checks = [...machine, mb];
-	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE), skipped("admin", "admin user", NO_INSTANCE), skipped("api-key", "API key", NO_INSTANCE), skipped("mb-profile", "mb profile", NO_INSTANCE), skipped("license", "license", NO_INSTANCE), skipped("databases", "databases", NO_INSTANCE), skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE), skipped("git-sync", "remote sync", NO_INSTANCE));
-	else checks.push(...await instanceRows(state, deps, dockerOk, mb.status === "ok"));
-	checks.push(...await skillRows(state, deps));
+	const mb = await mbFinding(deps);
+	const profiles = sharedProfileList(deps);
+	const checks = [...machine, mb.row];
+	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE), skipped("admin", "admin user", NO_INSTANCE), skipped("admin-password", "admin password", NO_INSTANCE), skipped("api-key", "API key", NO_INSTANCE), skipped("secrets-file", "secrets file", NO_INSTANCE), skipped("state-file", "state file", NO_INSTANCE), skipped("mb-profile", "mb profile", NO_INSTANCE), skipped("license", "license", NO_INSTANCE), skipped("databases", "databases", NO_INSTANCE), skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE), skipped("git-sync", "remote sync", NO_INSTANCE));
+	else checks.push(...await instanceRows(state, secrets, deps, dockerOk, profiles, mb.unusable));
+	const rdeProfile = state === null ? null : state.mbProfile;
+	checks.push(...await environmentRows(deps.environment, rdeProfile, profiles, mb.unusable), await otherMetabasesRow(deps.environment, rdeProfile, profiles, mb.unusable), ...await skillRows(state, deps));
 	return {
 		instance,
 		checks,
@@ -4891,18 +5607,38 @@ const MARK = {
 	failed: "✗",
 	skipped: "–"
 };
+const NOTE_MARK = "!";
 const HINT_ARROW = "→";
+function markFor(row) {
+	return row.status === "ok" && row.hint !== null ? NOTE_MARK : MARK[row.status];
+}
 function doctorLines(report) {
 	const width = Math.max(...report.checks.map((row) => row.label.length));
+	const indent = `  ${" ".repeat(width)}  `;
 	const lines = [];
 	for (const row of report.checks) {
-		lines.push(`${MARK[row.status]} ${row.label.padEnd(width)}  ${row.detail}`);
-		if (row.hint !== null) lines.push(`  ${" ".repeat(width)}  ${HINT_ARROW} ${row.hint}`);
+		const [first, ...rest] = row.detail.split("\n");
+		lines.push(`${markFor(row)} ${row.label.padEnd(width)}  ${first}`);
+		lines.push(...rest.map((line) => `${indent}${line}`));
+		if (row.hint !== null) lines.push(`${indent}${HINT_ARROW} ${row.hint}`);
 	}
 	return lines;
 }
+function fixCommand(step) {
+	return step === null ? null : `rde init --only ${step}`;
+}
+function doctorJson(report) {
+	return {
+		instance: report.instance,
+		checks: report.checks.map(({ step, ...row }) => ({
+			...row,
+			fix: fixCommand(step)
+		})),
+		failed: report.failed
+	};
+}
 function fixableSteps(report) {
-	const wanted = new Set(report.checks.flatMap((row) => row.status === "failed" && row.fix !== null ? [row.fix] : []));
+	const wanted = new Set(report.checks.flatMap((row) => row.status === "failed" && row.step !== null ? [row.step] : []));
 	return StepId.options.filter((id) => wanted.has(id));
 }
 function doctorSummary(report) {
@@ -4941,15 +5677,24 @@ const ADMIN_USER_KEYS = {
 	firstName: `${STEP_ID$6}.first-name`,
 	lastName: `${STEP_ID$6}.last-name`
 };
-const DEFAULT_ADMIN_EMAIL = "admin@metabase.com";
-const DEFAULT_ADMIN_PASSWORD = "metabase123";
+const GENERATED_ADMIN_EMAIL = "admin@metabase.local";
+const GENERATED_PASSWORD_BYTES = 24;
 const DEFAULT_SITE_NAME = "rde";
 const MIN_PASSWORD_LENGTH = 6;
 const DIGIT = /\d/;
 const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-const DEFAULT_ADMIN = { variant: "default" };
+const DEFAULT_ADMIN = { variant: "generated" };
+function generatePassword(random) {
+	for (;;) {
+		const candidate = random(GENERATED_PASSWORD_BYTES).toString("base64url");
+		if (DIGIT.test(candidate)) return candidate;
+	}
+}
 function hostDeps$8(ctx) {
-	return { client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal) };
+	return {
+		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
+		password: () => generatePassword(randomBytes)
+	};
 }
 function isNotReady(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
@@ -4988,26 +5733,22 @@ async function promptedUser(ctx) {
 		...lastName.length > 0 && { last_name: lastName }
 	};
 }
-async function chooseUser(ctx, kind) {
-	switch (kind) {
-		case "default": return {
-			email: DEFAULT_ADMIN_EMAIL,
-			password: DEFAULT_ADMIN_PASSWORD
+async function chooseUser(ctx, variant, deps) {
+	switch (variant) {
+		case "generated": return {
+			email: GENERATED_ADMIN_EMAIL,
+			password: deps.password()
 		};
 		case "prompted": return promptedUser(ctx);
 	}
 }
-function credentialsRecord(kind, user) {
-	switch (kind) {
-		case "default": return {
-			kind,
+function storedLogin(variant, user) {
+	switch (variant) {
+		case "generated": return {
 			email: user.email,
 			password: user.password
 		};
-		case "prompted": return {
-			kind,
-			email: user.email
-		};
+		case "prompted": return null;
 	}
 }
 function adminUserStep(options, deps = hostDeps$8) {
@@ -5026,7 +5767,8 @@ function adminUserStep(options, deps = hostDeps$8) {
 		},
 		async run(ctx) {
 			const configured = requireConfiguredRuntime(ctx.state);
-			const client = deps(ctx).client(configured.url, NO_AUTH);
+			const resolved = deps(ctx);
+			const client = resolved.client(configured.url, NO_AUTH);
 			const properties = await client.session.properties();
 			if (properties["has-user-setup"]) {
 				ctx.ui.info("Metabase already has an admin user");
@@ -5034,7 +5776,11 @@ function adminUserStep(options, deps = hostDeps$8) {
 			}
 			const token = properties["setup-token"];
 			if (token === null) throw new ConfigError("Metabase has no admin user yet but offers no setup token");
-			const user = await chooseUser(ctx, options.variant);
+			const user = await chooseUser(ctx, options.variant, resolved);
+			await ctx.saveSecrets({
+				...ctx.secrets,
+				admin: storedLogin(options.variant, user)
+			});
 			const session = await client.setup.create({
 				token,
 				user,
@@ -5043,7 +5789,10 @@ function adminUserStep(options, deps = hostDeps$8) {
 			ctx.session.metabaseSession.set(session.id);
 			await ctx.saveState({
 				...ctx.state,
-				admin: credentialsRecord(options.variant, user)
+				admin: {
+					kind: options.variant,
+					email: user.email
+				}
 			});
 			ctx.ui.success(`Admin user ${user.email} created`);
 			return "completed";
@@ -5055,8 +5804,7 @@ function adminUserStep(options, deps = hostDeps$8) {
 const STEP_ID$5 = "api-key";
 const API_KEY_KEYS = {
 	email: `${STEP_ID$5}.email`,
-	password: `${STEP_ID$5}.password`,
-	profile: `${STEP_ID$5}.profile`
+	password: `${STEP_ID$5}.password`
 };
 const ADMINISTRATORS_GROUP_NAME = "Administrators";
 function hostDeps$7(ctx) {
@@ -5066,11 +5814,12 @@ function hostDeps$7(ctx) {
 	};
 }
 async function adminCredentials(ctx) {
-	const admin = ctx.state.admin;
-	if (admin?.kind === "default") return {
-		username: admin.email,
-		password: admin.password
+	const stored = ctx.secrets.admin;
+	if (stored !== null) return {
+		username: stored.email,
+		password: stored.password
 	};
+	const admin = ctx.state.admin;
 	ctx.ui.info("An admin login is needed once to create the API key; it is not saved");
 	return {
 		username: await ctx.prompts.text({
@@ -5108,47 +5857,35 @@ async function freshApiKey(ctx, client) {
 		group_id: groupId
 	})).unmasked_key;
 }
-async function persistedApiKey(ctx, deps, url) {
-	if (ctx.state.apiKey !== null) return ctx.state.apiKey;
+async function authenticates(client) {
+	try {
+		await client.user.current();
+		return true;
+	} catch (error) {
+		if (isRejectedCredential(error)) return false;
+		throw error;
+	}
+}
+async function workingApiKey(ctx, deps, url) {
+	const stored = ctx.secrets.apiKey;
+	if (stored !== null) {
+		if (await authenticates(deps.client(url, {
+			kind: "api-key",
+			key: stored
+		}))) return stored;
+		ctx.ui.warn("Metabase rejects the stored API key; replacing it");
+	}
 	const sessionId = await superuserSession(ctx, deps, url);
 	const apiKey = await freshApiKey(ctx, deps.client(url, {
 		kind: "session",
 		id: sessionId
 	}));
-	await ctx.saveState({
-		...ctx.state,
+	await ctx.saveSecrets({
+		...ctx.secrets,
 		apiKey
 	});
 	return apiKey;
 }
-async function chooseProfile(ctx, mb, url) {
-	const profile = ctx.state.mbProfile;
-	if (profile !== "default") return profile;
-	let existing;
-	try {
-		existing = await mb.authStatus(DEFAULT_MB_PROFILE);
-	} catch (error) {
-		if (error instanceof ProcessNotFoundError) return profile;
-		throw error;
-	}
-	if (!existing.present || existing.url === url) return profile;
-	const chosen = await ctx.prompts.select({
-		key: API_KEY_KEYS.profile,
-		message: `mb profile ${DEFAULT_MB_PROFILE} already points at ${existing.url}; which profile should this instance use?`,
-		choices: [{
-			value: "rde",
-			label: `rde, and leave ${DEFAULT_MB_PROFILE} alone`
-		}, {
-			value: DEFAULT_MB_PROFILE,
-			label: `${DEFAULT_MB_PROFILE}, replacing it`
-		}]
-	});
-	if (chosen !== profile) await ctx.saveState({
-		...ctx.state,
-		mbProfile: chosen
-	});
-	return chosen;
-}
 function usageNote(profile) {
 	if (profile === "default") return `${mbCommand(profile)} <command> uses this instance`;
 	return `${mbCommand(profile)} <command>\nMB_PROFILE=${profile} for agents and scripts`;
@@ -5158,7 +5895,7 @@ function apiKeyStep(deps = hostDeps$7) {
 		id: STEP_ID$5,
 		title: "Connect the Metabase CLI",
 		async detect(ctx) {
-			if (ctx.state.apiKey === null) return "todo";
+			if (ctx.secrets.apiKey === null) return "todo";
 			const mb = mbTool(deps(ctx).runner);
 			const profile = ctx.state.mbProfile;
 			try {
@@ -5172,9 +5909,9 @@ function apiKeyStep(deps = hostDeps$7) {
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = await persistedApiKey(ctx, resolved, configured.url);
+			const apiKey = await workingApiKey(ctx, resolved, configured.url);
 			const mb = mbTool(resolved.runner);
-			const profile = await chooseProfile(ctx, mb, configured.url);
+			const profile = ctx.state.mbProfile;
 			await mb.authLogin({
 				url: configured.url,
 				profile,
@@ -5574,14 +6311,14 @@ function isMbUnavailable(error) {
 }
 async function runGitSync(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
-	if (ctx.state.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
 	const run = {
 		ctx,
 		deps,
 		git: gitTool(deps.runner),
 		client: deps.client(configured.url, {
 			kind: "api-key",
-			key: ctx.state.apiKey
+			key: ctx.secrets.apiKey
 		})
 	};
 	const flow = await runFlow({
@@ -5637,8 +6374,8 @@ function validateToken(value) {
 	return "A license token is 64 hexadecimal characters";
 }
 function requireApiKey$1(ctx) {
-	if (ctx.state.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
-	return ctx.state.apiKey;
+	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	return ctx.secrets.apiKey;
 }
 function activeLabel(status) {
 	const plan = status["plan-alias"];
@@ -5651,15 +6388,15 @@ function licenseStep(deps = hostDeps$5) {
 		async detect(ctx) {
 			if (ctx.state.steps[STEP_ID$3]?.status === "skipped") return "not-applicable";
 			const configured = configuredRuntime(ctx.state);
-			if (configured === null || ctx.state.apiKey === null) return "todo";
+			if (configured === null || ctx.secrets.apiKey === null) return "todo";
 			const client = deps(ctx).client(configured.url, {
 				kind: "api-key",
-				key: ctx.state.apiKey
+				key: ctx.secrets.apiKey
 			});
 			try {
 				return (await client.tokenStatus.get()).valid ? "done" : "todo";
 			} catch (error) {
-				if (isNoTokenYet(error)) return "todo";
+				if (isNoTokenYet(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -5894,9 +6631,9 @@ function isNotServingYet(error) {
 function isNotFound$1(error) {
 	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS;
 }
-function requireApiKey(state) {
-	if (state.apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
-	return state.apiKey;
+function requireApiKey(ctx) {
+	if (ctx.secrets.apiKey === null) throw new ConfigError(`instance ${ctx.state.name} has no API key yet; run \`rde init\``);
+	return ctx.secrets.apiKey;
 }
 async function recordedDatabase(record, client) {
 	if (record.databaseId === null) return null;
@@ -6018,23 +6755,23 @@ function sampleDatabaseStep(deps = hostDeps$3) {
 			if (!(await resolved.runtime.docker.available()).available) return "not-applicable";
 			const record = ctx.state.sampleDatabase;
 			const configured = configuredRuntime(ctx.state);
-			if (record === null || configured === null || ctx.state.apiKey === null) return "todo";
+			if (record === null || configured === null || ctx.secrets.apiKey === null) return "todo";
 			if (!(await sampleDatabaseContainer(record, resolved.runtime.docker).status()).installed) return "todo";
 			const client = resolved.client(configured.url, {
 				kind: "api-key",
-				key: ctx.state.apiKey
+				key: ctx.secrets.apiKey
 			});
 			try {
 				return await recordedDatabase(record, client) === null ? "todo" : "done";
 			} catch (error) {
-				if (isNotServingYet(error)) return "todo";
+				if (isNotServingYet(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey(ctx.state);
+			const apiKey = requireApiKey(ctx);
 			const docker = await resolved.runtime.docker.available();
 			if (!docker.available) throw new ConfigError(`the sample database runs in Docker, which is not available: ${docker.reason}`);
 			const choice = await persistedRecord(ctx, resolved);
@@ -6149,23 +6886,24 @@ function hostDeps$1(ctx) {
 function isNotServing$1(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
-function loginLine(admin) {
-	if (admin === null) return null;
-	switch (admin.kind) {
-		case "default": return `Login: ${admin.email} / ${admin.password}`;
-		case "prompted": return `Login: ${admin.email} with the password you entered`;
+function loginLine(kind, email) {
+	switch (kind) {
+		case "generated":
+		case "legacy-default": return `Login: ${email} (run rde credentials in your terminal for the password)`;
+		case "prompted": return `Login: ${email} with the password you entered`;
 	}
 }
-async function databaseLines$1(state, deps) {
-	if (state.url === null || state.apiKey === null) return ["Databases: none connected yet"];
+async function databaseLines$1(state, apiKey, deps) {
+	if (state.url === null || apiKey === null) return ["Databases: none connected yet"];
 	let databases;
 	try {
 		databases = (await deps.client(state.url, {
 			kind: "api-key",
-			key: state.apiKey
+			key: apiKey
 		}).database.list()).data;
 	} catch (error) {
 		if (isNotServing$1(error)) return ["Databases: Metabase is not running; `rde start`"];
+		if (isRejectedCredential(error)) return ["Databases: Metabase rejects the stored API key; `rde init --only api-key`"];
 		throw error;
 	}
 	if (databases.length === 0) return ["Databases: none connected yet; `rde db add`"];
@@ -6199,14 +6937,13 @@ function launchLines(agents, workdir) {
 	const prefix = workdir === null ? "" : `cd ${workdir} && `;
 	return ["Start working:", ...detected.map((agent) => `  ${prefix}${agent.launch}  (${agent.displayName})`)];
 }
-async function summaryLines(state, deps) {
+async function summaryLines(state, apiKey, deps) {
 	const profile = state.mbProfile;
 	const lines = [];
 	if (state.url !== null) lines.push(`Metabase: ${state.url}`);
-	const login = loginLine(state.admin);
-	if (login !== null) lines.push(login);
+	if (state.admin !== null) lines.push(loginLine(state.admin.kind, state.admin.email));
 	lines.push(profile === "default" ? `Metabase CLI: ${mbCommand(profile)} <command>` : `Metabase CLI: ${mbCommand(profile)} <command>  or  export MB_PROFILE=${profile}`);
-	lines.push(...await databaseLines$1(state, deps));
+	lines.push(...await databaseLines$1(state, apiKey, deps));
 	if (state.sampleDatabase !== null) lines.push(`Sample database: psql "${sampleDatabaseUrl(state.sampleDatabase.port)}"`);
 	lines.push(...gitLines(state));
 	const installed = await skillsCli(deps.runner).list();
@@ -6223,7 +6960,8 @@ function summaryStep(deps = hostDeps$1) {
 			return "todo";
 		},
 		async run(ctx) {
-			ctx.ui.note((await summaryLines(ctx.state, deps(ctx))).join("\n"), "Your environment");
+			const lines = await summaryLines(ctx.state, ctx.secrets.apiKey, deps(ctx));
+			ctx.ui.note(lines.join("\n"), "Your environment");
 			return "completed";
 		}
 	};
@@ -6257,7 +6995,7 @@ function initSteps(options) {
 //#region src/commands/doctor.ts
 function print(report, json) {
 	if (json) {
-		printJson(report);
+		printJson(doctorJson(report));
 		return;
 	}
 	printLines(doctorLines(report));
@@ -6288,12 +7026,12 @@ const doctor = defineRdeCommand({
 		const name = await instanceNameOrDefault();
 		const state = await readInstanceState(name);
 		const deps = hostDoctorDeps(name, interruptSignal);
-		let report = await collectDoctor(name, state, deps);
+		let report = await collectDoctor(name, state, state === null ? null : await readInstanceSecrets(name), deps);
 		if (args.fix && report.failed > 0) {
 			if (state === null) throw new ConfigError("no instance to fix yet; run `rde init`");
 			print(report, args.json);
 			const ctx = await createWizardContext(name, { signal: interruptSignal });
-			if (await fixDoctor(report, initSteps(DEFAULT_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, deps);
+			if (await fixDoctor(report, initSteps(DEFAULT_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, ctx.secrets, deps);
 		}
 		print(report, args.json);
 		if (report.failed > 0) throw new Error(doctorSummary(report));
@@ -6318,7 +7056,7 @@ const EnvString = z.string().transform((value, ctx) => {
 	}
 	return resolved;
 });
-const AdminVariant = z.enum(["default", "prompted"]);
+const AdminVariant = z.enum(["generated", "prompted"]);
 const RemoteKind = z.enum(["local-bare", "hosted"]);
 const FieldValue = z.union([
 	EnvString,
@@ -6347,7 +7085,6 @@ const SECTIONS = {
 		"first-name": z.string().optional(),
 		"last-name": z.string().optional()
 	}).optional(),
-	"api-key": z.strictObject({ profile: MbProfileChoice }).optional(),
 	license: z.strictObject({ token: EnvString.nullable() }).optional(),
 	databases: z.array(DatabaseEntry).optional(),
 	"git-sync": z.strictObject({
@@ -6443,8 +7180,6 @@ function keyedAnswers(answers) {
 	const map = /* @__PURE__ */ new Map();
 	const admin = answers["admin-user"];
 	if (admin !== void 0) addAdmin(map, admin);
-	const apiKey = answers["api-key"];
-	if (apiKey !== void 0) add(map, API_KEY_KEYS.profile, select$1(apiKey.profile));
 	const license = answers.license;
 	if (license !== void 0) add(map, LICENSE_KEYS.token, password$1(license.token ?? SKIP_LICENSE));
 	const databases = answers.databases;
@@ -6500,7 +7235,6 @@ const FLAG_FOR_KEY = {
 	[ADMIN_USER_KEYS.password]: "--admin-password",
 	[API_KEY_KEYS.email]: "--admin-email",
 	[API_KEY_KEYS.password]: "--admin-password",
-	[API_KEY_KEYS.profile]: "--mb-profile",
 	[LICENSE_KEYS.token]: "--license-token or --skip-license",
 	[DATABASE_KEYS.engine]: "--database or --skip-databases",
 	[DATABASE_KEYS.uri]: "--database",
@@ -6554,7 +7288,7 @@ function parseDatabase(spec) {
 function adminSection(flags, secrets) {
 	const prompted = flags.adminEmail !== void 0 || secrets.has("--admin-password");
 	if (flags.admin === void 0 && !prompted) return;
-	if (flags.admin === "default" && prompted) throw conflict("--admin default", "--admin-email/--admin-password");
+	if (flags.admin === "generated" && prompted) throw conflict("--admin generated", "--admin-email/--admin-password");
 	return {
 		variant: flags.admin ?? "prompted",
 		...flags.adminEmail !== void 0 && { email: flags.adminEmail },
@@ -6657,8 +7391,7 @@ async function answersFromFlags(flags, readStdin) {
 		license: licenseSection(flags, secrets),
 		databases: databasesSection(flags),
 		"git-sync": gitSection(flags, secrets),
-		"agents-skills": agentsSection(flags),
-		"api-key": flags.mbProfile === void 0 ? void 0 : { profile: flags.mbProfile }
+		"agents-skills": agentsSection(flags)
 	};
 	const present = Object.entries(sections).filter(([, section]) => section !== void 0);
 	return parseInitAnswers(Object.fromEntries(present), "the init flags");
@@ -6752,10 +7485,7 @@ function applyRecord(draft, record) {
 	if (key.startsWith("databases.")) applyDatabaseRecord(draft, record);
 	else if (key.startsWith("admin-user.")) applyAdminRecord(draft, key, value);
 	else if (key.startsWith("git-sync.")) applyGitRecord(draft, key, value);
-	else if (key === API_KEY_KEYS.profile && value !== null) {
-		const profile = MbProfileChoice.safeParse(value);
-		if (profile.success) draft.answers["api-key"] = { profile: profile.data };
-	} else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
+	else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
 }
 function writableUri(uri, index) {
 	return URI_WITH_PASSWORD.test(uri) ? envReference(databaseEnv(index, "uri")) : uri;
@@ -7027,7 +7757,7 @@ const init = defineRdeCommand({
 		},
 		admin: {
 			type: "string",
-			description: "Admin credentials: default (admin@metabase.com / metabase123) or prompted"
+			description: "Admin credentials: generated (a random password; `rde credentials` shows it) or prompted"
 		},
 		"admin-email": {
 			type: "string",
@@ -7085,10 +7815,6 @@ const init = defineRdeCommand({
 			description: "Install the skill for no agent",
 			default: false
 		},
-		"mb-profile": {
-			type: "string",
-			description: "mb profile for this instance when `default` already points elsewhere: default or rde"
-		},
 		yes: {
 			type: "boolean",
 			description: "Answer yes to every confirmation (skipping databases)",
@@ -7123,8 +7849,7 @@ const init = defineRdeCommand({
 				gitToken: args["git-token"],
 				skipGit: args["skip-git"],
 				agents: args.agents,
-				skipAgents: args["skip-agents"],
-				mbProfile: args["mb-profile"]
+				skipAgents: args["skip-agents"]
 			}
 		};
 		const printTo = args["print-answers"];
@@ -7243,11 +7968,11 @@ function isNotServing(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
 async function databasesOf(ctx, deps, health) {
-	if (health !== "healthy" || ctx.state.apiKey === null) return null;
+	if (health !== "healthy" || ctx.secrets.apiKey === null) return null;
 	try {
-		return await listDatabases(ctx.state, { client: deps.client });
+		return await listDatabases(ctx.state, ctx.secrets.apiKey, { client: deps.client });
 	} catch (error) {
-		if (isNotServing(error)) return null;
+		if (isNotServing(error) || isRejectedCredential(error)) return null;
 		throw error;
 	}
 }
@@ -7290,9 +8015,13 @@ async function collectStatus(ctx, deps) {
 	const runtime = configured === null ? null : await runtimeFromState(configured.runtime, deps.runtime).status();
 	const health = configured === null ? null : await healthOf(configured.url, deps);
 	const databases = health === null ? null : await databasesOf(ctx, deps, health);
+	const admin = ctx.state.admin;
 	return {
 		instance: ctx.state.name,
 		url: configured?.url ?? null,
+		mbProfile: ctx.state.mbProfile,
+		adminEmail: admin === null ? null : admin.email,
+		adminVariant: admin === null ? null : admin.kind,
 		runtime: configured === null || runtime === null ? null : {
 			kind: configured.runtime.kind,
 			installed: runtime.installed,
@@ -7346,6 +8075,8 @@ function databaseLines(report) {
 function statusLines(report) {
 	return [
 		report.url === null ? `Instance ${report.instance}` : `Instance ${report.instance} — ${report.url}`,
+		...report.adminVariant === null || report.adminEmail === null ? [] : [loginLine(report.adminVariant, report.adminEmail)],
+		`Metabase CLI: ${mbCommand(report.mbProfile)} <command>`,
 		runtimeLine(report),
 		versionLine(report),
 		`Health: ${report.health ?? "unknown"}`,
@@ -7648,7 +8379,7 @@ async function planUninstall(options, deps) {
 		if (jar.removal !== null) removals.push(jar.removal);
 		if (jar.kept !== null) kept.push(jar.kept);
 	}
-	const profiles = state === null ? await findMbProfiles([DEFAULT_MB_PROFILE, "rde"], null, deps.runner) : await findMbProfiles([state.mbProfile], state.url, deps.runner);
+	const profiles = state === null ? await findMbProfiles([DEFAULT_MB_PROFILE, mbProfileFor(options.instance)], null, deps.runner) : await findMbProfiles([state.mbProfile], state.url, deps.runner);
 	removals.push(...profiles);
 	if (options.removeSkill) {
 		const skill = await findSkill(deps.runner);
@@ -7657,6 +8388,11 @@ async function planUninstall(options, deps) {
 	const dir = instanceDir(options.instance);
 	const dirPresent = await pathExists(dir);
 	if (!options.keepData) {
+		const secrets = instanceSecretsPath(options.instance);
+		if (await pathExists(secrets)) removals.push({
+			label: `Stored credentials ${secrets} (the admin password and the API key)`,
+			remove: () => promises.rm(secrets, { force: true })
+		});
 		if (dirPresent) removals.push({
 			label: instanceDirLabel(dir, state),
 			remove: () => promises.rm(dir, {
@@ -8058,7 +8794,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.2",
+		version: "0.1.3-alpha.rde-fixes.59b956e",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {
@@ -8066,6 +8802,7 @@ const main = defineCommand({
 		start,
 		stop,
 		status,
+		credentials,
 		logs,
 		open,
 		db,