@metabase/rde 0.1.3-alpha.rde-fixes.59b956e → 0.1.3

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { defineCommand, runMain, showUsage } from "citty";
 import { createWriteStream, promises } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
+import { delimiter, dirname, join, resolve } from "node:path";
 import { ZodError, z } from "zod";
 import { homedir, tmpdir, userInfo } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -11,7 +11,6 @@ import { confirm, intro, isCancel, log, multiselect, note, outro, password, sele
 import { spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import semver from "semver";
-import { randomBytes } from "node:crypto";
 //#region src/errors.ts
 var AbortError = class extends Error {
 	constructor(message = "interrupted") {
@@ -57,10 +56,6 @@ var MetabaseApiError = class extends Error {
 		this.errors = failure.errors;
 	}
 };
-const UNAUTHORIZED_STATUS = 401;
-function isRejectedCredential(error) {
-	return error instanceof MetabaseApiError && error.status === UNAUTHORIZED_STATUS;
-}
 var MetabaseInitializingError = class extends Error {
 	progress;
 	constructor(progress) {
@@ -122,17 +117,6 @@ function installInterruptHandler(exit) {
 		setTimeout(() => exit(130), FORCED_EXIT_GRACE_MS).unref();
 	});
 }
-//#endregion
-//#region src/output/print.ts
-function printLines(lines) {
-	process.stdout.write(lines.join("\n") + "\n");
-}
-function stdoutIsTty() {
-	return process.stdout.isTTY === true;
-}
-function printJson(value) {
-	process.stdout.write(JSON.stringify(value, null, 2) + "\n");
-}
 const StepId = z.enum([
 	"preflight",
 	"install-mb",
@@ -173,36 +157,14 @@ const JarRuntimeState = z.object({
 });
 const RuntimeState = z.discriminatedUnion("kind", [DockerRuntimeState, JarRuntimeState]);
 const RuntimeKind = z.enum(["docker", "jar"]);
-const AdminCredentials = z.discriminatedUnion("kind", [
-	z.object({
-		kind: z.literal("generated"),
-		email: z.string()
-	}),
-	z.object({
-		kind: z.literal("prompted"),
-		email: z.string()
-	}),
-	z.object({
-		kind: z.literal("legacy-default"),
-		email: z.string()
-	})
-]);
-const AdminLogin = z.object({
+const AdminCredentials = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("prompted"),
+	email: z.string()
+}), z.object({
+	kind: z.literal("default"),
 	email: z.string(),
 	password: z.string()
-});
-const InstanceSecrets = z.object({
-	schemaVersion: z.literal(1),
-	admin: AdminLogin.nullable(),
-	apiKey: z.string().nullable()
-});
-function emptyInstanceSecrets() {
-	return {
-		schemaVersion: 1,
-		admin: null,
-		apiKey: null
-	};
-}
+})]);
 const LicenseState = z.discriminatedUnion("activated", [z.object({ activated: z.literal(false) }), z.object({
 	activated: z.literal(true),
 	features: z.array(z.string()),
@@ -240,12 +202,13 @@ const StepRecord = z.object({
 	completedAt: z.string()
 });
 const InstanceState = z.object({
-	schemaVersion: z.literal(4),
+	schemaVersion: z.literal(3),
 	name: z.string(),
 	runtime: RuntimeState.nullable(),
 	url: z.string().nullable(),
 	version: z.string().nullable(),
 	admin: AdminCredentials.nullable(),
+	apiKey: z.string().nullable(),
 	mbProfile: z.string(),
 	license: LicenseState,
 	databases: z.array(DatabaseRecord),
@@ -267,22 +230,20 @@ function requireConfiguredRuntime(state) {
 }
 const DEFAULT_INSTANCE_NAME = "default";
 const DEFAULT_MB_PROFILE = "default";
-const RDE_MB_PROFILE = "rde";
-function mbProfileFor(instance) {
-	return instance === "default" ? RDE_MB_PROFILE : `${RDE_MB_PROFILE}-${instance}`;
-}
+const MbProfileChoice = z.enum([DEFAULT_MB_PROFILE, "rde"]);
 function mbCommand(profile) {
 	return profile === "default" ? "mb" : `mb --profile ${profile}`;
 }
 function emptyInstanceState(name) {
 	return {
-		schemaVersion: 4,
+		schemaVersion: 3,
 		name,
 		runtime: null,
 		url: null,
 		version: null,
 		admin: null,
-		mbProfile: mbProfileFor(name),
+		apiKey: null,
+		mbProfile: DEFAULT_MB_PROFILE,
 		license: { activated: false },
 		databases: [],
 		sampleDatabase: null,
@@ -295,22 +256,8 @@ function emptyInstanceState(name) {
 const Versioned = z.object({ schemaVersion: z.int() });
 const V1 = 1;
 const V2 = 2;
-const V3 = 3;
 const StateV1 = z.object({ schemaVersion: z.literal(V1) }).loose();
 const StateV2 = z.object({ schemaVersion: z.literal(V2) }).loose();
-const AdminV3 = z.discriminatedUnion("kind", [z.object({
-	kind: z.literal("prompted"),
-	email: z.string()
-}), z.object({
-	kind: z.literal("default"),
-	email: z.string(),
-	password: z.string()
-})]);
-const StateV3 = z.object({
-	schemaVersion: z.literal(V3),
-	admin: AdminV3.nullable(),
-	apiKey: z.string().nullable()
-}).loose();
 function liftV1(raw) {
 	return {
 		...StateV1.parse(raw),
@@ -321,67 +268,27 @@ function liftV1(raw) {
 function liftV2(raw) {
 	return {
 		...StateV2.parse(raw),
-		schemaVersion: V3,
+		schemaVersion: 3,
 		sampleDatabase: null
 	};
 }
-function adminV4(admin) {
-	switch (admin.kind) {
-		case "default": return {
-			kind: "legacy-default",
-			email: admin.email
-		};
-		case "prompted": return {
-			kind: "prompted",
-			email: admin.email
-		};
-	}
-}
-function liftV3(raw) {
-	const { admin, apiKey, ...rest } = StateV3.parse(raw);
-	const login = admin?.kind === "default" ? {
-		email: admin.email,
-		password: admin.password
-	} : null;
-	return {
-		state: InstanceState.parse({
-			...rest,
-			schemaVersion: 4,
-			admin: admin === null ? null : adminV4(admin)
-		}),
-		movedSecrets: {
-			schemaVersion: 1,
-			admin: login,
-			apiKey
-		}
-	};
-}
 function migrateInstanceState(raw) {
 	const { schemaVersion } = Versioned.parse(raw);
 	switch (schemaVersion) {
 		case V1: return migrateInstanceState(liftV1(raw));
 		case V2: return migrateInstanceState(liftV2(raw));
-		case V3: return liftV3(raw);
-		case 4: return {
-			state: InstanceState.parse(raw),
-			movedSecrets: null
-		};
-		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 4)`);
+		case 3: return InstanceState.parse(raw);
+		default: throw new ConfigError(`state schemaVersion ${schemaVersion} is not supported by this build (expected 3)`);
 	}
 }
 //#endregion
 //#region src/env.ts
 const ENV_RDE_HOME = "RDE_HOME";
-const ENV_RDE_SKILL_SOURCE = "RDE_SKILL_SOURCE";
 function readEnv(name) {
 	return process.env[name];
 }
 const ENV_PATH = "PATH";
-const ENV_XDG_STATE_HOME = "XDG_STATE_HOME";
 const ENV_JAVA_HOME = "JAVA_HOME";
-const ENV_MB_PROFILE = "MB_PROFILE";
-const ENV_MB_URL = "MB_URL";
-const ENV_MB_API_KEY = "MB_API_KEY";
 function environmentWith(overrides) {
 	return {
 		...process.env,
@@ -395,7 +302,6 @@ const INSTANCES_DIR = "instances";
 const DATA_DIR = "data";
 const BACKUPS_DIR = "backups";
 const STATE_FILE = "state.json";
-const SECRETS_FILE = "secrets.json";
 const GLOBAL_CONFIG_FILE = "config.json";
 const JARS_DIR = "jars";
 const JAR_FILE$1 = "metabase.jar";
@@ -416,17 +322,8 @@ function instanceDataDir(name) {
 function instanceBackupsDir(name) {
 	return join(instanceDir(name), BACKUPS_DIR);
 }
-function stateFileIn(dir) {
-	return join(dir, STATE_FILE);
-}
-function secretsFileIn(dir) {
-	return join(dir, SECRETS_FILE);
-}
 function instanceStatePath(name) {
-	return stateFileIn(instanceDir(name));
-}
-function instanceSecretsPath(name) {
-	return secretsFileIn(instanceDir(name));
+	return join(instanceDir(name), STATE_FILE);
 }
 function globalConfigPath() {
 	return join(rdeHome(), GLOBAL_CONFIG_FILE);
@@ -440,21 +337,21 @@ function jarReleaseDir(version) {
 function releaseJarIn(jarsDirectory, version) {
 	return join(jarsDirectory, version, JAR_FILE$1);
 }
-const PERMISSION_BITS = 511;
+//#endregion
+//#region src/state/store.ts
+const FILE_MODE$1 = 384;
+const DIR_MODE = 448;
 function isFileNotFound$1(error) {
 	return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
-async function readTextFile(path) {
+async function readJsonFile(path) {
+	let raw;
 	try {
-		return await promises.readFile(path, "utf8");
+		raw = await promises.readFile(path, "utf8");
 	} catch (error) {
 		if (isFileNotFound$1(error)) return null;
 		throw error;
 	}
-}
-async function readJsonFile(path) {
-	const raw = await readTextFile(path);
-	if (raw === null) return null;
 	try {
 		return JSON.parse(raw);
 	} catch (error) {
@@ -473,11 +370,11 @@ function parseAt(path, parse) {
 async function writeJsonFile(path, value) {
 	await promises.mkdir(dirname(path), {
 		recursive: true,
-		mode: 448
+		mode: DIR_MODE
 	});
 	const tmpPath = `${path}.${process.pid}.tmp`;
-	await promises.writeFile(tmpPath, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
-	await promises.chmod(tmpPath, 384);
+	await promises.writeFile(tmpPath, JSON.stringify(value, null, 2) + "\n", { mode: FILE_MODE$1 });
+	await promises.chmod(tmpPath, FILE_MODE$1);
 	try {
 		await promises.rename(tmpPath, path);
 	} catch (error) {
@@ -489,12 +386,7 @@ async function readInstanceState(name) {
 	const path = instanceStatePath(name);
 	const raw = await readJsonFile(path);
 	if (raw === null) return null;
-	const migrated = parseAt(path, () => migrateInstanceState(raw));
-	if (migrated.movedSecrets !== null) {
-		await writeInstanceSecrets(name, migrated.movedSecrets);
-		await writeInstanceState(migrated.state);
-	}
-	return migrated.state;
+	return parseAt(path, () => migrateInstanceState(raw));
 }
 async function writeInstanceState(state) {
 	await writeJsonFile(instanceStatePath(state.name), state);
@@ -504,35 +396,6 @@ async function requireInstanceState(name) {
 	if (state === null) throw new ConfigError(`no instance named ${name}; run \`rde init\` first`);
 	return state;
 }
-async function readInstanceSecrets(name) {
-	const path = instanceSecretsPath(name);
-	const raw = await readJsonFile(path);
-	if (raw === null) return null;
-	return parseAt(path, () => InstanceSecrets.parse(raw));
-}
-async function writeInstanceSecrets(name, secrets) {
-	await writeJsonFile(instanceSecretsPath(name), secrets);
-	await promises.chmod(instanceDir(name), 448);
-}
-async function modeOf(path) {
-	try {
-		return (await promises.stat(path)).mode & PERMISSION_BITS;
-	} catch (error) {
-		if (isFileNotFound$1(error)) return null;
-		throw error;
-	}
-}
-const StateWithApiKey = z.object({ apiKey: z.string() }).loose();
-const StateWithPassword = z.object({ admin: z.object({ password: z.string() }).loose() }).loose();
-async function inspectCredentialFiles(dir) {
-	const raw = await readJsonFile(stateFileIn(dir));
-	const secretsInState = [...StateWithApiKey.safeParse(raw).success ? ["apiKey"] : [], ...StateWithPassword.safeParse(raw).success ? ["admin.password"] : []];
-	return {
-		dirMode: await modeOf(dir),
-		secretsMode: await modeOf(secretsFileIn(dir)),
-		secretsInState
-	};
-}
 async function readGlobalConfig() {
 	const path = globalConfigPath();
 	const raw = await readJsonFile(path);
@@ -543,91 +406,6 @@ async function writeGlobalConfig(config) {
 	await writeJsonFile(globalConfigPath(), config);
 }
 //#endregion
-//#region src/steps/credentials.ts
-const TERMINAL_ONLY = "rde credentials prints only to a terminal; run it in your own terminal";
-function storedPasswordLines(state, secrets, email) {
-	if (secrets === null || secrets.admin === null) throw new ConfigError(`the secrets file of instance ${state.name} holds no admin password; \`rde doctor\` says what to do`);
-	return [`Email: ${email}`, `Password: ${secrets.admin.password}`];
-}
-function credentialsLines(state, secrets) {
-	const admin = state.admin;
-	if (admin === null) throw new ConfigError(`instance ${state.name} has no admin user yet; run \`rde init\``);
-	const url = state.url === null ? [] : [`Metabase: ${state.url}`];
-	switch (admin.kind) {
-		case "generated": return [...url, ...storedPasswordLines(state, secrets, admin.email)];
-		case "legacy-default": return [
-			...url,
-			...storedPasswordLines(state, secrets, admin.email),
-			"This is the public default password; when the instance holds nothing you need, `rde uninstall` then `rde init` recreates it with a generated one"
-		];
-		case "prompted": return [
-			...url,
-			`Email: ${admin.email}`,
-			"Password: the one you entered during `rde init`; rde never stored it"
-		];
-	}
-}
-//#endregion
-//#region src/commands/define.ts
-function repeatedValues(rawArgs, flag) {
-	const values = [];
-	const inline = `${flag}=`;
-	for (let index = 0; index < rawArgs.length; index += 1) {
-		const arg = rawArgs[index];
-		if (arg === void 0) continue;
-		if (arg.startsWith(inline)) values.push(arg.slice(inline.length));
-		else if (arg === flag) {
-			const next = rawArgs[index + 1];
-			if (next !== void 0) {
-				values.push(next);
-				index += 1;
-			}
-		}
-	}
-	return values;
-}
-function defineRdeCommand(def) {
-	return defineCommand({
-		meta: def.meta,
-		...def.args !== void 0 && { args: def.args },
-		async run({ args, rawArgs }) {
-			try {
-				await def.run(args, rawArgs);
-			} catch (error) {
-				reportError(error);
-			}
-		}
-	});
-}
-//#endregion
-//#region src/commands/instance.ts
-async function defaultInstanceName() {
-	const config = await readGlobalConfig();
-	if (config === null) throw new ConfigError("no Metabase instance yet; run `rde init` first");
-	return config.defaultInstance;
-}
-async function instanceNameOrDefault() {
-	try {
-		return (await readGlobalConfig())?.defaultInstance ?? "default";
-	} catch (error) {
-		if (error instanceof ConfigError) return DEFAULT_INSTANCE_NAME;
-		throw error;
-	}
-}
-//#endregion
-//#region src/commands/credentials.ts
-const credentials = defineRdeCommand({
-	meta: {
-		name: "credentials",
-		description: "Print the admin login of the instance; only to a terminal"
-	},
-	async run() {
-		if (!stdoutIsTty()) throw new ConfigError(TERMINAL_ONLY);
-		const name = await defaultInstanceName();
-		printLines(credentialsLines(await requireInstanceState(name), await readInstanceSecrets(name)));
-	}
-});
-//#endregion
 //#region src/connections/parse-uri.ts
 var UriParseError = class extends Error {
 	engine;
@@ -1294,18 +1072,6 @@ function tokenStatusResource(http) {
 	return { get };
 }
 //#endregion
-//#region src/metabase/domain/user.ts
-const CurrentUser = z.object({ id: z.int() }).loose();
-//#endregion
-//#region src/metabase/resources/user.ts
-function userResource(http) {
-	/** GET /api/user/current */
-	async function current() {
-		return http.requestJson("GET", "/api/user/current", { schema: CurrentUser });
-	}
-	return { current };
-}
-//#endregion
 //#region src/metabase/client.ts
 const HEALTH_POLL_INTERVAL_MS = 2e3;
 function createMetabaseClient(baseUrl, auth, signal, options = {}) {
@@ -1326,8 +1092,7 @@ function createMetabaseClient(baseUrl, auth, signal, options = {}) {
 		setting: settingResource(http),
 		tokenStatus: tokenStatusResource(http),
 		database: databaseResource(http),
-		remoteSync: remoteSyncResource(http),
-		user: userResource(http)
+		remoteSync: remoteSyncResource(http)
 	};
 }
 function isNotReadyYet(error) {
@@ -2449,9 +2214,9 @@ function hostDatabasesDeps(signal) {
 function isNotServingYet$1(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
-function requireApiKey$2(state, apiKey) {
-	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
-	return apiKey;
+function requireApiKey$2(state) {
+	if (state.apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
+	return state.apiKey;
 }
 function hostAliasOf(runtime) {
 	switch (runtime.kind) {
@@ -2467,15 +2232,15 @@ function toRecord$1(database, createdAt) {
 		createdAt
 	};
 }
-function authenticatedClient(state, apiKey, deps) {
+function authenticatedClient(state, deps) {
 	const configured = requireConfiguredRuntime(state);
 	return deps.client(configured.url, {
 		kind: "api-key",
-		key: requireApiKey$2(state, apiKey)
+		key: requireApiKey$2(state)
 	});
 }
-async function listDatabases(state, apiKey, deps) {
-	const listed = await authenticatedClient(state, apiKey, deps).database.list();
+async function listDatabases(state, deps) {
+	const listed = await authenticatedClient(state, deps).database.list();
 	const records = new Map(state.databases.map((record) => [record.id, record]));
 	const onServer = listed.data.map((database) => ({
 		id: database.id,
@@ -2496,7 +2261,7 @@ async function listDatabases(state, apiKey, deps) {
 }
 async function addDatabases(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
-	const client = authenticatedClient(ctx.state, ctx.secrets.apiKey, deps);
+	const client = authenticatedClient(ctx.state, deps);
 	const properties = await client.session.properties();
 	const existing = await client.database.list();
 	if (existing.data.length > 0) ctx.ui.note(existingDatabaseLines(existing.data).join("\n"), "Connected databases");
@@ -2534,17 +2299,17 @@ function databasesStep(options, deps = hostDeps$12) {
 		title: "Connect your databases",
 		async detect(ctx) {
 			const configured = configuredRuntime(ctx.state);
-			if (configured === null || ctx.secrets.apiKey === null) return "todo";
+			if (configured === null || ctx.state.apiKey === null) return "todo";
 			const own = ownDatabaseIds(ctx.state);
 			if (own.size === 0) return sampleDatabaseId(ctx.state) !== null && !options.requested ? "done" : "todo";
 			const client = deps(ctx).client(configured.url, {
 				kind: "api-key",
-				key: ctx.secrets.apiKey
+				key: ctx.state.apiKey
 			});
 			try {
 				return (await client.database.list()).data.some((database) => own.has(database.id)) ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet$1(error) || isRejectedCredential(error)) return "todo";
+				if (isNotServingYet$1(error)) return "todo";
 				throw error;
 			}
 		},
@@ -2626,11 +2391,6 @@ async function createWizardContext(instanceName, options) {
 			await writeInstanceState(next);
 			ctx.state = next;
 		},
-		secrets: await readInstanceSecrets(instanceName) ?? emptyInstanceSecrets(),
-		saveSecrets: async (next) => {
-			await writeInstanceSecrets(instanceName, next);
-			ctx.secrets = next;
-		},
 		prompts: options.prompts ?? clackPrompts(),
 		ui: clackUi(),
 		signal: options.signal,
@@ -2639,6 +2399,53 @@ async function createWizardContext(instanceName, options) {
 	return ctx;
 }
 //#endregion
+//#region src/commands/define.ts
+function repeatedValues(rawArgs, flag) {
+	const values = [];
+	const inline = `${flag}=`;
+	for (let index = 0; index < rawArgs.length; index += 1) {
+		const arg = rawArgs[index];
+		if (arg === void 0) continue;
+		if (arg.startsWith(inline)) values.push(arg.slice(inline.length));
+		else if (arg === flag) {
+			const next = rawArgs[index + 1];
+			if (next !== void 0) {
+				values.push(next);
+				index += 1;
+			}
+		}
+	}
+	return values;
+}
+function defineRdeCommand(def) {
+	return defineCommand({
+		meta: def.meta,
+		...def.args !== void 0 && { args: def.args },
+		async run({ args, rawArgs }) {
+			try {
+				await def.run(args, rawArgs);
+			} catch (error) {
+				reportError(error);
+			}
+		}
+	});
+}
+//#endregion
+//#region src/commands/instance.ts
+async function defaultInstanceName() {
+	const config = await readGlobalConfig();
+	if (config === null) throw new ConfigError("no Metabase instance yet; run `rde init` first");
+	return config.defaultInstance;
+}
+async function instanceNameOrDefault() {
+	try {
+		return (await readGlobalConfig())?.defaultInstance ?? "default";
+	} catch (error) {
+		if (error instanceof ConfigError) return DEFAULT_INSTANCE_NAME;
+		throw error;
+	}
+}
+//#endregion
 //#region src/commands/db/add.ts
 const dbAdd = defineRdeCommand({
 	meta: {
@@ -2653,6 +2460,14 @@ const dbAdd = defineRdeCommand({
 	}
 });
 //#endregion
+//#region src/output/print.ts
+function printLines(lines) {
+	process.stdout.write(lines.join("\n") + "\n");
+}
+function printJson(value) {
+	process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+}
+//#endregion
 //#region src/commands/db/list.ts
 const dbList = defineRdeCommand({
 	meta: {
@@ -2665,10 +2480,7 @@ const dbList = defineRdeCommand({
 		default: false
 	} },
 	async run(args) {
-		const name = await defaultInstanceName();
-		const state = await requireInstanceState(name);
-		const secrets = await readInstanceSecrets(name);
-		const listing = await listDatabases(state, secrets === null ? null : secrets.apiKey, hostDatabasesDeps(interruptSignal));
+		const listing = await listDatabases(await requireInstanceState(await defaultInstanceName()), hostDatabasesDeps(interruptSignal));
 		if (args.json) {
 			printJson(listing);
 			return;
@@ -2997,20 +2809,15 @@ async function isExecutable(path) {
 		return false;
 	}
 }
-async function whichAll(name) {
+async function whichCommand(name) {
 	const searchPath = readEnv(ENV_PATH);
-	if (searchPath === void 0) return [];
-	const found = [];
-	for (const dir of new Set(searchPath.split(delimiter))) {
+	if (searchPath === void 0) return null;
+	for (const dir of searchPath.split(delimiter)) {
 		if (dir.length === 0) continue;
 		const candidate = join(dir, name);
-		if (await isExecutable(candidate)) found.push(candidate);
+		if (await isExecutable(candidate)) return candidate;
 	}
-	return found;
-}
-async function whichCommand(name) {
-	const [first] = await whichAll(name);
-	return first ?? null;
+	return null;
 }
 //#endregion
 //#region src/tools/java.ts
@@ -3854,117 +3661,44 @@ const GLOBAL_INSTALL = {
 function mbInstallCommand(packageManager) {
 	return GLOBAL_INSTALL[packageManager];
 }
-function ownerByMarker(path, markers) {
-	const normalized = path.replaceAll("\\", "/");
-	const found = markers.find(({ marker }) => normalized.includes(marker));
-	return found === void 0 ? null : found.owner;
-}
 const GLOBAL_MARKERS = [
 	{
 		marker: "/.bun/install/global/node_modules/",
-		owner: "bun"
+		packageManager: "bun"
 	},
 	{
 		marker: "/Library/pnpm/global/",
-		owner: "pnpm"
+		packageManager: "pnpm"
 	},
 	{
 		marker: "/.local/share/pnpm/global/",
-		owner: "pnpm"
+		packageManager: "pnpm"
 	},
 	{
 		marker: "/share/pnpm/global/",
-		owner: "pnpm"
+		packageManager: "pnpm"
 	},
 	{
 		marker: "/pnpm-global/node_modules/",
-		owner: "pnpm"
+		packageManager: "pnpm"
 	},
 	{
 		marker: "/.config/yarn/global/node_modules/",
-		owner: "yarn"
+		packageManager: "yarn"
 	},
 	{
 		marker: "/lib/node_modules/",
-		owner: "npm"
+		packageManager: "npm"
 	},
 	{
 		marker: "/.npm-global/node_modules/",
-		owner: "npm"
+		packageManager: "npm"
 	}
 ];
 function packageManagerFor(scriptPath) {
-	return ownerByMarker(scriptPath, GLOBAL_MARKERS) ?? "npm";
-}
-const MB_OWNER_NAMES = {
-	npm: "npm",
-	pnpm: "pnpm",
-	yarn: "Yarn",
-	bun: "Bun",
-	homebrew: "Homebrew"
-};
-const CELLAR = "/Cellar/";
-const NODE_MODULES = "/node_modules/";
-const OWNER_MARKERS = [
-	...GLOBAL_MARKERS,
-	{
-		marker: CELLAR,
-		owner: "homebrew"
-	},
-	{
-		marker: "/Library/pnpm/",
-		owner: "pnpm"
-	},
-	{
-		marker: "/.local/share/pnpm/",
-		owner: "pnpm"
-	}
-];
-async function locateMbOnPath() {
-	const paths = await whichAll(MB);
-	return Promise.all(paths.map(async (path) => ({
-		path,
-		resolved: await promises.realpath(path)
-	})));
-}
-function mbOwner(binary) {
-	return ownerByMarker(binary.resolved, OWNER_MARKERS) ?? ownerByMarker(binary.path, OWNER_MARKERS);
-}
-function firstSegmentAfter(path, marker) {
-	const at = path.lastIndexOf(marker);
-	if (at === -1) return null;
-	const [first] = path.slice(at + marker.length).split("/");
-	return first === void 0 || first.length === 0 ? null : first;
-}
-function packageName(resolved) {
-	const scopeOrName = firstSegmentAfter(resolved, NODE_MODULES);
-	if (scopeOrName === null || !scopeOrName.startsWith("@")) return scopeOrName;
-	const name = firstSegmentAfter(resolved, `${NODE_MODULES}${scopeOrName}/`);
-	return name === null ? null : `${scopeOrName}/${name}`;
-}
-const REMOVE_COMMANDS = {
-	npm: (name) => `npm uninstall -g ${name}`,
-	pnpm: (name) => `pnpm remove -g ${name}`,
-	yarn: (name) => `yarn global remove ${name}`,
-	bun: (name) => `bun remove -g ${name}`,
-	homebrew: (name) => `brew uninstall ${name}`
-};
-function mbRemoveCommand(binary) {
-	const owner = mbOwner(binary);
-	if (owner === null) return null;
-	const name = owner === "homebrew" ? firstSegmentAfter(binary.resolved, CELLAR) : packageName(binary.resolved);
-	return name === null ? null : REMOVE_COMMANDS[owner](name);
-}
-function setValue(name) {
-	const value = readEnv(name);
-	return value === void 0 || value.length === 0 ? null : value;
-}
-function mbEnvironment() {
-	return {
-		profile: setValue(ENV_MB_PROFILE),
-		url: setValue(ENV_MB_URL),
-		apiKeySet: setValue(ENV_MB_API_KEY) !== null
-	};
+	const normalized = scriptPath.replaceAll("\\", "/");
+	for (const { marker, packageManager } of GLOBAL_MARKERS) if (normalized.includes(marker)) return packageManager;
+	return "npm";
 }
 const ProbedUser = z.object({
 	id: z.int(),
@@ -4041,16 +3775,16 @@ function mbTool(runner) {
 		if (result.exitCode !== 0) throw toolFailure(MB, argv, result);
 		return parseJsonOutput(MB, argv, result.stdout, schema);
 	}
-	async function version(command = MB) {
+	async function version() {
 		const args = ["--version"];
 		let result;
 		try {
-			result = await runner.run(command, args);
+			result = await runner.run(MB, args);
 		} catch (error) {
 			if (error instanceof ProcessNotFoundError) return null;
 			throw error;
 		}
-		if (result.exitCode !== 0) throw toolFailure(command, args, result);
+		if (result.exitCode !== 0) throw toolFailure(MB, args, result);
 		return result.stdout.trim();
 	}
 	async function authLogin(options) {
@@ -4136,65 +3870,73 @@ function mbTool(runner) {
 	};
 }
 //#endregion
-//#region src/tools/skills-cli.ts
-const NPX = "npx";
-const SKILLS_PACKAGE = "skills@latest";
-const DEFAULT_RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/rde-skill";
-function rdeSkillSource() {
-	const override = readEnv(ENV_RDE_SKILL_SOURCE);
-	return override === void 0 || override.length === 0 ? DEFAULT_RDE_SKILL_SOURCE : override;
-}
-const InstalledSkill = z.object({
-	name: z.string(),
-	path: z.string(),
-	scope: z.string(),
-	agents: z.array(z.string()),
-	source: z.string().nullable()
-}).loose();
-const InstalledSkillList = z.array(InstalledSkill);
-const SkillLock = z.object({ skills: z.record(z.string(), z.object({ ref: z.string().nullish() }).loose()) }).loose();
-const GLOBAL_LOCK_FILE = ".skill-lock.json";
-const PROJECT_LOCK_FILE = "skills-lock.json";
-function globalSkillLockPath(home, stateHome) {
-	return stateHome === null ? join(home, ".agents", GLOBAL_LOCK_FILE) : join(stateHome, "skills", GLOBAL_LOCK_FILE);
-}
-function projectSkillLockPath(project) {
-	return join(project, PROJECT_LOCK_FILE);
+//#region src/wizard/engine.ts
+function requireKnownStep(steps, id, flag) {
+	if (id === void 0) return;
+	if (!steps.some((step) => step.id === id)) throw new ConfigError(`${flag} ${id} is not one of the steps: ${steps.map((step) => step.id).join(", ")}`);
 }
-function xdgStateHome() {
-	const value = readEnv(ENV_XDG_STATE_HOME);
-	return value === void 0 || value.length === 0 ? null : value;
+async function detectAll(steps, ctx, options) {
+	const detected = [];
+	let fromHere = false;
+	for (const step of steps) {
+		if (step.id === options.from) fromHere = true;
+		const forced = options.only !== void 0 ? step.id === options.only : fromHere;
+		detected.push({
+			step,
+			status: forced ? "todo" : await step.detect(ctx),
+			forced
+		});
+	}
+	return detected;
 }
-function lockedRef(path, raw, skill) {
-	if (raw === null) return null;
-	const parsed = SkillLock.safeParse(raw);
-	if (!parsed.success) throw new ConfigError(`${path} is not a skills lock file: ${parsed.error.message}`);
-	return parsed.data.skills[skill]?.ref ?? null;
+async function shouldRun(entry, ctx, options) {
+	if (entry.forced) return true;
+	if (options.only !== void 0 || entry.status === "done") return false;
+	return await entry.step.detect(ctx) === "todo";
 }
-const hostSkillFiles = {
-	readJson: readJsonFile,
-	readText: readTextFile
-};
-const GITHUB_URL = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/tree\/([^/]+)(?:\/.*)?)?\/?$/;
-function skillOrigin(source, cwd) {
-	const github = GITHUB_URL.exec(source);
-	if (github !== null) {
-		const [, owner, repo, ref] = github;
-		return {
-			kind: "github",
-			repository: `${owner}/${repo}`,
-			ref: ref ?? null
-		};
-	}
-	if (isAbsolute(source) || source.startsWith(".")) return {
-		kind: "local",
-		path: resolve(cwd, source)
+function recordFor(outcome, at) {
+	return {
+		status: outcome === "completed" ? "done" : "skipped",
+		completedAt: at.toISOString()
 	};
+}
+function withStepRecord(state, id, record) {
 	return {
-		kind: "other",
-		source
+		...state,
+		steps: {
+			...state.steps,
+			[id]: record
+		}
 	};
 }
+async function runWizard(steps, ctx, options = {}) {
+	requireKnownStep(steps, options.from, "--from");
+	requireKnownStep(steps, options.only, "--only");
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const detected = await detectAll(steps, ctx, options);
+	ctx.ui.checklist(detected.map(({ step, status }) => ({
+		title: step.title,
+		status
+	})));
+	for (const entry of detected) {
+		if (!await shouldRun(entry, ctx, options)) continue;
+		const outcome = await entry.step.run(ctx);
+		await ctx.saveState(withStepRecord(ctx.state, entry.step.id, recordFor(outcome, now())));
+	}
+}
+//#endregion
+//#region src/tools/skills-cli.ts
+const NPX = "npx";
+const SKILLS_PACKAGE = "skills@latest";
+const RDE_SKILL_SOURCE = "https://github.com/metabase/agent-skills/tree/rde-generic-skills";
+const InstalledSkill = z.object({
+	name: z.string(),
+	path: z.string(),
+	scope: z.string(),
+	agents: z.array(z.string()),
+	source: z.string().nullable()
+}).loose();
+const InstalledSkillList = z.array(InstalledSkill);
 function skillsCli(runner) {
 	async function add(options) {
 		const argv = [
@@ -4246,82 +3988,12 @@ function skillsCli(runner) {
 		if (result.exitCode !== 0) throw toolFailure(NPX, argv, result);
 		return parseJsonOutput(NPX, argv, result.stdout, InstalledSkillList);
 	}
-	async function listProject(cwd) {
-		const argv = [
-			"-y",
-			SKILLS_PACKAGE,
-			"list",
-			"--json"
-		];
-		const result = await runner.run(NPX, argv, {
-			cwd,
-			stdoutToFile: true
-		});
-		if (result.exitCode !== 0) throw toolFailure(NPX, argv, result);
-		return parseJsonOutput(NPX, argv, result.stdout, InstalledSkillList);
-	}
 	return {
 		add,
 		remove,
-		list,
-		listProject
-	};
-}
-//#endregion
-//#region src/wizard/engine.ts
-function requireKnownStep(steps, id, flag) {
-	if (id === void 0) return;
-	if (!steps.some((step) => step.id === id)) throw new ConfigError(`${flag} ${id} is not one of the steps: ${steps.map((step) => step.id).join(", ")}`);
-}
-async function detectAll(steps, ctx, options) {
-	const detected = [];
-	let fromHere = false;
-	for (const step of steps) {
-		if (step.id === options.from) fromHere = true;
-		const forced = options.only !== void 0 ? step.id === options.only : fromHere;
-		detected.push({
-			step,
-			status: forced ? "todo" : await step.detect(ctx),
-			forced
-		});
-	}
-	return detected;
-}
-async function shouldRun(entry, ctx, options) {
-	if (entry.forced) return true;
-	if (options.only !== void 0 || entry.status === "done") return false;
-	return await entry.step.detect(ctx) === "todo";
-}
-function recordFor(outcome, at) {
-	return {
-		status: outcome === "completed" ? "done" : "skipped",
-		completedAt: at.toISOString()
-	};
-}
-function withStepRecord(state, id, record) {
-	return {
-		...state,
-		steps: {
-			...state.steps,
-			[id]: record
-		}
+		list
 	};
 }
-async function runWizard(steps, ctx, options = {}) {
-	requireKnownStep(steps, options.from, "--from");
-	requireKnownStep(steps, options.only, "--only");
-	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	const detected = await detectAll(steps, ctx, options);
-	ctx.ui.checklist(detected.map(({ step, status }) => ({
-		title: step.title,
-		status
-	})));
-	for (const entry of detected) {
-		if (!await shouldRun(entry, ctx, options)) continue;
-		const outcome = await entry.step.run(ctx);
-		await ctx.saveState(withStepRecord(ctx.state, entry.step.id, recordFor(outcome, now())));
-	}
-}
 //#endregion
 //#region src/steps/agents-skills.ts
 const STEP_ID$8 = "agents-skills";
@@ -4330,8 +4002,7 @@ const DETECT_AGENTS = { agents: null };
 function hostDeps$11(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
-		probe: hostAgentProbe(),
-		skillSource: rdeSkillSource()
+		probe: hostAgentProbe()
 	};
 }
 function detectedOnly(agents) {
@@ -4391,10 +4062,9 @@ function agentsSkillsStep(options, deps = hostDeps$11) {
 				ctx.ui.info(skipLine(all, selection.source));
 				return "skipped";
 			}
-			const from = resolved.skillSource === "https://github.com/metabase/agent-skills/tree/rde-skill" ? "" : ` from ${resolved.skillSource}`;
-			ctx.ui.info(`Installing the rde skill for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})${from}`);
+			ctx.ui.info(`Installing the rde skill for ${displayNames(selection.agents)} (${SOURCE_NOTES[selection.source]})`);
 			await skillsCli(resolved.runner).add({
-				source: resolved.skillSource,
+				source: RDE_SKILL_SOURCE,
 				skill: "rde",
 				agents: selection.agents.map((agent) => agent.skillsCliName)
 			});
@@ -4420,8 +4090,7 @@ function rdeInstalledWith() {
 function hostDeps$10(ctx) {
 	return {
 		runner: processRunner(ctx.signal),
-		installedWith: rdeInstalledWith(),
-		locate: locateMbOnPath
+		installedWith: rdeInstalledWith()
 	};
 }
 async function inspectMb(runner) {
@@ -4438,100 +4107,14 @@ async function inspectMb(runner) {
 function displayCommand(install) {
 	return [install.command, ...install.args].join(" ");
 }
-async function versionAt(runner, path) {
-	try {
-		const raw = await mbTool(runner).version(path);
-		return raw === null ? null : semver.valid(raw);
-	} catch (error) {
-		if (error instanceof ExternalToolError) return null;
-		throw error;
-	}
-}
-async function inspectMbOnPath(runner, locate) {
-	const found = [];
-	for (const binary of await locate()) found.push({
-		path: binary.path,
-		version: await versionAt(runner, binary.path),
-		owner: mbOwner(binary),
-		removeCommand: mbRemoveCommand(binary)
-	});
-	return found;
-}
-function satisfiesMinimum(version) {
-	return version !== null && semver.satisfies(version, MB_RANGE, { includePrerelease: true });
-}
-function isNewer(candidate, than) {
-	if (candidate === null) return false;
-	return than === null || semver.gt(candidate, than);
-}
-function diagnoseMb(found, installer) {
-	const [running, ...later] = found;
-	if (running === void 0) return { kind: "missing" };
-	const sufficient = satisfiesMinimum(running.version);
-	const newer = later.find((candidate) => satisfiesMinimum(candidate.version) && isNewer(candidate.version, running.version));
-	if (newer !== void 0 && (!sufficient || running.owner !== installer)) return {
-		kind: "shadowed",
-		running,
-		newer
-	};
-	return sufficient ? {
-		kind: "current",
-		running
-	} : {
-		kind: "old",
-		running
-	};
-}
-function runningMbSuffices(diagnosis) {
-	return diagnosis.kind !== "missing" && satisfiesMinimum(diagnosis.running.version);
-}
-function versionText(entry) {
-	return entry.version ?? "an unknown version";
-}
-function describeEntry(entry) {
-	const owner = entry.owner === null ? "" : ` (${MB_OWNER_NAMES[entry.owner]})`;
-	return `${versionText(entry)} at ${entry.path}${owner}`;
-}
-function mbPathLines(found) {
-	return found.map((entry, index) => `${index === 0 ? "" : "then "}${describeEntry(entry)}`);
-}
-function removeClause(entry) {
-	if (entry.removeCommand !== null) return `remove the old one with \`${entry.removeCommand}\``;
-	if (entry.owner !== null) return `remove the old one with ${MB_OWNER_NAMES[entry.owner]}`;
-	return `remove ${entry.path}`;
-}
-function shadowedHint(diagnosis) {
-	const { running, newer } = diagnosis;
-	return [
-		`${running.path} (${versionText(running)}) runs before ${newer.path} (${versionText(newer)});`,
-		`${removeClause(running)}, or put ${dirname(newer.path)} before ${dirname(running.path)} on PATH,`,
-		"then open a new terminal"
-	].join(" ");
-}
-const NEW_TERMINAL = "open a new terminal and run rde init again";
-function stillWrongAdvice(diagnosis) {
-	switch (diagnosis.kind) {
-		case "shadowed": return `${shadowedHint(diagnosis)} and run rde init again`;
-		case "old": return `The install put no newer mb on PATH; ${removeClause(diagnosis.running)}, or ${NEW_TERMINAL}`;
-		case "missing":
-		case "current": return "Open a new terminal and run rde init again";
-	}
-}
-async function stillWrong(install, after, deps) {
-	const fail = (stderrTail) => new ExternalToolError({
+function stillWrong(install, after) {
+	const found = after.installed ? `mb ${after.version} is still what is on PATH (${MIN_MB_VERSION} or newer is required)` : "mb is not on PATH after the install";
+	return new ExternalToolError({
 		tool: install.command,
 		argv: install.args,
 		exitCode: 0,
-		stderrTail
+		stderrTail: `${found}; open a new terminal and run rde init again`
 	});
-	if (!after.installed) return fail(`mb is not on PATH after the install; ${NEW_TERMINAL}`);
-	const found = await inspectMbOnPath(deps.runner, deps.locate);
-	const diagnosis = diagnoseMb(found, deps.installedWith);
-	return fail([
-		`mb ${after.version} still runs first (${MIN_MB_VERSION} or newer is required).`,
-		`Every mb on PATH, in order: ${mbPathLines(found).join("; ")}.`,
-		`${stillWrongAdvice(diagnosis)}.`
-	].join(" "));
 }
 function installMbStep(deps = hostDeps$10) {
 	return {
@@ -4559,7 +4142,7 @@ function installMbStep(deps = hostDeps$10) {
 				stderrTail: ""
 			});
 			const after = await inspectMb(resolved.runner);
-			if (!after.installed || !after.satisfies) throw await stillWrong(install, after, resolved);
+			if (!after.installed || !after.satisfies) throw stillWrong(install, after);
 			ctx.ui.success(`mb ${after.version} is installed`);
 			return "completed";
 		}
@@ -4880,15 +4463,7 @@ function hostDoctorDeps(instanceName, signal) {
 		runtime,
 		ports: hostPortProbe,
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal),
-		probe: hostAgentProbe(),
-		locateMb: locateMbOnPath,
-		environment: mbEnvironment(),
-		skills: {
-			source: rdeSkillSource(),
-			cwd: process.cwd(),
-			stateHome: xdgStateHome(),
-			files: hostSkillFiles
-		}
+		probe: hostAgentProbe()
 	};
 }
 const NOT_FOUND_STATUS$2 = 404;
@@ -4901,17 +4476,7 @@ function ok(id, label, detail) {
 		status: "ok",
 		detail,
 		hint: null,
-		step: null
-	};
-}
-function note$1(id, label, detail, hint) {
-	return {
-		id,
-		label,
-		status: "ok",
-		detail,
-		hint,
-		step: null
+		fix: null
 	};
 }
 function skipped(id, label, detail) {
@@ -4921,7 +4486,7 @@ function skipped(id, label, detail) {
 		status: "skipped",
 		detail,
 		hint: null,
-		step: null
+		fix: null
 	};
 }
 function failed(id, label, failure) {
@@ -4942,7 +4507,7 @@ function machineRow(check, needed) {
 	return failed(check.id, check.id, {
 		detail: check.label,
 		hint: check.hint,
-		step: "preflight"
+		fix: "preflight"
 	});
 }
 async function machineRows(deps, runtime) {
@@ -4954,48 +4519,19 @@ function installHint(installedWith) {
 	const install = mbInstallCommand(installedWith);
 	return `\`${[install.command, ...install.args].join(" ")}\``;
 }
-const MB_LABEL = "mb";
-function mbUnusable(diagnosis) {
-	if (diagnosis.kind === "missing") return "mb is not installed";
-	return runningMbSuffices(diagnosis) ? null : "the mb that runs is too old";
-}
-function mbRow(diagnosis, lines, deps) {
-	switch (diagnosis.kind) {
-		case "missing": return failed("mb", MB_LABEL, {
-			detail: "not installed",
-			hint: installHint(deps.installedWith),
-			step: "install-mb"
-		});
-		case "old": {
-			const required = lines.map((line, index) => index === 0 ? `${line}; ${MIN_MB_VERSION} or newer is required` : line);
-			return failed("mb", MB_LABEL, {
-				detail: required.join("\n"),
-				hint: installHint(deps.installedWith),
-				step: "install-mb"
-			});
-		}
-		case "shadowed": return failed("mb", MB_LABEL, {
-			detail: lines.join("\n"),
-			hint: shadowedHint(diagnosis),
-			step: null
-		});
-		case "current": return ok("mb", MB_LABEL, lines.join("\n"));
-	}
-}
-async function mbFinding(deps) {
-	const found = await inspectMbOnPath(deps.runner, deps.locateMb);
-	const diagnosis = diagnoseMb(found, deps.installedWith);
-	return {
-		row: mbRow(diagnosis, mbPathLines(found), deps),
-		unusable: mbUnusable(diagnosis)
-	};
-}
-function sharedProfileList(deps) {
-	let listed = null;
-	return () => {
-		listed ??= mbTool(deps.runner).authList();
-		return listed;
-	};
+async function mbRow(deps) {
+	const found = await inspectMb(deps.runner);
+	if (!found.installed) return failed("mb", "mb", {
+		detail: "not installed",
+		hint: installHint(deps.installedWith),
+		fix: "install-mb"
+	});
+	if (!found.satisfies) return failed("mb", "mb", {
+		detail: `${found.version} (${MIN_MB_VERSION} or newer is required)`,
+		hint: installHint(deps.installedWith),
+		fix: "install-mb"
+	});
+	return ok("mb", "mb", found.version);
 }
 function publishesOnLoopback(container, port) {
 	return container.ports.some((mapping) => mapping.host === port && mapping.hostIp === "127.0.0.1");
@@ -5013,7 +4549,7 @@ async function containerRow(runtime, deps, dockerOk) {
 		row: failed("container", label, {
 			detail: `${runtime.containerName} does not exist`,
 			hint: "`rde init` recreates it from the saved choices",
-			step: "runtime"
+			fix: "runtime"
 		}),
 		running: false,
 		holder: CONTAINER
@@ -5026,7 +4562,7 @@ async function containerRow(runtime, deps, dockerOk) {
 		row: failed("container", label, {
 			detail: `${runtime.containerName} runs ${inspection.image}, the state says ${runtime.image}`,
 			hint: `remove it with \`docker rm -f ${runtime.containerName}\` and run \`rde init\``,
-			step: null
+			fix: null
 		}),
 		...found
 	};
@@ -5034,7 +4570,7 @@ async function containerRow(runtime, deps, dockerOk) {
 		row: failed("container", label, {
 			detail: `${runtime.containerName} does not publish port ${runtime.port} on ${LOOPBACK_HOST}`,
 			hint: `remove it with \`docker rm -f ${runtime.containerName}\` and run \`rde init\``,
-			step: null
+			fix: null
 		}),
 		...found
 	};
@@ -5055,7 +4591,7 @@ async function processRow(runtime, deps) {
 			row: failed("process", label, {
 				detail: `${inspection.jarPath} does not exist`,
 				hint,
-				step: "runtime"
+				fix: "runtime"
 			}),
 			running: false,
 			holder: JAR_PROCESS
@@ -5082,13 +4618,13 @@ async function portRow(port, finding, ports) {
 	if (finding.running) return failed("port", "port", {
 		detail: `${port} is not answering although ${finding.holder} runs`,
 		hint: "`rde logs` shows what Metabase is doing",
-		step: null
+		fix: null
 	});
 	if (free) return ok("port", "port", `${port} is free`);
 	return failed("port", "port", {
 		detail: `${port} is in use by another program`,
 		hint: "stop that program before `rde start`",
-		step: null
+		fix: null
 	});
 }
 async function healthRow(url, deps) {
@@ -5103,7 +4639,7 @@ async function healthRow(url, deps) {
 			row: failed("health", "health", {
 				detail: `initializing (${Math.round(error.progress * 100)}%)`,
 				hint: "wait for it; `rde logs -f` shows progress",
-				step: "start-metabase"
+				fix: "start-metabase"
 			}),
 			healthy: false
 		};
@@ -5111,7 +4647,7 @@ async function healthRow(url, deps) {
 			row: failed("health", "health", {
 				detail: "unreachable",
 				hint: "`rde start`",
-				step: "start-metabase"
+				fix: "start-metabase"
 			}),
 			healthy: false
 		};
@@ -5119,7 +4655,7 @@ async function healthRow(url, deps) {
 			row: failed("health", "health", {
 				detail: `something other than Metabase answers at ${url} (HTTP ${error.status})`,
 				hint: "another program holds the port; stop it before `rde start`",
-				step: null
+				fix: null
 			}),
 			healthy: false
 		};
@@ -5130,7 +4666,7 @@ function adminRow(state, properties) {
 	if (!properties["has-user-setup"]) return failed("admin", "admin user", {
 		detail: "Metabase has no admin user yet",
 		hint: "`rde init --only admin-user`",
-		step: "admin-user"
+		fix: "admin-user"
 	});
 	return ok("admin", "admin user", state.admin?.email ?? "created outside rde");
 }
@@ -5142,204 +4678,36 @@ function versionRow(state, properties) {
 	if (state.version !== running) return failed("version", label, {
 		detail: `running ${running}, the state file says ${state.version}`,
 		hint: "`rde start` records the running version",
-		step: VERSION_STEP
+		fix: VERSION_STEP
 	});
 	return ok("version", label, running);
 }
-const API_KEY_STEP = "api-key";
-const RECREATE_HINT = "when the instance holds nothing you need, `rde uninstall` then `rde init`";
-function adminPasswordRow(state, secrets) {
-	const id = "admin-password";
-	const label = "admin password";
-	const admin = state.admin;
-	if (admin === null) return skipped(id, label, "no admin user created by rde yet");
-	switch (admin.kind) {
-		case "prompted": return ok(id, label, "yours, entered during `rde init` and never stored");
-		case "generated":
-			if (secrets === null || secrets.admin === null) return failed(id, label, {
-				detail: "generated, but missing from the secrets file",
-				hint: `it cannot be recovered; ${RECREATE_HINT}`,
-				step: null
-			});
-			return ok(id, label, "generated and stored; `rde credentials` shows it in your terminal");
-		case "legacy-default": return failed(id, label, {
-			detail: "the public default password from an earlier rde (legacy-default)",
-			hint: `anyone who knows the default can log in; ${RECREATE_HINT} with a generated one`,
-			step: null
-		});
-	}
-}
-async function apiKeyFinding(secrets, url, healthy, deps) {
-	const id = "api-key";
-	const label = "API key";
-	const apiKey = secrets === null ? null : secrets.apiKey;
-	if (apiKey === null) return {
-		row: failed(id, label, {
-			detail: "none in the secrets file",
-			hint: "`rde init --only api-key`",
-			step: API_KEY_STEP
-		}),
-		access: {
-			kind: "unusable",
-			reason: "no API key"
-		}
-	};
-	if (url === null || !healthy) return {
-		row: ok(id, label, "in the secrets file"),
-		access: {
-			kind: "unusable",
-			reason: NOT_HEALTHY
-		}
-	};
-	const client = deps.client(url, {
-		kind: "api-key",
-		key: apiKey
-	});
-	try {
-		await client.user.current();
-	} catch (error) {
-		if (!isRejectedCredential(error)) throw error;
-		return {
-			row: failed(id, label, {
-				detail: "in the secrets file, but Metabase rejects it",
-				hint: "`rde init --only api-key` replaces it",
-				step: API_KEY_STEP
-			}),
-			access: {
-				kind: "unusable",
-				reason: "Metabase rejects the API key"
-			}
-		};
-	}
-	return {
-		row: ok(id, label, "in the secrets file, accepted by Metabase"),
-		access: {
-			kind: "accepted",
-			client
-		}
-	};
-}
-function octal(mode) {
-	return `0${mode.toString(8)}`;
-}
-function expectsSecrets(state) {
-	return state.admin !== null && state.admin.kind !== "prompted" || state.steps[API_KEY_STEP]?.status === "done";
-}
-function secretsFileRow(state, files, dir) {
-	const id = "secrets-file";
-	const label = "secrets file";
-	const path = secretsFileIn(dir);
-	if (files.secretsMode === null) {
-		if (!expectsSecrets(state)) return skipped(id, label, "nothing stored yet");
-		return failed(id, label, {
-			detail: `${path} is missing`,
-			hint: "`rde init --only api-key` stores a new API key",
-			step: API_KEY_STEP
-		});
-	}
-	if (files.secretsMode !== 384 || files.dirMode !== 448) {
-		const dirMode = files.dirMode === null ? "missing" : octal(files.dirMode);
-		return failed(id, label, {
-			detail: `${path} is ${octal(files.secretsMode)} in a ${dirMode} directory`,
-			hint: `\`chmod ${octal(384)} ${path} && chmod ${octal(448)} ${dir}\``,
-			step: null
-		});
-	}
-	return ok(id, label, `${path}, ${octal(384)} in a ${octal(448)} directory`);
-}
-function stateFileRow(files) {
-	const id = "state-file";
-	const label = "state file";
-	if (files.secretsInState.length > 0) return failed(id, label, {
-		detail: `carries ${files.secretsInState.join(", ")}`,
-		hint: "`rde init --only api-key` rewrites it without them",
-		step: API_KEY_STEP
+function apiKeyRow(state) {
+	if (state.apiKey === null) return failed("api-key", "API key", {
+		detail: "none in the state file",
+		hint: "`rde init --only api-key`",
+		fix: "api-key"
 	});
-	return ok(id, label, "no secrets");
+	return ok("api-key", "API key", "in the state file");
 }
-async function credentialRows(state, secrets, apiKey, deps) {
-	const dir = deps.runtime.instanceDir;
-	const files = await inspectCredentialFiles(dir);
-	return [
-		adminPasswordRow(state, secrets),
-		apiKey.row,
-		secretsFileRow(state, files, dir),
-		stateFileRow(files)
-	];
-}
-function withoutTrailingSlash(url) {
-	return url.replace(/\/+$/, "");
-}
-async function mbProfileRow(state, url, profiles, mbUnusableReason, healthy) {
+async function mbProfileRow(state, deps, mbInstalled, healthy) {
 	const label = "mb profile";
-	if (mbUnusableReason !== null) return skipped("mb-profile", label, mbUnusableReason);
+	if (!mbInstalled) return skipped("mb-profile", label, "mb is not installed");
 	if (!healthy) return skipped("mb-profile", label, NOT_HEALTHY);
-	const entry = (await profiles()).find((candidate) => candidate.profile === state.mbProfile);
+	const entry = (await mbTool(deps.runner).authList()).find((candidate) => candidate.profile === state.mbProfile);
 	if (entry === void 0) return failed("mb-profile", label, {
 		detail: `${state.mbProfile} is not configured`,
 		hint: "`rde init --only api-key`",
-		step: "api-key"
-	});
-	if (withoutTrailingSlash(entry.url) !== withoutTrailingSlash(url)) return failed("mb-profile", label, {
-		detail: `${state.mbProfile} points at ${entry.url}, not at this instance (${url})`,
-		hint: "`rde init --only api-key` logs it back in against the instance",
-		step: "api-key"
+		fix: "api-key"
 	});
 	if (entry.status !== "ok") return failed("mb-profile", label, {
 		detail: `${state.mbProfile}: ${entry.status}`,
 		hint: "`rde init --only api-key` logs it in again",
-		step: "api-key"
+		fix: "api-key"
 	});
 	const user = entry.user === null ? "" : ` as ${entry.user.name}`;
 	return ok("mb-profile", label, `${state.mbProfile}: ok${user}`);
 }
-function hostOf(url) {
-	return URL.canParse(url) ? new URL(url).host : "an address that is not a URL";
-}
-function unsetHint(name) {
-	return `\`unset ${name}\`, remove it from your shell profile if it is exported there, then restart the agent session`;
-}
-async function mbProfileEnvRow(name, rdeProfile, profiles, mbUnusableReason) {
-	const id = `env.${ENV_MB_PROFILE}`;
-	if (name === rdeProfile) return ok(id, ENV_MB_PROFILE, `${name}: rde's own profile, so plain \`mb\` uses this instance`);
-	const rde = rdeProfile === null ? "rde's" : `rde's (${rdeProfile})`;
-	const detail = (where) => `${name}: \`mb\` and the rde skill will use profile ${name} (${where}) instead of ${rde}`;
-	if (mbUnusableReason !== null) return note$1(id, ENV_MB_PROFILE, detail(mbUnusableReason), unsetHint(ENV_MB_PROFILE));
-	const entry = (await profiles()).find((candidate) => candidate.profile === name);
-	const where = entry === void 0 ? "not configured" : hostOf(entry.url);
-	return note$1(id, ENV_MB_PROFILE, detail(where), unsetHint(ENV_MB_PROFILE));
-}
-async function environmentRows(env, rdeProfile, profiles, mbUnusableReason) {
-	const rows = [];
-	if (env.profile !== null) rows.push(await mbProfileEnvRow(env.profile, rdeProfile, profiles, mbUnusableReason));
-	if (env.url !== null) rows.push(note$1(`env.${ENV_MB_URL}`, ENV_MB_URL, `every \`mb\` call goes to ${hostOf(env.url)}, whatever \`--profile\` says, rde's own included`, unsetHint(ENV_MB_URL)));
-	if (env.apiKeySet) rows.push(note$1(`env.${ENV_MB_API_KEY}`, ENV_MB_API_KEY, "set (value not shown): every `mb` call sends it, whatever `--profile` says, rde's own included", unsetHint(ENV_MB_API_KEY)));
-	return rows;
-}
-const PROFILE_STATUS_WORDS = {
-	ok: "authenticates",
-	"auth-failed": "login rejected",
-	"network-error": "not answering",
-	"server-error": "answers with a server error",
-	"not-probed": "not checked"
-};
-function plainMbLine(env, rdeProfile, profiles) {
-	if (env.url !== null) return `plain \`mb\` goes to ${hostOf(env.url)} (${ENV_MB_URL})`;
-	const name = env.profile ?? "default";
-	const via = env.profile === null ? "" : ` (${ENV_MB_PROFILE})`;
-	const entry = profiles.find((candidate) => candidate.profile === name);
-	if (entry === void 0) return `plain \`mb\` uses ${name}${via}, which is not configured`;
-	const instance = name === rdeProfile ? ", this instance" : "";
-	return `plain \`mb\` uses ${name}${via}: ${hostOf(entry.url)}${instance}`;
-}
-async function otherMetabasesRow(env, rdeProfile, profiles, mbUnusableReason) {
-	const id = "other-metabases";
-	const label = "other Metabases";
-	if (mbUnusableReason !== null) return skipped(id, label, mbUnusableReason);
-	const all = await profiles();
-	const others = all.filter((entry) => entry.profile !== rdeProfile);
-	return ok(id, label, [...others.length === 0 ? ["none"] : others.map((entry) => `${entry.profile}: ${hostOf(entry.url)}, ${PROFILE_STATUS_WORDS[entry.status]}`), plainMbLine(env, rdeProfile, all)].join("\n"));
-}
 function isNotFound$2(error) {
 	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$2;
 }
@@ -5350,7 +4718,7 @@ async function licenseRow(client) {
 		if (!status.valid) return failed("license", label, {
 			detail: `invalid: ${status.status}`,
 			hint: "`rde init --from license` with a valid token",
-			step: "license"
+			fix: "license"
 		});
 		return ok("license", label, `valid, ${status.features.includes("remote-sync") ? `with ${REMOTE_SYNC_FEATURE}` : `without ${REMOTE_SYNC_FEATURE}, so git sync is unavailable`}`);
 	} catch (error) {
@@ -5367,47 +4735,47 @@ async function databasesRow(state, client) {
 	if (missing.length > 0) return failed("databases", label, {
 		detail: `not on the server any more: ${missing.map((record) => record.name).join(", ")}`,
 		hint: "`rde db add` connects them again",
-		step: "databases"
+		fix: "databases"
 	});
 	const names = state.databases.map((record) => record.name).join(", ");
 	return ok("databases", label, `${state.databases.length} connected: ${names}`);
 }
 const SAMPLE_DATABASE_STEP = "sample-database";
 const SAMPLE_LABEL = "sample database";
-async function sampleDatabaseRow(record, deps, dockerOk, access) {
+async function sampleDatabaseRow(record, deps, dockerOk, client) {
 	const id = "sample-database";
 	if (!dockerOk) return skipped(id, SAMPLE_LABEL, "Docker is not available");
 	const status = await sampleDatabaseContainer(record, deps.runtime.docker).status();
 	if (!status.installed) return failed(id, SAMPLE_LABEL, {
 		detail: `${record.containerName} does not exist`,
 		hint: "`rde init` recreates it",
-		step: SAMPLE_DATABASE_STEP
+		fix: SAMPLE_DATABASE_STEP
 	});
 	if (!status.running) return failed(id, SAMPLE_LABEL, {
 		detail: `${record.containerName} is stopped`,
 		hint: "`rde start`",
-		step: "start-metabase"
+		fix: "start-metabase"
 	});
 	if (await deps.ports.isFree(record.port)) return failed(id, SAMPLE_LABEL, {
 		detail: `${record.containerName} runs but port ${record.port} is not answering`,
 		hint: `\`docker logs ${record.containerName}\` shows what Postgres is doing`,
-		step: null
+		fix: null
 	});
 	const where = `${record.containerName} running on ${LOOPBACK_HOST}:${record.port}`;
 	if (record.databaseId === null) return failed(id, SAMPLE_LABEL, {
 		detail: `${where}; not connected to Metabase yet`,
 		hint: "`rde init` connects it",
-		step: SAMPLE_DATABASE_STEP
+		fix: SAMPLE_DATABASE_STEP
 	});
-	if (access.kind === "unusable") return skipped(id, SAMPLE_LABEL, `${where}; ${access.reason}, so the connection is unchecked`);
+	if (client === null) return skipped(id, SAMPLE_LABEL, `${where}; ${NOT_HEALTHY}, so the connection is unchecked`);
 	try {
-		const database = await access.client.database.get(record.databaseId);
+		const database = await client.database.get(record.databaseId);
 		return ok(id, SAMPLE_LABEL, `${where}, database ${database.id} sync ${database.initial_sync_status}`);
 	} catch (error) {
 		if (isNotFound$2(error)) return failed(id, SAMPLE_LABEL, {
 			detail: `${where}; database ${record.databaseId} is gone from Metabase`,
 			hint: "`rde init` connects it again",
-			step: SAMPLE_DATABASE_STEP
+			fix: SAMPLE_DATABASE_STEP
 		});
 		throw error;
 	}
@@ -5424,7 +4792,7 @@ async function gitSyncRow(state, deps) {
 		if (status.branch === null) return failed("git-sync", label, {
 			detail: "Metabase reports no branch",
 			hint: "`rde init --only git-sync`",
-			step: "git-sync"
+			fix: "git-sync"
 		});
 		const dirty = status.is_dirty ? "unsynced changes" : "in sync";
 		return ok("git-sync", label, `branch ${status.branch}, ${dirty}, ${state.gitRemote.workdir}`);
@@ -5432,100 +4800,15 @@ async function gitSyncRow(state, deps) {
 		if (isMbFailure$1(error)) return failed("git-sync", label, {
 			detail: error.message,
 			hint: `\`${mbCommand(state.mbProfile)} git-sync status\` shows the full answer`,
-			step: null
+			fix: null
 		});
 		throw error;
 	}
 }
 const SKILL_STEP = "agents-skills";
-const GLOBAL_SCOPE = "global";
-const SKILL_FILE = "SKILL.md";
-const CLAUDE_CODE = "Claude Code";
-const CLAUDE_CODE_SKILL_RULE = "a personal skill wins over a project one: https://code.claude.com/docs/en/skills";
 function skillRowId(agent) {
 	return `skill.${agent.id}`;
 }
-function withRef(source, ref) {
-	return ref === null ? source : `${source}#${ref}`;
-}
-async function copyRef(entry, deps) {
-	const path = entry.scope === GLOBAL_SCOPE ? globalSkillLockPath(deps.probe.home, deps.skills.stateHome) : projectSkillLockPath(deps.skills.cwd);
-	return lockedRef(path, await deps.skills.files.readJson(path), entry.name);
-}
-async function judgeCopy(entry, origin, deps) {
-	const where = `${entry.scope} ${entry.path}`;
-	switch (origin.kind) {
-		case "local": {
-			const installed = await deps.skills.files.readText(join(entry.path, SKILL_FILE));
-			const wanted = await deps.skills.files.readText(join(origin.path, SKILL_FILE));
-			const current = installed !== null && installed === wanted;
-			return {
-				entry,
-				current,
-				line: `${where}: ${current ? "same as" : "differs from"} ${origin.path}`
-			};
-		}
-		case "github": {
-			const wanted = withRef(origin.repository, origin.ref);
-			if (entry.source === null) return {
-				entry,
-				current: false,
-				line: `${where}: no recorded source, not ${wanted}`
-			};
-			const found = withRef(entry.source, await copyRef(entry, deps));
-			const current = found === wanted;
-			return {
-				entry,
-				current,
-				line: `${where}: from ${found}${current ? "" : `, not ${wanted}`}`
-			};
-		}
-		case "other": {
-			const current = entry.source === origin.source;
-			return {
-				entry,
-				current,
-				line: `${where}: from ${entry.source ?? "no recorded source"}${current ? "" : `, not ${origin.source}`}`
-			};
-		}
-	}
-}
-function loadedCopyLine(entries, cwd) {
-	if (entries.length < 2) return null;
-	const count = `${entries.length} copies are installed`;
-	const forClaude = entries.filter((entry) => entry.agents.includes(CLAUDE_CODE));
-	const loaded = forClaude.find((entry) => entry.scope === GLOBAL_SCOPE) ?? forClaude[0];
-	if (loaded === void 0) return count;
-	return `${count}; ${CLAUDE_CODE} started in ${cwd} loads ${loaded.path} (${CLAUDE_CODE_SKILL_RULE})`;
-}
-function staleCopiesRow(stale, detail, deps) {
-	const globalStale = stale.some((copy) => copy.entry.scope === GLOBAL_SCOPE);
-	const projectStale = stale.some((copy) => copy.entry.scope !== GLOBAL_SCOPE);
-	const repairs = [];
-	if (globalStale) repairs.push(`\`rde init --only ${SKILL_STEP}\` reinstalls the global copy from ${deps.skills.source}`);
-	if (projectStale) repairs.push(`remove the project copy with \`npx -y skills@latest remove rde -y\` in ${deps.skills.cwd}`);
-	return failed("skill-copies", "rde skill copies", {
-		detail,
-		hint: `${repairs.join("; ")}; then restart the agent session`,
-		step: globalStale ? SKILL_STEP : null
-	});
-}
-async function skillCopiesRow(globalEntries, deps) {
-	const id = "skill-copies";
-	const label = "rde skill copies";
-	const cwd = deps.skills.cwd;
-	const projectEntries = cwd === deps.probe.home ? [] : (await skillsCli(deps.runner).listProject(cwd)).filter((entry) => entry.name === "rde");
-	const entries = [...globalEntries, ...projectEntries];
-	if (entries.length === 0) return skipped(id, label, "no copy installed");
-	const origin = skillOrigin(deps.skills.source, cwd);
-	const judged = [];
-	for (const entry of entries) judged.push(await judgeCopy(entry, origin, deps));
-	const loaded = loadedCopyLine(entries, cwd);
-	const lines = judged.map((copy) => copy.line);
-	const detail = (loaded === null ? lines : [...lines, loaded]).join("\n");
-	const stale = judged.filter((copy) => !copy.current);
-	return stale.length === 0 ? ok(id, label, detail) : staleCopiesRow(stale, detail, deps);
-}
 async function skillRows(state, deps) {
 	const label = "rde skill";
 	if (state === null) return [skipped("skill", label, NO_INSTANCE)];
@@ -5533,18 +4816,17 @@ async function skillRows(state, deps) {
 	const detected = (await detectAgents(deps.probe)).filter((agent) => agent.detected);
 	if (detected.length === 0) return [skipped("skill", label, "no coding agents detected")];
 	const entries = await rdeSkillEntries(deps.runner);
-	const copies = await skillCopiesRow(entries, deps);
 	if (detected.filter((agent) => entries.some((entry) => skillCoversAgent(entry, agent))).length === 0) return [failed("skill", label, {
 		detail: `not installed for ${detected.map((agent) => agent.displayName).join(", ")}`,
 		hint: `\`rde init --only ${SKILL_STEP}\``,
-		step: SKILL_STEP
-	}), copies];
-	return [...detected.map((agent) => {
+		fix: SKILL_STEP
+	})];
+	return detected.map((agent) => {
 		const entry = entries.find((candidate) => skillCoversAgent(candidate, agent));
 		const agentLabel = `${label} (${agent.displayName})`;
 		if (entry === void 0) return skipped(skillRowId(agent), agentLabel, `not installed; \`rde init --only ${SKILL_STEP}\` adds it`);
 		return ok(skillRowId(agent), agentLabel, entry.path);
-	}), copies];
+	});
 }
 function noRuntimeRows() {
 	return [
@@ -5553,13 +4835,13 @@ function noRuntimeRows() {
 		"health"
 	].map((id) => skipped(id, id, NO_INSTANCE));
 }
-async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusableReason) {
+async function instanceRows(state, deps, dockerOk, mbInstalled) {
 	const configured = configuredRuntime(state);
 	if (configured === null) return [
 		...noRuntimeRows(),
 		skipped("version", "Metabase version", NO_INSTANCE),
 		skipped("admin", "admin user", NO_INSTANCE),
-		...await credentialRows(state, secrets, await apiKeyFinding(secrets, null, false, deps), deps),
+		apiKeyRow(state),
 		skipped("mb-profile", "mb profile", NO_INSTANCE),
 		skipped("license", "license", NO_INSTANCE),
 		skipped("databases", "databases", NO_INSTANCE),
@@ -5569,33 +4851,35 @@ async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusable
 	const runtime = await runtimeRow(configured.runtime, deps, dockerOk);
 	const { row: health, healthy } = await healthRow(configured.url, deps);
 	const properties = healthy ? await deps.client(configured.url, NO_AUTH).session.properties() : null;
-	const apiKey = await apiKeyFinding(secrets, configured.url, healthy, deps);
 	const rows = [
 		runtime.row,
 		await portRow(configured.runtime.port, runtime, deps.ports),
 		health,
 		properties === null ? skipped("version", "Metabase version", NOT_HEALTHY) : versionRow(state, properties),
 		properties === null ? skipped("admin", "admin user", NOT_HEALTHY) : adminRow(state, properties),
-		...await credentialRows(state, secrets, apiKey, deps),
-		await mbProfileRow(state, configured.url, profiles, mbUnusableReason, healthy)
+		apiKeyRow(state),
+		await mbProfileRow(state, deps, mbInstalled, healthy)
 	];
-	const access = apiKey.access;
-	if (access.kind === "unusable") rows.push(skipped("license", "license", access.reason), skipped("databases", "databases", access.reason));
-	else rows.push(await licenseRow(access.client), await databasesRow(state, access.client));
-	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, access));
+	const client = healthy && state.apiKey !== null ? deps.client(configured.url, {
+		kind: "api-key",
+		key: state.apiKey
+	}) : null;
+	if (client === null) {
+		const reason = healthy ? "no API key" : NOT_HEALTHY;
+		rows.push(skipped("license", "license", reason), skipped("databases", "databases", reason));
+	} else rows.push(await licenseRow(client), await databasesRow(state, client));
+	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, client));
 	rows.push(await gitSyncRow(state, deps));
 	return rows;
 }
-async function collectDoctor(instance, state, secrets, deps) {
+async function collectDoctor(instance, state, deps) {
 	const machine = await machineRows(deps, state?.runtime ?? null);
 	const dockerOk = machine.some((row) => row.id === "docker" && row.status === "ok");
-	const mb = await mbFinding(deps);
-	const profiles = sharedProfileList(deps);
-	const checks = [...machine, mb.row];
-	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE), skipped("admin", "admin user", NO_INSTANCE), skipped("admin-password", "admin password", NO_INSTANCE), skipped("api-key", "API key", NO_INSTANCE), skipped("secrets-file", "secrets file", NO_INSTANCE), skipped("state-file", "state file", NO_INSTANCE), skipped("mb-profile", "mb profile", NO_INSTANCE), skipped("license", "license", NO_INSTANCE), skipped("databases", "databases", NO_INSTANCE), skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE), skipped("git-sync", "remote sync", NO_INSTANCE));
-	else checks.push(...await instanceRows(state, secrets, deps, dockerOk, profiles, mb.unusable));
-	const rdeProfile = state === null ? null : state.mbProfile;
-	checks.push(...await environmentRows(deps.environment, rdeProfile, profiles, mb.unusable), await otherMetabasesRow(deps.environment, rdeProfile, profiles, mb.unusable), ...await skillRows(state, deps));
+	const mb = await mbRow(deps);
+	const checks = [...machine, mb];
+	if (state === null) checks.push(...noRuntimeRows(), skipped("version", "Metabase version", NO_INSTANCE), skipped("admin", "admin user", NO_INSTANCE), skipped("api-key", "API key", NO_INSTANCE), skipped("mb-profile", "mb profile", NO_INSTANCE), skipped("license", "license", NO_INSTANCE), skipped("databases", "databases", NO_INSTANCE), skipped("sample-database", SAMPLE_LABEL, NO_INSTANCE), skipped("git-sync", "remote sync", NO_INSTANCE));
+	else checks.push(...await instanceRows(state, deps, dockerOk, mb.status === "ok"));
+	checks.push(...await skillRows(state, deps));
 	return {
 		instance,
 		checks,
@@ -5607,38 +4891,18 @@ const MARK = {
 	failed: "✗",
 	skipped: "–"
 };
-const NOTE_MARK = "!";
 const HINT_ARROW = "→";
-function markFor(row) {
-	return row.status === "ok" && row.hint !== null ? NOTE_MARK : MARK[row.status];
-}
 function doctorLines(report) {
 	const width = Math.max(...report.checks.map((row) => row.label.length));
-	const indent = `  ${" ".repeat(width)}  `;
 	const lines = [];
 	for (const row of report.checks) {
-		const [first, ...rest] = row.detail.split("\n");
-		lines.push(`${markFor(row)} ${row.label.padEnd(width)}  ${first}`);
-		lines.push(...rest.map((line) => `${indent}${line}`));
-		if (row.hint !== null) lines.push(`${indent}${HINT_ARROW} ${row.hint}`);
+		lines.push(`${MARK[row.status]} ${row.label.padEnd(width)}  ${row.detail}`);
+		if (row.hint !== null) lines.push(`  ${" ".repeat(width)}  ${HINT_ARROW} ${row.hint}`);
 	}
 	return lines;
 }
-function fixCommand(step) {
-	return step === null ? null : `rde init --only ${step}`;
-}
-function doctorJson(report) {
-	return {
-		instance: report.instance,
-		checks: report.checks.map(({ step, ...row }) => ({
-			...row,
-			fix: fixCommand(step)
-		})),
-		failed: report.failed
-	};
-}
 function fixableSteps(report) {
-	const wanted = new Set(report.checks.flatMap((row) => row.status === "failed" && row.step !== null ? [row.step] : []));
+	const wanted = new Set(report.checks.flatMap((row) => row.status === "failed" && row.fix !== null ? [row.fix] : []));
 	return StepId.options.filter((id) => wanted.has(id));
 }
 function doctorSummary(report) {
@@ -5677,24 +4941,15 @@ const ADMIN_USER_KEYS = {
 	firstName: `${STEP_ID$6}.first-name`,
 	lastName: `${STEP_ID$6}.last-name`
 };
-const GENERATED_ADMIN_EMAIL = "admin@metabase.local";
-const GENERATED_PASSWORD_BYTES = 24;
+const DEFAULT_ADMIN_EMAIL = "admin@metabase.com";
+const DEFAULT_ADMIN_PASSWORD = "metabase123";
 const DEFAULT_SITE_NAME = "rde";
 const MIN_PASSWORD_LENGTH = 6;
 const DIGIT = /\d/;
 const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-const DEFAULT_ADMIN = { variant: "generated" };
-function generatePassword(random) {
-	for (;;) {
-		const candidate = random(GENERATED_PASSWORD_BYTES).toString("base64url");
-		if (DIGIT.test(candidate)) return candidate;
-	}
-}
+const DEFAULT_ADMIN = { variant: "default" };
 function hostDeps$8(ctx) {
-	return {
-		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		password: () => generatePassword(randomBytes)
-	};
+	return { client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal) };
 }
 function isNotReady(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
@@ -5733,22 +4988,26 @@ async function promptedUser(ctx) {
 		...lastName.length > 0 && { last_name: lastName }
 	};
 }
-async function chooseUser(ctx, variant, deps) {
-	switch (variant) {
-		case "generated": return {
-			email: GENERATED_ADMIN_EMAIL,
-			password: deps.password()
+async function chooseUser(ctx, kind) {
+	switch (kind) {
+		case "default": return {
+			email: DEFAULT_ADMIN_EMAIL,
+			password: DEFAULT_ADMIN_PASSWORD
 		};
 		case "prompted": return promptedUser(ctx);
 	}
 }
-function storedLogin(variant, user) {
-	switch (variant) {
-		case "generated": return {
+function credentialsRecord(kind, user) {
+	switch (kind) {
+		case "default": return {
+			kind,
 			email: user.email,
 			password: user.password
 		};
-		case "prompted": return null;
+		case "prompted": return {
+			kind,
+			email: user.email
+		};
 	}
 }
 function adminUserStep(options, deps = hostDeps$8) {
@@ -5767,8 +5026,7 @@ function adminUserStep(options, deps = hostDeps$8) {
 		},
 		async run(ctx) {
 			const configured = requireConfiguredRuntime(ctx.state);
-			const resolved = deps(ctx);
-			const client = resolved.client(configured.url, NO_AUTH);
+			const client = deps(ctx).client(configured.url, NO_AUTH);
 			const properties = await client.session.properties();
 			if (properties["has-user-setup"]) {
 				ctx.ui.info("Metabase already has an admin user");
@@ -5776,11 +5034,7 @@ function adminUserStep(options, deps = hostDeps$8) {
 			}
 			const token = properties["setup-token"];
 			if (token === null) throw new ConfigError("Metabase has no admin user yet but offers no setup token");
-			const user = await chooseUser(ctx, options.variant, resolved);
-			await ctx.saveSecrets({
-				...ctx.secrets,
-				admin: storedLogin(options.variant, user)
-			});
+			const user = await chooseUser(ctx, options.variant);
 			const session = await client.setup.create({
 				token,
 				user,
@@ -5789,10 +5043,7 @@ function adminUserStep(options, deps = hostDeps$8) {
 			ctx.session.metabaseSession.set(session.id);
 			await ctx.saveState({
 				...ctx.state,
-				admin: {
-					kind: options.variant,
-					email: user.email
-				}
+				admin: credentialsRecord(options.variant, user)
 			});
 			ctx.ui.success(`Admin user ${user.email} created`);
 			return "completed";
@@ -5804,7 +5055,8 @@ function adminUserStep(options, deps = hostDeps$8) {
 const STEP_ID$5 = "api-key";
 const API_KEY_KEYS = {
 	email: `${STEP_ID$5}.email`,
-	password: `${STEP_ID$5}.password`
+	password: `${STEP_ID$5}.password`,
+	profile: `${STEP_ID$5}.profile`
 };
 const ADMINISTRATORS_GROUP_NAME = "Administrators";
 function hostDeps$7(ctx) {
@@ -5814,12 +5066,11 @@ function hostDeps$7(ctx) {
 	};
 }
 async function adminCredentials(ctx) {
-	const stored = ctx.secrets.admin;
-	if (stored !== null) return {
-		username: stored.email,
-		password: stored.password
-	};
 	const admin = ctx.state.admin;
+	if (admin?.kind === "default") return {
+		username: admin.email,
+		password: admin.password
+	};
 	ctx.ui.info("An admin login is needed once to create the API key; it is not saved");
 	return {
 		username: await ctx.prompts.text({
@@ -5857,35 +5108,47 @@ async function freshApiKey(ctx, client) {
 		group_id: groupId
 	})).unmasked_key;
 }
-async function authenticates(client) {
-	try {
-		await client.user.current();
-		return true;
-	} catch (error) {
-		if (isRejectedCredential(error)) return false;
-		throw error;
-	}
-}
-async function workingApiKey(ctx, deps, url) {
-	const stored = ctx.secrets.apiKey;
-	if (stored !== null) {
-		if (await authenticates(deps.client(url, {
-			kind: "api-key",
-			key: stored
-		}))) return stored;
-		ctx.ui.warn("Metabase rejects the stored API key; replacing it");
-	}
+async function persistedApiKey(ctx, deps, url) {
+	if (ctx.state.apiKey !== null) return ctx.state.apiKey;
 	const sessionId = await superuserSession(ctx, deps, url);
 	const apiKey = await freshApiKey(ctx, deps.client(url, {
 		kind: "session",
 		id: sessionId
 	}));
-	await ctx.saveSecrets({
-		...ctx.secrets,
+	await ctx.saveState({
+		...ctx.state,
 		apiKey
 	});
 	return apiKey;
 }
+async function chooseProfile(ctx, mb, url) {
+	const profile = ctx.state.mbProfile;
+	if (profile !== "default") return profile;
+	let existing;
+	try {
+		existing = await mb.authStatus(DEFAULT_MB_PROFILE);
+	} catch (error) {
+		if (error instanceof ProcessNotFoundError) return profile;
+		throw error;
+	}
+	if (!existing.present || existing.url === url) return profile;
+	const chosen = await ctx.prompts.select({
+		key: API_KEY_KEYS.profile,
+		message: `mb profile ${DEFAULT_MB_PROFILE} already points at ${existing.url}; which profile should this instance use?`,
+		choices: [{
+			value: "rde",
+			label: `rde, and leave ${DEFAULT_MB_PROFILE} alone`
+		}, {
+			value: DEFAULT_MB_PROFILE,
+			label: `${DEFAULT_MB_PROFILE}, replacing it`
+		}]
+	});
+	if (chosen !== profile) await ctx.saveState({
+		...ctx.state,
+		mbProfile: chosen
+	});
+	return chosen;
+}
 function usageNote(profile) {
 	if (profile === "default") return `${mbCommand(profile)} <command> uses this instance`;
 	return `${mbCommand(profile)} <command>\nMB_PROFILE=${profile} for agents and scripts`;
@@ -5895,7 +5158,7 @@ function apiKeyStep(deps = hostDeps$7) {
 		id: STEP_ID$5,
 		title: "Connect the Metabase CLI",
 		async detect(ctx) {
-			if (ctx.secrets.apiKey === null) return "todo";
+			if (ctx.state.apiKey === null) return "todo";
 			const mb = mbTool(deps(ctx).runner);
 			const profile = ctx.state.mbProfile;
 			try {
@@ -5909,9 +5172,9 @@ function apiKeyStep(deps = hostDeps$7) {
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = await workingApiKey(ctx, resolved, configured.url);
+			const apiKey = await persistedApiKey(ctx, resolved, configured.url);
 			const mb = mbTool(resolved.runner);
-			const profile = ctx.state.mbProfile;
+			const profile = await chooseProfile(ctx, mb, configured.url);
 			await mb.authLogin({
 				url: configured.url,
 				profile,
@@ -6311,14 +5574,14 @@ function isMbUnavailable(error) {
 }
 async function runGitSync(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
-	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	if (ctx.state.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
 	const run = {
 		ctx,
 		deps,
 		git: gitTool(deps.runner),
 		client: deps.client(configured.url, {
 			kind: "api-key",
-			key: ctx.secrets.apiKey
+			key: ctx.state.apiKey
 		})
 	};
 	const flow = await runFlow({
@@ -6374,8 +5637,8 @@ function validateToken(value) {
 	return "A license token is 64 hexadecimal characters";
 }
 function requireApiKey$1(ctx) {
-	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
-	return ctx.secrets.apiKey;
+	if (ctx.state.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	return ctx.state.apiKey;
 }
 function activeLabel(status) {
 	const plan = status["plan-alias"];
@@ -6388,15 +5651,15 @@ function licenseStep(deps = hostDeps$5) {
 		async detect(ctx) {
 			if (ctx.state.steps[STEP_ID$3]?.status === "skipped") return "not-applicable";
 			const configured = configuredRuntime(ctx.state);
-			if (configured === null || ctx.secrets.apiKey === null) return "todo";
+			if (configured === null || ctx.state.apiKey === null) return "todo";
 			const client = deps(ctx).client(configured.url, {
 				kind: "api-key",
-				key: ctx.secrets.apiKey
+				key: ctx.state.apiKey
 			});
 			try {
 				return (await client.tokenStatus.get()).valid ? "done" : "todo";
 			} catch (error) {
-				if (isNoTokenYet(error) || isRejectedCredential(error)) return "todo";
+				if (isNoTokenYet(error)) return "todo";
 				throw error;
 			}
 		},
@@ -6631,9 +5894,9 @@ function isNotServingYet(error) {
 function isNotFound$1(error) {
 	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS;
 }
-function requireApiKey(ctx) {
-	if (ctx.secrets.apiKey === null) throw new ConfigError(`instance ${ctx.state.name} has no API key yet; run \`rde init\``);
-	return ctx.secrets.apiKey;
+function requireApiKey(state) {
+	if (state.apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
+	return state.apiKey;
 }
 async function recordedDatabase(record, client) {
 	if (record.databaseId === null) return null;
@@ -6755,23 +6018,23 @@ function sampleDatabaseStep(deps = hostDeps$3) {
 			if (!(await resolved.runtime.docker.available()).available) return "not-applicable";
 			const record = ctx.state.sampleDatabase;
 			const configured = configuredRuntime(ctx.state);
-			if (record === null || configured === null || ctx.secrets.apiKey === null) return "todo";
+			if (record === null || configured === null || ctx.state.apiKey === null) return "todo";
 			if (!(await sampleDatabaseContainer(record, resolved.runtime.docker).status()).installed) return "todo";
 			const client = resolved.client(configured.url, {
 				kind: "api-key",
-				key: ctx.secrets.apiKey
+				key: ctx.state.apiKey
 			});
 			try {
 				return await recordedDatabase(record, client) === null ? "todo" : "done";
 			} catch (error) {
-				if (isNotServingYet(error) || isRejectedCredential(error)) return "todo";
+				if (isNotServingYet(error)) return "todo";
 				throw error;
 			}
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const configured = requireConfiguredRuntime(ctx.state);
-			const apiKey = requireApiKey(ctx);
+			const apiKey = requireApiKey(ctx.state);
 			const docker = await resolved.runtime.docker.available();
 			if (!docker.available) throw new ConfigError(`the sample database runs in Docker, which is not available: ${docker.reason}`);
 			const choice = await persistedRecord(ctx, resolved);
@@ -6886,24 +6149,23 @@ function hostDeps$1(ctx) {
 function isNotServing$1(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
-function loginLine(kind, email) {
-	switch (kind) {
-		case "generated":
-		case "legacy-default": return `Login: ${email} (run rde credentials in your terminal for the password)`;
-		case "prompted": return `Login: ${email} with the password you entered`;
+function loginLine(admin) {
+	if (admin === null) return null;
+	switch (admin.kind) {
+		case "default": return `Login: ${admin.email} / ${admin.password}`;
+		case "prompted": return `Login: ${admin.email} with the password you entered`;
 	}
 }
-async function databaseLines$1(state, apiKey, deps) {
-	if (state.url === null || apiKey === null) return ["Databases: none connected yet"];
+async function databaseLines$1(state, deps) {
+	if (state.url === null || state.apiKey === null) return ["Databases: none connected yet"];
 	let databases;
 	try {
 		databases = (await deps.client(state.url, {
 			kind: "api-key",
-			key: apiKey
+			key: state.apiKey
 		}).database.list()).data;
 	} catch (error) {
 		if (isNotServing$1(error)) return ["Databases: Metabase is not running; `rde start`"];
-		if (isRejectedCredential(error)) return ["Databases: Metabase rejects the stored API key; `rde init --only api-key`"];
 		throw error;
 	}
 	if (databases.length === 0) return ["Databases: none connected yet; `rde db add`"];
@@ -6937,13 +6199,14 @@ function launchLines(agents, workdir) {
 	const prefix = workdir === null ? "" : `cd ${workdir} && `;
 	return ["Start working:", ...detected.map((agent) => `  ${prefix}${agent.launch}  (${agent.displayName})`)];
 }
-async function summaryLines(state, apiKey, deps) {
+async function summaryLines(state, deps) {
 	const profile = state.mbProfile;
 	const lines = [];
 	if (state.url !== null) lines.push(`Metabase: ${state.url}`);
-	if (state.admin !== null) lines.push(loginLine(state.admin.kind, state.admin.email));
+	const login = loginLine(state.admin);
+	if (login !== null) lines.push(login);
 	lines.push(profile === "default" ? `Metabase CLI: ${mbCommand(profile)} <command>` : `Metabase CLI: ${mbCommand(profile)} <command>  or  export MB_PROFILE=${profile}`);
-	lines.push(...await databaseLines$1(state, apiKey, deps));
+	lines.push(...await databaseLines$1(state, deps));
 	if (state.sampleDatabase !== null) lines.push(`Sample database: psql "${sampleDatabaseUrl(state.sampleDatabase.port)}"`);
 	lines.push(...gitLines(state));
 	const installed = await skillsCli(deps.runner).list();
@@ -6960,8 +6223,7 @@ function summaryStep(deps = hostDeps$1) {
 			return "todo";
 		},
 		async run(ctx) {
-			const lines = await summaryLines(ctx.state, ctx.secrets.apiKey, deps(ctx));
-			ctx.ui.note(lines.join("\n"), "Your environment");
+			ctx.ui.note((await summaryLines(ctx.state, deps(ctx))).join("\n"), "Your environment");
 			return "completed";
 		}
 	};
@@ -6995,7 +6257,7 @@ function initSteps(options) {
 //#region src/commands/doctor.ts
 function print(report, json) {
 	if (json) {
-		printJson(doctorJson(report));
+		printJson(report);
 		return;
 	}
 	printLines(doctorLines(report));
@@ -7026,12 +6288,12 @@ const doctor = defineRdeCommand({
 		const name = await instanceNameOrDefault();
 		const state = await readInstanceState(name);
 		const deps = hostDoctorDeps(name, interruptSignal);
-		let report = await collectDoctor(name, state, state === null ? null : await readInstanceSecrets(name), deps);
+		let report = await collectDoctor(name, state, deps);
 		if (args.fix && report.failed > 0) {
 			if (state === null) throw new ConfigError("no instance to fix yet; run `rde init`");
 			print(report, args.json);
 			const ctx = await createWizardContext(name, { signal: interruptSignal });
-			if (await fixDoctor(report, initSteps(DEFAULT_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, ctx.secrets, deps);
+			if (await fixDoctor(report, initSteps(DEFAULT_STEP_OPTIONS), ctx, { yes: args.yes })) report = await collectDoctor(name, ctx.state, deps);
 		}
 		print(report, args.json);
 		if (report.failed > 0) throw new Error(doctorSummary(report));
@@ -7056,7 +6318,7 @@ const EnvString = z.string().transform((value, ctx) => {
 	}
 	return resolved;
 });
-const AdminVariant = z.enum(["generated", "prompted"]);
+const AdminVariant = z.enum(["default", "prompted"]);
 const RemoteKind = z.enum(["local-bare", "hosted"]);
 const FieldValue = z.union([
 	EnvString,
@@ -7085,6 +6347,7 @@ const SECTIONS = {
 		"first-name": z.string().optional(),
 		"last-name": z.string().optional()
 	}).optional(),
+	"api-key": z.strictObject({ profile: MbProfileChoice }).optional(),
 	license: z.strictObject({ token: EnvString.nullable() }).optional(),
 	databases: z.array(DatabaseEntry).optional(),
 	"git-sync": z.strictObject({
@@ -7180,6 +6443,8 @@ function keyedAnswers(answers) {
 	const map = /* @__PURE__ */ new Map();
 	const admin = answers["admin-user"];
 	if (admin !== void 0) addAdmin(map, admin);
+	const apiKey = answers["api-key"];
+	if (apiKey !== void 0) add(map, API_KEY_KEYS.profile, select$1(apiKey.profile));
 	const license = answers.license;
 	if (license !== void 0) add(map, LICENSE_KEYS.token, password$1(license.token ?? SKIP_LICENSE));
 	const databases = answers.databases;
@@ -7235,6 +6500,7 @@ const FLAG_FOR_KEY = {
 	[ADMIN_USER_KEYS.password]: "--admin-password",
 	[API_KEY_KEYS.email]: "--admin-email",
 	[API_KEY_KEYS.password]: "--admin-password",
+	[API_KEY_KEYS.profile]: "--mb-profile",
 	[LICENSE_KEYS.token]: "--license-token or --skip-license",
 	[DATABASE_KEYS.engine]: "--database or --skip-databases",
 	[DATABASE_KEYS.uri]: "--database",
@@ -7288,7 +6554,7 @@ function parseDatabase(spec) {
 function adminSection(flags, secrets) {
 	const prompted = flags.adminEmail !== void 0 || secrets.has("--admin-password");
 	if (flags.admin === void 0 && !prompted) return;
-	if (flags.admin === "generated" && prompted) throw conflict("--admin generated", "--admin-email/--admin-password");
+	if (flags.admin === "default" && prompted) throw conflict("--admin default", "--admin-email/--admin-password");
 	return {
 		variant: flags.admin ?? "prompted",
 		...flags.adminEmail !== void 0 && { email: flags.adminEmail },
@@ -7391,7 +6657,8 @@ async function answersFromFlags(flags, readStdin) {
 		license: licenseSection(flags, secrets),
 		databases: databasesSection(flags),
 		"git-sync": gitSection(flags, secrets),
-		"agents-skills": agentsSection(flags)
+		"agents-skills": agentsSection(flags),
+		"api-key": flags.mbProfile === void 0 ? void 0 : { profile: flags.mbProfile }
 	};
 	const present = Object.entries(sections).filter(([, section]) => section !== void 0);
 	return parseInitAnswers(Object.fromEntries(present), "the init flags");
@@ -7485,7 +6752,10 @@ function applyRecord(draft, record) {
 	if (key.startsWith("databases.")) applyDatabaseRecord(draft, record);
 	else if (key.startsWith("admin-user.")) applyAdminRecord(draft, key, value);
 	else if (key.startsWith("git-sync.")) applyGitRecord(draft, key, value);
-	else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
+	else if (key === API_KEY_KEYS.profile && value !== null) {
+		const profile = MbProfileChoice.safeParse(value);
+		if (profile.success) draft.answers["api-key"] = { profile: profile.data };
+	} else if (key === LICENSE_KEYS.token && value !== null) draft.answers.license = { token: value.length === 0 ? null : envReference(ENV_LICENSE_TOKEN) };
 }
 function writableUri(uri, index) {
 	return URI_WITH_PASSWORD.test(uri) ? envReference(databaseEnv(index, "uri")) : uri;
@@ -7757,7 +7027,7 @@ const init = defineRdeCommand({
 		},
 		admin: {
 			type: "string",
-			description: "Admin credentials: generated (a random password; `rde credentials` shows it) or prompted"
+			description: "Admin credentials: default (admin@metabase.com / metabase123) or prompted"
 		},
 		"admin-email": {
 			type: "string",
@@ -7815,6 +7085,10 @@ const init = defineRdeCommand({
 			description: "Install the skill for no agent",
 			default: false
 		},
+		"mb-profile": {
+			type: "string",
+			description: "mb profile for this instance when `default` already points elsewhere: default or rde"
+		},
 		yes: {
 			type: "boolean",
 			description: "Answer yes to every confirmation (skipping databases)",
@@ -7849,7 +7123,8 @@ const init = defineRdeCommand({
 				gitToken: args["git-token"],
 				skipGit: args["skip-git"],
 				agents: args.agents,
-				skipAgents: args["skip-agents"]
+				skipAgents: args["skip-agents"],
+				mbProfile: args["mb-profile"]
 			}
 		};
 		const printTo = args["print-answers"];
@@ -7968,11 +7243,11 @@ function isNotServing(error) {
 	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
 }
 async function databasesOf(ctx, deps, health) {
-	if (health !== "healthy" || ctx.secrets.apiKey === null) return null;
+	if (health !== "healthy" || ctx.state.apiKey === null) return null;
 	try {
-		return await listDatabases(ctx.state, ctx.secrets.apiKey, { client: deps.client });
+		return await listDatabases(ctx.state, { client: deps.client });
 	} catch (error) {
-		if (isNotServing(error) || isRejectedCredential(error)) return null;
+		if (isNotServing(error)) return null;
 		throw error;
 	}
 }
@@ -8015,13 +7290,9 @@ async function collectStatus(ctx, deps) {
 	const runtime = configured === null ? null : await runtimeFromState(configured.runtime, deps.runtime).status();
 	const health = configured === null ? null : await healthOf(configured.url, deps);
 	const databases = health === null ? null : await databasesOf(ctx, deps, health);
-	const admin = ctx.state.admin;
 	return {
 		instance: ctx.state.name,
 		url: configured?.url ?? null,
-		mbProfile: ctx.state.mbProfile,
-		adminEmail: admin === null ? null : admin.email,
-		adminVariant: admin === null ? null : admin.kind,
 		runtime: configured === null || runtime === null ? null : {
 			kind: configured.runtime.kind,
 			installed: runtime.installed,
@@ -8075,8 +7346,6 @@ function databaseLines(report) {
 function statusLines(report) {
 	return [
 		report.url === null ? `Instance ${report.instance}` : `Instance ${report.instance} — ${report.url}`,
-		...report.adminVariant === null || report.adminEmail === null ? [] : [loginLine(report.adminVariant, report.adminEmail)],
-		`Metabase CLI: ${mbCommand(report.mbProfile)} <command>`,
 		runtimeLine(report),
 		versionLine(report),
 		`Health: ${report.health ?? "unknown"}`,
@@ -8379,7 +7648,7 @@ async function planUninstall(options, deps) {
 		if (jar.removal !== null) removals.push(jar.removal);
 		if (jar.kept !== null) kept.push(jar.kept);
 	}
-	const profiles = state === null ? await findMbProfiles([DEFAULT_MB_PROFILE, mbProfileFor(options.instance)], null, deps.runner) : await findMbProfiles([state.mbProfile], state.url, deps.runner);
+	const profiles = state === null ? await findMbProfiles([DEFAULT_MB_PROFILE, "rde"], null, deps.runner) : await findMbProfiles([state.mbProfile], state.url, deps.runner);
 	removals.push(...profiles);
 	if (options.removeSkill) {
 		const skill = await findSkill(deps.runner);
@@ -8388,11 +7657,6 @@ async function planUninstall(options, deps) {
 	const dir = instanceDir(options.instance);
 	const dirPresent = await pathExists(dir);
 	if (!options.keepData) {
-		const secrets = instanceSecretsPath(options.instance);
-		if (await pathExists(secrets)) removals.push({
-			label: `Stored credentials ${secrets} (the admin password and the API key)`,
-			remove: () => promises.rm(secrets, { force: true })
-		});
 		if (dirPresent) removals.push({
 			label: instanceDirLabel(dir, state),
 			remove: () => promises.rm(dir, {
@@ -8794,7 +8058,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.3-alpha.rde-fixes.59b956e",
+		version: "0.1.3",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {
@@ -8802,7 +8066,6 @@ const main = defineCommand({
 		start,
 		stop,
 		status,
-		credentials,
 		logs,
 		open,
 		db,