@mrciphersmith/keryx 0.2.159 → 0.2.161

package/dist/cli.js

@@ -320,7 +320,20 @@ function saveCustomCompatProvider(provider, dir) {
       return acc;
     }, {});
     current[provider.name] = provider;
-    writeOwnerOnlyFile(llmProvidersConfigPath(dir), `${JSON.stringify({ schemaVersion: 1, providers: current }, null, 2)}
+    writeOwnerOnlyFileAtomic(llmProvidersConfigPath(dir), `${JSON.stringify({ schemaVersion: 1, providers: current }, null, 2)}
+`);
+  } catch {}
+}
+function removeCustomCompatProvider(name, dir) {
+  try {
+    const current = loadCustomCompatProviders(dir).reduce((acc, p) => {
+      acc[p.name] = p;
+      return acc;
+    }, {});
+    if (!(name in current))
+      return;
+    delete current[name];
+    writeOwnerOnlyFileAtomic(llmProvidersConfigPath(dir), `${JSON.stringify({ schemaVersion: 1, providers: current }, null, 2)}
 `);
   } catch {}
 }
@@ -467,7 +480,7 @@ function saveShellConfig(patch, dir) {
   try {
     ensureKeryxConfigDir(dir);
     const next = { ...loadShellConfig(dir), ...patch };
-    writeOwnerOnlyFile(shellConfigPath(dir), `${JSON.stringify(next, null, 2)}
+    writeOwnerOnlyFileAtomic(shellConfigPath(dir), `${JSON.stringify(next, null, 2)}
 `);
   } catch {}
 }
@@ -479,6 +492,27 @@ function saveProviderBaseUrl(provider, baseUrl, dir) {
   const existing = loadShellConfig(dir).baseUrls ?? {};
   saveShellConfig({ baseUrls: { ...existing, [provider]: baseUrl } }, dir);
 }
+function removeApiKey(envKey, dir) {
+  const existing = loadShellConfig(dir).apiKeys ?? {};
+  if (!(envKey in existing))
+    return;
+  const { [envKey]: _removed, ...rest } = existing;
+  saveShellConfig({ apiKeys: rest }, dir);
+}
+function removeProviderBaseUrl(provider, dir) {
+  const existing = loadShellConfig(dir).baseUrls ?? {};
+  if (!(provider in existing))
+    return;
+  const { [provider]: _removed, ...rest } = existing;
+  saveShellConfig({ baseUrls: rest }, dir);
+}
+function removeProviderModelParams(provider, dir) {
+  const existing = loadShellConfig(dir).modelParams ?? {};
+  if (!(provider in existing))
+    return;
+  const { [provider]: _removed, ...rest } = existing;
+  saveShellConfig({ modelParams: rest }, dir);
+}
 function envWithSavedApiKeys(env = process.env, dir) {
   const merged = { ...env };
   try {
@@ -600,6 +634,9 @@ function grantNeedsRefresh(grant, now = Date.now) {
   }
   return grant.expires - now() <= ACCESS_TOKEN_REFRESH_SKEW_MS;
 }
+function oauthEnvKeyFor(provider) {
+  return OAUTH_ENV_KEYS.find((entry) => entry.provider === provider)?.envKey;
+}
 function envWithOAuthAccess(env = process.env, dir) {
   const merged = { ...env };
   for (const { provider, envKey } of OAUTH_ENV_KEYS) {
@@ -647,6 +684,498 @@ var init_grants = __esm(() => {
   ];
 });
 
+// src/lib/oauth/device-code.ts
+function requestInit(base, signal) {
+  return signal === undefined ? base : { ...base, signal };
+}
+function formHeaders(extra) {
+  return {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json",
+    ...extra
+  };
+}
+function positiveSecondsToMs(value, defaultMs) {
+  const seconds = Number(value);
+  return Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : defaultMs;
+}
+async function defaultSleep(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+function aborted(signal) {
+  return signal?.aborted === true;
+}
+function readJsonError(body) {
+  if (typeof body !== "object" || body === null) {
+    return {};
+  }
+  const rec = body;
+  return {
+    ...typeof rec.error === "string" ? { error: rec.error } : {},
+    ...typeof rec.error_description === "string" ? { error_description: rec.error_description } : {}
+  };
+}
+async function requestDeviceCode(request, http) {
+  if (aborted(http.signal)) {
+    throw new DeviceCodeError("cancelled", "device authorization was cancelled");
+  }
+  const body = new URLSearchParams({
+    client_id: request.clientId,
+    scope: request.scope,
+    ...request.extraForm
+  });
+  const response = await http.fetch(request.deviceAuthorizationEndpoint, requestInit({
+    method: "POST",
+    headers: formHeaders(request.headers),
+    body: body.toString()
+  }, http.signal));
+  const json = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const detail = readJsonError(json).error_description ?? `HTTP ${response.status}`;
+    throw new DeviceCodeError("failed", `device code request failed: ${detail}`);
+  }
+  if (typeof json !== "object" || json === null) {
+    throw new DeviceCodeError("failed", "device code response is not an object");
+  }
+  const rec = json;
+  const deviceCode = typeof rec.device_code === "string" ? rec.device_code : "";
+  const userCode = typeof rec.user_code === "string" ? rec.user_code : "";
+  const verificationUri = typeof rec.verification_uri === "string" ? rec.verification_uri : "";
+  if (deviceCode.length === 0 || userCode.length === 0 || verificationUri.length === 0) {
+    throw new DeviceCodeError("failed", "device code response is missing device_code / user_code / verification_uri");
+  }
+  if (![...userCode].every((c) => /[A-Za-z0-9-]/.test(c))) {
+    throw new DeviceCodeError("failed", "device code response has an invalid user_code");
+  }
+  const complete = typeof rec.verification_uri_complete === "string" && rec.verification_uri_complete.length > 0 ? rec.verification_uri_complete : undefined;
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...complete !== undefined ? { verificationUriComplete: complete } : {},
+    ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {},
+    ...typeof rec.interval === "number" ? { intervalSeconds: rec.interval } : {}
+  };
+}
+async function pollDeviceCodeToken(challenge, request, http) {
+  const sleep = http.sleep ?? defaultSleep;
+  const now = http.now ?? Date.now;
+  const expiresInMs = positiveSecondsToMs(challenge.expiresInSeconds, DEFAULT_EXPIRES_MS);
+  const deadline = now() + expiresInMs;
+  let intervalMs = Math.max(positiveSecondsToMs(challenge.intervalSeconds, DEFAULT_INTERVAL_MS), MIN_INTERVAL_MS);
+  while (now() < deadline) {
+    if (aborted(http.signal)) {
+      throw new DeviceCodeError("cancelled", "device authorization was cancelled");
+    }
+    const response = await http.fetch(request.tokenEndpoint, requestInit({
+      method: "POST",
+      headers: formHeaders(request.headers),
+      body: new URLSearchParams({
+        grant_type: DEVICE_CODE_GRANT_TYPE,
+        client_id: request.clientId,
+        device_code: challenge.deviceCode,
+        ...request.extraForm
+      }).toString()
+    }, http.signal));
+    const json = await response.json().catch(() => ({}));
+    if (typeof json === "object" && json !== null && typeof json.access_token === "string") {
+      const rec = json;
+      return {
+        accessToken: rec.access_token,
+        ...typeof rec.refresh_token === "string" && rec.refresh_token.length > 0 ? { refreshToken: rec.refresh_token } : {},
+        ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {},
+        ...typeof rec.scope === "string" ? { scope: rec.scope } : {},
+        ...typeof rec.id_token === "string" ? { idToken: rec.id_token } : {}
+      };
+    }
+    const { error, error_description } = readJsonError(json);
+    const remaining = Math.max(0, deadline - now());
+    if (error === "authorization_pending") {
+      await sleep(Math.min(intervalMs + POLL_SAFETY_MARGIN_MS, remaining));
+      continue;
+    }
+    if (error === "slow_down") {
+      intervalMs += SLOW_DOWN_INCREMENT_MS;
+      await sleep(Math.min(intervalMs + POLL_SAFETY_MARGIN_MS, remaining));
+      continue;
+    }
+    if (error === "access_denied" || error === "authorization_denied") {
+      throw new DeviceCodeError("access_denied", "device authorization was denied");
+    }
+    if (error === "expired_token") {
+      throw new DeviceCodeError("expired_token", "device code expired");
+    }
+    if (!response.ok) {
+      throw new DeviceCodeError("failed", `device token exchange failed (${response.status})${error_description ? `: ${error_description}` : ""}`);
+    }
+    throw new DeviceCodeError("failed", `device token exchange failed${error_description ? `: ${error_description}` : ""}`);
+  }
+  throw new DeviceCodeError("timeout", "device authorization timed out");
+}
+async function refreshAccessToken(request, http) {
+  const response = await http.fetch(request.tokenEndpoint, requestInit({
+    method: "POST",
+    headers: formHeaders(request.headers),
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: request.refreshToken,
+      client_id: request.clientId,
+      ...request.extraForm
+    }).toString()
+  }, http.signal));
+  const json = await response.json().catch(() => ({}));
+  if (!response.ok || typeof json !== "object" || json === null || typeof json.access_token !== "string") {
+    const detail = readJsonError(json).error_description ?? `HTTP ${response.status}`;
+    throw new DeviceCodeError("failed", `token refresh failed: ${detail}`);
+  }
+  const rec = json;
+  return {
+    accessToken: rec.access_token,
+    refreshToken: typeof rec.refresh_token === "string" && rec.refresh_token.length > 0 ? rec.refresh_token : request.refreshToken,
+    ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {},
+    ...typeof rec.scope === "string" ? { scope: rec.scope } : {},
+    ...typeof rec.id_token === "string" ? { idToken: rec.id_token } : {}
+  };
+}
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code", DEFAULT_INTERVAL_MS = 5000, MIN_INTERVAL_MS = 1000, SLOW_DOWN_INCREMENT_MS = 5000, DEFAULT_EXPIRES_MS, POLL_SAFETY_MARGIN_MS = 3000, DeviceCodeError;
+var init_device_code = __esm(() => {
+  DEFAULT_EXPIRES_MS = 5 * 60 * 1000;
+  DeviceCodeError = class DeviceCodeError extends Error {
+    kind;
+    constructor(kind, message) {
+      super(message);
+      this.name = "DeviceCodeError";
+      this.kind = kind;
+    }
+  };
+});
+
+// src/lib/oauth/copilot.ts
+function copilotApiBaseFromExchange(raw) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    return;
+  }
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0) {
+      return;
+    }
+    const host = url.hostname;
+    if (host !== "api.githubcopilot.com" && !host.endsWith(".githubcopilot.com")) {
+      return;
+    }
+    return `https://${host}${url.port.length > 0 ? `:${url.port}` : ""}`;
+  } catch {
+    return;
+  }
+}
+function expiresInSecondsFrom(rec, now) {
+  if (typeof rec.expires_at === "string") {
+    const expires = Date.parse(rec.expires_at);
+    if (Number.isFinite(expires)) {
+      return Math.max(1, Math.floor((expires - now) / 1000));
+    }
+  }
+  if (typeof rec.expires_at === "number" && Number.isFinite(rec.expires_at)) {
+    const expiresMs = rec.expires_at < 1000000000000 ? rec.expires_at * 1000 : rec.expires_at;
+    return Math.max(1, Math.floor((expiresMs - now) / 1000));
+  }
+  if (typeof rec.refresh_in === "number" && Number.isFinite(rec.refresh_in) && rec.refresh_in > 0) {
+    return Math.floor(rec.refresh_in);
+  }
+  return;
+}
+function describeExchangeFailure(status, json, body) {
+  if (typeof json === "object" && json !== null) {
+    const rec = json;
+    if (rec.error_details?.copilot_access_denied === true) {
+      return `GitHub Copilot token exchange failed (HTTP ${status}): Copilot access denied \u2014 check the GitHub Copilot subscription on this account`;
+    }
+    if (typeof rec.message === "string" && rec.message.length > 0) {
+      return `GitHub Copilot token exchange failed (HTTP ${status}): ${rec.message}`;
+    }
+  }
+  if (/zscaler|blocked because it does not comply/i.test(body)) {
+    return `GitHub Copilot token exchange failed (HTTP ${status}): request was blocked by a gateway or proxy`;
+  }
+  return `GitHub Copilot token exchange failed (HTTP ${status})`;
+}
+async function exchangeGithubTokenForCopilot(githubToken, http) {
+  const init = {
+    method: "GET",
+    headers: {
+      ...GITHUB_COPILOT_REQUEST_HEADERS,
+      Authorization: `token ${githubToken}`
+    }
+  };
+  if (http.signal !== undefined) {
+    init.signal = http.signal;
+  }
+  const response = await http.fetch(COPILOT_TOKEN_URL, init);
+  const body = await response.text().catch(() => "");
+  let json = {};
+  if (body.length > 0) {
+    try {
+      json = JSON.parse(body);
+    } catch {
+      json = {};
+    }
+  }
+  if (!response.ok || typeof json !== "object" || json === null) {
+    throw new DeviceCodeError("failed", describeExchangeFailure(response.status, json, body));
+  }
+  const rec = json;
+  if (typeof rec.token !== "string" || rec.token.length === 0) {
+    throw new DeviceCodeError("failed", "GitHub Copilot token exchange returned no token");
+  }
+  const expiresInSeconds = expiresInSecondsFrom(rec, Date.now());
+  const apiBaseUrl = copilotApiBaseFromExchange(rec.endpoints?.api);
+  return {
+    accessToken: rec.token,
+    ...expiresInSeconds !== undefined ? { expiresInSeconds } : {},
+    ...apiBaseUrl !== undefined ? { apiBaseUrl } : {}
+  };
+}
+var COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
+var init_copilot = __esm(() => {
+  init_catalog();
+  init_device_code();
+});
+
+// src/lib/oauth/openai-codex.ts
+function withSignal(base, signal) {
+  return signal === undefined ? base : { ...base, signal };
+}
+async function requestCodexDeviceCode(http) {
+  const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/api/accounts/deviceauth/usercode`, withSignal({
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "keryx" },
+    body: JSON.stringify({ client_id: OPENAI_CODEX_CLIENT_ID })
+  }, http.signal));
+  const json = await response.json().catch(() => ({}));
+  if (!response.ok || typeof json !== "object" || json === null) {
+    throw new DeviceCodeError("failed", `ChatGPT device authorization failed (HTTP ${response.status})`);
+  }
+  const rec = json;
+  if (typeof rec.device_auth_id !== "string" || typeof rec.user_code !== "string") {
+    throw new DeviceCodeError("failed", "ChatGPT device authorization is missing device_auth_id / user_code");
+  }
+  const intervalSeconds = Number(rec.interval);
+  return {
+    deviceAuthId: rec.device_auth_id,
+    userCode: rec.user_code,
+    verificationUri: `${OPENAI_CODEX_ISSUER}/codex/device`,
+    intervalMs: Number.isFinite(intervalSeconds) && intervalSeconds > 0 ? intervalSeconds * 1000 : 5000
+  };
+}
+async function pollCodexDeviceToken(challenge, http) {
+  const sleep = http.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = http.now ?? Date.now;
+  const deadline = now() + 5 * 60 * 1000;
+  while (now() < deadline) {
+    if (http.signal?.aborted === true) {
+      throw new DeviceCodeError("cancelled", "device authorization was cancelled");
+    }
+    const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/api/accounts/deviceauth/token`, withSignal({
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "keryx" },
+      body: JSON.stringify({ device_auth_id: challenge.deviceAuthId, user_code: challenge.userCode })
+    }, http.signal));
+    if (response.ok) {
+      const data = await response.json();
+      if (typeof data.authorization_code !== "string" || typeof data.code_verifier !== "string") {
+        throw new DeviceCodeError("failed", "ChatGPT device token is missing authorization_code");
+      }
+      return exchangeCodexAuthorizationCode(data.authorization_code, data.code_verifier, http);
+    }
+    if (response.status !== 403 && response.status !== 404) {
+      throw new DeviceCodeError("failed", `ChatGPT device token poll failed (HTTP ${response.status})`);
+    }
+    await sleep(challenge.intervalMs + POLL_SAFETY_MARGIN_MS2);
+  }
+  throw new DeviceCodeError("timeout", "ChatGPT device authorization timed out");
+}
+async function exchangeCodexAuthorizationCode(code, codeVerifier, http) {
+  const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/oauth/token`, withSignal({
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: `${OPENAI_CODEX_ISSUER}/deviceauth/callback`,
+      client_id: OPENAI_CODEX_CLIENT_ID,
+      code_verifier: codeVerifier
+    }).toString()
+  }, http.signal));
+  const json = await response.json().catch(() => ({}));
+  if (!response.ok || typeof json !== "object" || json === null || typeof json.access_token !== "string") {
+    throw new DeviceCodeError("failed", `ChatGPT token exchange failed (HTTP ${response.status})`);
+  }
+  const rec = json;
+  return {
+    accessToken: rec.access_token,
+    ...typeof rec.refresh_token === "string" ? { refreshToken: rec.refresh_token } : {},
+    ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {}
+  };
+}
+var OPENAI_CODEX_ISSUER = "https://auth.openai.com", OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", POLL_SAFETY_MARGIN_MS2 = 3000;
+var init_openai_codex = __esm(() => {
+  init_device_code();
+});
+
+// src/lib/oauth/login.ts
+function httpOf(input) {
+  return {
+    fetch: input.fetch,
+    ...input.sleep !== undefined ? { sleep: input.sleep } : {},
+    ...input.now !== undefined ? { now: input.now } : {},
+    ...input.signal !== undefined ? { signal: input.signal } : {}
+  };
+}
+function present(challenge, provider) {
+  return {
+    userCode: challenge.userCode,
+    verificationUri: challenge.verificationUri,
+    ...challenge.verificationUriComplete !== undefined ? { verificationUriComplete: challenge.verificationUriComplete } : {},
+    instructions: `Open ${challenge.verificationUri} and enter code: ${challenge.userCode} (${deviceCodeMethodLabel(provider)})`
+  };
+}
+async function loginRfc8628(input) {
+  const endpoints = input.provider === "github-copilot" ? GITHUB_COPILOT_DEVICE : XAI_GROK_DEVICE;
+  const http = httpOf(input);
+  const challenge = await requestDeviceCode({
+    deviceAuthorizationEndpoint: endpoints.deviceAuthorizationEndpoint,
+    clientId: endpoints.clientId,
+    scope: endpoints.scope,
+    ...endpoints.extraForm !== undefined ? { extraForm: endpoints.extraForm } : {},
+    ...endpoints.headers !== undefined ? { headers: endpoints.headers } : {}
+  }, http);
+  input.onChallenge(present(challenge, input.provider));
+  const tokens = await pollDeviceCodeToken(challenge, {
+    tokenEndpoint: endpoints.tokenEndpoint,
+    clientId: endpoints.clientId,
+    ...endpoints.headers !== undefined ? { headers: endpoints.headers } : {}
+  }, http);
+  if (endpoints.afterToken === "github-copilot") {
+    const copilot = await exchangeGithubTokenForCopilot(tokens.accessToken, http);
+    if (copilot.apiBaseUrl !== undefined) {
+      saveProviderBaseUrl("github-copilot", copilot.apiBaseUrl, input.dir);
+    }
+    return {
+      accessToken: copilot.accessToken,
+      refreshToken: tokens.accessToken,
+      ...copilot.expiresInSeconds !== undefined ? { expiresInSeconds: copilot.expiresInSeconds } : {}
+    };
+  }
+  return tokens;
+}
+async function loginDeviceCode(input) {
+  const entry = authCatalogEntry(input.provider);
+  if (entry === undefined) {
+    return { ok: false, error: `unknown provider: ${input.provider}` };
+  }
+  if (!entry.methods.includes("device-code")) {
+    const refusal = catalogRefusal(input.provider);
+    if (refusal !== undefined) {
+      return { ok: false, error: refusal, refused: true };
+    }
+    return { ok: false, error: `${input.provider} does not support device authorization` };
+  }
+  try {
+    const tokens = input.provider === "openai" ? await loginCodex(input) : await loginRfc8628(input);
+    saveOAuthGrant(input.provider, grantFromTokens("device-code", tokens, input.now), input.dir);
+    return { ok: true, provider: input.provider };
+  } catch (err) {
+    const message = err instanceof DeviceCodeError ? err.message : err instanceof Error ? err.message : "device authorization failed";
+    return { ok: false, error: message };
+  }
+}
+async function loginCodex(input) {
+  const http = httpOf(input);
+  const challenge = await requestCodexDeviceCode(http);
+  input.onChallenge(present({
+    userCode: challenge.userCode,
+    verificationUri: challenge.verificationUri
+  }, "openai"));
+  return pollCodexDeviceToken(challenge, http);
+}
+async function refreshProviderGrant(provider, http, dir) {
+  const grant = loadOAuthGrant(provider, dir);
+  if (grant === undefined || !grantNeedsRefresh(grant, http.now)) {
+    return grant;
+  }
+  if (grant.refresh === undefined) {
+    return grant;
+  }
+  const endpoints = provider === "github-copilot" ? GITHUB_COPILOT_DEVICE : XAI_GROK_DEVICE;
+  if (provider === "github-copilot") {
+    const copilot = await exchangeGithubTokenForCopilot(grant.refresh, http);
+    if (copilot.apiBaseUrl !== undefined) {
+      saveProviderBaseUrl("github-copilot", copilot.apiBaseUrl, dir);
+    }
+    const next = grantFromTokens("device-code", {
+      accessToken: copilot.accessToken,
+      refreshToken: grant.refresh,
+      ...copilot.expiresInSeconds !== undefined ? { expiresInSeconds: copilot.expiresInSeconds } : {}
+    }, http.now);
+    next.lastRefreshedAt = new Date((http.now ?? Date.now)()).toISOString();
+    saveOAuthGrant(provider, next, dir);
+    return next;
+  }
+  if (provider === "openai") {
+    return grant;
+  }
+  const tokens = await refreshAccessToken({
+    tokenEndpoint: endpoints.tokenEndpoint,
+    clientId: endpoints.clientId,
+    refreshToken: grant.refresh,
+    ...endpoints.headers !== undefined ? { headers: endpoints.headers } : {}
+  }, http);
+  const next = grantFromTokens("device-code", tokens, http.now);
+  next.lastRefreshedAt = new Date((http.now ?? Date.now)()).toISOString();
+  saveOAuthGrant(provider, next, dir);
+  return next;
+}
+async function refreshSavedGrants(http, dir, providers = SESSION_REFRESHED_GRANTS) {
+  const warnings = [];
+  const now = http.now ?? Date.now;
+  for (const provider of providers) {
+    if (!SESSION_REFRESHED_GRANTS.includes(provider))
+      continue;
+    const grant = loadOAuthGrant(provider, dir);
+    if (grant === undefined)
+      continue;
+    if (grant.refresh === undefined || grant.refresh.length === 0) {
+      if (grant.expires !== undefined && grant.expires <= now()) {
+        warnings.push(`${provider}: the saved login has expired and holds no refresh token. Run \`keryx auth login ${provider}\`.`);
+      }
+      continue;
+    }
+    if (!grantNeedsRefresh(grant, http.now))
+      continue;
+    try {
+      await refreshProviderGrant(provider, http, dir);
+    } catch (cause) {
+      const reason = cause instanceof Error ? cause.message : String(cause);
+      warnings.push(`${provider}: the saved login is expiring or expired and could not be refreshed (${reason}). ` + `Run \`keryx auth login ${provider}\`.`);
+    }
+  }
+  return warnings;
+}
+function logoutProvider(provider, dir) {
+  deleteOAuthGrant(provider, dir);
+}
+var SESSION_REFRESHED_GRANTS;
+var init_login = __esm(() => {
+  init_shell_config();
+  init_catalog();
+  init_copilot();
+  init_device_code();
+  init_grants();
+  init_openai_codex();
+  SESSION_REFRESHED_GRANTS = ["grok", "github-copilot"];
+});
+
 // src/lib/caller-session.ts
 function resolveCallerSession(input = {}) {
   const pair = (provider, model, source) => ({
@@ -717,6 +1246,827 @@ function shortFlag(flag) {
 }
 var init_args = () => {};
 
+// src/lib/md-blocks.ts
+function stripTrailingCr(line) {
+  return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
+function splitLines(text) {
+  return text.split(`
+`).map(stripTrailingCr);
+}
+function markdownTableCells(line) {
+  const source = line.trim();
+  if (!source.includes("|")) {
+    return;
+  }
+  const cells = [];
+  let cell = "";
+  let inCode = false;
+  for (let index = 0;index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === "\\" && source[index + 1] === "|") {
+      cell += "|";
+      index += 1;
+      continue;
+    }
+    if (char === "`") {
+      inCode = !inCode;
+      cell += char;
+      continue;
+    }
+    if (char === "|" && !inCode) {
+      cells.push(cell.trim());
+      cell = "";
+      continue;
+    }
+    cell += char;
+  }
+  cells.push(cell.trim());
+  if (source.startsWith("|")) {
+    cells.shift();
+  }
+  if (source.endsWith("|")) {
+    cells.pop();
+  }
+  return cells.length >= 2 ? cells : undefined;
+}
+function tableAlignments(line, columns) {
+  const cells = markdownTableCells(line);
+  if (cells === undefined || cells.length !== columns) {
+    return;
+  }
+  const alignments = [];
+  for (const cell of cells) {
+    const marker = cell.trim();
+    if (!/^:?-{3,}:?$/.test(marker)) {
+      return;
+    }
+    alignments.push(marker.startsWith(":") && marker.endsWith(":") ? "center" : marker.endsWith(":") ? "right" : "left");
+  }
+  return alignments;
+}
+function parseMarkdownTables(text) {
+  if (text.length === 0) {
+    return [];
+  }
+  const lines = splitLines(text);
+  const parts = [];
+  let proseStart = 0;
+  const flushProse = (end) => {
+    if (end <= proseStart) {
+      return;
+    }
+    const prose = lines.slice(proseStart, end).join(`
+`);
+    if (prose.length > 0) {
+      parts.push({ kind: "prose", text: prose });
+    }
+  };
+  for (let index = 0;index + 1 < lines.length; index += 1) {
+    const headers = markdownTableCells(lines[index] ?? "");
+    if (headers === undefined) {
+      continue;
+    }
+    const alignments = tableAlignments(lines[index + 1] ?? "", headers.length);
+    if (alignments === undefined) {
+      continue;
+    }
+    flushProse(index);
+    const rows = [];
+    let cursor = index + 2;
+    while (cursor < lines.length) {
+      const row = markdownTableCells(lines[cursor] ?? "");
+      if (row === undefined || row.length !== headers.length) {
+        break;
+      }
+      rows.push(row);
+      cursor += 1;
+    }
+    parts.push({ kind: "table", table: { headers, alignments, rows } });
+    proseStart = cursor;
+    index = cursor - 1;
+  }
+  flushProse(lines.length);
+  return parts.length > 0 ? parts : [{ kind: "prose", text }];
+}
+function fenceInfo(line) {
+  const match = FENCE_LINE.exec(line);
+  if (match === null) {
+    return;
+  }
+  return { marker: match[1] ?? "", lang: (match[2] ?? "").trim().split(/\s+/)[0] ?? "" };
+}
+function segmentMarkdown(md) {
+  const segments = [];
+  let text = [];
+  let code;
+  let lang = "";
+  let marker = "";
+  const flushText = () => {
+    const joined = text.join(`
+`);
+    text = [];
+    if (joined.length > 0) {
+      segments.push({ kind: "text", text: joined });
+    }
+  };
+  for (const line of splitLines(md)) {
+    const fence = fenceInfo(line);
+    if (code === undefined) {
+      if (fence === undefined) {
+        text.push(line);
+        continue;
+      }
+      flushText();
+      marker = fence.marker;
+      lang = fence.lang;
+      code = [];
+      continue;
+    }
+    if (fence?.marker === marker) {
+      segments.push({ kind: "code", lang, body: code.join(`
+`) });
+      code = undefined;
+      continue;
+    }
+    code.push(line);
+  }
+  if (code === undefined) {
+    flushText();
+  } else {
+    segments.push({ kind: "code", lang, body: code.join(`
+`) });
+  }
+  return segments;
+}
+function classifyDiffLine(line) {
+  if (line.startsWith("@@")) {
+    return "hunk";
+  }
+  if (line.startsWith("---") || line.startsWith("+++")) {
+    return "meta";
+  }
+  if (line.startsWith("+")) {
+    return "add";
+  }
+  if (line.startsWith("-")) {
+    return "del";
+  }
+  return "context";
+}
+function looksLikeUnifiedDiff(text) {
+  const lines = splitLines(text);
+  for (const [index, line] of lines.entries()) {
+    if (HUNK_HEADER.test(line)) {
+      return true;
+    }
+    if (line.startsWith("--- ") && (lines[index + 1]?.startsWith("+++ ") ?? false)) {
+      return true;
+    }
+  }
+  return false;
+}
+function codeCommentPrefix(normalizedLang) {
+  switch (normalizedLang) {
+    case "javascript":
+    case "typescript":
+    case "go":
+    case "rust":
+    case "java":
+    case "c":
+    case "cpp":
+    case "csharp":
+    case "swift":
+    case "kotlin":
+    case "scala":
+    case "php":
+      return "//";
+    case "python":
+    case "bash":
+    case "ruby":
+    case "yaml":
+    case "toml":
+    case "r":
+    case "perl":
+      return "#";
+    case "sql":
+    case "lua":
+    case "haskell":
+      return "--";
+    default:
+      return "";
+  }
+}
+function normalizeCodeLang(lang) {
+  const key = lang.trim().toLowerCase();
+  return CODE_LANG_ALIASES[key] ?? key;
+}
+function tokenizeCodeWords(text, keywords) {
+  const tokens = [];
+  let last = 0;
+  CODE_WORD_OR_NUMBER.lastIndex = 0;
+  let m;
+  while ((m = CODE_WORD_OR_NUMBER.exec(text)) !== null) {
+    if (m.index > last) {
+      tokens.push({ kind: "plain", text: text.slice(last, m.index) });
+    }
+    const word = m[0];
+    if (/^[0-9]/.test(word)) {
+      tokens.push({ kind: "number", text: word });
+    } else if (keywords.has(word)) {
+      tokens.push({ kind: "keyword", text: word });
+    } else {
+      tokens.push({ kind: "plain", text: word });
+    }
+    last = m.index + word.length;
+  }
+  if (last < text.length) {
+    tokens.push({ kind: "plain", text: text.slice(last) });
+  }
+  return tokens;
+}
+function tokenizeCodeLine(line, lang) {
+  const normalized = normalizeCodeLang(lang);
+  const keywords = CODE_LANG_KEYWORDS[normalized] ?? GENERIC_KEYWORDS;
+  const commentPrefix = codeCommentPrefix(normalized);
+  const tokens = [];
+  let plainBuf = "";
+  const flushPlain = () => {
+    if (plainBuf.length > 0) {
+      tokens.push(...tokenizeCodeWords(plainBuf, keywords));
+      plainBuf = "";
+    }
+  };
+  let i = 0;
+  while (i < line.length) {
+    if (commentPrefix.length > 0 && line.startsWith(commentPrefix, i)) {
+      flushPlain();
+      tokens.push({ kind: "comment", text: line.slice(i) });
+      break;
+    }
+    const ch = line[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      flushPlain();
+      let j = i + 1;
+      while (j < line.length && line[j] !== ch) {
+        j += line[j] === "\\" ? 2 : 1;
+      }
+      j = Math.min(j + 1, line.length);
+      tokens.push({ kind: "string", text: line.slice(i, j) });
+      i = j;
+      continue;
+    }
+    plainBuf += ch;
+    i += 1;
+  }
+  flushPlain();
+  return tokens;
+}
+function payloadKind(lang, _lineCount) {
+  const normalized = lang.toLowerCase();
+  if (MARKDOWN_LANGS.has(normalized)) {
+    return "markdown";
+  }
+  if (DIFF_LANGS.has(normalized)) {
+    return "diff";
+  }
+  return "code";
+}
+function blockLabel({ kind, lineCount, collapsed, hint }) {
+  const marker = collapsed ? "\u25B8" : "\u25BE";
+  const unit = lineCount === 1 ? "line" : "lines";
+  const suffix = hint !== undefined && hint.length > 0 ? ` \xB7 ${hint}` : "";
+  return `${marker} ${kind} (${lineCount} ${unit})${suffix}`;
+}
+function summarizeSubmittedLine(line) {
+  const normalized = line.replace(/\r\n/g, `
+`).replace(/\r/g, `
+`);
+  const nonEmpty = normalized.split(`
+`).filter((linePart) => linePart.length > 0);
+  if (nonEmpty.length <= 1) {
+    return line;
+  }
+  const [first, ...rest] = nonEmpty;
+  return `${first} [+ ${rest.length} pasted line${rest.length === 1 ? "" : "s"}]`;
+}
+function isZeroWidth(cp) {
+  return cp >= 768 && cp <= 879 || cp >= 8203 && cp <= 8207 || cp >= 65024 && cp <= 65039 || cp >= 8288 && cp <= 8292;
+}
+function codePointWidth(cp) {
+  for (const [lo, hi] of WIDE_RANGES) {
+    if (cp >= lo && cp <= hi) {
+      return 2;
+    }
+  }
+  return 1;
+}
+function visualWidth(text) {
+  let width = 0;
+  for (const ch of text) {
+    const codePoint = ch.codePointAt(0) ?? 0;
+    if (isZeroWidth(codePoint)) {
+      continue;
+    }
+    width += codePointWidth(codePoint);
+  }
+  return width;
+}
+function hugWidth(text, chrome) {
+  const lines = splitLines(text.replace(/\n+$/, ""));
+  let widest = 0;
+  for (const line of lines) {
+    widest = Math.max(widest, visualWidth(line));
+  }
+  return widest + chrome;
+}
+var FENCE_LINE, HUNK_HEADER, MARKDOWN_LANGS, DIFF_LANGS, CODE_LANG_ALIASES, GENERIC_KEYWORDS, CODE_LANG_KEYWORDS, CODE_WORD_OR_NUMBER, WIDE_RANGES;
+var init_md_blocks = __esm(() => {
+  FENCE_LINE = /^[ \t]{0,3}(```|~~~)(.*)\r?$/;
+  HUNK_HEADER = /^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/;
+  MARKDOWN_LANGS = new Set(["md", "markdown", "prompt"]);
+  DIFF_LANGS = new Set(["diff", "patch"]);
+  CODE_LANG_ALIASES = {
+    js: "javascript",
+    mjs: "javascript",
+    cjs: "javascript",
+    jsx: "javascript",
+    ts: "typescript",
+    tsx: "typescript",
+    py: "python",
+    py3: "python",
+    sh: "bash",
+    shell: "bash",
+    zsh: "bash",
+    console: "bash",
+    yml: "yaml",
+    rb: "ruby",
+    rs: "rust",
+    kt: "kotlin",
+    cs: "csharp",
+    "c++": "cpp",
+    cc: "cpp",
+    cxx: "cpp",
+    hpp: "cpp"
+  };
+  GENERIC_KEYWORDS = new Set([
+    "if",
+    "else",
+    "for",
+    "while",
+    "return",
+    "function",
+    "class",
+    "const",
+    "let",
+    "var",
+    "import",
+    "export",
+    "from",
+    "true",
+    "false",
+    "null",
+    "new",
+    "this",
+    "try",
+    "catch",
+    "throw",
+    "switch",
+    "case",
+    "break",
+    "continue",
+    "default",
+    "static",
+    "public",
+    "private"
+  ]);
+  CODE_LANG_KEYWORDS = {
+    javascript: new Set([
+      ...GENERIC_KEYWORDS,
+      "async",
+      "await",
+      "yield",
+      "typeof",
+      "instanceof",
+      "in",
+      "of",
+      "void",
+      "undefined",
+      "super",
+      "extends",
+      "finally",
+      "do",
+      "delete"
+    ]),
+    typescript: new Set([
+      ...GENERIC_KEYWORDS,
+      "async",
+      "await",
+      "yield",
+      "typeof",
+      "instanceof",
+      "in",
+      "of",
+      "void",
+      "undefined",
+      "super",
+      "extends",
+      "implements",
+      "interface",
+      "type",
+      "enum",
+      "namespace",
+      "declare",
+      "readonly",
+      "abstract",
+      "as",
+      "satisfies",
+      "finally",
+      "do",
+      "delete"
+    ]),
+    python: new Set([
+      "def",
+      "return",
+      "if",
+      "elif",
+      "else",
+      "for",
+      "while",
+      "break",
+      "continue",
+      "class",
+      "import",
+      "from",
+      "as",
+      "try",
+      "except",
+      "finally",
+      "raise",
+      "with",
+      "lambda",
+      "yield",
+      "pass",
+      "None",
+      "True",
+      "False",
+      "and",
+      "or",
+      "not",
+      "in",
+      "is",
+      "global",
+      "nonlocal",
+      "assert",
+      "async",
+      "await",
+      "del",
+      "self"
+    ]),
+    bash: new Set([
+      "if",
+      "then",
+      "else",
+      "elif",
+      "fi",
+      "for",
+      "while",
+      "do",
+      "done",
+      "case",
+      "esac",
+      "function",
+      "return",
+      "local",
+      "export",
+      "exit",
+      "break",
+      "continue",
+      "in",
+      "select",
+      "until"
+    ]),
+    go: new Set([
+      "func",
+      "return",
+      "if",
+      "else",
+      "for",
+      "range",
+      "switch",
+      "case",
+      "default",
+      "break",
+      "continue",
+      "package",
+      "import",
+      "var",
+      "const",
+      "type",
+      "struct",
+      "interface",
+      "map",
+      "chan",
+      "go",
+      "defer",
+      "select",
+      "fallthrough",
+      "nil",
+      "true",
+      "false"
+    ]),
+    rust: new Set([
+      "fn",
+      "let",
+      "mut",
+      "return",
+      "if",
+      "else",
+      "for",
+      "while",
+      "loop",
+      "match",
+      "struct",
+      "enum",
+      "impl",
+      "trait",
+      "pub",
+      "use",
+      "mod",
+      "crate",
+      "self",
+      "Self",
+      "super",
+      "const",
+      "static",
+      "async",
+      "await",
+      "move",
+      "ref",
+      "dyn",
+      "where",
+      "unsafe",
+      "true",
+      "false",
+      "None",
+      "Some",
+      "Ok",
+      "Err"
+    ]),
+    json: new Set(["true", "false", "null"])
+  };
+  CODE_WORD_OR_NUMBER = /[A-Za-z_$][A-Za-z0-9_$]*|\d+(?:\.\d+)?/g;
+  WIDE_RANGES = [
+    [4352, 4447],
+    [11904, 12350],
+    [12353, 13311],
+    [13312, 19903],
+    [19968, 40959],
+    [40960, 42191],
+    [44032, 55203],
+    [63744, 64255],
+    [65072, 65135],
+    [65280, 65376],
+    [65504, 65510],
+    [127744, 128591],
+    [129280, 129535],
+    [131072, 262141]
+  ];
+});
+
+// src/lib/ui.ts
+import { stdout } from "process";
+function colorEnabled() {
+  if (process.env.NO_COLOR !== undefined) {
+    return false;
+  }
+  if (process.env.FORCE_COLOR !== undefined) {
+    return true;
+  }
+  return Boolean(stdout.isTTY);
+}
+function wrap(open, close) {
+  return (text) => colorEnabled() ? `\x1B[${open}m${text}\x1B[${close}m` : text;
+}
+function banner(title, subtitle) {
+  const rule = style.cyan("\u2501".repeat(RULE_WIDTH));
+  console.log(rule);
+  console.log(`  ${style.bold(title)}`);
+  if (subtitle) {
+    console.log(`  ${style.dim(subtitle)}`);
+  }
+  console.log(rule);
+}
+function heading(title, emit = console.log) {
+  emit(`
+${style.bold(style.cyan(title))}`);
+}
+function statusLine(label, enabled, detail) {
+  const marker = enabled ? style.green(symbols.ok) : style.gray(symbols.off);
+  const name = enabled ? label : style.gray(label);
+  const suffix = detail ? style.dim(` (${detail})`) : "";
+  console.log(`  ${marker} ${name}${suffix}`);
+}
+function nextSteps(steps) {
+  if (steps.length === 0) {
+    return;
+  }
+  heading("Next steps");
+  for (const step of steps) {
+    console.log(`  ${style.cyan(symbols.arrow)} ${step}`);
+  }
+}
+function note(message) {
+  console.log(`  ${style.dim(message)}`);
+}
+function renderInline(text) {
+  const withCode = text.replace(/`([^`]+)`/g, (_match, code) => style.gray(code));
+  return withCode.replace(/\*\*([^*]+)\*\*/g, (_match, bold) => style.bold(bold));
+}
+function renderTextLine(line) {
+  const heading = /^#{1,6}\s+(.*)$/.exec(line);
+  if (heading !== null) {
+    return style.bold(style.cyan(heading[1] ?? ""));
+  }
+  const bullet = /^(\s*)[-*]\s+(.*)$/.exec(line);
+  if (bullet !== null) {
+    return `${bullet[1] ?? ""}${style.cyan(symbols.bullet)} ${renderInline(bullet[2] ?? "")}`;
+  }
+  return renderInline(line);
+}
+function renderDiff(text) {
+  if (!colorEnabled()) {
+    return text;
+  }
+  return splitLines(text).map((line) => {
+    switch (classifyDiffLine(line)) {
+      case "add":
+        return style.green(line);
+      case "del":
+        return style.red(line);
+      case "hunk":
+        return style.cyan(line);
+      case "meta":
+        return style.dim(line);
+      default:
+        return line;
+    }
+  }).join(`
+`);
+}
+function renderCodeSegment(lang, body) {
+  const lines = body.split(`
+`);
+  const out = [];
+  if (lang.length > 0) {
+    out.push(style.dim(lang));
+  }
+  if (payloadKind(lang, lines.length) === "diff" || looksLikeUnifiedDiff(body)) {
+    out.push(renderDiff(body));
+    return out;
+  }
+  for (const line of lines) {
+    out.push(style.gray(line));
+  }
+  return out;
+}
+function renderMarkdown(md) {
+  if (!colorEnabled()) {
+    return md;
+  }
+  const out = [];
+  for (const segment of segmentMarkdown(md)) {
+    if (segment.kind === "code") {
+      out.push(...renderCodeSegment(segment.lang, segment.body));
+      continue;
+    }
+    for (const line of segment.text.split(`
+`)) {
+      out.push(renderTextLine(line));
+    }
+  }
+  return out.join(`
+`);
+}
+function collapseToolOutput(text, maxWidth = 100) {
+  const trimmed = text.replace(/\r?\n+$/, "");
+  const lines = trimmed.length === 0 ? [] : splitLines(trimmed);
+  const firstNonEmpty = lines.find((line) => line.trim().length > 0) ?? "";
+  const summary = firstNonEmpty.length > maxWidth ? `${firstNonEmpty.slice(0, maxWidth)}\u2026` : firstNonEmpty;
+  const lineCount = lines.length;
+  return { summary, lineCount, hidden: Math.max(0, lineCount - 1) };
+}
+function indentBlock(text, pad) {
+  return text.split(`
+`).map((line) => line.length > 0 ? pad + line : line).join(`
+`);
+}
+function summarizeToolArgs(input, max = 80) {
+  const clip = (s) => s.length > max ? `${s.slice(0, max)}\u2026` : s;
+  const raw = input.trim();
+  if (raw.length === 0) {
+    return "";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return clip(raw);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return clip(raw);
+  }
+  const parts = [];
+  for (const [key, value] of Object.entries(parsed)) {
+    let shown;
+    if (value === null) {
+      shown = "null";
+    } else if (Array.isArray(value)) {
+      shown = "[\u2026]";
+    } else if (typeof value === "object") {
+      shown = "{\u2026}";
+    } else {
+      shown = String(value);
+    }
+    parts.push(`${key}=${shown}`);
+  }
+  return clip(parts.join(", "));
+}
+function helpTitle(command, summary) {
+  console.log(`${style.bold(command)} ${style.dim(`\u2014 ${summary}`)}`);
+}
+function helpUsage(lines) {
+  heading("Usage");
+  for (const line of lines) {
+    console.log(`  ${style.cyan(line)}`);
+  }
+}
+function helpOptions(options) {
+  heading("Options");
+  const width = Math.max(...options.map((option) => option.flag.length));
+  for (const option of options) {
+    console.log(`  ${style.cyan(option.flag.padEnd(width))}  ${style.dim(option.desc)}`);
+  }
+}
+var style, symbols, RULE_WIDTH = 52;
+var init_ui = __esm(() => {
+  init_md_blocks();
+  style = {
+    bold: wrap(1, 22),
+    dim: wrap(2, 22),
+    red: wrap(31, 39),
+    green: wrap(32, 39),
+    yellow: wrap(33, 39),
+    cyan: wrap(36, 39),
+    gray: wrap(90, 39)
+  };
+  symbols = {
+    ok: "\u2713",
+    cross: "\u2717",
+    off: "\xB7",
+    arrow: "\u2192",
+    bullet: "\u2022"
+  };
+});
+
+// src/lib/prompt.ts
+import { stdin as input, stdout as output } from "process";
+import readline from "readline/promises";
+async function confirm(question, defaultValue = false) {
+  if (!input.isTTY) {
+    return defaultValue;
+  }
+  const suffix = defaultValue ? "Y/n" : "y/N";
+  const rl = readline.createInterface({ input, output });
+  try {
+    const answer = await rl.question(`${style.cyan(symbols.arrow)} ${question} ${style.dim(`(${suffix})`)} `);
+    const normalized = answer.trim().toLowerCase();
+    if (!normalized) {
+      return defaultValue;
+    }
+    return normalized === "y" || normalized === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function choice(question, choices, defaultValue) {
+  if (!input.isTTY) {
+    return defaultValue;
+  }
+  const rl = readline.createInterface({ input, output });
+  try {
+    const answer = await rl.question(`${style.cyan(symbols.arrow)} ${question} ${style.dim(`(${choices.join("/")}; default: ${defaultValue})`)} `);
+    const normalized = answer.trim().toLowerCase();
+    const match = choices.find((item) => item.toLowerCase() === normalized);
+    return match ?? defaultValue;
+  } finally {
+    rl.close();
+  }
+}
+var init_prompt = __esm(() => {
+  init_ui();
+});
+
 // src/commands/providers.ts
 function isProviderPlatformSupported(provider, platform = process.platform) {
   if (provider.platforms === undefined || provider.platforms.length === 0) {
@@ -987,6 +2337,82 @@ function providerApiKey(provider, env = process.env) {
   const raw = env[envKey];
   return typeof raw === "string" && raw.length > 0 ? raw : undefined;
 }
+async function testProviderConnection(provider, fetchFn = globalThis.fetch, env = process.env) {
+  const apiKey = providerApiKey(provider, env) ?? provider.apiKey;
+  return fetchOpenAiCompatModelsDetailed(fetchFn, provider, apiKey, { timeoutMs: MODELS_FETCH_TIMEOUT_MS });
+}
+function providersSharingEnvKey(envKey, excludeName, providers) {
+  return providers.filter((p) => p.envKey === envKey && p.name !== excludeName).map((p) => p.name).sort();
+}
+function sharedCredentialWarning(sharedWith, envKey) {
+  if (sharedWith.length === 0 || envKey === undefined)
+    return;
+  return `this also disconnects ${sharedWith.join(", ")} (same ${envKey})`;
+}
+function classifyProviderConnection(name, env = process.env, dir) {
+  if (customCompatProviders(dir).some((p) => p.name === name)) {
+    return { kind: "custom", sharedWith: [] };
+  }
+  if (loadShellConfig(dir).oauthGrants?.[name] !== undefined) {
+    const envKey = oauthEnvKeyFor(name);
+    const sharedWith = envKey === undefined ? [] : providersSharingEnvKey(envKey, name, allOpenAiCompatProviders(dir));
+    return { kind: "oauth-grant", ...envKey !== undefined ? { envKey } : {}, sharedWith };
+  }
+  const registry = providerByName(name, dir);
+  const envKey = registry?.envKey;
+  if (envKey === undefined) {
+    return { kind: "no-credential", sharedWith: [] };
+  }
+  const sharedWith = providersSharingEnvKey(envKey, name, allOpenAiCompatProviders(dir));
+  if (loadShellConfig(dir).apiKeys?.[envKey] !== undefined) {
+    return { kind: "saved-api-key", envKey, sharedWith };
+  }
+  const raw = env[envKey];
+  if (typeof raw === "string" && raw.length > 0) {
+    return { kind: "env-var-only", envKey, sharedWith };
+  }
+  return { kind: "no-credential", sharedWith: [] };
+}
+function disconnectProvider(name, env = process.env, dir) {
+  const classification = classifyProviderConnection(name, env, dir);
+  switch (classification.kind) {
+    case "custom":
+      removeCustomCompatProvider(name, dir);
+      removeProviderBaseUrl(name, dir);
+      removeProviderModelParams(name, dir);
+      return { ok: true, kind: "custom", sharedWith: classification.sharedWith };
+    case "oauth-grant": {
+      logoutProvider(name, dir);
+      const envKey = classification.envKey;
+      if (envKey !== undefined && savedCredentialEnvKeys().has(envKey)) {
+        delete process.env[envKey];
+      }
+      return { ok: true, kind: "oauth-grant", sharedWith: classification.sharedWith };
+    }
+    case "saved-api-key": {
+      const envKey = classification.envKey;
+      removeApiKey(envKey, dir);
+      if (savedCredentialEnvKeys().has(envKey)) {
+        delete process.env[envKey];
+      }
+      return { ok: true, kind: "saved-api-key", sharedWith: classification.sharedWith };
+    }
+    case "env-var-only":
+      return {
+        ok: false,
+        kind: "env-var-only",
+        reason: `set via ${classification.envKey} in your environment \u2014 unset ${classification.envKey} in your shell to disconnect`,
+        sharedWith: classification.sharedWith
+      };
+    case "no-credential":
+      return {
+        ok: true,
+        kind: "no-credential",
+        reason: "no saved credential for this provider \u2014 nothing to remove",
+        sharedWith: classification.sharedWith
+      };
+  }
+}
 function configuredProviders(env = process.env, dir) {
   const customNames = new Set(customCompatProviders(dir).map((provider) => provider.name));
   return allOpenAiCompatProviders(dir).filter((provider) => {
@@ -997,7 +2423,7 @@ function configuredProviders(env = process.env, dir) {
     return providerApiKey(provider, env) !== undefined || provider.apiKey !== undefined;
   }).filter((provider) => isProviderPlatformSupported(provider)).map((provider) => ({ name: provider.name, models: provider.models }));
 }
-function providersCommand(args) {
+async function providersCommand(args, deps = {}) {
   const command = args[0];
   if (!command || command === "--help" || command === "-h") {
     printProvidersHelp();
@@ -1011,10 +2437,99 @@ function providersCommand(args) {
     runCrossFamily(args.slice(1));
     return;
   }
+  if (command === "test") {
+    await runProvidersTest(args.slice(1), deps);
+    return;
+  }
+  if (command === "remove") {
+    await runProvidersRemove(args.slice(1), deps);
+    return;
+  }
   console.error(`Unknown providers command: ${command}`);
   printProvidersHelp();
   process.exitCode = 1;
 }
+async function runProvidersTest(args, deps) {
+  const name = args[0];
+  if (name === undefined || name === "--help" || name === "-h") {
+    console.error("Usage: keryx providers test <name> [--json]");
+    process.exitCode = 1;
+    return;
+  }
+  const dir = deps.dir;
+  const provider = providerByName(name, dir);
+  if (provider === undefined) {
+    console.error(`Unknown provider: ${name}`);
+    process.exitCode = 1;
+    return;
+  }
+  const env = deps.env ?? envWithOAuthAccess(envWithSavedApiKeys(process.env, dir));
+  const fetchFn = deps.fetch ?? globalThis.fetch;
+  const result = await testProviderConnection(provider, fetchFn, env);
+  const label = provider.label ?? provider.name;
+  if (args.includes("--json")) {
+    console.log(JSON.stringify({ provider: name, ok: result.source === "live", models: result.models.length, failure: result.failure ?? null }, null, 2));
+    if (result.source !== "live")
+      process.exitCode = 1;
+    return;
+  }
+  if (result.source === "live") {
+    console.log(`${label}: ok \u2014 ${result.models.length} model(s)`);
+    return;
+  }
+  console.log(modelsFailureLine(label, result.failure ?? { kind: "empty" }));
+  process.exitCode = 1;
+}
+async function runProvidersRemove(args, deps) {
+  const name = args[0];
+  if (name === undefined || name === "--help" || name === "-h") {
+    console.error("Usage: keryx providers remove <name> [--yes] [--json]");
+    process.exitCode = 1;
+    return;
+  }
+  const dir = deps.dir;
+  const env = deps.env ?? process.env;
+  const json = args.includes("--json");
+  if (providerByName(name, dir) === undefined) {
+    if (json) {
+      console.log(JSON.stringify({ provider: name, ok: false, reason: "unknown provider" }, null, 2));
+    } else {
+      console.error(`Unknown provider: ${name}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const classification = classifyProviderConnection(name, env, dir);
+  const warning = sharedCredentialWarning(classification.sharedWith, classification.envKey);
+  const yes = args.includes("--yes");
+  const confirmFn = deps.confirm ?? confirm;
+  const question = warning === undefined ? `Disconnect provider "${name}" and remove its saved credential?` : `Disconnect provider "${name}" and remove its saved credential? Note: ${warning}.`;
+  const confirmed = yes || await confirmFn(question, false);
+  if (!confirmed) {
+    if (json) {
+      console.log(JSON.stringify({ provider: name, ok: false, reason: "not confirmed", sharedWith: classification.sharedWith }, null, 2));
+    } else {
+      console.log("keryx providers remove: not confirmed \u2014 nothing was changed.");
+    }
+    if (!yes && !process.stdin.isTTY && deps.confirm === undefined)
+      process.exitCode = 1;
+    return;
+  }
+  const result = disconnectProvider(name, env, dir);
+  if (json) {
+    console.log(JSON.stringify({ provider: name, ok: result.ok, kind: result.kind, sharedWith: result.sharedWith, reason: result.reason ?? null }, null, 2));
+    if (!result.ok)
+      process.exitCode = 1;
+    return;
+  }
+  if (!result.ok) {
+    console.log(`keryx providers remove: "${name}" not removed \u2014 ${result.reason}`);
+    process.exitCode = 1;
+    return;
+  }
+  const sharedNote = sharedCredentialWarning(result.sharedWith, classification.envKey);
+  console.log(`keryx providers remove: "${name}" disconnected (${result.kind}).${sharedNote !== undefined ? ` Note: ${sharedNote}.` : ""}${result.reason !== undefined ? ` ${result.reason}` : ""}`);
+}
 function runProvidersList(args) {
   const env = envWithOAuthAccess(envWithSavedApiKeys());
   const configured = configuredProviders(env).map((provider) => ({
@@ -1098,17 +2613,38 @@ function printProvidersHelp() {
 Usage:
   keryx providers list [--json]
   keryx providers cross-family [--opt-in] [--session-provider <id>] [--session-model <id>] [--from-shell-config] [--json]
+  keryx providers test <name> [--json]
+  keryx providers remove <name> [--yes] [--json]
 
 Commands:
   list          Providers this operator has configured, and the family of each
   cross-family  Whether review can run on a different model family than authored
                 the change, and the record the round should carry
+  test          Run this provider's live model-list probe and report ok/count
+                or the failure reason. Makes ONE network call \u2014 unlike list/
+                cross-family, not network-free
+  remove        Disconnect a provider: remove its saved API key, OAuth grant,
+                or custom-provider entry. Errors on an unknown name (exit 1)
+                before asking anything. Asks for confirmation on a terminal;
+                refuses without one unless --yes. A provider whose only
+                credential is an environment variable you exported yourself
+                cannot be removed \u2014 the command names the variable to unset.
+                Some built-ins share one env var (e.g. zai/zai-coding both
+                read ZAI_API_KEY): removing either ALSO disconnects the
+                other, and both the confirmation prompt and the result name
+                every provider this affects \u2014 --json lists them under
+                sharedWith
 
 cross-family is OPT-IN: without --opt-in it reports what would happen and
 chooses single-family review. Dispatching to another provider spends tokens and
 sends the change to a second vendor, which is a decision rather than an
 optimisation. With no second family configured it reports single-family review
 with a stated reason and exits 0 \u2014 that is a normal configuration, not an error.
+
+Disconnecting a provider removes only keryx's LOCAL copy of its credential. It
+does not revoke anything at the vendor: an OAuth grant is deleted from
+auth.json only (no revoke call), and a saved API key simply stops being read \u2014
+the key itself is still valid until you revoke it yourself with the vendor.
 `);
 }
 var DEFAULT_MODELS_PATH = "/v1/models", MINIMAX_REASONING_PRESET_HOSTS, DEEPSEEK_REASONING_PRESET_HOSTS, OPENAI_COMPAT_PROVIDERS, MODELS_FETCH_TIMEOUT_MS = 1e4, MODELS_ERROR_BODY_LIMIT = 4096, BALANCE_FETCH_TIMEOUT_MS = 8000;
@@ -1116,9 +2652,11 @@ var init_providers = __esm(() => {
   init_provider_config();
   init_catalog();
   init_grants();
+  init_login();
   init_caller_session();
   init_shell_config();
   init_args();
+  init_prompt();
   MINIMAX_REASONING_PRESET_HOSTS = new Set(["api.minimax.io", "api.minimaxi.com"]);
   DEEPSEEK_REASONING_PRESET_HOSTS = new Set(["api.deepseek.com"]);
   OPENAI_COMPAT_PROVIDERS = [
@@ -45281,498 +46819,6 @@ var init_debug_log = __esm(() => {
   init_config_dir();
 });
 
-// src/lib/oauth/device-code.ts
-function requestInit(base, signal) {
-  return signal === undefined ? base : { ...base, signal };
-}
-function formHeaders(extra) {
-  return {
-    "Content-Type": "application/x-www-form-urlencoded",
-    Accept: "application/json",
-    ...extra
-  };
-}
-function positiveSecondsToMs(value, defaultMs) {
-  const seconds = Number(value);
-  return Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : defaultMs;
-}
-async function defaultSleep(ms) {
-  await new Promise((resolve) => setTimeout(resolve, ms));
-}
-function aborted(signal) {
-  return signal?.aborted === true;
-}
-function readJsonError(body) {
-  if (typeof body !== "object" || body === null) {
-    return {};
-  }
-  const rec = body;
-  return {
-    ...typeof rec.error === "string" ? { error: rec.error } : {},
-    ...typeof rec.error_description === "string" ? { error_description: rec.error_description } : {}
-  };
-}
-async function requestDeviceCode(request, http) {
-  if (aborted(http.signal)) {
-    throw new DeviceCodeError("cancelled", "device authorization was cancelled");
-  }
-  const body = new URLSearchParams({
-    client_id: request.clientId,
-    scope: request.scope,
-    ...request.extraForm
-  });
-  const response = await http.fetch(request.deviceAuthorizationEndpoint, requestInit({
-    method: "POST",
-    headers: formHeaders(request.headers),
-    body: body.toString()
-  }, http.signal));
-  const json = await response.json().catch(() => ({}));
-  if (!response.ok) {
-    const detail = readJsonError(json).error_description ?? `HTTP ${response.status}`;
-    throw new DeviceCodeError("failed", `device code request failed: ${detail}`);
-  }
-  if (typeof json !== "object" || json === null) {
-    throw new DeviceCodeError("failed", "device code response is not an object");
-  }
-  const rec = json;
-  const deviceCode = typeof rec.device_code === "string" ? rec.device_code : "";
-  const userCode = typeof rec.user_code === "string" ? rec.user_code : "";
-  const verificationUri = typeof rec.verification_uri === "string" ? rec.verification_uri : "";
-  if (deviceCode.length === 0 || userCode.length === 0 || verificationUri.length === 0) {
-    throw new DeviceCodeError("failed", "device code response is missing device_code / user_code / verification_uri");
-  }
-  if (![...userCode].every((c) => /[A-Za-z0-9-]/.test(c))) {
-    throw new DeviceCodeError("failed", "device code response has an invalid user_code");
-  }
-  const complete = typeof rec.verification_uri_complete === "string" && rec.verification_uri_complete.length > 0 ? rec.verification_uri_complete : undefined;
-  return {
-    deviceCode,
-    userCode,
-    verificationUri,
-    ...complete !== undefined ? { verificationUriComplete: complete } : {},
-    ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {},
-    ...typeof rec.interval === "number" ? { intervalSeconds: rec.interval } : {}
-  };
-}
-async function pollDeviceCodeToken(challenge, request, http) {
-  const sleep = http.sleep ?? defaultSleep;
-  const now = http.now ?? Date.now;
-  const expiresInMs = positiveSecondsToMs(challenge.expiresInSeconds, DEFAULT_EXPIRES_MS);
-  const deadline = now() + expiresInMs;
-  let intervalMs = Math.max(positiveSecondsToMs(challenge.intervalSeconds, DEFAULT_INTERVAL_MS), MIN_INTERVAL_MS);
-  while (now() < deadline) {
-    if (aborted(http.signal)) {
-      throw new DeviceCodeError("cancelled", "device authorization was cancelled");
-    }
-    const response = await http.fetch(request.tokenEndpoint, requestInit({
-      method: "POST",
-      headers: formHeaders(request.headers),
-      body: new URLSearchParams({
-        grant_type: DEVICE_CODE_GRANT_TYPE,
-        client_id: request.clientId,
-        device_code: challenge.deviceCode,
-        ...request.extraForm
-      }).toString()
-    }, http.signal));
-    const json = await response.json().catch(() => ({}));
-    if (typeof json === "object" && json !== null && typeof json.access_token === "string") {
-      const rec = json;
-      return {
-        accessToken: rec.access_token,
-        ...typeof rec.refresh_token === "string" && rec.refresh_token.length > 0 ? { refreshToken: rec.refresh_token } : {},
-        ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {},
-        ...typeof rec.scope === "string" ? { scope: rec.scope } : {},
-        ...typeof rec.id_token === "string" ? { idToken: rec.id_token } : {}
-      };
-    }
-    const { error, error_description } = readJsonError(json);
-    const remaining = Math.max(0, deadline - now());
-    if (error === "authorization_pending") {
-      await sleep(Math.min(intervalMs + POLL_SAFETY_MARGIN_MS, remaining));
-      continue;
-    }
-    if (error === "slow_down") {
-      intervalMs += SLOW_DOWN_INCREMENT_MS;
-      await sleep(Math.min(intervalMs + POLL_SAFETY_MARGIN_MS, remaining));
-      continue;
-    }
-    if (error === "access_denied" || error === "authorization_denied") {
-      throw new DeviceCodeError("access_denied", "device authorization was denied");
-    }
-    if (error === "expired_token") {
-      throw new DeviceCodeError("expired_token", "device code expired");
-    }
-    if (!response.ok) {
-      throw new DeviceCodeError("failed", `device token exchange failed (${response.status})${error_description ? `: ${error_description}` : ""}`);
-    }
-    throw new DeviceCodeError("failed", `device token exchange failed${error_description ? `: ${error_description}` : ""}`);
-  }
-  throw new DeviceCodeError("timeout", "device authorization timed out");
-}
-async function refreshAccessToken(request, http) {
-  const response = await http.fetch(request.tokenEndpoint, requestInit({
-    method: "POST",
-    headers: formHeaders(request.headers),
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: request.refreshToken,
-      client_id: request.clientId,
-      ...request.extraForm
-    }).toString()
-  }, http.signal));
-  const json = await response.json().catch(() => ({}));
-  if (!response.ok || typeof json !== "object" || json === null || typeof json.access_token !== "string") {
-    const detail = readJsonError(json).error_description ?? `HTTP ${response.status}`;
-    throw new DeviceCodeError("failed", `token refresh failed: ${detail}`);
-  }
-  const rec = json;
-  return {
-    accessToken: rec.access_token,
-    refreshToken: typeof rec.refresh_token === "string" && rec.refresh_token.length > 0 ? rec.refresh_token : request.refreshToken,
-    ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {},
-    ...typeof rec.scope === "string" ? { scope: rec.scope } : {},
-    ...typeof rec.id_token === "string" ? { idToken: rec.id_token } : {}
-  };
-}
-var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code", DEFAULT_INTERVAL_MS = 5000, MIN_INTERVAL_MS = 1000, SLOW_DOWN_INCREMENT_MS = 5000, DEFAULT_EXPIRES_MS, POLL_SAFETY_MARGIN_MS = 3000, DeviceCodeError;
-var init_device_code = __esm(() => {
-  DEFAULT_EXPIRES_MS = 5 * 60 * 1000;
-  DeviceCodeError = class DeviceCodeError extends Error {
-    kind;
-    constructor(kind, message) {
-      super(message);
-      this.name = "DeviceCodeError";
-      this.kind = kind;
-    }
-  };
-});
-
-// src/lib/oauth/copilot.ts
-function copilotApiBaseFromExchange(raw) {
-  if (typeof raw !== "string" || raw.length === 0) {
-    return;
-  }
-  try {
-    const url = new URL(raw);
-    if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0) {
-      return;
-    }
-    const host = url.hostname;
-    if (host !== "api.githubcopilot.com" && !host.endsWith(".githubcopilot.com")) {
-      return;
-    }
-    return `https://${host}${url.port.length > 0 ? `:${url.port}` : ""}`;
-  } catch {
-    return;
-  }
-}
-function expiresInSecondsFrom(rec, now) {
-  if (typeof rec.expires_at === "string") {
-    const expires = Date.parse(rec.expires_at);
-    if (Number.isFinite(expires)) {
-      return Math.max(1, Math.floor((expires - now) / 1000));
-    }
-  }
-  if (typeof rec.expires_at === "number" && Number.isFinite(rec.expires_at)) {
-    const expiresMs = rec.expires_at < 1000000000000 ? rec.expires_at * 1000 : rec.expires_at;
-    return Math.max(1, Math.floor((expiresMs - now) / 1000));
-  }
-  if (typeof rec.refresh_in === "number" && Number.isFinite(rec.refresh_in) && rec.refresh_in > 0) {
-    return Math.floor(rec.refresh_in);
-  }
-  return;
-}
-function describeExchangeFailure(status, json, body) {
-  if (typeof json === "object" && json !== null) {
-    const rec = json;
-    if (rec.error_details?.copilot_access_denied === true) {
-      return `GitHub Copilot token exchange failed (HTTP ${status}): Copilot access denied \u2014 check the GitHub Copilot subscription on this account`;
-    }
-    if (typeof rec.message === "string" && rec.message.length > 0) {
-      return `GitHub Copilot token exchange failed (HTTP ${status}): ${rec.message}`;
-    }
-  }
-  if (/zscaler|blocked because it does not comply/i.test(body)) {
-    return `GitHub Copilot token exchange failed (HTTP ${status}): request was blocked by a gateway or proxy`;
-  }
-  return `GitHub Copilot token exchange failed (HTTP ${status})`;
-}
-async function exchangeGithubTokenForCopilot(githubToken, http) {
-  const init = {
-    method: "GET",
-    headers: {
-      ...GITHUB_COPILOT_REQUEST_HEADERS,
-      Authorization: `token ${githubToken}`
-    }
-  };
-  if (http.signal !== undefined) {
-    init.signal = http.signal;
-  }
-  const response = await http.fetch(COPILOT_TOKEN_URL, init);
-  const body = await response.text().catch(() => "");
-  let json = {};
-  if (body.length > 0) {
-    try {
-      json = JSON.parse(body);
-    } catch {
-      json = {};
-    }
-  }
-  if (!response.ok || typeof json !== "object" || json === null) {
-    throw new DeviceCodeError("failed", describeExchangeFailure(response.status, json, body));
-  }
-  const rec = json;
-  if (typeof rec.token !== "string" || rec.token.length === 0) {
-    throw new DeviceCodeError("failed", "GitHub Copilot token exchange returned no token");
-  }
-  const expiresInSeconds = expiresInSecondsFrom(rec, Date.now());
-  const apiBaseUrl = copilotApiBaseFromExchange(rec.endpoints?.api);
-  return {
-    accessToken: rec.token,
-    ...expiresInSeconds !== undefined ? { expiresInSeconds } : {},
-    ...apiBaseUrl !== undefined ? { apiBaseUrl } : {}
-  };
-}
-var COPILOT_TOKEN_URL = "https://api.github.com/copilot_internal/v2/token";
-var init_copilot = __esm(() => {
-  init_catalog();
-  init_device_code();
-});
-
-// src/lib/oauth/openai-codex.ts
-function withSignal(base, signal) {
-  return signal === undefined ? base : { ...base, signal };
-}
-async function requestCodexDeviceCode(http) {
-  const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/api/accounts/deviceauth/usercode`, withSignal({
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "keryx" },
-    body: JSON.stringify({ client_id: OPENAI_CODEX_CLIENT_ID })
-  }, http.signal));
-  const json = await response.json().catch(() => ({}));
-  if (!response.ok || typeof json !== "object" || json === null) {
-    throw new DeviceCodeError("failed", `ChatGPT device authorization failed (HTTP ${response.status})`);
-  }
-  const rec = json;
-  if (typeof rec.device_auth_id !== "string" || typeof rec.user_code !== "string") {
-    throw new DeviceCodeError("failed", "ChatGPT device authorization is missing device_auth_id / user_code");
-  }
-  const intervalSeconds = Number(rec.interval);
-  return {
-    deviceAuthId: rec.device_auth_id,
-    userCode: rec.user_code,
-    verificationUri: `${OPENAI_CODEX_ISSUER}/codex/device`,
-    intervalMs: Number.isFinite(intervalSeconds) && intervalSeconds > 0 ? intervalSeconds * 1000 : 5000
-  };
-}
-async function pollCodexDeviceToken(challenge, http) {
-  const sleep = http.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-  const now = http.now ?? Date.now;
-  const deadline = now() + 5 * 60 * 1000;
-  while (now() < deadline) {
-    if (http.signal?.aborted === true) {
-      throw new DeviceCodeError("cancelled", "device authorization was cancelled");
-    }
-    const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/api/accounts/deviceauth/token`, withSignal({
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "keryx" },
-      body: JSON.stringify({ device_auth_id: challenge.deviceAuthId, user_code: challenge.userCode })
-    }, http.signal));
-    if (response.ok) {
-      const data = await response.json();
-      if (typeof data.authorization_code !== "string" || typeof data.code_verifier !== "string") {
-        throw new DeviceCodeError("failed", "ChatGPT device token is missing authorization_code");
-      }
-      return exchangeCodexAuthorizationCode(data.authorization_code, data.code_verifier, http);
-    }
-    if (response.status !== 403 && response.status !== 404) {
-      throw new DeviceCodeError("failed", `ChatGPT device token poll failed (HTTP ${response.status})`);
-    }
-    await sleep(challenge.intervalMs + POLL_SAFETY_MARGIN_MS2);
-  }
-  throw new DeviceCodeError("timeout", "ChatGPT device authorization timed out");
-}
-async function exchangeCodexAuthorizationCode(code, codeVerifier, http) {
-  const response = await http.fetch(`${OPENAI_CODEX_ISSUER}/oauth/token`, withSignal({
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: `${OPENAI_CODEX_ISSUER}/deviceauth/callback`,
-      client_id: OPENAI_CODEX_CLIENT_ID,
-      code_verifier: codeVerifier
-    }).toString()
-  }, http.signal));
-  const json = await response.json().catch(() => ({}));
-  if (!response.ok || typeof json !== "object" || json === null || typeof json.access_token !== "string") {
-    throw new DeviceCodeError("failed", `ChatGPT token exchange failed (HTTP ${response.status})`);
-  }
-  const rec = json;
-  return {
-    accessToken: rec.access_token,
-    ...typeof rec.refresh_token === "string" ? { refreshToken: rec.refresh_token } : {},
-    ...typeof rec.expires_in === "number" ? { expiresInSeconds: rec.expires_in } : {}
-  };
-}
-var OPENAI_CODEX_ISSUER = "https://auth.openai.com", OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", POLL_SAFETY_MARGIN_MS2 = 3000;
-var init_openai_codex = __esm(() => {
-  init_device_code();
-});
-
-// src/lib/oauth/login.ts
-function httpOf(input) {
-  return {
-    fetch: input.fetch,
-    ...input.sleep !== undefined ? { sleep: input.sleep } : {},
-    ...input.now !== undefined ? { now: input.now } : {},
-    ...input.signal !== undefined ? { signal: input.signal } : {}
-  };
-}
-function present(challenge, provider) {
-  return {
-    userCode: challenge.userCode,
-    verificationUri: challenge.verificationUri,
-    ...challenge.verificationUriComplete !== undefined ? { verificationUriComplete: challenge.verificationUriComplete } : {},
-    instructions: `Open ${challenge.verificationUri} and enter code: ${challenge.userCode} (${deviceCodeMethodLabel(provider)})`
-  };
-}
-async function loginRfc8628(input) {
-  const endpoints = input.provider === "github-copilot" ? GITHUB_COPILOT_DEVICE : XAI_GROK_DEVICE;
-  const http = httpOf(input);
-  const challenge = await requestDeviceCode({
-    deviceAuthorizationEndpoint: endpoints.deviceAuthorizationEndpoint,
-    clientId: endpoints.clientId,
-    scope: endpoints.scope,
-    ...endpoints.extraForm !== undefined ? { extraForm: endpoints.extraForm } : {},
-    ...endpoints.headers !== undefined ? { headers: endpoints.headers } : {}
-  }, http);
-  input.onChallenge(present(challenge, input.provider));
-  const tokens = await pollDeviceCodeToken(challenge, {
-    tokenEndpoint: endpoints.tokenEndpoint,
-    clientId: endpoints.clientId,
-    ...endpoints.headers !== undefined ? { headers: endpoints.headers } : {}
-  }, http);
-  if (endpoints.afterToken === "github-copilot") {
-    const copilot = await exchangeGithubTokenForCopilot(tokens.accessToken, http);
-    if (copilot.apiBaseUrl !== undefined) {
-      saveProviderBaseUrl("github-copilot", copilot.apiBaseUrl, input.dir);
-    }
-    return {
-      accessToken: copilot.accessToken,
-      refreshToken: tokens.accessToken,
-      ...copilot.expiresInSeconds !== undefined ? { expiresInSeconds: copilot.expiresInSeconds } : {}
-    };
-  }
-  return tokens;
-}
-async function loginDeviceCode(input) {
-  const entry = authCatalogEntry(input.provider);
-  if (entry === undefined) {
-    return { ok: false, error: `unknown provider: ${input.provider}` };
-  }
-  if (!entry.methods.includes("device-code")) {
-    const refusal = catalogRefusal(input.provider);
-    if (refusal !== undefined) {
-      return { ok: false, error: refusal, refused: true };
-    }
-    return { ok: false, error: `${input.provider} does not support device authorization` };
-  }
-  try {
-    const tokens = input.provider === "openai" ? await loginCodex(input) : await loginRfc8628(input);
-    saveOAuthGrant(input.provider, grantFromTokens("device-code", tokens, input.now), input.dir);
-    return { ok: true, provider: input.provider };
-  } catch (err) {
-    const message = err instanceof DeviceCodeError ? err.message : err instanceof Error ? err.message : "device authorization failed";
-    return { ok: false, error: message };
-  }
-}
-async function loginCodex(input) {
-  const http = httpOf(input);
-  const challenge = await requestCodexDeviceCode(http);
-  input.onChallenge(present({
-    userCode: challenge.userCode,
-    verificationUri: challenge.verificationUri
-  }, "openai"));
-  return pollCodexDeviceToken(challenge, http);
-}
-async function refreshProviderGrant(provider, http, dir) {
-  const grant = loadOAuthGrant(provider, dir);
-  if (grant === undefined || !grantNeedsRefresh(grant, http.now)) {
-    return grant;
-  }
-  if (grant.refresh === undefined) {
-    return grant;
-  }
-  const endpoints = provider === "github-copilot" ? GITHUB_COPILOT_DEVICE : XAI_GROK_DEVICE;
-  if (provider === "github-copilot") {
-    const copilot = await exchangeGithubTokenForCopilot(grant.refresh, http);
-    if (copilot.apiBaseUrl !== undefined) {
-      saveProviderBaseUrl("github-copilot", copilot.apiBaseUrl, dir);
-    }
-    const next = grantFromTokens("device-code", {
-      accessToken: copilot.accessToken,
-      refreshToken: grant.refresh,
-      ...copilot.expiresInSeconds !== undefined ? { expiresInSeconds: copilot.expiresInSeconds } : {}
-    }, http.now);
-    next.lastRefreshedAt = new Date((http.now ?? Date.now)()).toISOString();
-    saveOAuthGrant(provider, next, dir);
-    return next;
-  }
-  if (provider === "openai") {
-    return grant;
-  }
-  const tokens = await refreshAccessToken({
-    tokenEndpoint: endpoints.tokenEndpoint,
-    clientId: endpoints.clientId,
-    refreshToken: grant.refresh,
-    ...endpoints.headers !== undefined ? { headers: endpoints.headers } : {}
-  }, http);
-  const next = grantFromTokens("device-code", tokens, http.now);
-  next.lastRefreshedAt = new Date((http.now ?? Date.now)()).toISOString();
-  saveOAuthGrant(provider, next, dir);
-  return next;
-}
-async function refreshSavedGrants(http, dir, providers = SESSION_REFRESHED_GRANTS) {
-  const warnings = [];
-  const now = http.now ?? Date.now;
-  for (const provider of providers) {
-    if (!SESSION_REFRESHED_GRANTS.includes(provider))
-      continue;
-    const grant = loadOAuthGrant(provider, dir);
-    if (grant === undefined)
-      continue;
-    if (grant.refresh === undefined || grant.refresh.length === 0) {
-      if (grant.expires !== undefined && grant.expires <= now()) {
-        warnings.push(`${provider}: the saved login has expired and holds no refresh token. Run \`keryx auth login ${provider}\`.`);
-      }
-      continue;
-    }
-    if (!grantNeedsRefresh(grant, http.now))
-      continue;
-    try {
-      await refreshProviderGrant(provider, http, dir);
-    } catch (cause) {
-      const reason = cause instanceof Error ? cause.message : String(cause);
-      warnings.push(`${provider}: the saved login is expiring or expired and could not be refreshed (${reason}). ` + `Run \`keryx auth login ${provider}\`.`);
-    }
-  }
-  return warnings;
-}
-function logoutProvider(provider, dir) {
-  deleteOAuthGrant(provider, dir);
-}
-var SESSION_REFRESHED_GRANTS;
-var init_login = __esm(() => {
-  init_shell_config();
-  init_catalog();
-  init_copilot();
-  init_device_code();
-  init_grants();
-  init_openai_codex();
-  SESSION_REFRESHED_GRANTS = ["grok", "github-copilot"];
-});
-
 // src/tui/debug-watcher.ts
 import { spawn as spawn6, spawnSync as spawnSync4 } from "child_process";
 import { closeSync as closeSync5, constants as constants4, openSync as openSync6, readdirSync as readdirSync5, readFileSync as readFileSync15, readlinkSync as readlinkSync3, statSync as statSync12 } from "fs";
@@ -46531,786 +47577,8 @@ function sanitizeForDisplay(value) {
   return out;
 }
 
-// src/lib/ui.ts
-import { stdout } from "process";
-
-// src/lib/md-blocks.ts
-var FENCE_LINE = /^[ \t]{0,3}(```|~~~)(.*)\r?$/;
-var HUNK_HEADER = /^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/;
-var MARKDOWN_LANGS = new Set(["md", "markdown", "prompt"]);
-var DIFF_LANGS = new Set(["diff", "patch"]);
-function stripTrailingCr(line) {
-  return line.endsWith("\r") ? line.slice(0, -1) : line;
-}
-function splitLines(text) {
-  return text.split(`
-`).map(stripTrailingCr);
-}
-function markdownTableCells(line) {
-  const source = line.trim();
-  if (!source.includes("|")) {
-    return;
-  }
-  const cells = [];
-  let cell = "";
-  let inCode = false;
-  for (let index = 0;index < source.length; index += 1) {
-    const char = source[index] ?? "";
-    if (char === "\\" && source[index + 1] === "|") {
-      cell += "|";
-      index += 1;
-      continue;
-    }
-    if (char === "`") {
-      inCode = !inCode;
-      cell += char;
-      continue;
-    }
-    if (char === "|" && !inCode) {
-      cells.push(cell.trim());
-      cell = "";
-      continue;
-    }
-    cell += char;
-  }
-  cells.push(cell.trim());
-  if (source.startsWith("|")) {
-    cells.shift();
-  }
-  if (source.endsWith("|")) {
-    cells.pop();
-  }
-  return cells.length >= 2 ? cells : undefined;
-}
-function tableAlignments(line, columns) {
-  const cells = markdownTableCells(line);
-  if (cells === undefined || cells.length !== columns) {
-    return;
-  }
-  const alignments = [];
-  for (const cell of cells) {
-    const marker = cell.trim();
-    if (!/^:?-{3,}:?$/.test(marker)) {
-      return;
-    }
-    alignments.push(marker.startsWith(":") && marker.endsWith(":") ? "center" : marker.endsWith(":") ? "right" : "left");
-  }
-  return alignments;
-}
-function parseMarkdownTables(text) {
-  if (text.length === 0) {
-    return [];
-  }
-  const lines = splitLines(text);
-  const parts = [];
-  let proseStart = 0;
-  const flushProse = (end) => {
-    if (end <= proseStart) {
-      return;
-    }
-    const prose = lines.slice(proseStart, end).join(`
-`);
-    if (prose.length > 0) {
-      parts.push({ kind: "prose", text: prose });
-    }
-  };
-  for (let index = 0;index + 1 < lines.length; index += 1) {
-    const headers = markdownTableCells(lines[index] ?? "");
-    if (headers === undefined) {
-      continue;
-    }
-    const alignments = tableAlignments(lines[index + 1] ?? "", headers.length);
-    if (alignments === undefined) {
-      continue;
-    }
-    flushProse(index);
-    const rows = [];
-    let cursor = index + 2;
-    while (cursor < lines.length) {
-      const row = markdownTableCells(lines[cursor] ?? "");
-      if (row === undefined || row.length !== headers.length) {
-        break;
-      }
-      rows.push(row);
-      cursor += 1;
-    }
-    parts.push({ kind: "table", table: { headers, alignments, rows } });
-    proseStart = cursor;
-    index = cursor - 1;
-  }
-  flushProse(lines.length);
-  return parts.length > 0 ? parts : [{ kind: "prose", text }];
-}
-function fenceInfo(line) {
-  const match = FENCE_LINE.exec(line);
-  if (match === null) {
-    return;
-  }
-  return { marker: match[1] ?? "", lang: (match[2] ?? "").trim().split(/\s+/)[0] ?? "" };
-}
-function segmentMarkdown(md) {
-  const segments = [];
-  let text = [];
-  let code;
-  let lang = "";
-  let marker = "";
-  const flushText = () => {
-    const joined = text.join(`
-`);
-    text = [];
-    if (joined.length > 0) {
-      segments.push({ kind: "text", text: joined });
-    }
-  };
-  for (const line of splitLines(md)) {
-    const fence = fenceInfo(line);
-    if (code === undefined) {
-      if (fence === undefined) {
-        text.push(line);
-        continue;
-      }
-      flushText();
-      marker = fence.marker;
-      lang = fence.lang;
-      code = [];
-      continue;
-    }
-    if (fence?.marker === marker) {
-      segments.push({ kind: "code", lang, body: code.join(`
-`) });
-      code = undefined;
-      continue;
-    }
-    code.push(line);
-  }
-  if (code === undefined) {
-    flushText();
-  } else {
-    segments.push({ kind: "code", lang, body: code.join(`
-`) });
-  }
-  return segments;
-}
-function classifyDiffLine(line) {
-  if (line.startsWith("@@")) {
-    return "hunk";
-  }
-  if (line.startsWith("---") || line.startsWith("+++")) {
-    return "meta";
-  }
-  if (line.startsWith("+")) {
-    return "add";
-  }
-  if (line.startsWith("-")) {
-    return "del";
-  }
-  return "context";
-}
-function looksLikeUnifiedDiff(text) {
-  const lines = splitLines(text);
-  for (const [index, line] of lines.entries()) {
-    if (HUNK_HEADER.test(line)) {
-      return true;
-    }
-    if (line.startsWith("--- ") && (lines[index + 1]?.startsWith("+++ ") ?? false)) {
-      return true;
-    }
-  }
-  return false;
-}
-var CODE_LANG_ALIASES = {
-  js: "javascript",
-  mjs: "javascript",
-  cjs: "javascript",
-  jsx: "javascript",
-  ts: "typescript",
-  tsx: "typescript",
-  py: "python",
-  py3: "python",
-  sh: "bash",
-  shell: "bash",
-  zsh: "bash",
-  console: "bash",
-  yml: "yaml",
-  rb: "ruby",
-  rs: "rust",
-  kt: "kotlin",
-  cs: "csharp",
-  "c++": "cpp",
-  cc: "cpp",
-  cxx: "cpp",
-  hpp: "cpp"
-};
-var GENERIC_KEYWORDS = new Set([
-  "if",
-  "else",
-  "for",
-  "while",
-  "return",
-  "function",
-  "class",
-  "const",
-  "let",
-  "var",
-  "import",
-  "export",
-  "from",
-  "true",
-  "false",
-  "null",
-  "new",
-  "this",
-  "try",
-  "catch",
-  "throw",
-  "switch",
-  "case",
-  "break",
-  "continue",
-  "default",
-  "static",
-  "public",
-  "private"
-]);
-var CODE_LANG_KEYWORDS = {
-  javascript: new Set([
-    ...GENERIC_KEYWORDS,
-    "async",
-    "await",
-    "yield",
-    "typeof",
-    "instanceof",
-    "in",
-    "of",
-    "void",
-    "undefined",
-    "super",
-    "extends",
-    "finally",
-    "do",
-    "delete"
-  ]),
-  typescript: new Set([
-    ...GENERIC_KEYWORDS,
-    "async",
-    "await",
-    "yield",
-    "typeof",
-    "instanceof",
-    "in",
-    "of",
-    "void",
-    "undefined",
-    "super",
-    "extends",
-    "implements",
-    "interface",
-    "type",
-    "enum",
-    "namespace",
-    "declare",
-    "readonly",
-    "abstract",
-    "as",
-    "satisfies",
-    "finally",
-    "do",
-    "delete"
-  ]),
-  python: new Set([
-    "def",
-    "return",
-    "if",
-    "elif",
-    "else",
-    "for",
-    "while",
-    "break",
-    "continue",
-    "class",
-    "import",
-    "from",
-    "as",
-    "try",
-    "except",
-    "finally",
-    "raise",
-    "with",
-    "lambda",
-    "yield",
-    "pass",
-    "None",
-    "True",
-    "False",
-    "and",
-    "or",
-    "not",
-    "in",
-    "is",
-    "global",
-    "nonlocal",
-    "assert",
-    "async",
-    "await",
-    "del",
-    "self"
-  ]),
-  bash: new Set([
-    "if",
-    "then",
-    "else",
-    "elif",
-    "fi",
-    "for",
-    "while",
-    "do",
-    "done",
-    "case",
-    "esac",
-    "function",
-    "return",
-    "local",
-    "export",
-    "exit",
-    "break",
-    "continue",
-    "in",
-    "select",
-    "until"
-  ]),
-  go: new Set([
-    "func",
-    "return",
-    "if",
-    "else",
-    "for",
-    "range",
-    "switch",
-    "case",
-    "default",
-    "break",
-    "continue",
-    "package",
-    "import",
-    "var",
-    "const",
-    "type",
-    "struct",
-    "interface",
-    "map",
-    "chan",
-    "go",
-    "defer",
-    "select",
-    "fallthrough",
-    "nil",
-    "true",
-    "false"
-  ]),
-  rust: new Set([
-    "fn",
-    "let",
-    "mut",
-    "return",
-    "if",
-    "else",
-    "for",
-    "while",
-    "loop",
-    "match",
-    "struct",
-    "enum",
-    "impl",
-    "trait",
-    "pub",
-    "use",
-    "mod",
-    "crate",
-    "self",
-    "Self",
-    "super",
-    "const",
-    "static",
-    "async",
-    "await",
-    "move",
-    "ref",
-    "dyn",
-    "where",
-    "unsafe",
-    "true",
-    "false",
-    "None",
-    "Some",
-    "Ok",
-    "Err"
-  ]),
-  json: new Set(["true", "false", "null"])
-};
-function codeCommentPrefix(normalizedLang) {
-  switch (normalizedLang) {
-    case "javascript":
-    case "typescript":
-    case "go":
-    case "rust":
-    case "java":
-    case "c":
-    case "cpp":
-    case "csharp":
-    case "swift":
-    case "kotlin":
-    case "scala":
-    case "php":
-      return "//";
-    case "python":
-    case "bash":
-    case "ruby":
-    case "yaml":
-    case "toml":
-    case "r":
-    case "perl":
-      return "#";
-    case "sql":
-    case "lua":
-    case "haskell":
-      return "--";
-    default:
-      return "";
-  }
-}
-function normalizeCodeLang(lang) {
-  const key = lang.trim().toLowerCase();
-  return CODE_LANG_ALIASES[key] ?? key;
-}
-var CODE_WORD_OR_NUMBER = /[A-Za-z_$][A-Za-z0-9_$]*|\d+(?:\.\d+)?/g;
-function tokenizeCodeWords(text, keywords) {
-  const tokens = [];
-  let last = 0;
-  CODE_WORD_OR_NUMBER.lastIndex = 0;
-  let m;
-  while ((m = CODE_WORD_OR_NUMBER.exec(text)) !== null) {
-    if (m.index > last) {
-      tokens.push({ kind: "plain", text: text.slice(last, m.index) });
-    }
-    const word = m[0];
-    if (/^[0-9]/.test(word)) {
-      tokens.push({ kind: "number", text: word });
-    } else if (keywords.has(word)) {
-      tokens.push({ kind: "keyword", text: word });
-    } else {
-      tokens.push({ kind: "plain", text: word });
-    }
-    last = m.index + word.length;
-  }
-  if (last < text.length) {
-    tokens.push({ kind: "plain", text: text.slice(last) });
-  }
-  return tokens;
-}
-function tokenizeCodeLine(line, lang) {
-  const normalized = normalizeCodeLang(lang);
-  const keywords = CODE_LANG_KEYWORDS[normalized] ?? GENERIC_KEYWORDS;
-  const commentPrefix = codeCommentPrefix(normalized);
-  const tokens = [];
-  let plainBuf = "";
-  const flushPlain = () => {
-    if (plainBuf.length > 0) {
-      tokens.push(...tokenizeCodeWords(plainBuf, keywords));
-      plainBuf = "";
-    }
-  };
-  let i = 0;
-  while (i < line.length) {
-    if (commentPrefix.length > 0 && line.startsWith(commentPrefix, i)) {
-      flushPlain();
-      tokens.push({ kind: "comment", text: line.slice(i) });
-      break;
-    }
-    const ch = line[i];
-    if (ch === '"' || ch === "'" || ch === "`") {
-      flushPlain();
-      let j = i + 1;
-      while (j < line.length && line[j] !== ch) {
-        j += line[j] === "\\" ? 2 : 1;
-      }
-      j = Math.min(j + 1, line.length);
-      tokens.push({ kind: "string", text: line.slice(i, j) });
-      i = j;
-      continue;
-    }
-    plainBuf += ch;
-    i += 1;
-  }
-  flushPlain();
-  return tokens;
-}
-function payloadKind(lang, _lineCount) {
-  const normalized = lang.toLowerCase();
-  if (MARKDOWN_LANGS.has(normalized)) {
-    return "markdown";
-  }
-  if (DIFF_LANGS.has(normalized)) {
-    return "diff";
-  }
-  return "code";
-}
-function blockLabel({ kind, lineCount, collapsed, hint }) {
-  const marker = collapsed ? "\u25B8" : "\u25BE";
-  const unit = lineCount === 1 ? "line" : "lines";
-  const suffix = hint !== undefined && hint.length > 0 ? ` \xB7 ${hint}` : "";
-  return `${marker} ${kind} (${lineCount} ${unit})${suffix}`;
-}
-function summarizeSubmittedLine(line) {
-  const normalized = line.replace(/\r\n/g, `
-`).replace(/\r/g, `
-`);
-  const nonEmpty = normalized.split(`
-`).filter((linePart) => linePart.length > 0);
-  if (nonEmpty.length <= 1) {
-    return line;
-  }
-  const [first, ...rest] = nonEmpty;
-  return `${first} [+ ${rest.length} pasted line${rest.length === 1 ? "" : "s"}]`;
-}
-function isZeroWidth(cp) {
-  return cp >= 768 && cp <= 879 || cp >= 8203 && cp <= 8207 || cp >= 65024 && cp <= 65039 || cp >= 8288 && cp <= 8292;
-}
-var WIDE_RANGES = [
-  [4352, 4447],
-  [11904, 12350],
-  [12353, 13311],
-  [13312, 19903],
-  [19968, 40959],
-  [40960, 42191],
-  [44032, 55203],
-  [63744, 64255],
-  [65072, 65135],
-  [65280, 65376],
-  [65504, 65510],
-  [127744, 128591],
-  [129280, 129535],
-  [131072, 262141]
-];
-function codePointWidth(cp) {
-  for (const [lo, hi] of WIDE_RANGES) {
-    if (cp >= lo && cp <= hi) {
-      return 2;
-    }
-  }
-  return 1;
-}
-function visualWidth(text) {
-  let width = 0;
-  for (const ch of text) {
-    const codePoint = ch.codePointAt(0) ?? 0;
-    if (isZeroWidth(codePoint)) {
-      continue;
-    }
-    width += codePointWidth(codePoint);
-  }
-  return width;
-}
-function hugWidth(text, chrome) {
-  const lines = splitLines(text.replace(/\n+$/, ""));
-  let widest = 0;
-  for (const line of lines) {
-    widest = Math.max(widest, visualWidth(line));
-  }
-  return widest + chrome;
-}
-
-// src/lib/ui.ts
-function colorEnabled() {
-  if (process.env.NO_COLOR !== undefined) {
-    return false;
-  }
-  if (process.env.FORCE_COLOR !== undefined) {
-    return true;
-  }
-  return Boolean(stdout.isTTY);
-}
-function wrap(open, close) {
-  return (text) => colorEnabled() ? `\x1B[${open}m${text}\x1B[${close}m` : text;
-}
-var style = {
-  bold: wrap(1, 22),
-  dim: wrap(2, 22),
-  red: wrap(31, 39),
-  green: wrap(32, 39),
-  yellow: wrap(33, 39),
-  cyan: wrap(36, 39),
-  gray: wrap(90, 39)
-};
-var symbols = {
-  ok: "\u2713",
-  cross: "\u2717",
-  off: "\xB7",
-  arrow: "\u2192",
-  bullet: "\u2022"
-};
-var RULE_WIDTH = 52;
-function banner(title, subtitle) {
-  const rule = style.cyan("\u2501".repeat(RULE_WIDTH));
-  console.log(rule);
-  console.log(`  ${style.bold(title)}`);
-  if (subtitle) {
-    console.log(`  ${style.dim(subtitle)}`);
-  }
-  console.log(rule);
-}
-function heading(title, emit = console.log) {
-  emit(`
-${style.bold(style.cyan(title))}`);
-}
-function statusLine(label, enabled, detail) {
-  const marker = enabled ? style.green(symbols.ok) : style.gray(symbols.off);
-  const name = enabled ? label : style.gray(label);
-  const suffix = detail ? style.dim(` (${detail})`) : "";
-  console.log(`  ${marker} ${name}${suffix}`);
-}
-function nextSteps(steps) {
-  if (steps.length === 0) {
-    return;
-  }
-  heading("Next steps");
-  for (const step of steps) {
-    console.log(`  ${style.cyan(symbols.arrow)} ${step}`);
-  }
-}
-function note(message) {
-  console.log(`  ${style.dim(message)}`);
-}
-function renderInline(text) {
-  const withCode = text.replace(/`([^`]+)`/g, (_match, code) => style.gray(code));
-  return withCode.replace(/\*\*([^*]+)\*\*/g, (_match, bold) => style.bold(bold));
-}
-function renderTextLine(line) {
-  const heading = /^#{1,6}\s+(.*)$/.exec(line);
-  if (heading !== null) {
-    return style.bold(style.cyan(heading[1] ?? ""));
-  }
-  const bullet = /^(\s*)[-*]\s+(.*)$/.exec(line);
-  if (bullet !== null) {
-    return `${bullet[1] ?? ""}${style.cyan(symbols.bullet)} ${renderInline(bullet[2] ?? "")}`;
-  }
-  return renderInline(line);
-}
-function renderDiff(text) {
-  if (!colorEnabled()) {
-    return text;
-  }
-  return splitLines(text).map((line) => {
-    switch (classifyDiffLine(line)) {
-      case "add":
-        return style.green(line);
-      case "del":
-        return style.red(line);
-      case "hunk":
-        return style.cyan(line);
-      case "meta":
-        return style.dim(line);
-      default:
-        return line;
-    }
-  }).join(`
-`);
-}
-function renderCodeSegment(lang, body) {
-  const lines = body.split(`
-`);
-  const out = [];
-  if (lang.length > 0) {
-    out.push(style.dim(lang));
-  }
-  if (payloadKind(lang, lines.length) === "diff" || looksLikeUnifiedDiff(body)) {
-    out.push(renderDiff(body));
-    return out;
-  }
-  for (const line of lines) {
-    out.push(style.gray(line));
-  }
-  return out;
-}
-function renderMarkdown(md) {
-  if (!colorEnabled()) {
-    return md;
-  }
-  const out = [];
-  for (const segment of segmentMarkdown(md)) {
-    if (segment.kind === "code") {
-      out.push(...renderCodeSegment(segment.lang, segment.body));
-      continue;
-    }
-    for (const line of segment.text.split(`
-`)) {
-      out.push(renderTextLine(line));
-    }
-  }
-  return out.join(`
-`);
-}
-function collapseToolOutput(text, maxWidth = 100) {
-  const trimmed = text.replace(/\r?\n+$/, "");
-  const lines = trimmed.length === 0 ? [] : splitLines(trimmed);
-  const firstNonEmpty = lines.find((line) => line.trim().length > 0) ?? "";
-  const summary = firstNonEmpty.length > maxWidth ? `${firstNonEmpty.slice(0, maxWidth)}\u2026` : firstNonEmpty;
-  const lineCount = lines.length;
-  return { summary, lineCount, hidden: Math.max(0, lineCount - 1) };
-}
-function indentBlock(text, pad) {
-  return text.split(`
-`).map((line) => line.length > 0 ? pad + line : line).join(`
-`);
-}
-function summarizeToolArgs(input, max = 80) {
-  const clip = (s) => s.length > max ? `${s.slice(0, max)}\u2026` : s;
-  const raw = input.trim();
-  if (raw.length === 0) {
-    return "";
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return clip(raw);
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return clip(raw);
-  }
-  const parts = [];
-  for (const [key, value] of Object.entries(parsed)) {
-    let shown;
-    if (value === null) {
-      shown = "null";
-    } else if (Array.isArray(value)) {
-      shown = "[\u2026]";
-    } else if (typeof value === "object") {
-      shown = "{\u2026}";
-    } else {
-      shown = String(value);
-    }
-    parts.push(`${key}=${shown}`);
-  }
-  return clip(parts.join(", "));
-}
-function helpTitle(command, summary) {
-  console.log(`${style.bold(command)} ${style.dim(`\u2014 ${summary}`)}`);
-}
-function helpUsage(lines) {
-  heading("Usage");
-  for (const line of lines) {
-    console.log(`  ${style.cyan(line)}`);
-  }
-}
-function helpOptions(options) {
-  heading("Options");
-  const width = Math.max(...options.map((option) => option.flag.length));
-  for (const option of options) {
-    console.log(`  ${style.cyan(option.flag.padEnd(width))}  ${style.dim(option.desc)}`);
-  }
-}
-
 // src/commands/projects.ts
+init_ui();
 async function projectsCommand(args = []) {
   const sub = args[0];
   if (args.includes("--help") || args.includes("-h") || sub === "help") {
@@ -47512,40 +47780,9 @@ var GDGRAPH_CORE_SOURCES = [
   "types.ts"
 ];
 
-// src/lib/prompt.ts
-import { stdin as input, stdout as output } from "process";
-import readline from "readline/promises";
-async function confirm(question, defaultValue = false) {
-  if (!input.isTTY) {
-    return defaultValue;
-  }
-  const suffix = defaultValue ? "Y/n" : "y/N";
-  const rl = readline.createInterface({ input, output });
-  try {
-    const answer = await rl.question(`${style.cyan(symbols.arrow)} ${question} ${style.dim(`(${suffix})`)} `);
-    const normalized = answer.trim().toLowerCase();
-    if (!normalized) {
-      return defaultValue;
-    }
-    return normalized === "y" || normalized === "yes";
-  } finally {
-    rl.close();
-  }
-}
-async function choice(question, choices, defaultValue) {
-  if (!input.isTTY) {
-    return defaultValue;
-  }
-  const rl = readline.createInterface({ input, output });
-  try {
-    const answer = await rl.question(`${style.cyan(symbols.arrow)} ${question} ${style.dim(`(${choices.join("/")}; default: ${defaultValue})`)} `);
-    const normalized = answer.trim().toLowerCase();
-    const match = choices.find((item) => item.toLowerCase() === normalized);
-    return match ?? defaultValue;
-  } finally {
-    rl.close();
-  }
-}
+// src/commands/init.ts
+init_prompt();
+init_ui();
 
 // src/lib/project-sandbox-policy.ts
 init_paths();
@@ -53009,7 +53246,7 @@ import path47 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.159",
+  version: "0.2.161",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -61452,6 +61689,9 @@ function normalizeRouteText(value) {
   return value.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim();
 }
 
+// src/commands/skills.ts
+init_ui();
+
 // src/gdskills/learn.ts
 init_fs();
 init_json();
@@ -66038,9 +66278,10 @@ init_github();
 init_flow_move();
 init_service7();
 init_guard2();
+init_ui();
+init_machine();
 import { randomInt } from "crypto";
 import path155 from "path";
-init_machine();
 
 // src/flow/types.ts
 var ATTEMPT_CLI_OUTCOMES = ["started", "failed", "blocked"];
@@ -67281,6 +67522,7 @@ function createJobService(deps) {
 }
 
 // src/commands/job.ts
+init_ui();
 function positional2(args, index) {
   const value = args[index];
   return value === undefined || value.startsWith("--") ? undefined : value;
@@ -73906,6 +74148,7 @@ Options:
 }
 
 // src/commands/standard.ts
+init_ui();
 import { mkdir as mkdir59, writeFile as writeFile49 } from "fs/promises";
 import path166 from "path";
 
@@ -74308,15 +74551,15 @@ function extractCapabilities(manifest) {
 
 // src/standard/help-groups.ts
 var HELP_GROUP_ORDER = [
-  { name: "Start here", slug: "start-here" },
-  { name: "Connect a model provider", slug: "connect" },
-  { name: "Look and feel", slug: "look-and-feel" },
-  { name: "Working in keryx shell", slug: "shell-work" },
-  { name: "Project knowledge", slug: "project-knowledge" },
-  { name: "Managed work", slug: "managed-work" },
-  { name: "Automation", slug: "automation" },
-  { name: "External agents, ACP and MCP", slug: "external-agents" },
-  { name: "Maintenance and diagnostics", slug: "maintenance" }
+  { name: "Start here", slug: "start-here", tab: "Start", tabShort: "Start" },
+  { name: "Connect a model provider", slug: "connect", tab: "Connect", tabShort: "Conn" },
+  { name: "Look and feel", slug: "look-and-feel", tab: "Look", tabShort: "Look" },
+  { name: "Working in keryx shell", slug: "shell-work", tab: "Shell", tabShort: "Shell" },
+  { name: "Project knowledge", slug: "project-knowledge", tab: "Knowledge", tabShort: "Know" },
+  { name: "Managed work", slug: "managed-work", tab: "Work", tabShort: "Work" },
+  { name: "Automation", slug: "automation", tab: "Automate", tabShort: "Auto" },
+  { name: "External agents, ACP and MCP", slug: "external-agents", tab: "Agents", tabShort: "Agents" },
+  { name: "Maintenance and diagnostics", slug: "maintenance", tab: "Maintain", tabShort: "Maint" }
 ];
 var HELP_GROUPS = [
   { kind: "cli", name: "init", group: "Start here", summary: "Initialize .metaproject in the current project." },
@@ -74346,7 +74589,7 @@ var HELP_GROUPS = [
     group: "Connect a model provider",
     summary: "Providers this operator has configured, and cross-family review eligibility."
   },
-  { kind: "slash", name: "/connect", group: "Connect a model provider", summary: "Switch provider / API key." },
+  { kind: "slash", name: "/connect", group: "Connect a model provider", summary: "Switch provider; row buttons test/disconnect it." },
   {
     kind: "slash",
     name: "/search-provider",
@@ -74762,15 +75005,29 @@ function renderEntryRows(entries, maxColumns) {
   }
   return rows;
 }
+var SHELL_SUBHEADING = "  in keryx shell:";
+function renderGroupLines(group, maxColumns) {
+  const cliEntries = entriesInGroup(group.name, "cli");
+  const slashEntries = entriesInGroup(group.name, "slash");
+  if (cliEntries.length === 0 && slashEntries.length === 0) {
+    return [];
+  }
+  const lines = [`${group.name}:`];
+  lines.push(...renderEntryRows(cliEntries, maxColumns));
+  if (slashEntries.length > 0) {
+    lines.push(SHELL_SUBHEADING);
+    lines.push(...renderEntryRows(slashEntries, maxColumns));
+  }
+  return lines;
+}
 function renderGroupedCliHelp(maxColumns = HELP_DEFAULT_COLUMNS) {
   const lines = [];
   for (const group of HELP_GROUP_ORDER) {
-    const entries = entriesInGroup(group.name, "cli");
-    if (entries.length === 0) {
+    const groupLines = renderGroupLines(group, maxColumns);
+    if (groupLines.length === 0) {
       continue;
     }
-    lines.push(`${group.name}:`);
-    lines.push(...renderEntryRows(entries, maxColumns));
+    lines.push(...groupLines);
     lines.push("");
   }
   return lines.join(`
@@ -74778,8 +75035,7 @@ function renderGroupedCliHelp(maxColumns = HELP_DEFAULT_COLUMNS) {
 `);
 }
 function renderCliGroupHelp(group, maxColumns = HELP_DEFAULT_COLUMNS) {
-  const entries = entriesInGroup(group.name, "cli");
-  const lines = [`${group.name}:`, ...renderEntryRows(entries, maxColumns)];
+  const lines = renderGroupLines(group, maxColumns);
   return lines.join(`
 `) + `
 `;
@@ -74798,12 +75054,12 @@ function renderGroupedNamedHelp(options, maxColumns) {
 `) + `
 `;
 }
-function renderEntryDetail(entry) {
-  const lines = [`${entry.name}`, "", entry.summary, ""];
+function renderEntryDetail(entry, maxColumns = HELP_DEFAULT_COLUMNS) {
+  const lines = [`${entry.name}`, "", ...wrapWords(entry.summary, maxColumns), ""];
   if (entry.kind === "slash") {
-    lines.push("This is a keryx shell command \u2014 type it inside `keryx shell` (readline chat/agent mode, or the", "TUI's `/`-menu). It has no standalone CLI form.");
+    lines.push(...wrapWords("This is a keryx shell command \u2014 type it inside `keryx shell` (readline chat/agent mode, or " + "the TUI's `/`-menu). It has no standalone CLI form.", maxColumns));
   } else {
-    lines.push(`Run \`keryx ${entry.name} --help\` (or \`keryx help ${entry.name}\`) for its full usage.`);
+    lines.push(...wrapWords(`Run \`keryx ${entry.name} --help\` (or \`keryx help ${entry.name}\`) for its full usage.`, maxColumns));
   }
   return lines.join(`
 `) + `
@@ -76561,13 +76817,14 @@ Usage:
 }
 
 // src/commands/security.ts
-import { mkdir as mkdir60, readdir as readdir33, readFile as readFile96, writeFile as writeFile50 } from "fs/promises";
-import path168 from "path";
-import { fileURLToPath as fileURLToPath7 } from "url";
+init_ui();
 init_args();
 init_contained_path();
 init_fs();
 init_json();
+import { mkdir as mkdir60, readdir as readdir33, readFile as readFile96, writeFile as writeFile50 } from "fs/promises";
+import path168 from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/security/detect/mcp.ts
 import { createHash as createHash31 } from "crypto";
@@ -77906,8 +78163,10 @@ async function sandboxCommand(args = [], deps = {}) {
 
 // src/commands/mcp.ts
 init_args();
+init_ui();
 
 // src/commands/integrate.ts
+init_ui();
 import path170 from "path";
 var EDITOR_USAGE = `<cursor|claude|opencode|vscode|generic|all>`;
 var DEFAULT_EDITORS = ["all"];
@@ -81231,6 +81490,7 @@ function positional3(args) {
 
 // src/commands/serve-mcp.ts
 init_args();
+init_ui();
 import path183 from "path";
 
 // src/mcp/discovery.ts
@@ -99820,6 +100080,7 @@ async function approveExternalSpawn(request) {
 init_caller_session();
 
 // src/lib/statusbar.ts
+init_ui();
 import { homedir as homedir10 } from "os";
 var ESC = "\x1B";
 var CSI = `${ESC}[`;
@@ -100821,6 +101082,7 @@ function boldChunk(otui, text) {
 }
 
 // src/tui/transcript-blocks.ts
+init_md_blocks();
 var EVICTED_BLOCK_TEXT = "(output no longer retained)";
 var UNKNOWN_BLOCK_TEXT = "(no such block)";
 var TRUNCATED_BLOCK_NOTICE = "\u2026 (output truncated at the retention cap)";
@@ -109997,7 +110259,32 @@ function openSessionInfo(otui, chrome, options) {
 // src/tui/help-modal.ts
 var HELP_MODAL_TITLE = "/help";
 var HELP_MODAL_KEYS = "keys: \u2191/\u2193 select \xB7 enter details \xB7 \u2190/\u2192 tabs \xB7 esc close";
-var HELP_MODAL_TABS = HELP_GROUP_ORDER.map((g) => ({ id: g.slug, label: g.name }));
+var HELP_MODAL_TABS = HELP_GROUP_ORDER.map((g) => ({ id: g.slug, label: g.tab }));
+var HELP_MODAL_TABS_SHORT = HELP_GROUP_ORDER.map((g) => ({ id: g.slug, label: g.tabShort }));
+function tabStripWidth(labels) {
+  return labels.reduce((total, label, i) => total + label.length + 2 + (i === 0 ? 0 : 1), 0);
+}
+var READABLE_TAB_STRIP_WIDTH = tabStripWidth(HELP_MODAL_TABS.map((t) => t.label));
+function pickTabs(chrome, options) {
+  let cols;
+  let rows;
+  if (options.renderer !== undefined) {
+    cols = options.renderer.width;
+    rows = options.renderer.height;
+  } else {
+    const c = chrome;
+    if (c?.renderer !== undefined) {
+      cols = resolveModalAvailableWidth(c);
+      rows = c.renderer.height;
+    }
+  }
+  if (typeof cols !== "number" || typeof rows !== "number") {
+    return HELP_MODAL_TABS_SHORT;
+  }
+  const panelWidth = Math.min(cols, resolveModalPanelSize(cols, rows).width);
+  const innerWidth = panelWidth - MODAL_PANEL_CHROME_X;
+  return READABLE_TAB_STRIP_WIDTH <= innerWidth ? HELP_MODAL_TABS : HELP_MODAL_TABS_SHORT;
+}
 function entriesForGroup(group) {
   return [...entriesInGroup(group.name, "cli"), ...entriesInGroup(group.name, "slash")];
 }
@@ -110010,9 +110297,10 @@ function openHelpModal(otui, chrome, options) {
   const core = otui;
   const r = chrome?.renderer;
   const bodyRows = bodyRowsFor2(chrome, options);
+  const tabs = pickTabs(chrome, options);
   const states = new Map(HELP_GROUP_ORDER.map((group) => [
     group.slug,
-    { entries: entriesForGroup(group), selected: 0, detail: false, scroll: 0 }
+    { groupName: group.name, entries: entriesForGroup(group), selected: 0, detail: false, scroll: 0 }
   ]));
   let width;
   let bodyNode;
@@ -110020,23 +110308,29 @@ function openHelpModal(otui, chrome, options) {
   const keys = {};
   const host = {};
   const activeState = () => {
-    const id = host.handle?.activeTab() ?? (HELP_MODAL_TABS[0]?.id ?? "");
+    const id = host.handle?.activeTab() ?? (tabs[0]?.id ?? "");
     const existing = states.get(id);
     if (existing !== undefined) {
       return existing;
     }
-    const fallback = { entries: [], selected: 0, detail: false, scroll: 0 };
+    const fallback = { groupName: "", entries: [], selected: 0, detail: false, scroll: 0 };
     states.set(id, fallback);
     return fallback;
   };
   const tabLines = (state) => {
+    const heading = `${state.groupName}:`;
     if (state.entries.length === 0) {
-      return [HELP_MODAL_KEYS, "", "(no commands in this group)"];
+      return [heading, HELP_MODAL_KEYS, "", "(no commands in this group)"];
     }
     if (state.detail) {
       const entry = state.entries[state.selected];
-      return [HELP_MODAL_KEYS, "", ...entry === undefined ? ["(nothing selected)"] : wrapLines(renderEntryDetail(entry), width).split(`
-`)];
+      return [
+        heading,
+        HELP_MODAL_KEYS,
+        "",
+        ...entry === undefined ? ["(nothing selected)"] : wrapLines(renderEntryDetail(entry), width).split(`
+`)
+      ];
     }
     const rows = state.entries.map((entry, i) => {
       const marker = i === state.selected ? ">" : " ";
@@ -110045,7 +110339,7 @@ function openHelpModal(otui, chrome, options) {
 `).join(`
 `);
     });
-    return [HELP_MODAL_KEYS, "", ...rows];
+    return [heading, HELP_MODAL_KEYS, "", ...rows];
   };
   const paint = () => {
     if (closed) {
@@ -110054,7 +110348,7 @@ function openHelpModal(otui, chrome, options) {
     const state = activeState();
     const lines = tabLines(state);
     if (!state.detail) {
-      state.scroll = scrollToReveal(state.selected + 2, state.scroll, bodyRows);
+      state.scroll = scrollToReveal(state.selected + 3, state.scroll, bodyRows);
     }
     state.scroll = clampScroll(state.scroll, lines.length, bodyRows);
     if (bodyNode !== undefined) {
@@ -110065,7 +110359,7 @@ function openHelpModal(otui, chrome, options) {
   const initialTab = options.initialGroupSlug !== undefined && groupBySlug(options.initialGroupSlug) !== undefined ? options.initialGroupSlug : undefined;
   const handle = openModal(core, chrome, {
     title: HELP_MODAL_TITLE,
-    tabs: HELP_MODAL_TABS,
+    tabs,
     ...initialTab !== undefined ? { initialTab } : {},
     footer: [
       { key: "\u2191/\u2193", label: "select" },
@@ -111179,6 +111473,8 @@ function openGamesModal(otui, chrome, options = {}) {
 }
 // src/tui/tui-shell.ts
 init_providers();
+init_ui();
+init_md_blocks();
 init_patch_risk();
 init_catalog();
 init_grants();
@@ -112083,6 +112379,13 @@ function stepQueueNavAction(selected, direction) {
   const nextIdx = direction === "left" ? idx > 0 ? idx - 1 : count - 1 : idx < count - 1 ? idx + 1 : 0;
   return QUEUE_NAV_ACTIONS[nextIdx];
 }
+var CONNECT_NAV_ACTIONS = ["label", "test", "disconnect"];
+function stepConnectNavAction(selected, direction) {
+  const idx = CONNECT_NAV_ACTIONS.indexOf(selected);
+  const count = CONNECT_NAV_ACTIONS.length;
+  const nextIdx = direction === "left" ? idx > 0 ? idx - 1 : count - 1 : idx < count - 1 ? idx + 1 : 0;
+  return CONNECT_NAV_ACTIONS[nextIdx];
+}
 
 // src/tui/worker-fleet.ts
 var STATUS_GLYPH2 = {
@@ -117653,6 +117956,28 @@ function modelPickerNotice(label, result) {
   }
   return modelsFailureLine(label, result.failure);
 }
+function smallActionButton(otui, r, label, id, color, onMouseDown) {
+  const box = new otui.BoxRenderable(r, {
+    id,
+    flexShrink: 0,
+    marginLeft: 1,
+    paddingLeft: 1,
+    paddingRight: 1,
+    onMouseDown: (event) => {
+      event.stopPropagation();
+      onMouseDown();
+    }
+  });
+  const text = new otui.TextRenderable(r, { id: `${id}-t`, content: `[${label}]` });
+  text.fg = color;
+  box.add(text);
+  const setActive = (active) => {
+    box.backgroundColor = active ? getTheme().highlight : undefined;
+    text.content = active ? otui.t`${boldChunk(otui, `[${label}]`)}` : `[${label}]`;
+    text.fg = color;
+  };
+  return { box, setActive };
+}
 function pickProviderStep(otui, target, detected) {
   const r = stepRenderer(target);
   return new Promise((resolve) => {
@@ -117691,6 +118016,221 @@ function pickProviderStep(otui, target, detected) {
     });
   });
 }
+function pickConnectedProviderStep(otui, target, detected, opts) {
+  const r = stepRenderer(target);
+  return new Promise((resolve) => {
+    let rows = [...detected];
+    let selectedIndex = 0;
+    let selectedAction = "label";
+    let pendingDisconnect;
+    let resolved = false;
+    let rowBlocks = [];
+    const labelOf = (d) => d.label ?? d.name;
+    const noteOf = (d) => d.note ?? `${d.models.length} model(s)`;
+    const unsubEscapeGuard = onKeypress4(r, (key) => {
+      if (resolved || key.name !== "escape" || pendingDisconnect === undefined)
+        return;
+      clearPending();
+      applyHighlight();
+      key.preventDefault();
+      key.stopPropagation();
+    });
+    const surface = openStepSurface(otui, target, {
+      id: "connect-picker",
+      title: "Connected providers",
+      tab: "Providers",
+      hint: "(\u2191/\u2193 row \xB7 \u2190/\u2192 Label/Test/Disconnect \xB7 Enter \xB7 Esc to cancel)",
+      footer: [
+        { key: "\u2191/\u2193", label: "row" },
+        { key: "\u2190/\u2192", label: "Label/Test/Disconnect" },
+        { key: "Enter", label: "select/run" },
+        { key: "esc", label: "cancel" }
+      ],
+      contentRows: selectBoxHeight(Math.max(rows.length, 1), true),
+      onEscape: () => finish(undefined)
+    });
+    const body = surface.body;
+    function finish(value) {
+      if (resolved)
+        return;
+      resolved = true;
+      unsubEscapeGuard();
+      unsub();
+      surface.close();
+      resolve(value);
+    }
+    function clearPending() {
+      if (pendingDisconnect === undefined)
+        return;
+      const armed = rowBlocks.find((b) => b.name === pendingDisconnect);
+      pendingDisconnect = undefined;
+      if (armed !== undefined)
+        armed.status.content = "";
+    }
+    function applyHighlight() {
+      for (let i = 0;i < rowBlocks.length; i++) {
+        const block = rowBlocks[i];
+        if (block === undefined)
+          continue;
+        const active = i === selectedIndex;
+        block.outer.backgroundColor = active ? getTheme().highlight : undefined;
+        block.labelText.content = active && selectedAction === "label" ? otui.t`${boldChunk(otui, `${labelOf(rows[i])}`)}  ${dimChunk(otui, noteOf(rows[i]))}` : otui.t`${labelOf(rows[i])}  ${dimChunk(otui, noteOf(rows[i]))}`;
+        block.test.setActive(active && selectedAction === "test");
+        block.disconnect.setActive(active && selectedAction === "disconnect");
+      }
+    }
+    async function runTest(name) {
+      const block = rowBlocks.find((b) => b.name === name);
+      const provider = providerByName(name, opts.configDir);
+      if (block === undefined)
+        return;
+      if (provider === undefined) {
+        block.status.content = otui.t`${roleChunk(otui, "error", "\u2717")} unknown provider \u2014 cannot test`;
+        return;
+      }
+      block.status.content = otui.t`${dimChunk(otui, "testing\u2026")}`;
+      const result = await testProviderConnection(provider, opts.fetch ?? globalThis.fetch, opts.env ?? process.env);
+      const current = rowBlocks.find((b) => b.name === name);
+      if (current === undefined || resolved)
+        return;
+      current.status.content = result.source === "live" ? otui.t`${roleChunk(otui, "ok", "\u2713")} ok \u2014 ${String(result.models.length)} model(s)` : otui.t`${roleChunk(otui, "error", "\u2717")} ${modelsFailureLine(labelOf(rows.find((d) => d.name === name) ?? { name, models: [] }), result.failure ?? { kind: "empty" })}`;
+    }
+    function armOrConfirmDisconnect(name) {
+      const block = rowBlocks.find((b) => b.name === name);
+      if (block === undefined)
+        return;
+      if (pendingDisconnect !== name) {
+        clearPending();
+        pendingDisconnect = name;
+        const env = opts.env ?? process.env;
+        const classification = classifyProviderConnection(name, env, opts.configDir);
+        const warning = sharedCredentialWarning(classification.sharedWith, classification.envKey);
+        const label = labelOf(rows.find((d) => d.name === name) ?? { name, models: [] });
+        block.status.content = warning === undefined ? otui.t`${roleChunk(otui, "attention", "?")} disconnect '${label}'? ${dimChunk(otui, "click/Enter Disconnect again to confirm, Esc to cancel")}` : otui.t`${roleChunk(otui, "attention", "?")} disconnect '${label}'? ${roleChunk(otui, "attention", `Note: ${warning}.`)} ${dimChunk(otui, "click/Enter Disconnect again to confirm, Esc to cancel")}`;
+        return;
+      }
+      pendingDisconnect = undefined;
+      const result = disconnectProvider(name, opts.env ?? process.env, opts.configDir);
+      if (!result.ok) {
+        block.status.content = otui.t`${roleChunk(otui, "error", "\u2717")} not removed \u2014 ${result.reason ?? "unknown reason"}`;
+        return;
+      }
+      opts.onDisconnected?.(name, result.sharedWith);
+      rows = rows.filter((d) => d.name !== name);
+      paint();
+    }
+    function paint() {
+      for (const block of rowBlocks) {
+        try {
+          body.remove(block.outer);
+        } catch {}
+      }
+      rowBlocks = [];
+      if (rows.length === 0) {
+        finish(undefined);
+        return;
+      }
+      selectedIndex = clampQueueNavIndex(selectedIndex, rows.length);
+      for (let i = 0;i < rows.length; i++) {
+        const d = rows[i];
+        const outer = new otui.BoxRenderable(r, { id: `cp-${d.name}`, width: "100%", flexDirection: "column" });
+        const row = new otui.BoxRenderable(r, { id: `cp-${d.name}-row`, width: "100%", flexDirection: "row" });
+        const labelText = new otui.TextRenderable(r, {
+          id: `cp-${d.name}-label-t`,
+          content: otui.t`${labelOf(d)}  ${dimChunk(otui, noteOf(d))}`
+        });
+        const label = new otui.BoxRenderable(r, {
+          id: `cp-${d.name}-label`,
+          flexGrow: 1,
+          minWidth: 0,
+          onMouseDown: (event) => {
+            event.stopPropagation();
+            clearPending();
+            selectedIndex = i;
+            selectedAction = "label";
+            finish(d);
+          }
+        });
+        label.add(labelText);
+        row.add(label);
+        const test = smallActionButton(otui, r, "Test", `cp-test-${d.name}`, getTheme().focus, () => {
+          clearPending();
+          selectedIndex = i;
+          selectedAction = "test";
+          applyHighlight();
+          runTest(d.name);
+        });
+        const disconnect = smallActionButton(otui, r, "Disconnect", `cp-disc-${d.name}`, getTheme().error, () => {
+          selectedIndex = i;
+          selectedAction = "disconnect";
+          applyHighlight();
+          armOrConfirmDisconnect(d.name);
+        });
+        row.add(test.box);
+        row.add(disconnect.box);
+        outer.add(row);
+        const status = new otui.TextRenderable(r, { id: `cp-${d.name}-status`, content: "", marginLeft: 1 });
+        outer.add(status);
+        body.add(outer);
+        rowBlocks.push({ name: d.name, outer, label, labelText, status, test, disconnect });
+      }
+      applyHighlight();
+    }
+    const unsub = onKeypress4(r, (key) => {
+      if (resolved)
+        return;
+      if (key.name === "up") {
+        clearPending();
+        selectedIndex = stepQueueNavIndex(selectedIndex, rows.length, "up");
+        applyHighlight();
+        key.preventDefault();
+        key.stopPropagation();
+        return;
+      }
+      if (key.name === "down") {
+        clearPending();
+        selectedIndex = stepQueueNavIndex(selectedIndex, rows.length, "down");
+        applyHighlight();
+        key.preventDefault();
+        key.stopPropagation();
+        return;
+      }
+      if (key.name === "left") {
+        clearPending();
+        selectedAction = stepConnectNavAction(selectedAction, "left");
+        applyHighlight();
+        key.preventDefault();
+        key.stopPropagation();
+        return;
+      }
+      if (key.name === "right") {
+        clearPending();
+        selectedAction = stepConnectNavAction(selectedAction, "right");
+        applyHighlight();
+        key.preventDefault();
+        key.stopPropagation();
+        return;
+      }
+      if (key.name === "return" || key.name === "linefeed" || key.name === "kpenter") {
+        const row = rows[selectedIndex];
+        if (row === undefined)
+          return;
+        if (selectedAction === "label") {
+          clearPending();
+          finish(row);
+        } else if (selectedAction === "test") {
+          clearPending();
+          runTest(row.name);
+        } else {
+          armOrConfirmDisconnect(row.name);
+        }
+        key.preventDefault();
+        key.stopPropagation();
+      }
+    });
+    paint();
+  });
+}
 function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
   return new Promise((resolve) => {
     if (detected.length === 0) {
@@ -117709,7 +118249,12 @@ function selectProviderModelInTui(otui, rOrChrome, detected, options = {}) {
       }
       const allCandidates = options.onlyConnected ? candidates : [...candidates, CUSTOM_ADD_ENTRY];
       while (true) {
-        const prov = await pickProviderStep(otui, rOrChrome, allCandidates);
+        const prov = options.onlyConnected ? await pickConnectedProviderStep(otui, rOrChrome, allCandidates, {
+          ...options.fetch !== undefined ? { fetch: options.fetch } : {},
+          ...options.env !== undefined ? { env: options.env } : {},
+          ...options.configDir !== undefined ? { configDir: options.configDir } : {},
+          ...options.onDisconnected !== undefined ? { onDisconnected: options.onDisconnected } : {}
+        }) : await pickProviderStep(otui, rOrChrome, allCandidates);
         if (prov === undefined) {
           resolve(undefined);
           return;
@@ -119793,28 +120338,7 @@ Staying in the current session.
     let selectedQueueAction = "force";
     chrome.addOverlaySource(() => queueNavActive);
     let mainQueueBlocks = [];
-    const mainQueueButton = (label, id, color, onMouseDown) => {
-      const box = new otui.BoxRenderable(r, {
-        id,
-        flexShrink: 0,
-        marginLeft: 1,
-        paddingLeft: 1,
-        paddingRight: 1,
-        onMouseDown: (event) => {
-          event.stopPropagation();
-          onMouseDown();
-        }
-      });
-      const text = new otui.TextRenderable(r, { id: `${id}-t`, content: `[${label}]` });
-      text.fg = color;
-      box.add(text);
-      const setActive = (active) => {
-        box.backgroundColor = active ? getTheme().highlight : undefined;
-        text.content = active ? otui.t`${boldChunk(otui, `[${label}]`)}` : `[${label}]`;
-        text.fg = color;
-      };
-      return { box, setActive };
-    };
+    const mainQueueButton = (label, id, color, onMouseDown) => smallActionButton(otui, r, label, id, color, onMouseDown);
     const applyQueueNavHighlight = () => {
       for (let i = 0;i < mainQueueBlocks.length; i++) {
         const entry = mainQueueBlocks[i];
@@ -120711,7 +121235,20 @@ Usage: /reasoning <${REASONING_EFFORT_LEVELS.join("|")}>
         if (command.name === "/connect" || command.name === "/provider") {
           (async () => {
             const detected = opts.redetect !== undefined ? await opts.redetect() : opts.detected;
-            const ns = await chrome.withOverlay(() => command.name === "/connect" ? selectProviderModelInTui(otui, chrome, detected, { onlyConnected: true, env: process.env }) : selectProviderModelInTui(otui, chrome, detected));
+            const ns = await chrome.withOverlay(() => command.name === "/connect" ? selectProviderModelInTui(otui, chrome, detected, {
+              onlyConnected: true,
+              env: process.env,
+              onDisconnected: (name, sharedWith) => {
+                if (sharedWith.length > 0) {
+                  io.onSystem?.(`\u25C7 ${name} disconnected \u2014 this also disconnected: ${sharedWith.join(", ")}.
+`);
+                }
+                if (name === currentSel.provider) {
+                  io.onSystem?.(`\u25C7 ${name} disconnected \u2014 this session keeps its already-loaded credential until you /connect another provider or restart.
+`);
+                }
+              }
+            }) : selectProviderModelInTui(otui, chrome, detected));
             if (ns !== undefined) {
               await switchTo(ns);
             } else if (command.name === "/connect") {
@@ -121055,6 +121592,7 @@ Usage: /reasoning <${REASONING_EFFORT_LEVELS.join("|")}>
 
 // src/tui/chat-shell.ts
 init_shell_config();
+init_md_blocks();
 var TURN_SEPARATOR = `
 
 `;
@@ -121452,6 +121990,8 @@ async function launchTuiChatShell(opts) {
 init_shell_config();
 init_patch_risk();
 init_permission_mode();
+init_ui();
+init_md_blocks();
 init_agent();
 init_slate_lifecycle();
 init_slate_lifecycle();
@@ -126528,9 +127068,11 @@ most one CLI-origin pause lease can be active in the clone at a time.
 
 // src/commands/modules.ts
 init_fs();
+init_prompt();
 import { readFile as readFile110 } from "fs/promises";
 import { stdin } from "process";
 import path224 from "path";
+init_ui();
 var MODULES = [
   { name: "gdgraph", flag: "--no-gdgraph", desc: "code graph, symbols, affected context", defaultEnabled: true },
   { name: "gdctx", flag: "--no-gdctx", desc: "token-aware command/read output", defaultEnabled: true },
@@ -127777,6 +128319,7 @@ function assembleSubmitTurn(profile, dir, seams = {}) {
 }
 
 // src/commands/serve.ts
+init_ui();
 function parseArgs3(args, valueFlags, booleanFlags) {
   const values = new Map;
   const flags = new Set;
@@ -128254,6 +128797,7 @@ init_templates2();
 init_templates();
 init_fs();
 init_git_hooks();
+init_ui();
 init_templates3();
 async function updateCommand(args = []) {
   const options = parseUpdateArgs(args);
@@ -129495,6 +130039,7 @@ function printHelp22() {
 import { spawn as spawn8 } from "child_process";
 import path229 from "path";
 init_args();
+init_ui();
 async function dashboardCommand(args = []) {
   const options = parseOptions(args);
   const subcommand = options.positionals[0];
@@ -129811,6 +130356,7 @@ ${settled.stderr}` };
 
 // src/commands/agents-external.ts
 init_args();
+init_ui();
 function describeAvailability(entry, availability) {
   if (availability.state === "not-probed") {
     return "not probed \u2014 run `keryx agents external probe " + entry.id + "`";
@@ -130174,6 +130720,7 @@ function reduceAgents(events) {
 
 // src/commands/agents.ts
 init_args();
+init_ui();
 var RUNTIME_USAGE = "<claude|opencode|zcode|codex|antigravity|all>";
 async function agentsCommand(args = []) {
   const subcommand = args[0];
@@ -133407,6 +133954,8 @@ var USAGE_BODY = `Usage:
   keryx sync install-hooks | uninstall-hooks
   keryx providers list [--json]
   keryx providers cross-family [--opt-in] [--json]
+  keryx providers test <name> [--json]
+  keryx providers remove <name> [--yes] [--json]
   keryx auth list [--json]
   keryx auth login <provider>
   keryx auth logout <provider>