@phantomcodes/cli 1.0.0 → 1.1.1

package/LICENSE

@@ -1,6 +1,6 @@
 Phantom Proprietary License
 
-Copyright (c) 2026 Connor Tessaro. All rights reserved.
+Copyright (c) 2026 Harbor Financial LLC. All rights reserved.
 
 This license covers the Phantom source code, the Phantom website, and the
 Phantom CLI command-line tool ("the CLI"), together "the Software". It
@@ -8,7 +8,7 @@ applies to every copy of the Software that carries this file.
 
 1. Ownership
 
-   Connor Tessaro owns all right, title and interest in the Software,
+   Harbor Financial LLC owns all right, title and interest in the Software,
    including all copyrights and other intellectual property rights. Nothing
    in this license transfers ownership to you.
 
@@ -16,7 +16,7 @@ applies to every copy of the Software that carries this file.
 
    This license grants no rights in the Phantom source code, including the
    code behind the website. You may not use, copy, modify or distribute any
-   part of it unless Connor Tessaro gives you written permission. The only
+   part of it unless Harbor Financial LLC gives you written permission. The only
    permission this license grants is the one in section 3, and it covers the
    CLI alone. Visiting phantom.codes and using the Phantom service are
    governed by the terms of service at phantom.codes/terms, not by this
@@ -24,7 +24,7 @@ applies to every copy of the Software that carries this file.
 
 3. Limited permission for the Phantom CLI
 
-   If you got the CLI from Connor Tessaro's official release (the
+   If you got the CLI from Harbor Financial LLC's official release (the
    @phantomcodes/cli package on npm), you may install and run unmodified
    copies of it, only to access the Phantom service. This permission is
    revocable, non-exclusive, non-transferable and non-sublicensable.
@@ -46,14 +46,14 @@ applies to every copy of the Software that carries this file.
 5. Confidentiality
 
    The non-public parts of the Software, including its source code, routing
-   logic and design, are Connor Tessaro's trade secrets. If you see them, you
-   must keep them confidential and use them only as Connor Tessaro allows in
+   logic and design, are Harbor Financial LLC's trade secrets. If you see them, you
+   must keep them confidential and use them only as Harbor Financial LLC allows in
    writing.
 
 6. Termination
 
    This license, and any permission under section 3, ends automatically if
-   you break any of its terms. Connor Tessaro may also end the section 3
+   you break any of its terms. Harbor Financial LLC may also end the section 3
    permission at any time. When it ends, you must stop using the Software and
    destroy all copies you have.
 
@@ -65,10 +65,10 @@ applies to every copy of the Software that carries this file.
 
 8. Limitation of liability
 
-   TO THE FULLEST EXTENT THE LAW ALLOWS, CONNOR TESSARO IS NOT LIABLE FOR ANY
+   TO THE FULLEST EXTENT THE LAW ALLOWS, HARBOR FINANCIAL LLC IS NOT LIABLE FOR ANY
    INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR
    ANY LOSS OF DATA, PROFITS OR REVENUE, ARISING FROM THE SOFTWARE OR THIS
-   LICENSE. HIS TOTAL LIABILITY UNDER THIS LICENSE IS LIMITED TO THE AMOUNT
+   LICENSE. ITS TOTAL LIABILITY UNDER THIS LICENSE IS LIMITED TO THE AMOUNT
    YOU PAID FOR THE SOFTWARE, IF ANY.
 
 9. Governing law

package/README.md

@@ -132,6 +132,45 @@ Prefer a specific model? Select it in your agent. Policies that apply only to
 `auto` leave explicit model choices alone.
 [Routing](docs/guides/routing.md) covers conditions, fallback and conversation affinity.
 
+`phantom-1` picks a tier for each request: economy, standard or frontier. Your key's
+lineup picks the model in each tier, and a fallback model to try when it fails:
+
+```bash
+phantom lineup --table
+phantom lineup set --frontier <model> --economy-fallback <model>
+phantom lineup reset
+```
+
+`lineup` shows the choices for each tier. `default` in place of a model puts that tier
+back to its default.
+
+See what a key spent, and what `phantom-1` saved against always running its frontier
+model:
+
+```bash
+phantom spend --table
+phantom spend --from 2026-09-01 --to 2026-09-30
+phantom spend --workspace --table
+```
+
+The dates are UTC days and the default is this month. `--workspace` lists every key in
+your workspace by name; without it you see the key you run as. The saving is an
+estimate: the same tokens at the frontier model's price today.
+
+A Pro ($20 a month) or Max ($100 a month) plan pays for `phantom-1` calls up to an amount
+of model cost in any 7 days, then your credit pays:
+
+```bash
+phantom plan --table
+phantom plan pro
+phantom plan manage
+```
+
+`plan` shows the key's plan and how much of the last 7 days it has paid for. `plan pro`
+and `plan max` print a Stripe Checkout link that puts the plan on this key and open it.
+`plan manage` opens Stripe's billing page, where the card changes, the plan switches and
+it cancels. A named model, not `phantom-1`, still spends credit.
+
 ## Commands
 
 | Task | Commands |
@@ -139,10 +178,11 @@ Prefer a specific model? Select it in your agent. Policies that apply only to
 | Connect | `phantom login`, `phantom logout` |
 | Connect existing agents | `phantom setup`, `phantom setup --dry-run`, `phantom setup --restore` |
 | Run inference | `phantom claude`, `phantom codex`, `phantom pi` |
-| Fund and check spending | `phantom workspace fund`, `phantom workspace status`, `phantom balance` |
+| Fund and check spending | `phantom workspace fund`, `phantom workspace status`, `phantom balance`, `phantom spend` |
 | Manage workspace keys | `phantom keys create`, `phantom keys set`, `phantom keys rotate`, `phantom keys revoke` |
 | Manage local copies | `phantom keys saved`, `phantom keys save`, `phantom keys rm` |
 | Route models | `phantom route` |
+| Pick phantom-1's models | `phantom lineup`, `phantom lineup set`, `phantom lineup reset` |
 
 Put phantom flags before agent arguments; use `--` to separate them:
 

package/dist/agents/command.mjs

@@ -7,8 +7,10 @@ import { DEFAULT_BASE_URL, httpsOnly, request } from "../core/request.mjs";
 import { keyId, readNamedKey, resolveApiKey } from "../keys/saved.mjs";
 import { workspaceLogin } from "../workspace/command.mjs";
 const DEFAULT_MODEL = 'auto';
+/** The key's spend and balance, or null when the answer has no numbers, such as a sign-in page that came back with status 200. */
 async function keyStatus(apiKey, baseUrl) {
-    return request('GET', '/key/balance', apiKey, undefined, baseUrl);
+    const s = await request('GET', '/key/balance', apiKey, undefined, baseUrl);
+    return Number.isFinite(s.credit_spent_usd) && Number.isFinite(s.credit_balance_usd) ? s : null;
 }
 import { proxyToken, startProxy } from "./proxy.mjs";
 const hasModel = (args) => args.some((a) => a === '-m' || a === '--model' || a.startsWith('--model=') || /^model=/.test(a));

package/dist/cli/commands.mjs

@@ -1,7 +1,9 @@
 import { workspaceCommand, workspaceLogin, forgetWorkspace } from "../workspace/command.mjs";
 import { agentCommand } from "../agents/command.mjs";
 import { balanceCommand, keyCommand, loginCommand, logoutCommand } from "../keys/command.mjs";
-import { routeCommand } from "../spend/command.mjs";
+import { lineupCommand, routeCommand } from "../spend/command.mjs";
+import { spendCommand } from "../spend/report.mjs";
+import { planCommand } from "../plan/command.mjs";
 import { verifyCommand } from "../receipts/command.mjs";
 import { setupCommand } from "../setup/command.mjs";
 import { SETUP_MODEL } from "../setup/shared.mjs";
@@ -43,7 +45,7 @@ export const COMMANDS = [
     {
         name: 'fund', handler: fundDispatch, keyless: true,
         help: `  fund --amount <USD> [--card | --coin usdc|usdt|sol] [--no-browser]
-                                    fund your workspace balance with card or crypto`,
+                                    fund your workspace balance with card (plus Stripe's fee) or crypto`,
     },
     {
         name: 'keys', handler: workspaceCommand, keyless: true,
@@ -76,6 +78,19 @@ export const COMMANDS = [
         name: 'balance', handler: balanceCommand,
         help: `  balance                           show credit balance and expiry`,
     },
+    {
+        name: 'spend', handler: spendCommand, keyless: ['--workspace'],
+        help: `  spend [--from <date>] [--to <date>]  what this key spent, by model and day, and what phantom-1
+                                    saved; dates are UTC days as YYYY-MM-DD, default this month
+  spend --workspace                 every key in the workspace by name (needs phantom login)`,
+    },
+    {
+        name: 'plan', handler: planCommand,
+        help: `  plan [status]                     this key's Pro or Max plan and how much of the week is used
+  plan pro | max [--no-browser]     print a Stripe Checkout link that puts the plan on this key
+                                    and open it
+  plan manage [--no-browser]        the same for Stripe's billing page: card, switch plan, cancel`,
+    },
     {
         name: 'key', advanced: true, handler: keyCommand, keyless: true,
         help: `  key list [--balance]              saved keys, by name and id
@@ -99,6 +114,16 @@ export const COMMANDS = [
   route rule rm <n>                 remove rule n
   route test [--model auto]         which model a request would get now (free)
   route clear                       remove the policy`,
+    },
+    {
+        name: 'lineup', handler: lineupCommand,
+        help: `  lineup [get]                      show the model phantom-1 runs in each tier, and the choices
+  lineup set --economy <model>      pick the model for a tier; "default" goes back to the default
+             [--standard <model>] [--frontier <model>]
+             [--economy-fallback <model>] [--standard-fallback <model>]
+             [--frontier-fallback <model>]
+                                    the model to try when a tier's model fails
+  lineup reset                      every tier back to its default`,
     },
     {
         name: 'logout', handler: logoutDispatch, keyless: true,
@@ -112,9 +137,9 @@ export const COMMANDS = [
         [--yes]                     don't ask
         [--dry-run]                 show the changes, write nothing
         [--model <id>]              the model each agent starts on (default ${SETUP_MODEL})
-  setup --agent <name> [--mcp]      install the skill for one agent, without asking:
+  setup --agent <name>              install the skill for one agent, without asking:
                                     ${orList(SETUP_NAMES)}
-                                    or all; --mcp also adds the MCP server
+                                    or all
   setup [--agent <name>] --provider point that agent's model calls at Phantom AI;
                                     --provider off removes only what phantom wrote
   setup --restore [--agent <name>]  put back the files setup changed, from the

package/dist/core/request.mjs

@@ -1,6 +1,8 @@
 import { PhantomApiError, die } from "./errors.mjs";
 /** The Phantom AI API address phantom calls when PHANTOM_BASE_URL is unset. */
 export const DEFAULT_BASE_URL = 'https://phantom.codes/v1';
+/** How long {@link request} waits for the whole answer, in milliseconds, before it gives up. */
+export const REQUEST_TIMEOUT_MS = 30_000;
 /**
  * Calls the Phantom AI API with the key as a Bearer token and returns the
  * JSON answer. Every client function in phantom goes through it.
@@ -10,20 +12,38 @@ export const DEFAULT_BASE_URL = 'https://phantom.codes/v1';
  * @param body Sent as JSON when given.
  * @param baseUrl The API base. Defaults to PHANTOM_BASE_URL, then {@link DEFAULT_BASE_URL}. Must be https ({@link httpsOnly}).
  * @param headers Extra headers to send.
+ * @param timeoutMs How long to wait for the answer. Defaults to {@link REQUEST_TIMEOUT_MS}.
  * @throws {@link PhantomApiError} when the API answers with an error status.
+ * @throws {@link CliError} with code `request_timeout` when no answer arrives in time.
  */
-export async function request(method, path, apiKey, body, baseUrl, headers = {}) {
+export async function request(method, path, apiKey, body, baseUrl, headers = {}, timeoutMs = REQUEST_TIMEOUT_MS) {
     const url = `${apiBase(baseUrl)}${path}`;
-    const res = await fetch(url, {
-        method,
-        headers: {
-            Authorization: `Bearer ${apiKey}`,
-            ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
-            ...headers,
-        },
-        body: body !== undefined ? JSON.stringify(body) : undefined,
-    });
-    const json = await res.json().catch(() => ({}));
+    const signal = AbortSignal.timeout(timeoutMs);
+    let res;
+    let json;
+    try {
+        res = await fetch(url, {
+            method,
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+                ...headers,
+            },
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+            signal,
+        });
+        // The deadline covers the body too: a server can send headers and then stall.
+        json = await res.json().catch((err) => {
+            if (signal.aborted)
+                throw err;
+            return {};
+        });
+    }
+    catch (err) {
+        if (signal.aborted)
+            die(`Phantom AI did not answer ${method} ${path} within ${Math.round(timeoutMs / 1000)} seconds. Check your connection and try again.`, 'request_timeout');
+        throw err;
+    }
     if (!res.ok)
         throw apiError(res.status, json);
     return json;
@@ -51,6 +71,7 @@ export function httpsOnly(baseUrl) {
     return baseUrl;
 }
 export function apiError(status, json) {
+    json = json && typeof json === 'object' ? json : {};
     const err = json.error;
     let code = String(status);
     let msg = `HTTP ${status}`;
@@ -60,7 +81,9 @@ export function apiError(status, json) {
         msg = typeof e.message === 'string' ? e.message : msg;
     }
     else if (typeof err === 'string') {
-        msg = err;
+        // The plan routes answer { error: <code>, detail: <words> }.
+        const detail = json.detail;
+        msg = typeof detail === 'string' && detail ? detail : err;
         code = err;
     }
     else if (typeof json.detail === 'string') {
@@ -72,7 +95,14 @@ export function apiError(status, json) {
     }
     return new PhantomApiError(status, code, msg);
 }
-/** Credit left, credit spent and expiry of a key (GET /key/balance). */
-export function getBalance(apiKey, baseUrl) {
-    return request('GET', '/key/balance', apiKey, undefined, baseUrl);
+/**
+ * Credit left, credit spent and expiry of a key (GET /key/balance).
+ * @throws {@link CliError} with code `balance_unreadable` when the answer has no numbers, such as a sign-in page that came back with status 200.
+ */
+export async function getBalance(apiKey, baseUrl) {
+    const balance = await request('GET', '/key/balance', apiKey, undefined, baseUrl);
+    if (!balance || !Number.isFinite(balance.credit_balance_usd) || !Number.isFinite(balance.credit_spent_usd)) {
+        die('The balance answer had no credit numbers. Check PHANTOM_BASE_URL, and that the address answers with the Phantom AI API.', 'balance_unreadable');
+    }
+    return balance;
 }

package/dist/core/version.mjs

@@ -1,2 +1,2 @@
 /** This release of phantom. `npm version` keeps it equal to the version in package.json. */
-export const VERSION = '1.0.0';
+export const VERSION = '1.1.1';

package/dist/phantom.mjs

@@ -14,10 +14,13 @@
 import { fileURLToPath } from 'node:url';
 import { realpathSync } from 'node:fs';
 import { run } from "./cli/run.mjs";
-export { DEFAULT_BASE_URL, request, httpsOnly, getBalance } from "./core/request.mjs";
+export { DEFAULT_BASE_URL, REQUEST_TIMEOUT_MS, request, httpsOnly, getBalance } from "./core/request.mjs";
 export { VERSION } from "./core/version.mjs";
 export { PhantomApiError, CliError, die } from "./core/errors.mjs";
+export { getLineup, putLineup, resetLineup, LINEUP_TIERS } from "./spend/lineup.mjs";
 export { getRoute, putRoute, patchRoute, clearRoute, testRoute, parseCondition } from "./spend/routing.mjs";
+export { getSpend, tableSpend } from "./spend/report.mjs";
+export { getPlan, planCheckout, planPortal, tablePlan } from "./plan/command.mjs";
 export { checkReceipt, modelsMatch, verifyModel } from "./receipts/receipts.mjs";
 export { keychain } from "./core/secrets.mjs";
 export { keyId, keySource, resolveApiKey, readNamedKey, saveNamedKey, removeNamedKey, listNamedKeys, saveApiKey, removeApiKey } from "./keys/saved.mjs";

package/dist/plan/command.mjs

@@ -0,0 +1,73 @@
+import { die } from "../core/errors.mjs";
+import { openUrl, out } from "../core/helpers.mjs";
+import { request } from "../core/request.mjs";
+import { savedManagement } from "../workspace/command.mjs";
+/** The plan of the key's workspace and its week (GET /plan). */
+export function getPlan(apiKey, baseUrl) {
+    return request('GET', '/plan', apiKey, undefined, baseUrl);
+}
+/** A Stripe Checkout link that puts `plan` on the key's workspace (POST /plan/checkout). */
+export function planCheckout(apiKey, plan, baseUrl) {
+    return request('POST', '/plan/checkout', apiKey, { plan }, baseUrl);
+}
+/**
+ * A link to Stripe's billing page for a workspace's plan (POST /plan/portal).
+ * It takes the workspace's management credential: an inference key gets 403.
+ */
+export function planPortal(credential, baseUrl) {
+    return request('POST', '/plan/portal', credential, undefined, baseUrl);
+}
+const dollars = (n) => `$${n.toFixed(2)}`;
+/** `--table` output for `plan`. */
+export function tablePlan(d) {
+    const p = d;
+    if (!p.plan) {
+        return p.available
+            ? 'plan      none\nsubscribe phantom plan pro   or   phantom plan max'
+            : 'plan      none (plans are not available right now)';
+    }
+    const lines = [
+        `plan      ${p.plan === 'max' ? 'Max' : 'Pro'}, on this ${p.scope}`,
+        `status    ${p.status}`,
+        `used      ${dollars(p.week_used_usd)} of ${dollars(p.week_limit_usd)} in the last 7 days (model cost, before markup)`,
+    ];
+    if (p.resets_at)
+        lines.push(`room      starts to free up ${p.resets_at}`);
+    if (p.renews_at)
+        lines.push(`period    ends ${p.renews_at}`);
+    return lines.join('\n');
+}
+/** What `phantom plan` accepts after `plan`. */
+const USAGE = 'Use phantom plan, phantom plan pro, phantom plan max or phantom plan manage.';
+/**
+ * `phantom plan`: the plan of the key's workspace and how much of the week is
+ * used. `phantom plan pro|max` prints a Stripe Checkout link that puts the
+ * plan on that workspace, and opens it unless `--no-browser`. `phantom plan
+ * manage` does the same for Stripe's billing page, where the card changes, the
+ * plan switches and it cancels; it sends the workspace credential `phantom
+ * login` saved, since a key can't manage billing. Run by `run()`.
+ */
+export async function planCommand(input) {
+    const { io, apiKey, table, baseUrl, flags, subcommand } = input;
+    const open = (url) => {
+        if (!flags['no-browser'])
+            openUrl(url);
+    };
+    if (subcommand === undefined || subcommand === 'status') {
+        out(await getPlan(apiKey, baseUrl), table, tablePlan, io.stdout);
+    }
+    else if (subcommand === 'pro' || subcommand === 'max') {
+        const result = await planCheckout(apiKey, subcommand, baseUrl);
+        out(result, table, (d) => `Open this link to pay: ${d.checkout_url}`, io.stdout);
+        open(result.checkout_url);
+    }
+    else if (subcommand === 'manage') {
+        const result = await planPortal(savedManagement(input) ?? apiKey, baseUrl);
+        out(result, table, (d) => `Open this link to manage billing: ${d.portal_url}`, io.stdout);
+        open(result.portal_url);
+    }
+    else {
+        die(`Unknown plan command "${subcommand}". ${USAGE}`, 'plan_usage');
+    }
+    return 0;
+}

package/dist/setup/agents.mjs

@@ -4,7 +4,7 @@ import { existsSync } from 'node:fs';
 import { isDeepStrictEqual } from 'node:util';
 import { die } from "../core/errors.mjs";
 import { resolveApiKey } from "../keys/saved.mjs";
-import { SETUP_MODEL, agentBaseUrl, MCP_ARGS, mcpByCli, readText, configHome, onPath, phantomCommand, offResult, unreadable, SETUP_MARK, SETUP_CONTEXT_WINDOW, } from "./shared.mjs";
+import { SETUP_MODEL, agentBaseUrl, readText, configHome, onPath, phantomCommand, offResult, unreadable, SETUP_MARK, SETUP_CONTEXT_WINDOW, } from "./shared.mjs";
 import { jsonObject, jsonEdit, tomlSet, tomlRemoveOurs, yamlSetTop, yamlAddModel, yamlRemoveOurs } from "./editors.mjs";
 // ── Manual Provider Helper ───────────────────────────────────────────────────
 /** An agent whose model settings live on its own settings screen: setup prints the steps. */
@@ -318,7 +318,7 @@ export function clineProvider(ctx, off) {
  * @deprecated Compatibility export. Use {@link planSetup}, {@link applySetup}, and {@link restoreSetup} for agent setup.
  */
 export const SETUP_AGENTS = {
-    /** pi. No MCP; it uses the CLI through the skill. */
+    /** pi. It uses the CLI through the skill. */
     pi: {
         label: 'pi',
         /** ~/.pi */
@@ -334,7 +334,6 @@ export const SETUP_AGENTS = {
         detect: (env, home) => existsSync(codexDir(env, home)),
         /** ~/.agents/skills */
         skills: '.agents/skills',
-        mcp: mcpByCli('codex'),
         provider: codexProvider,
         shellEnv: () => ({}),
     },
@@ -346,7 +345,6 @@ export const SETUP_AGENTS = {
         detect: (env, home) => existsSync(claudeDir(env, home)),
         /** ~/.claude/skills */
         skills: '.claude/skills',
-        mcp: mcpByCli('claude'),
         provider: (ctx, off) => claudePlan(ctx.env, { off, model: ctx.model, onPath: ctx.onPath }),
     },
     /** Cursor. Its models are set on its settings screen; the shell block gives it PHANTOM_API_KEY to copy. */
@@ -356,15 +354,6 @@ export const SETUP_AGENTS = {
         home: '.cursor',
         /** ~/.cursor/skills */
         skills: '.cursor/skills',
-        /** Merges the server into ~/.cursor/mcp.json, keeping the others. */
-        mcp: (ctx, add) => {
-            const server = { command: 'npx', args: MCP_ARGS };
-            const mcp = `add to ~/.cursor/mcp.json: ${JSON.stringify({ mcpServers: { phantom: server } })}`;
-            if (!add)
-                return { mcp };
-            const file = path.join(ctx.home, '.cursor', 'mcp.json');
-            return { mcp, edits: [{ file, after: jsonEdit(file, readText(file), [[['mcpServers', 'phantom'], server]]) }] };
-        },
         provider: manualProvider('Cursor Settings, Models', (ctx) => [
             'Open Cursor Settings (Cmd+Shift+J on macOS), then Models.',
             `Under OpenAI API Key, paste your Phantom AI key, then turn on Override OpenAI Base URL and set it to ${agentBaseUrl(ctx.env, 'cursor')}`,

package/dist/setup/apply.mjs

@@ -1,7 +1,6 @@
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
 import { stateDir } from "../core/state.mjs";
 import { readText } from "./shared.mjs";
 import { jsonText } from "./editors.mjs";
@@ -64,8 +63,6 @@ export function setupPreview(plan) {
         else
             parts.push(`${f.action} ${f.file}\n${maskKeys(lineDiff(f.before, f.after))}`);
     }
-    for (const r of plan.runs)
-        parts.push(`run ${r.cmd} ${r.args.join(' ')}`);
     for (const s of plan.skipped)
         parts.push(`skip ${s.agent}: ${s.reason}`);
     for (const a of plan.agents) {
@@ -97,11 +94,9 @@ const sha256 = (text) => createHash('sha256').update(text).digest('hex');
  * Writes a plan from {@link planSetup}. Before it edits a file it copies it
  * to `<file>.phantom.bak`, unless the file is still as phantom last wrote it: then the
  * copy from before phantom's first change stays. A file that changed after the
- * plan read it is left alone and listed in `skipped`. Then it runs any MCP
- * commands.
- * @param exec Runs an agent's CLI, such as `claude mcp add`.
+ * plan read it is left alone and listed in `skipped`.
  */
-export function applySetup(env, plan, exec = (cmd, args) => execFileSync(cmd, args, { stdio: 'ignore' })) {
+export function applySetup(env, plan) {
     const backups = readBackups(env);
     const skipped = [...plan.skipped];
     const files = [];
@@ -138,10 +133,7 @@ export function applySetup(env, plan, exec = (cmd, args) => execFileSync(cmd, ar
     }
     if (plan.files.some((f) => !f.skill))
         writeBackups(env, backups);
-    for (const r of plan.runs)
-        exec(r.cmd, r.args);
-    const agents = plan.agents.map((a) => ({ ...a, mcp_added: plan.mcp.includes(a.agent) }));
-    return { agents, files, ...(skipped.length ? { skipped } : {}), ...(plan.notes.length ? { notes: plan.notes } : {}) };
+    return { agents: plan.agents, files, ...(skipped.length ? { skipped } : {}), ...(plan.notes.length ? { notes: plan.notes } : {}) };
 }
 /**
  * Points Claude Code at Phantom AI, or removes phantom's settings with `off`.
@@ -155,7 +147,7 @@ export function claudeProvider(env, opts = {}) {
         const before = readText(edit.file);
         return { ...edit, before, agent: 'claude', action: before === null ? 'create' : edit.after === null ? 'remove' : 'update' };
     });
-    applySetup(env, { agents: [], files, runs: [], mcp: [], skipped: [], notes: [] });
+    applySetup(env, { agents: [], files, skipped: [], notes: [] });
     return provider.result;
 }
 /** A plan as `--dry-run` reports it: each file that would change, with its diff, and nothing written. */
@@ -170,12 +162,12 @@ export function previewSetup(plan) {
 }
 /**
  * Installs the phantom-ai skill for one agent, or for every agent found
- * (see {@link SETUP_AGENTS}), and with `mcp` and `provider` sets those up
+ * (see {@link SETUP_AGENTS}), and with `provider` sets that up
  * too, without asking: {@link planSetup}, then {@link applySetup}.
  * @throws {@link CliError} when no agent is found, the agent is unknown, or `provider` is set without an agent that supports it.
  */
 export function setupAgents(env, opts = {}) {
-    return applySetup(env, planSetup(env, opts), opts.exec);
+    return applySetup(env, planSetup(env, opts));
 }
 /**
  * Puts back the files `phantom setup` changed, from the copies it kept

package/dist/setup/command.mjs

@@ -13,7 +13,6 @@ export function tableSetup(d) {
         const p = a.provider;
         return [
             `${a.agent.padEnd(16)}${a.skill ? `skill ${r.dry_run || r.applied === false ? 'goes' : 'installed'} at ${a.skill}` : 'no skill (this agent does not read skills)'}`,
-            ...(a.mcp_added ? [`${pad}MCP server added`] : a.mcp ? [`${pad}MCP (optional): ${a.mcp}`] : []),
             ...(!p
                 ? []
                 : p.manual
@@ -74,10 +73,9 @@ export async function setupCommand({ env, io, flags, table }) {
     }
     // Plain `phantom setup` sets up everything it finds and asks first. Any of
     // the older flags runs just what they name, without asking.
-    const guided = agent === undefined && provider === undefined && !flags['mcp'];
+    const guided = agent === undefined && provider === undefined;
     const plan = planSetup(env, {
         agent,
-        mcp: Boolean(flags['mcp']),
         provider: guided || provider === true ? true : provider === 'off' ? 'off' : false,
         model: typeof model === 'string' ? model : undefined,
         guided,

package/dist/setup/plan.mjs

@@ -18,7 +18,7 @@ function skillSource() {
 const isSkip = (err) => err instanceof CliError && err.code === 'setup_unreadable';
 /**
  * Works out what setup would change, and writes nothing: the skill for each
- * agent ({@link SETUP_AGENTS}), the MCP server with `mcp`, each agent's model
+ * agent ({@link SETUP_AGENTS}), each agent's model
  * settings with `provider` ({@link SetupAgentSpec.provider}), and the shell
  * block ({@link shellBlock}) for agents that read the key from the
  * environment. A config file setup can't edit safely is left out and listed
@@ -61,8 +61,6 @@ export function planSetup(env, opts = {}) {
     }
     const ctx = { env, home, onPath: opts.onPath, model: opts.model, shellRc: shellRcFile(env, home) };
     const files = [];
-    const runs = [];
-    const mcpAdds = [];
     const skipped = [];
     const agents = [];
     const add = (agent, file, after, skill = false, mode) => {
@@ -87,25 +85,6 @@ export function planSetup(env, opts = {}) {
         const skill = spec.skills ? path.join(home, spec.skills, 'phantom-ai', 'SKILL.md') : null;
         if (skill)
             add(agent, skill, skillText, true);
-        let mcp = null;
-        if (spec.mcp) {
-            try {
-                const m = spec.mcp(ctx, Boolean(opts.mcp));
-                mcp = m.mcp;
-                if (opts.mcp) {
-                    if (m.run)
-                        runs.push({ agent, cmd: m.run[0], args: m.run[1] });
-                    for (const e of m.edits ?? [])
-                        add(agent, e.file, e.after);
-                    mcpAdds.push(agent);
-                }
-            }
-            catch (err) {
-                if (!isSkip(err))
-                    throw err;
-                skipped.push({ agent, reason: err.message });
-            }
-        }
         let result;
         if (provider && spec.provider) {
             try {
@@ -126,7 +105,7 @@ export function planSetup(env, opts = {}) {
                 skipped.push({ agent, reason: err.message });
             }
         }
-        agents.push({ agent, skill, mcp, mcp_added: false, ...(result ? { provider: result } : {}) });
+        agents.push({ agent, skill, ...(result ? { provider: result } : {}) });
     }
     if (shellOn.size || shellOff.length) {
         try {
@@ -138,5 +117,5 @@ export function planSetup(env, opts = {}) {
             skipped.push({ agent: 'shell', reason: err.message });
         }
     }
-    return { agents, files, runs, mcp: mcpAdds, skipped, notes };
+    return { agents, files, skipped, notes };
 }

package/dist/setup/shared.mjs

@@ -19,14 +19,6 @@ export function agentBaseUrl(env, agent) {
     const origin = httpsOnly(env.PHANTOM_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, '').replace(/\/v1$/, '');
     return agent === 'claude-code' ? `${origin}/claude-code` : `${origin}/${agent}/v1`;
 }
-export const MCP_ARGS = ['-y', '@phantomcodes/cli', 'mcp'];
-/** MCP for an agent whose CLI adds servers: `<agent> mcp add phantom -- npx ...`. */
-export function mcpByCli(agent) {
-    return () => ({
-        mcp: `${agent} mcp add phantom -- npx ${MCP_ARGS.join(' ')}`,
-        run: [agent, ['mcp', 'add', 'phantom', '--', 'npx', ...MCP_ARGS]],
-    });
-}
 /** The end of every line phantom adds to a TOML, YAML or shell file. */
 export const SETUP_MARK = '# phantom setup';
 /** The start of a line phantom turned into a comment because it replaced it. `--provider off` puts it back. */

package/dist/spend/command.mjs

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { die } from "../core/errors.mjs";
 import { flagNum, out } from "../core/helpers.mjs";
+import { getLineup, putLineup, resetLineup, LINEUP_TIERS } from "./lineup.mjs";
 import { getRoute, putRoute, patchRoute, clearRoute, testRoute, parseCondition } from "./routing.mjs";
 /** `--table` output for `route`. */
 export function tableRoute(d) {
@@ -103,3 +104,69 @@ export async function routeCommand({ argv, io, apiKey, subcommand, flags, table,
     }
     return 0;
 }
+/** `--table` output for `lineup`. */
+export function tableLineup(d) {
+    const { lineup, tiers, choices } = d;
+    return LINEUP_TIERS.flatMap((tier) => {
+        const pick = lineup?.[tier];
+        const fallback = lineup?.fallbacks?.[tier];
+        return [
+            `${tier.padEnd(15)} ${tiers[tier].model}  ${pick ? '(your pick)' : '(default)'}`,
+            ...(fallback ? [`${''.padEnd(15)} falls back to ${fallback}`] : []),
+            ...(choices ? choices[tier].map((c) => `${''.padEnd(15)} - ${c.model}${c.default ? ' (default)' : ''}`) : []),
+        ];
+    }).join('\n');
+}
+/**
+ * Changes one tier's entry in `into` from a flag value: a model id sets it,
+ * and `default` clears it so the tier runs its default again.
+ */
+function applyPick(into, tier, flag, value) {
+    if (value === undefined)
+        return;
+    if (value === true || !value)
+        die(`--${flag} needs a model id, or "default" to clear it`);
+    if (value === 'default')
+        delete into[tier];
+    else
+        into[tier] = value;
+}
+/** `phantom lineup`: the model phantom-1 runs in each tier, and a fallback for each. Run by `run()`. */
+export async function lineupCommand({ io, apiKey, subcommand, flags, table, baseUrl }) {
+    if (!subcommand || subcommand === 'get') {
+        out(await getLineup(apiKey, baseUrl), table, tableLineup, io.stdout);
+    }
+    else if (subcommand === 'set') {
+        // PUT replaces the whole lineup, so start from what the key has now.
+        const read = await getLineup(apiKey, baseUrl);
+        const current = read.lineup ?? {};
+        const { fallbacks: currentFallbacks, ...picks } = current;
+        const fallbacks = { ...currentFallbacks };
+        const model = { economy: flags['economy'], standard: flags['standard'], frontier: flags['frontier'] };
+        const fallback = {
+            economy: flags['economy-fallback'],
+            standard: flags['standard-fallback'],
+            frontier: flags['frontier-fallback'],
+        };
+        for (const tier of LINEUP_TIERS) {
+            applyPick(picks, tier, tier, model[tier]);
+            applyPick(fallbacks, tier, `${tier}-fallback`, fallback[tier]);
+            // A fallback the key already had can't be its tier's own model, which the server refuses. Drop it when this change makes it so.
+            const runs = picks[tier] ?? read.choices?.[tier].find((c) => c.default)?.model;
+            if (fallback[tier] === undefined && fallbacks[tier] === runs)
+                delete fallbacks[tier];
+        }
+        if (LINEUP_TIERS.every((tier) => model[tier] === undefined && fallback[tier] === undefined)) {
+            die('lineup set needs --economy, --standard or --frontier, or --economy-fallback, --standard-fallback or --frontier-fallback, each with a model id or "default"');
+        }
+        const next = Object.keys(fallbacks).length ? { ...picks, fallbacks } : picks;
+        out(await putLineup(apiKey, next, baseUrl), table, tableLineup, io.stdout);
+    }
+    else if (subcommand === 'reset') {
+        out(await resetLineup(apiKey, baseUrl), table, tableLineup, io.stdout);
+    }
+    else {
+        die(`Unknown lineup subcommand: ${subcommand}`);
+    }
+    return 0;
+}

package/dist/spend/lineup.mjs

@@ -0,0 +1,20 @@
+import { request } from "../core/request.mjs";
+/**
+ * A key's lineup decides which model `phantom-1` runs in each tier. The server
+ * checks every pick against the tier's choices (lib/lineup.ts in the Phantom
+ * repo), so the CLI passes model ids through.
+ */
+/** The three tiers `phantom-1` picks between, cheapest first. */
+export const LINEUP_TIERS = ['economy', 'standard', 'frontier'];
+/** The key's lineup, the model each tier runs, and each tier's choices (GET /key/lineup). */
+export function getLineup(apiKey, baseUrl) {
+    return request('GET', '/key/lineup', apiKey, undefined, baseUrl);
+}
+/** Replaces the key's whole lineup (PUT /key/lineup). The server checks it before saving. */
+export function putLineup(apiKey, lineup, baseUrl) {
+    return request('PUT', '/key/lineup', apiKey, lineup, baseUrl);
+}
+/** Puts every tier back to its default (DELETE /key/lineup). */
+export function resetLineup(apiKey, baseUrl) {
+    return request('DELETE', '/key/lineup', apiKey, undefined, baseUrl);
+}

package/dist/spend/report.mjs

@@ -0,0 +1,61 @@
+import { die } from "../core/errors.mjs";
+import { out } from "../core/helpers.mjs";
+import { request } from "../core/request.mjs";
+import { workspaceGet } from "../workspace/command.mjs";
+/** The dates `--from` and `--to` ask for, as a query string. The server checks them. */
+function query(dates) {
+    const params = new URLSearchParams();
+    for (const [name, value] of Object.entries(dates)) {
+        if (value === true)
+            die(`--${name} requires a date as YYYY-MM-DD`);
+        if (value !== undefined)
+            params.set(name, value);
+    }
+    const text = params.toString();
+    return text ? `?${text}` : '';
+}
+/** What the key spent (GET /key/spend). */
+export function getSpend(apiKey, dates = {}, baseUrl) {
+    return request('GET', `/key/spend${query(dates)}`, apiKey, undefined, baseUrl);
+}
+const dollars = (n) => `$${n.toFixed(4)}`;
+const calls = (n) => `${n} ${n === 1 ? 'call' : 'calls'}`;
+/** `--table` output for `spend`. */
+export function tableSpend(d) {
+    const s = d;
+    const lines = [
+        `range           ${s.from} to ${s.to} (UTC)`,
+        `spent           ${dollars(s.total.spent_usd)} (${calls(s.total.calls)})`,
+    ];
+    if (s.total.plan_usd > 0)
+        lines.push(`paid by plan    ${dollars(s.total.plan_usd)}`);
+    if (!s.routing.available)
+        lines.push(`phantom-1 saved not available: ${s.routing.reason}`);
+    else if (s.routing.calls === 0)
+        lines.push('phantom-1 saved no calls went to phantom-1');
+    else
+        lines.push(`phantom-1 saved ${dollars(s.routing.saved_usd)} (${calls(s.routing.calls)} cost ${dollars(s.routing.spent_usd)}; on ${s.routing.baseline_model} they would cost ${dollars(s.routing.baseline_usd)})`);
+    lines.push('', 'by key');
+    for (const k of s.keys) {
+        const saved = k.saved_usd === null ? '' : `  saved ${dollars(k.saved_usd)}`;
+        lines.push(`  ${k.name.padEnd(16)}${dollars(k.spent_usd)}  ${calls(k.calls)}${saved}${k.active ? '' : '  (revoked or rotated)'}`);
+    }
+    lines.push('', 'by model');
+    for (const m of s.models)
+        lines.push(`  ${m.model.padEnd(40)}${dollars(m.spent_usd)}  ${calls(m.calls)}`);
+    return lines.join('\n');
+}
+/**
+ * `phantom spend`: what the key spent, by model and day, and what phantom-1
+ * saved. `--workspace` shows every key in the workspace by name, with the
+ * workspace connection `phantom login` saved. Run by `run()`.
+ */
+export async function spendCommand(input) {
+    const { io, apiKey, table, baseUrl, flags } = input;
+    const dates = { from: flags['from'], to: flags['to'] };
+    const result = flags['workspace']
+        ? (await workspaceGet(input, `/spend${query(dates)}`))
+        : await getSpend(apiKey, dates, baseUrl);
+    out(result, table, tableSpend, io.stdout);
+    return 0;
+}

package/dist/spend/routing.mjs

@@ -16,7 +16,7 @@ export function patchRoute(apiKey, fields, baseUrl) {
 export function clearRoute(apiKey, baseUrl) {
     return request('DELETE', '/key/route', apiKey, undefined, baseUrl);
 }
-/** Which model a request would run on now, and why (POST /key/route/test). Nothing is charged and no model is called. */
+/** Which model a request would run on now, and why (POST /key/route/test). Nothing is charged. A route policy picks without calling a model; `phantom-1`, `phantom-1:zdr`, or `auto` on a key with no policy can call the model that picks the tier. `phantom-1:free` never does. */
 export function testRoute(apiKey, opts, baseUrl) {
     return request('POST', '/key/route/test', apiKey, opts, baseUrl);
 }

package/dist/workspace/command.mjs

@@ -27,6 +27,15 @@ function credentials(input) {
         die('This workspace belongs to a different API address. Run phantom login for this address.', 'workspace_origin');
     return saved;
 }
+/** The management credential `phantom login` saved for this API address, or null when it saved none. */
+export function savedManagement(input) {
+    return existsSync(credentialPath(input.env)) ? credentials(input).management_credential : null;
+}
+/** A read from the saved workspace, such as `/spend`, with its management credential. */
+export async function workspaceGet(input, path) {
+    const saved = credentials(input);
+    return wire(saved.base_url, 'GET', '/workspaces/' + encodeURIComponent(saved.workspace_id) + path, undefined, saved.management_credential);
+}
 /** Device authorization for accounts or guests, saving keys locally without copying a secret through the browser. */
 export async function workspaceLogin(input) {
     const { env, io, flags } = input;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phantomcodes/cli",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "description": "AI inference for your coding agents. Route models, control spending, and fund your workspace.",
   "keywords": [
     "phantom",
@@ -65,7 +65,7 @@
     "url": "https://github.com/connortessaro/phantom/issues"
   },
   "license": "SEE LICENSE IN LICENSE",
-  "author": "Connor Tessaro",
+  "author": "Harbor Financial LLC",
   "devDependencies": {
     "@types/node": "^24.19.1",
     "@vitest/coverage-v8": "^5.0.3",

package/skills/phantom-ai/SKILL.md

@@ -101,6 +101,44 @@ phantom route test --table
 Routing affects `auto` requests. Use `PHANTOM_KEY_NAME=coding` to manage the same
 key used by an agent with `--key coding`. Route tests are free.
 
+## Pick phantom-1's models
+
+```bash
+phantom lineup --table
+phantom lineup set --frontier <model> --economy-fallback <model>
+phantom lineup reset
+```
+
+Each tier (economy, standard, frontier) takes a model from its own choices, which
+`phantom lineup` lists. A fallback is the model to try when the tier's model fails.
+`default` in place of a model puts that tier back to its default. `lineup set`
+keeps the tiers you don't name.
+
+## See what was spent
+
+```bash
+phantom spend --table
+phantom spend --workspace --from 2026-09-01 --to 2026-09-30
+```
+
+`spend` shows what the key spent by model and day, and an estimate of what `phantom-1`
+saved against its frontier model. `--workspace` shows every key in the workspace by
+name. Dates are UTC days (`YYYY-MM-DD`); the default is this month.
+
+## Plans
+
+```bash
+phantom plan --table
+phantom plan pro
+phantom plan manage
+```
+
+A Pro or Max plan pays for `phantom-1` calls up to an amount of model cost in any 7 days,
+then the key's credit pays. `plan` shows the plan and the week's use. `plan pro` and
+`plan max` print a Stripe Checkout link (and open it unless `--no-browser`); the user
+pays there. `plan manage` opens Stripe's billing page. Naming a model, not `phantom-1`,
+still spends credit.
+
 ## Advanced tasks
 
 Use `phantom --help --all` for receipts, MCP and direct-key purchases.