@proxysoul/soulforge 2.13.1 → 2.14.0

package/dist/workers/io.worker.js

@@ -129,6 +129,9 @@ function createWorkerHandler(handlers, onInit, onDispose) {
   const allHandlers = {
     ...handlers,
     __memoryUsage: () => {
+      try {
+        Bun.gc(true);
+      } catch {}
       const usage = process.memoryUsage();
       return {
         heapUsed: usage.heapUsed,
@@ -41832,7 +41835,9 @@ var init_ui = __esm(() => {
     floatingTerminal: false,
     updateModal: false,
     mcpSettings: false,
-    tabNamePopup: false
+    hearthSettings: false,
+    tabNamePopup: false,
+    uiDemo: false
   };
   useUIStore = create()(subscribeWithSelector((set2) => ({
     modals: {
@@ -49515,7 +49520,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@proxysoul/soulforge",
-    version: "2.13.1",
+    version: "2.14.0",
     description: "Graph-powered code intelligence \u2014 multi-agent coding with codebase-aware AI",
     repository: {
       type: "git",
@@ -49532,7 +49537,8 @@ var init_package = __esm(() => {
     author: "proxySoul",
     bin: {
       soulforge: "./dist/bin.sh",
-      sf: "./dist/bin.sh"
+      sf: "./dist/bin.sh",
+      "soulforge-remote": "./dist/soulforge-remote.sh"
     },
     engines: {
       bun: ">=1.2.0"
@@ -49573,7 +49579,7 @@ var init_package = __esm(() => {
       "@types/node": "25.6.0",
       "@types/react": "19.2.14",
       "babel-plugin-react-compiler": "1.0.0",
-      "bun-types": "1.3.12",
+      "bun-types": "1.3.13",
       typescript: "6.0.3"
     },
     dependencies: {
@@ -49593,20 +49599,21 @@ var init_package = __esm(() => {
       "@modelcontextprotocol/sdk": "^1.29.0",
       "@mozilla/readability": "0.6.0",
       "@openrouter/ai-sdk-provider": "2.8.0",
-      "@opentui/react": "0.1.100",
+      "@opentui/react": "0.1.102",
       ai: "6.0.168",
       "ghostty-opentui": "1.4.10",
       isbinaryfile: "6.0.0",
       jsonrepair: "^3.14.0",
       linkedom: "0.18.12",
       "linkify-it": "5.0.0",
-      marked: "18.0.1",
+      marked: "18.0.2",
       neovim: "5.4.0",
       react: "19.2.5",
       shiki: "4.0.2",
       "strip-ansi": "7.2.0",
       "tree-sitter-wasms": "0.1.13",
       "ts-morph": "28.0.0",
+      undici: "^8.1.0",
       "vercel-minimax-ai-provider": "^0.0.2",
       "web-tree-sitter": "0.25.10",
       zod: "4.3.6",
@@ -74331,11 +74338,162 @@ var init_openrouter = __esm(() => {
   };
 });
 
+// src/core/proxy/key-resolver.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
+function candidateConfigPaths() {
+  const paths = [process.env.PROXY_CONFIG_PATH, join7(homedir5(), ".soulforge", "proxy", "config.yaml"), "/opt/homebrew/etc/cliproxyapi.conf", "/opt/homebrew/etc/cliproxyapi/config.yaml", "/usr/local/etc/cliproxyapi.conf", "/usr/local/etc/cliproxyapi/config.yaml", "/etc/cliproxyapi.conf", "/etc/cliproxyapi/config.yaml", join7(homedir5(), ".config", "cliproxyapi", "config.yaml"), join7(homedir5(), ".cli-proxy-api", "config.yaml")];
+  return paths.filter((p) => typeof p === "string" && p.length > 0);
+}
+function isPlausibleKey(value) {
+  const s = value.trim();
+  if (!s)
+    return false;
+  if (PLACEHOLDER_PATTERNS.some((re) => re.test(s)))
+    return false;
+  if (BCRYPT_RE.test(s))
+    return false;
+  if (SHA256_HEX_RE.test(s))
+    return false;
+  return true;
+}
+function parseApiKeys(content) {
+  const lines = content.split(`
+`);
+  const keys = [];
+  let inList = false;
+  let listIndent = -1;
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, "");
+    const stripped = line.replace(/^\s*/, "");
+    if (stripped.startsWith("#"))
+      continue;
+    if (!inList) {
+      if (/^api-keys\s*:\s*$/.test(stripped) && !line.startsWith(" ") && !line.startsWith("\t")) {
+        inList = true;
+        listIndent = -1;
+      }
+      continue;
+    }
+    if (stripped === "")
+      continue;
+    const indentMatch = line.match(/^(\s+)/);
+    const indent = indentMatch?.[1]?.length ?? 0;
+    if (indent === 0)
+      break;
+    if (listIndent === -1)
+      listIndent = indent;
+    if (indent < listIndent)
+      break;
+    const item = line.slice(indent).match(/^-\s+(?:"([^"]*)"|'([^']*)'|(.+?))\s*$/);
+    if (!item)
+      continue;
+    const v = item[1] ?? item[2] ?? item[3] ?? "";
+    keys.push(v);
+  }
+  return keys;
+}
+function discoverApiKeys() {
+  const out = [];
+  const seen = new Set;
+  for (const path of candidateConfigPaths()) {
+    try {
+      if (!existsSync2(path))
+        continue;
+      const content = readFileSync2(path, "utf-8");
+      for (const k of parseApiKeys(content)) {
+        if (!isPlausibleKey(k))
+          continue;
+        if (seen.has(k))
+          continue;
+        seen.add(k);
+        out.push({
+          key: k,
+          source: path
+        });
+      }
+    } catch {}
+  }
+  return out;
+}
+function primaryConfigPath() {
+  for (const path of candidateConfigPaths()) {
+    try {
+      if (!existsSync2(path))
+        continue;
+      const content = readFileSync2(path, "utf-8");
+      if (/^api-keys\s*:\s*$/m.test(content))
+        return path;
+    } catch {}
+  }
+  return null;
+}
+function getActiveProxyApiKey() {
+  return cached2;
+}
+function setActiveProxyApiKey(key) {
+  cached2 = key;
+  cachedIsProbed = true;
+}
+function candidateApiKeys() {
+  const out = [];
+  const push = (v) => {
+    if (!v)
+      return;
+    const s = v.trim();
+    if (!s)
+      return;
+    if (!out.includes(s))
+      out.push(s);
+  };
+  push(process.env.PROXY_API_KEY);
+  push("soulforge");
+  for (const d of discoverApiKeys())
+    push(d.key);
+  return out;
+}
+var PLACEHOLDER_PATTERNS, BCRYPT_RE, SHA256_HEX_RE, cached2, cachedIsProbed = false;
+var init_key_resolver = __esm(() => {
+  PLACEHOLDER_PATTERNS = [/^your[-_]?(?:api[-_]?)?key/i, /^changeme$/i, /^replace[-_ ]?me/i, /^xxx+$/i];
+  BCRYPT_RE = /^\$2[aby]\$/;
+  SHA256_HEX_RE = /^[0-9a-f]{64}$/i;
+  cached2 = process.env.PROXY_API_KEY?.trim() || "soulforge";
+});
+
 // src/core/setup/install.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync2, symlinkSync, unlinkSync } from "fs";
-import { homedir as homedir5, platform } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, symlinkSync, unlinkSync } from "fs";
+import { homedir as homedir6, platform } from "os";
+import { join as join8 } from "path";
+async function fetchLatestProxyVersion(timeoutMs = 5000) {
+  try {
+    const ctl = new AbortController;
+    const t = setTimeout(() => ctl.abort(), timeoutMs);
+    const res = await fetch(PROXY_RELEASES_URL, {
+      signal: ctl.signal,
+      headers: {
+        Accept: "application/vnd.github+json"
+      }
+    });
+    clearTimeout(t);
+    if (!res.ok)
+      return null;
+    const data = await res.json();
+    return data.tag_name?.replace(/^v/, "")?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function resolveProxyVersion() {
+  const env = process.env.SOULFORGE_PROXY_VERSION?.trim();
+  if (env)
+    return env;
+  const latest = await fetchLatestProxyVersion();
+  if (latest)
+    return latest;
+  return FALLBACK_PROXY_VERSION;
+}
 function getPlatformKey() {
   const key = `${process.platform}-${process.arch}`;
   if (key !== "darwin-arm64" && key !== "darwin-x64" && key !== "linux-x64" && key !== "linux-arm64") {
@@ -74347,22 +74505,22 @@ async function installBinary(config2) {
   ensureDirs();
   const key = getPlatformKey();
   const asset = config2.getAsset(key);
-  const extractDir = join7(INSTALLS_DIR, `${config2.name}-${config2.version}`);
-  if (!existsSync2(asset.binPath)) {
+  const extractDir = join8(INSTALLS_DIR, `${config2.name}-${config2.version}`);
+  if (!existsSync3(asset.binPath)) {
     await downloadAndExtract(asset.url, extractDir);
   }
-  if (!existsSync2(asset.binPath)) {
+  if (!existsSync3(asset.binPath)) {
     throw new Error(`${config2.name} binary not found after extraction at ${asset.binPath}`);
   }
   execSync(`chmod +x "${asset.binPath}"`, {
     stdio: "ignore"
   });
-  createSymlink(asset.binPath, join7(BIN_DIR, config2.binName));
-  return join7(BIN_DIR, config2.binName);
+  createSymlink(asset.binPath, join8(BIN_DIR, config2.binName));
+  return join8(BIN_DIR, config2.binName);
 }
 function getVendoredPath(binary) {
-  const binLink = join7(BIN_DIR, binary);
-  return existsSync2(binLink) ? binLink : null;
+  const binLink = join8(BIN_DIR, binary);
+  return existsSync3(binLink) ? binLink : null;
 }
 function ensureDirs() {
   mkdirSync2(BIN_DIR, {
@@ -74380,7 +74538,7 @@ async function downloadAndExtract(url2, extractDir) {
   if (!response.ok) {
     throw new Error(`Download failed: ${response.status} ${response.statusText} (${url2})`);
   }
-  const tmpFile = join7(extractDir, "download.tar.gz");
+  const tmpFile = join8(extractDir, "download.tar.gz");
   const buffer = await response.arrayBuffer();
   await Bun.write(tmpFile, buffer);
   execSync(`tar xzf "${tmpFile}" -C "${extractDir}"`, {
@@ -74389,14 +74547,14 @@ async function downloadAndExtract(url2, extractDir) {
   unlinkSync(tmpFile);
 }
 function createSymlink(target, link) {
-  if (existsSync2(link)) {
+  if (existsSync3(link)) {
     unlinkSync(link);
   }
   symlinkSync(target, link);
 }
 async function installProxy(version2) {
-  const v = version2 ?? PROXY_VERSION;
-  return installBinary({
+  const v = version2 ?? await resolveProxyVersion();
+  const path = await installBinary({
     name: "cliproxyapi",
     binName: "cli-proxy-api",
     version: v,
@@ -74405,17 +74563,21 @@ async function installProxy(version2) {
       const asset = `CLIProxyAPI_${v}_${suffix}.tar.gz`;
       return {
         url: `https://github.com/router-for-me/CLIProxyAPI/releases/download/v${v}/${asset}`,
-        binPath: join7(INSTALLS_DIR, `cliproxyapi-${v}`, "cli-proxy-api")
+        binPath: join8(INSTALLS_DIR, `cliproxyapi-${v}`, "cli-proxy-api")
       };
     }
   });
+  return {
+    path,
+    version: v
+  };
 }
-var SOULFORGE_DIR, BIN_DIR, INSTALLS_DIR, FONTS_DIR, PROXY_VERSION = "6.9.28", PROXY_SUFFIXES;
+var SOULFORGE_DIR, BIN_DIR, INSTALLS_DIR, FONTS_DIR, FALLBACK_PROXY_VERSION = "6.9.29", PROXY_RELEASES_URL = "https://api.github.com/repos/router-for-me/CLIProxyAPI/releases/latest", PROXY_SUFFIXES;
 var init_install = __esm(() => {
-  SOULFORGE_DIR = join7(homedir5(), ".soulforge");
-  BIN_DIR = join7(SOULFORGE_DIR, "bin");
-  INSTALLS_DIR = join7(SOULFORGE_DIR, "installs");
-  FONTS_DIR = join7(SOULFORGE_DIR, "fonts");
+  SOULFORGE_DIR = join8(homedir6(), ".soulforge");
+  BIN_DIR = join8(SOULFORGE_DIR, "bin");
+  INSTALLS_DIR = join8(SOULFORGE_DIR, "installs");
+  FONTS_DIR = join8(SOULFORGE_DIR, "fonts");
   PROXY_SUFFIXES = {
     "darwin-arm64": "darwin_arm64",
     "darwin-x64": "darwin_amd64",
@@ -74426,80 +74588,51 @@ var init_install = __esm(() => {
 
 // src/core/proxy/lifecycle.ts
 import { execFileSync, execSync as execSync2, spawn as spawn4 } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join8 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join9 } from "path";
 function setState(state, error48 = null) {
   currentState = state;
   lastError = error48;
   for (const fn of stateListeners)
     fn(state, error48);
 }
-function getInstalledProxyVersion() {
-  try {
-    if (existsSync3(VERSION_FILE)) {
-      const v = readFileSync2(VERSION_FILE, "utf-8").trim();
-      if (v)
-        return v;
-    }
-  } catch {}
-  return PROXY_VERSION;
-}
 function saveInstalledProxyVersion(version2) {
   mkdirSync3(PROXY_CONFIG_DIR, {
     recursive: true
   });
   writeFileSync2(VERSION_FILE, version2);
 }
-function hasConflictingKeys(content) {
-  for (const line of content.split(`
-`)) {
-    if (line.length === 0 || line[0] === "#" || line[0] === " " || line[0] === "\t")
-      continue;
-    const colon = line.indexOf(":");
-    if (colon === -1)
-      continue;
-    const key = line.slice(0, colon).trim();
-    if (PERF_KEYS.includes(key))
-      return true;
-  }
-  return false;
+function stripLegacyPerfBlock(content) {
+  if (!content.includes(LEGACY_PERF_MARKER_PREFIX))
+    return content;
+  const lines = content.split(`
+`);
+  const start = lines.findIndex((l) => l.startsWith(LEGACY_PERF_MARKER_PREFIX));
+  if (start === -1)
+    return content;
+  let end = start + 1;
+  while (end < lines.length && lines[end]?.trim() !== "")
+    end++;
+  lines.splice(start, end - start);
+  return lines.join(`
+`);
 }
 function ensureConfig() {
   mkdirSync3(PROXY_CONFIG_DIR, {
     recursive: true
   });
-  if (!existsSync3(PROXY_CONFIG_PATH)) {
-    writeFileSync2(PROXY_CONFIG_PATH, ["host: 127.0.0.1", "port: 8317", 'auth-dir: "~/.cli-proxy-api"', "api-keys:", '  - "soulforge"', "", PERF_BLOCK, ""].join(`
+  if (!existsSync4(PROXY_CONFIG_PATH)) {
+    writeFileSync2(PROXY_CONFIG_PATH, ["host: 127.0.0.1", "port: 8317", 'auth-dir: "~/.cli-proxy-api"', "api-keys:", '  - "soulforge"', ""].join(`
 `));
     return;
   }
   try {
-    const existing = readFileSync2(PROXY_CONFIG_PATH, "utf-8");
-    if (existing.includes(PERF_MARKER))
-      return;
-    let cleaned = existing;
-    if (existing.includes(PERF_MARKER_PREFIX)) {
-      const lines = existing.split(`
-`);
-      const start = lines.findIndex((l) => l.startsWith(PERF_MARKER_PREFIX));
-      if (start !== -1) {
-        let end = start + 1;
-        while (end < lines.length && lines[end]?.trim() !== "")
-          end++;
-        lines.splice(start, end - start);
-        cleaned = lines.join(`
-`);
-      }
+    const existing = readFileSync3(PROXY_CONFIG_PATH, "utf-8");
+    const cleaned = stripLegacyPerfBlock(existing);
+    if (cleaned !== existing) {
+      writeFileSync2(PROXY_CONFIG_PATH, cleaned);
     }
-    if (hasConflictingKeys(cleaned))
-      return;
-    const sep = cleaned.endsWith(`
-`) ? "" : `
-`;
-    writeFileSync2(PROXY_CONFIG_PATH, `${cleaned}${sep}
-${PERF_BLOCK}
-`);
   } catch {}
 }
 function commandExists(cmd) {
@@ -74512,24 +74645,76 @@ function commandExists(cmd) {
     return false;
   }
 }
+function getBinaryVersion(binary) {
+  const parse5 = (s) => {
+    const m = s.match(/Version:\s*(\d+\.\d+\.\d+)/);
+    return m?.[1] ?? null;
+  };
+  try {
+    const out = execFileSync(binary, ["-help"], {
+      encoding: "utf-8",
+      timeout: 2000,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return parse5(out);
+  } catch (err) {
+    const e = err;
+    const stdout = typeof e.stdout === "string" ? e.stdout : e.stdout?.toString() ?? "";
+    const stderr = typeof e.stderr === "string" ? e.stderr : e.stderr?.toString() ?? "";
+    return parse5(stdout + stderr);
+  }
+}
+function compareVersions(a, b) {
+  const ap = a.split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const bp = b.split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const len = Math.max(ap.length, bp.length);
+  for (let i = 0;i < len; i++) {
+    const diff = (ap[i] ?? 0) - (bp[i] ?? 0);
+    if (diff !== 0)
+      return diff;
+  }
+  return 0;
+}
 function getProxyBinary() {
+  const systemBinary = commandExists("cli-proxy-api") ? "cli-proxy-api" : commandExists("cliproxyapi") ? "cliproxyapi" : null;
   const vendored = getVendoredPath("cli-proxy-api");
-  if (vendored)
-    return vendored;
-  if (commandExists("cli-proxy-api"))
-    return "cli-proxy-api";
-  if (commandExists("cliproxyapi"))
-    return "cliproxyapi";
-  return null;
+  if (systemBinary && vendored) {
+    const sysVersion = getBinaryVersion(systemBinary);
+    const vendoredVersion = getBinaryVersion(vendored);
+    if (sysVersion && vendoredVersion) {
+      if (compareVersions(sysVersion, vendoredVersion) >= 0)
+        return systemBinary;
+      logBackgroundError("CLIProxyAPI", `system binary v${sysVersion} is older than vendored v${vendoredVersion} \u2014 using vendored`);
+      return vendored;
+    }
+    return systemBinary;
+  }
+  return systemBinary ?? vendored;
 }
-async function healthCheck() {
+function portIsOccupied() {
+  const portMatch = PROXY_URL.match(/:([0-9]+)/);
+  if (!portMatch)
+    return false;
+  const port = portMatch[1];
+  try {
+    const out = execFileSync("lsof", ["-ti", `tcp:${port}`], {
+      encoding: "utf-8",
+      timeout: 3000,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return out.length > 0;
+  } catch {
+    return false;
+  }
+}
+async function healthCheck(key) {
   try {
     const controller = new AbortController;
     const timeout = setTimeout(() => controller.abort(), HEALTH_TIMEOUT_MS);
     const res = await fetch(`${PROXY_URL}/models`, {
       signal: controller.signal,
       headers: {
-        Authorization: `Bearer ${PROXY_API_KEY}`
+        Authorization: `Bearer ${key}`
       }
     });
     clearTimeout(timeout);
@@ -74542,6 +74727,33 @@ async function healthCheck() {
     return "unreachable";
   }
 }
+async function probeForWorkingKey() {
+  let sawAuthRequired = false;
+  let sawUnreachable = false;
+  for (const candidate of candidateApiKeys()) {
+    const r = await healthCheck(candidate);
+    if (r === "ok")
+      return {
+        key: candidate,
+        state: "ok"
+      };
+    if (r === "auth-required")
+      sawAuthRequired = true;
+    if (r === "unreachable")
+      sawUnreachable = true;
+  }
+  if (sawAuthRequired)
+    return {
+      state: "auth-required"
+    };
+  if (sawUnreachable)
+    return {
+      state: "unreachable"
+    };
+  return {
+    state: "unreachable"
+  };
+}
 async function ensureProxy() {
   if (currentState === "starting") {
     return {
@@ -74549,32 +74761,43 @@ async function ensureProxy() {
       error: "Proxy is already starting"
     };
   }
-  const installed = getInstalledProxyVersion();
-  const needsUpgrade = installed !== PROXY_VERSION;
-  if (needsUpgrade) {
-    stopProxy();
-    killProxyOnPort();
-  }
-  const health = await healthCheck();
-  if (health === "ok" && !needsUpgrade) {
+  const probe = await probeForWorkingKey();
+  if (probe.state === "ok") {
+    setActiveProxyApiKey(probe.key);
     setState("running");
     return {
       ok: true
     };
   }
-  if (health === "auth-required") {
+  if (probe.state === "auth-required") {
+    const cfg = primaryConfigPath();
+    const discovered = discoverApiKeys();
+    if (cfg && discovered.length === 0) {
+      const msg = `Proxy rejected every candidate API key. Edit ${cfg} (replace placeholder in \`api-keys:\`) or set PROXY_API_KEY, then restart the proxy.`;
+      setState("needs-auth", msg);
+      return {
+        ok: false,
+        error: msg
+      };
+    }
     setState("needs-auth", "Authentication required \u2014 run /proxy login");
     return {
       ok: false,
       error: "Authentication required \u2014 run /proxy login"
     };
   }
+  if (portIsOccupied()) {
+    logBackgroundError("CLIProxyAPI", "orphan process on port \u2014 clearing");
+    killProxyOnPort();
+    await new Promise((r) => setTimeout(r, 200));
+  }
   setState("starting");
   let binary = getProxyBinary();
   if (!binary) {
     try {
-      binary = await installProxy();
-      saveInstalledProxyVersion(PROXY_VERSION);
+      const installed = await installProxy();
+      binary = installed.path;
+      saveInstalledProxyVersion(installed.version);
     } catch (err) {
       const msg = toErrorMessage(err);
       setState("error", `Failed to install CLIProxyAPI: ${msg}`);
@@ -74620,7 +74843,7 @@ async function ensureProxy() {
   }
   for (let i = 0;i < STARTUP_POLL_ATTEMPTS; i++) {
     await new Promise((r) => setTimeout(r, STARTUP_POLL_MS));
-    const status = await healthCheck();
+    const status = await healthCheck(getActiveProxyApiKey());
     if (status === "ok") {
       setState("running");
       return {
@@ -74657,7 +74880,7 @@ function stopProxy() {
   killProxyOnPort();
   setState("stopped");
 }
-function killProxyOnPort() {
+function killProxyOnPort(force = false) {
   const portMatch = PROXY_URL.match(/:([0-9]+)/);
   if (!portMatch)
     return;
@@ -74666,13 +74889,15 @@ function killProxyOnPort() {
   try {
     out = execFileSync("lsof", ["-ti", `tcp:${port}`], {
       encoding: "utf-8",
-      timeout: 3000
+      timeout: 3000,
+      stdio: ["ignore", "pipe", "ignore"]
     }).trim();
   } catch {
     try {
       out = execFileSync("fuser", [`${port}/tcp`], {
         encoding: "utf-8",
-        timeout: 3000
+        timeout: 3000,
+        stdio: ["ignore", "pipe", "ignore"]
       }).trim();
     } catch {
       return;
@@ -74680,31 +74905,28 @@ function killProxyOnPort() {
   }
   if (!out)
     return;
+  const signal = force ? "SIGKILL" : "SIGTERM";
   for (const token of out.split(/[\s\n]+/)) {
     const pid = Number.parseInt(token.trim(), 10);
     if (pid > 0 && pid !== process.pid) {
       try {
-        process.kill(pid, "SIGTERM");
+        process.kill(pid, signal);
       } catch {}
     }
   }
 }
-var proxyProcess = null, PROXY_URL, PROXY_API_KEY, PROXY_CONFIG_DIR, PROXY_CONFIG_PATH, HEALTH_TIMEOUT_MS = 2000, STARTUP_POLL_MS = 500, STARTUP_POLL_ATTEMPTS = 10, currentState = "stopped", lastError = null, stateListeners, VERSION_FILE, PERF_MARKER_PREFIX = "# soulforge-perf-defaults", PERF_MARKER_VERSION = 1, PERF_MARKER, PERF_KEYS, PERF_BLOCK, AUTH_DIR, VERSION_CACHE_TTL;
+var proxyProcess = null, PROXY_URL, PROXY_CONFIG_DIR, PROXY_CONFIG_PATH, HEALTH_TIMEOUT_MS = 2000, STARTUP_POLL_MS = 500, STARTUP_POLL_ATTEMPTS = 10, currentState = "stopped", lastError = null, stateListeners, VERSION_FILE, LEGACY_PERF_MARKER_PREFIX = "# soulforge-perf-defaults", AUTH_DIR, VERSION_CACHE_TTL;
 var init_lifecycle = __esm(() => {
   init_errors4();
   init_process_tracker();
   init_install();
+  init_key_resolver();
   PROXY_URL = process.env.PROXY_API_URL || "http://127.0.0.1:8317/v1";
-  PROXY_API_KEY = process.env.PROXY_API_KEY || "soulforge";
-  PROXY_CONFIG_DIR = join8(homedir6(), ".soulforge", "proxy");
-  PROXY_CONFIG_PATH = join8(PROXY_CONFIG_DIR, "config.yaml");
+  PROXY_CONFIG_DIR = join9(homedir7(), ".soulforge", "proxy");
+  PROXY_CONFIG_PATH = join9(PROXY_CONFIG_DIR, "config.yaml");
   stateListeners = new Set;
-  VERSION_FILE = join8(PROXY_CONFIG_DIR, "version");
-  PERF_MARKER = `${PERF_MARKER_PREFIX} v${String(PERF_MARKER_VERSION)}`;
-  PERF_KEYS = ["request-retry", "max-retry-interval", "max-retry-credentials", "streaming", "nonstream-keepalive-interval"];
-  PERF_BLOCK = [PERF_MARKER, "request-retry: 1", "max-retry-interval: 10", "max-retry-credentials: 2", "streaming:", "  keepalive-seconds: 15", "  bootstrap-retries: 1", "nonstream-keepalive-interval: 30"].join(`
-`);
-  AUTH_DIR = join8(homedir6(), ".cli-proxy-api");
+  VERSION_FILE = join9(PROXY_CONFIG_DIR, "version");
+  AUTH_DIR = join9(homedir7(), ".cli-proxy-api");
   VERSION_CACHE_TTL = 10 * 60 * 1000;
 });
 
@@ -74712,14 +74934,14 @@ var init_lifecycle = __esm(() => {
 function isAnthropicModel2(modelId) {
   return modelId.toLowerCase().startsWith("claude");
 }
-var baseURL, apiKey, proxy;
+var baseURL, proxy;
 var init_proxy = __esm(() => {
   init_dist6();
   init_dist8();
+  init_key_resolver();
   init_lifecycle();
   init_context_windows();
   baseURL = process.env.PROXY_API_URL || "http://127.0.0.1:8317/v1";
-  apiKey = process.env.PROXY_API_KEY || "soulforge";
   proxy = {
     id: "proxy",
     name: "Proxy",
@@ -74728,6 +74950,7 @@ var init_proxy = __esm(() => {
     asciiIcon: "\u26E8",
     grouped: true,
     createModel(modelId) {
+      const apiKey = getActiveProxyApiKey();
       if (isAnthropicModel2(modelId)) {
         return createAnthropic({
           baseURL,
@@ -74838,8 +75061,8 @@ var init_vercel_gateway = __esm(() => {
     description: "Vercel AI Gateway",
     grouped: true,
     createModel(modelId) {
-      const apiKey2 = getProviderApiKey("AI_GATEWAY_API_KEY");
-      if (!apiKey2) {
+      const apiKey = getProviderApiKey("AI_GATEWAY_API_KEY");
+      if (!apiKey) {
         throw new Error("AI_GATEWAY_API_KEY is not set");
       }
       return gateway(modelId);
@@ -77807,21 +78030,21 @@ var init_xai = __esm(() => {
     asciiIcon: "X",
     description: "Grok models",
     createModel(modelId) {
-      const apiKey2 = getProviderApiKey("XAI_API_KEY");
-      if (!apiKey2) {
+      const apiKey = getProviderApiKey("XAI_API_KEY");
+      if (!apiKey) {
         throw new Error("XAI_API_KEY is not set");
       }
       return createXai({
-        apiKey: apiKey2
+        apiKey
       })(modelId);
     },
     async fetchModels() {
-      const apiKey2 = getProviderApiKey("XAI_API_KEY");
-      if (!apiKey2)
+      const apiKey = getProviderApiKey("XAI_API_KEY");
+      if (!apiKey)
         return null;
       const res = await fetch("https://api.x.ai/v1/models", {
         headers: {
-          Authorization: `Bearer ${apiKey2}`
+          Authorization: `Bearer ${apiKey}`
         }
       });
       if (!res.ok)
@@ -78120,9 +78343,9 @@ var init_summarize = __esm(() => {
 });
 
 // src/core/workers/io.worker.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync3, statSync } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync } from "fs";
 import { readFile, rename, writeFile as writeFile2 } from "fs/promises";
-import { extname, join as join9 } from "path";
+import { extname, join as join10 } from "path";
 
 // node_modules/isbinaryfile/lib/index.js
 import { open, stat } from "fs/promises";
@@ -78496,7 +78719,7 @@ var handlers = {
     const dir = sessionDir;
     const sessionMeta = meta3;
     const entries = tabEntries;
-    if (!existsSync4(dir)) {
+    if (!existsSync5(dir)) {
       mkdirSync4(dir, {
         recursive: true,
         mode: 448
@@ -78524,8 +78747,8 @@ var handlers = {
     const metaJson = JSON.stringify(updatedMeta, null, 2);
     const lines = allMessages.map((m) => JSON.stringify(m)).join(`
 `);
-    const metaPath = join9(dir, "meta.json");
-    const jsonlPath = join9(dir, "messages.jsonl");
+    const metaPath = join10(dir, "meta.json");
+    const jsonlPath = join10(dir, "messages.jsonl");
     const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     const metaTmp = `${metaPath}.${suffix}.tmp`;
     const jsonlTmp = `${jsonlPath}.${suffix}.tmp`;
@@ -78546,7 +78769,7 @@ var handlers = {
       for (const [tabId, msgs] of cores) {
         coreData[tabId] = msgs;
       }
-      const corePath = join9(dir, "core.json");
+      const corePath = join10(dir, "core.json");
       const coreTmp = `${corePath}.${suffix}.tmp`;
       await writeFile2(coreTmp, JSON.stringify(coreData), {
         encoding: "utf-8",
@@ -78557,14 +78780,14 @@ var handlers = {
   },
   loadSession: async (sessionDir) => {
     const dir = sessionDir;
-    const metaPath = join9(dir, "meta.json");
-    if (!existsSync4(metaPath))
+    const metaPath = join10(dir, "meta.json");
+    if (!existsSync5(metaPath))
       return null;
-    const meta3 = JSON.parse(readFileSync3(metaPath, "utf-8"));
-    const jsonlPath = join9(dir, "messages.jsonl");
+    const meta3 = JSON.parse(readFileSync4(metaPath, "utf-8"));
+    const jsonlPath = join10(dir, "messages.jsonl");
     const allMessages = [];
-    if (existsSync4(jsonlPath)) {
-      const content = readFileSync3(jsonlPath, "utf-8").trim();
+    if (existsSync5(jsonlPath)) {
+      const content = readFileSync4(jsonlPath, "utf-8").trim();
       if (content) {
         for (const line of content.split(`
 `)) {
@@ -78586,11 +78809,11 @@ var handlers = {
       } = tab.messageRange;
       tabEntries.push([tab.id, allMessages.slice(startLine, endLine)]);
     }
-    const corePath = join9(dir, "core.json");
+    const corePath = join10(dir, "core.json");
     let coreEntries;
-    if (existsSync4(corePath)) {
+    if (existsSync5(corePath)) {
       try {
-        const coreData = JSON.parse(readFileSync3(corePath, "utf-8"));
+        const coreData = JSON.parse(readFileSync4(corePath, "utf-8"));
         coreEntries = Object.entries(coreData);
       } catch {}
     }
@@ -78602,27 +78825,27 @@ var handlers = {
   },
   listSessions: (sessionsDir) => {
     const dir = sessionsDir;
-    if (!existsSync4(dir))
+    if (!existsSync5(dir))
       return [];
     try {
       const entries = readdirSync4(dir);
       const metas = [];
       for (const entry of entries) {
         try {
-          const fullPath = join9(dir, entry);
+          const fullPath = join10(dir, entry);
           const s = statSync(fullPath);
           if (!s.isDirectory())
             continue;
-          const metaPath = join9(fullPath, "meta.json");
-          if (!existsSync4(metaPath))
+          const metaPath = join10(fullPath, "meta.json");
+          if (!existsSync5(metaPath))
             continue;
-          const raw = readFileSync3(metaPath, "utf-8");
+          const raw = readFileSync4(metaPath, "utf-8");
           const meta3 = JSON.parse(raw);
           const totalMessages = (meta3.tabs ?? []).reduce((sum, t) => sum + (t.messageRange.endLine - t.messageRange.startLine), 0);
           let sizeBytes = 0;
           for (const file2 of ["meta.json", "messages.jsonl"]) {
             try {
-              sizeBytes += statSync(join9(fullPath, file2)).size;
+              sizeBytes += statSync(join10(fullPath, file2)).size;
             } catch {}
           }
           metas.push({