@sayknow-cli/coding-agent 0.5.21 → 0.5.23

package/src/decisions/skill-routing.ts

@@ -0,0 +1,123 @@
+/**
+ * Semantic fallback for workflow-skill routing.
+ *
+ * The keyword table in `hooks/skill-keywords.ts` is thirteen literal strings. It is
+ * exact and free, and it is the right first stage — but measured against realistic
+ * paraphrases it recalls 4/17, and **0/9 in Korean**, which is most of our users. A
+ * miss is not fatal (the model still sees the routing rules in the system prompt), but
+ * it means the deterministic gate simply does not exist for those prompts.
+ *
+ * This module fills that gap only where the keyword stage produced nothing:
+ *
+ *   keyword (exact, free) -> semantic (this, one cheap call) -> system prompt (as today)
+ *
+ * The two stages fail in opposite directions, which is why both are kept. Measured on
+ * the same 22 prompts, the literal stage is the one that catches `ultragoal this` and
+ * `consensus plan`; the semantic stage is the one that catches everything Korean.
+ */
+import { logger } from "@sayknow-cli/utils";
+import { CANONICAL_SKC_WORKFLOW_SKILLS, type CanonicalSkcWorkflowSkill } from "../skill-state/active-state";
+import type { DecisionService } from "./index";
+
+const NONE = "none";
+
+/**
+ * What each workflow is *for*, in the words a user would recognise. These descriptions
+ * are the whole contract with the model — the enum ids alone carry almost no signal.
+ */
+const WORKFLOW_MEANINGS: Record<CanonicalSkcWorkflowSkill, string> = {
+	// Scoped to the *behaviour* the user is asking for, not only to the state of the
+	// request. The earlier wording ("vague about what to build") described a property of
+	// the spec, so a direct instruction to ask rather than assume — the request is not
+	// vague, it is an order about how to proceed — landed on `none`. Measured: that one
+	// prompt was the sole miss in the 23-case set.
+	"deep-interview":
+		"The user wants requirements drawn out of them by questioning before anything is built. Includes explicit instructions to ask rather than assume.",
+	ralplan:
+		"The user wants a deliberate plan, design comparison, or approval before any code is touched. Architecture or sequencing risk is involved.",
+	ultragoal:
+		"The user wants an objective tracked in a durable ledger across many turns until every deliverable is verified.",
+	team: "The work is large enough to split across several coordinated workers running in parallel.",
+};
+
+const ROUTING_INSTRUCTIONS =
+	"Which workflow should handle this user request? Choose none unless the request clearly calls for one of the workflows.";
+
+/** Exported so tests can assert the contract the model is actually given. */
+export function buildRoutingCriteria(): Record<string, string> {
+	const criteria: Record<string, string> = {};
+	for (const skill of CANONICAL_SKC_WORKFLOW_SKILLS) criteria[skill] = WORKFLOW_MEANINGS[skill];
+	criteria[NONE] =
+		"An ordinary request: a question, a bug fix, a small edit, or anything that should just be handled directly.";
+	return criteria;
+}
+
+/** Prompts below this length never carry enough signal to justify a model round-trip. */
+const MIN_PROMPT_CHARS = 12;
+/** Only the opening of a prompt decides its workflow; the rest is payload. */
+const MAX_PROMPT_CHARS = 4_000;
+
+/**
+ * Minimum calibrated confidence required to activate a workflow.
+ *
+ * Activation is a strong move: it switches on the mutation guard, the Stop hook and the
+ * ask tool. Getting it wrong is worse than missing, because the user did not ask for any
+ * of that and has no obvious way to see why it appeared.
+ *
+ * Measured over ten routing prompts against the hosted model: every answer it reported
+ * at 1.00 was correct, and its single wrong answer reported 0.71. The lowest *correct*
+ * confidence was 0.67 — and that case was "none", so gating it out costs nothing. A
+ * floor here therefore removes the observed error without removing a real activation.
+ *
+ * One prompt sits close to this line. "추측하지 말고 모르는 건 다 물어봐" resolves to
+ * deep-interview in 8/8 samples but at 0.76-0.83, so the floor has roughly 0.01 of
+ * headroom on it. Raising the floor would drop a correct activation; lowering it would
+ * re-admit the 0.71 error. Treat 0.75 as fitted to a small sample and re-derive it from
+ * real usage rather than nudging it on a hunch.
+ *
+ * Only applied when the backend reports `calibrated: true`. An ordinary LLM answering
+ * through a forced enum has no meaningful confidence to compare against, so gating on a
+ * number it did not really produce would just be superstition.
+ */
+const MIN_CALIBRATED_CONFIDENCE = 0.75;
+
+export type SkillRouter = (text: string) => Promise<CanonicalSkcWorkflowSkill | null>;
+
+/**
+ * Build the semantic router. Returns null-resolving function when the service is
+ * disabled so the caller keeps its existing behaviour with no branching.
+ */
+export function createSemanticSkillRouter(service: DecisionService): SkillRouter {
+	const criteria = buildRoutingCriteria();
+	return async (text: string): Promise<CanonicalSkcWorkflowSkill | null> => {
+		if (!service.enabled) return null;
+		const trimmed = text.trim();
+		if (trimmed.length < MIN_PROMPT_CHARS) return null;
+		const state = trimmed.length > MAX_PROMPT_CHARS ? trimmed.slice(0, MAX_PROMPT_CHARS) : trimmed;
+
+		const result = await service.decide({
+			state,
+			questions: { workflow: { type: "choice", instructions: ROUTING_INSTRUCTIONS, criteria } },
+		});
+		const answer = result?.answers.workflow;
+		if (!result || answer?.type !== "choice" || answer.choice === NONE) return null;
+		const skill = CANONICAL_SKC_WORKFLOW_SKILLS.find(candidate => candidate === answer.choice);
+		if (!skill) return null;
+		if (result.calibrated && (answer.confidence ?? 0) < MIN_CALIBRATED_CONFIDENCE) {
+			logger.debug("decisions/skill-routing: below confidence floor, leaving routing alone", {
+				skill,
+				confidence: answer.confidence,
+				floor: MIN_CALIBRATED_CONFIDENCE,
+			});
+			return null;
+		}
+		logger.debug("decisions/skill-routing: semantic match", {
+			skill,
+			backend: result.backend,
+			confidence: answer.confidence,
+			calibrated: result.calibrated,
+			durationMs: result.durationMs,
+		});
+		return skill;
+	};
+}

package/src/decisions/types.ts

@@ -0,0 +1,119 @@
+/**
+ * Typed decisions — "Jev-shaped" structured judgments for code to branch on.
+ *
+ * The request/response shape follows TypeSafe's System One API so a backend can be
+ * swapped without touching call sites: the hosted `jev` model, a self-hosted OpenJev
+ * daemon, or — the default — the model the user is already logged into.
+ *
+ * What this is NOT: a probability oracle. Only the hosted model returns calibrated
+ * probabilities. Backends that constrain an ordinary LLM return an ordinal value and
+ * report `calibrated: false`; treat those numbers as a ranking, never as P(correct).
+ */
+
+/** Pick exactly one option from a closed set. */
+export interface ChoiceQuestion {
+	type: "choice";
+	instructions: string;
+	/** option id -> what that option means. At least two. */
+	criteria: Record<string, string>;
+}
+
+/** Rate the state against ordered levels. Level 0 is the lowest. */
+export interface ScoreQuestion {
+	type: "score";
+	instructions: string;
+	/** Ordered level descriptions, lowest first. At least two. */
+	criteria: string[];
+}
+
+/** Is this statement true of the state? */
+export interface NoulQuestion {
+	type: "noul";
+	instructions: string;
+}
+
+export type Question = ChoiceQuestion | ScoreQuestion | NoulQuestion;
+
+export interface ChoiceAnswer {
+	type: "choice";
+	/** The selected option id. Always one of the declared `criteria` keys. */
+	choice: string;
+	/** Present only when the backend exposes a distribution. */
+	probabilities?: Record<string, number>;
+	/**
+	 * How certain the backend is, 0..1. Only meaningful when the result reports
+	 * `calibrated: true` — that is the difference between a number you can threshold on
+	 * and a number that merely ranks. Absent when the backend cannot supply one.
+	 */
+	confidence?: number;
+}
+
+export interface ScoreAnswer {
+	type: "score";
+	/** Level index. Fractional only when the backend returns a distribution. */
+	score: number;
+	/** Selected level index. */
+	level: number;
+	legend: Record<string, string>;
+	probabilities?: Record<string, number>;
+	/** See {@link ChoiceAnswer.confidence}. */
+	confidence?: number;
+}
+
+export interface NoulAnswer {
+	type: "noul";
+	/** 0 (no) .. 1 (yes). Ordinal unless `calibrated` is true. */
+	noul: number;
+}
+
+export type Answer = ChoiceAnswer | ScoreAnswer | NoulAnswer;
+
+export interface DecisionResult {
+	answers: Record<string, Answer>;
+	/** Which backend answered, for logging and A/B comparison. */
+	backend: string;
+	/** Model identifier the backend used. */
+	model: string;
+	/**
+	 * False means the numbers are ordinal rankings, not probabilities.
+	 * Only the hosted System One model reports true.
+	 */
+	calibrated: boolean;
+	durationMs: number;
+}
+
+export interface DecisionRequest {
+	/** The content to judge. Plain text, or JSON-serialisable structured state. */
+	state: string | Record<string, unknown> | unknown[];
+	/** Question id -> question. Answers come back under the same ids. */
+	questions: Record<string, Question>;
+	signal?: AbortSignal;
+}
+
+export interface DecisionBackend {
+	readonly name: string;
+	/** Resolves null when the backend is unavailable (no credentials, offline, disabled). */
+	decide(request: DecisionRequest): Promise<DecisionResult | null>;
+}
+
+export const MIN_OPTIONS = 2;
+/** Matches OpenJev's letter-slot ceiling so a graph stays portable across backends. */
+export const MAX_OPTIONS = 16;
+
+export function validateQuestions(questions: Record<string, Question>): void {
+	const entries = Object.entries(questions);
+	if (entries.length === 0) throw new Error("decisions: questions must not be empty");
+	for (const [key, question] of entries) {
+		if (question.type === "noul") {
+			if (!question.instructions?.trim()) throw new Error(`decisions: ${key} needs instructions`);
+			continue;
+		}
+		const size = question.type === "choice" ? Object.keys(question.criteria).length : question.criteria.length;
+		if (size < MIN_OPTIONS || size > MAX_OPTIONS)
+			throw new Error(`decisions: ${key} needs ${MIN_OPTIONS}-${MAX_OPTIONS} options, got ${size}`);
+	}
+}
+
+export function stateToText(state: DecisionRequest["state"]): string {
+	return typeof state === "string" ? state : JSON.stringify(state);
+}

package/src/decisions/typesafe-backend.ts

@@ -0,0 +1,168 @@
+/**
+ * Decision backend backed by TypeSafe's hosted System One model (`jev`).
+ *
+ * Unlike the LLM backend, this one returns **calibrated probabilities**: the model is
+ * trained to make the number mean what it says, so `confidence` is a value code can
+ * threshold on rather than a ranking. That is the whole reason to prefer it when a key
+ * is present — the type safety alone we already get from enum-constrained tool calls.
+ *
+ * Credentials ride the existing store (`ModelRegistry.getApiKeyForProvider`), so a key
+ * added through the normal "add model" flow turns this backend on and removing it turns
+ * it off. There is nothing extra to configure.
+ *
+ * Deliberately *not* registered in `packages/ai`'s provider registry: that registry is
+ * for streaming chat APIs, and this endpoint has no stream, no messages, and no text
+ * output. Wiring it there would force a `Model` shape onto something that is not a chat
+ * model. It stays a plain HTTP client behind the `DecisionBackend` interface.
+ */
+import { logger } from "@sayknow-cli/utils";
+import type { ModelRegistry } from "../config/model-registry";
+import {
+	type Answer,
+	type DecisionBackend,
+	type DecisionRequest,
+	type DecisionResult,
+	type Question,
+	validateQuestions,
+} from "./types";
+
+/** Provider id under which the key is stored and surfaced in the model list. */
+export const TYPESAFE_PROVIDER = "typesafe";
+const DEFAULT_BASE_URL = "https://api.typesafe.ai";
+const DEFAULT_MODEL = "jev-latest";
+/** The hosted model answers in well under a second; anything slower is a network fault. */
+const REQUEST_TIMEOUT_MS = 10_000;
+
+interface TypeSafeAnswer {
+	type?: string;
+	noul?: number;
+	choice?: string;
+	score?: number;
+	probabilities?: Record<string, number>;
+	legend?: Record<string, string>;
+	confidence?: number;
+}
+
+interface TypeSafeResponse {
+	model?: string;
+	answers?: Record<string, TypeSafeAnswer>;
+	usage?: { input_tokens?: number; output_tokens?: number };
+}
+
+/**
+ * Our question shape is already the System One shape, so this is a rename rather than a
+ * translation — `noul` carries no criteria, `choice` an id→meaning map, `score` an
+ * ordered level array. Keeping them aligned is what lets a caller switch backends
+ * without touching the call site.
+ */
+function toWireQuestions(questions: Record<string, Question>): Record<string, unknown> {
+	const wire: Record<string, unknown> = {};
+	for (const [key, question] of Object.entries(questions)) {
+		wire[key] =
+			question.type === "noul"
+				? { type: "noul", instructions: question.instructions }
+				: { type: question.type, instructions: question.instructions, criteria: question.criteria };
+	}
+	return wire;
+}
+
+/**
+ * Map a wire answer onto our typed answer.
+ *
+ * Anything that does not match the question we asked is dropped rather than coerced: a
+ * decision that looks typed but is not the one we requested is worse than a missing one,
+ * because the caller cannot tell the difference.
+ */
+function toAnswer(question: Question, raw: TypeSafeAnswer | undefined): Answer | null {
+	if (!raw) return null;
+	if (question.type === "noul") {
+		return typeof raw.noul === "number" ? { type: "noul", noul: raw.noul } : null;
+	}
+	if (question.type === "choice") {
+		if (typeof raw.choice !== "string" || !(raw.choice in question.criteria)) return null;
+		return {
+			type: "choice",
+			choice: raw.choice,
+			...(raw.probabilities ? { probabilities: raw.probabilities } : {}),
+			...(typeof raw.confidence === "number" ? { confidence: raw.confidence } : {}),
+		};
+	}
+	if (typeof raw.score !== "number") return null;
+	const level = Math.min(question.criteria.length - 1, Math.max(0, Math.round(raw.score)));
+	return {
+		type: "score",
+		score: raw.score,
+		level,
+		legend: raw.legend ?? Object.fromEntries(question.criteria.map((meaning, index) => [String(index), meaning])),
+		...(raw.probabilities ? { probabilities: raw.probabilities } : {}),
+		...(typeof raw.confidence === "number" ? { confidence: raw.confidence } : {}),
+	};
+}
+
+export interface TypeSafeBackendDeps {
+	registry: ModelRegistry;
+	sessionId?: string;
+	/** Override for self-hosted or proxied deployments. */
+	baseUrl?: string;
+	/** Model id sent in the request body. Named to avoid colliding with the LLM backend's `model`. */
+	modelId?: string;
+	/** Injected in tests; defaults to global fetch. */
+	fetchImpl?: typeof fetch;
+}
+
+export function createTypeSafeDecisionBackend(deps: TypeSafeBackendDeps): DecisionBackend {
+	const baseUrl = (deps.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+	const model = deps.modelId ?? DEFAULT_MODEL;
+	const doFetch = deps.fetchImpl ?? fetch;
+
+	return {
+		name: "typesafe",
+		async decide(request: DecisionRequest): Promise<DecisionResult | null> {
+			validateQuestions(request.questions);
+			const apiKey = await deps.registry.getApiKeyForProvider(TYPESAFE_PROVIDER, deps.sessionId);
+			// No key means the user never added TypeSafe. That is not an error — the next
+			// backend (their logged-in model) handles it.
+			if (!apiKey) return null;
+
+			const controller = new AbortController();
+			const abortOnCaller = () => controller.abort();
+			request.signal?.addEventListener("abort", abortOnCaller, { once: true });
+			const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+			const started = Date.now();
+			try {
+				const response = await doFetch(`${baseUrl}/v1/systemone`, {
+					method: "POST",
+					headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+					body: JSON.stringify({ state: request.state, model, questions: toWireQuestions(request.questions) }),
+					signal: controller.signal,
+				});
+				if (!response.ok) {
+					logger.debug("decisions/typesafe: request failed", {
+						status: response.status,
+						body: (await response.text().catch(() => "")).slice(0, 300),
+					});
+					return null;
+				}
+				const payload = (await response.json()) as TypeSafeResponse;
+				const answers: Record<string, Answer> = {};
+				for (const [key, question] of Object.entries(request.questions)) {
+					const answer = toAnswer(question, payload.answers?.[key]);
+					if (answer) answers[key] = answer;
+				}
+				if (Object.keys(answers).length === 0) return null;
+				return {
+					answers,
+					backend: "typesafe",
+					model: payload.model ?? model,
+					// The hosted System One model is trained for calibration; this is the one
+					// backend allowed to claim it.
+					calibrated: true,
+					durationMs: Date.now() - started,
+				};
+			} finally {
+				clearTimeout(timer);
+				request.signal?.removeEventListener("abort", abortOnCaller);
+			}
+		},
+	};
+}

package/src/hooks/skill-keywords.ts

@@ -36,6 +36,26 @@ export const SKC_SKILL_KEYWORD_DEFINITIONS: readonly SkillKeywordDefinition[] =
 		priority: 8,
 		guidance: "Activate SKC deep-interview requirements workflow",
 	},
+	// Korean counterparts. The table was English-only, which is why the deterministic
+	// stage recalled 0/9 on Korean prompts while scoring 4/8 on English ones — the gap
+	// was never about phrasing being harder to detect, it was about nobody enumerating it.
+	//
+	// These stay deliberately narrow. A keyword fires with full authority and no
+	// confidence to fall back on, so a loose phrase here activates a workflow the user
+	// never asked for — worse than missing one, because the semantic stage still catches
+	// paraphrases behind it.
+	{
+		keyword: "추측하지 말",
+		skill: "deep-interview",
+		priority: 8,
+		guidance: "Activate SKC deep-interview requirements workflow",
+	},
+	{
+		keyword: "인터뷰하듯",
+		skill: "deep-interview",
+		priority: 8,
+		guidance: "Activate SKC deep-interview requirements workflow",
+	},
 	{
 		keyword: "$ralplan",
 		skill: "ralplan",
@@ -48,6 +68,18 @@ export const SKC_SKILL_KEYWORD_DEFINITIONS: readonly SkillKeywordDefinition[] =
 		priority: 9,
 		guidance: "Activate SKC ralplan planning workflow",
 	},
+	{
+		keyword: "합의된 계획",
+		skill: "ralplan",
+		priority: 9,
+		guidance: "Activate SKC ralplan planning workflow",
+	},
+	{
+		keyword: "계획서 만들",
+		skill: "ralplan",
+		priority: 9,
+		guidance: "Activate SKC ralplan planning workflow",
+	},
 	{
 		keyword: "$ultragoal",
 		skill: "ultragoal",
@@ -60,6 +92,18 @@ export const SKC_SKILL_KEYWORD_DEFINITIONS: readonly SkillKeywordDefinition[] =
 		priority: 8,
 		guidance: "Activate SKC ultragoal durable goal workflow",
 	},
+	{
+		keyword: "끝까지 추적",
+		skill: "ultragoal",
+		priority: 8,
+		guidance: "Activate SKC ultragoal durable goal workflow",
+	},
+	{
+		keyword: "장기 목표로",
+		skill: "ultragoal",
+		priority: 8,
+		guidance: "Activate SKC ultragoal durable goal workflow",
+	},
 	{
 		keyword: "$team",
 		skill: "team",
@@ -72,6 +116,18 @@ export const SKC_SKILL_KEYWORD_DEFINITIONS: readonly SkillKeywordDefinition[] =
 		priority: 8,
 		guidance: "Activate SKC team workflow",
 	},
+	{
+		keyword: "병렬로 돌려",
+		skill: "team",
+		priority: 8,
+		guidance: "Activate SKC team workflow",
+	},
+	{
+		keyword: "팀 구성해서",
+		skill: "team",
+		priority: 8,
+		guidance: "Activate SKC team workflow",
+	},
 ] as const;
 
 export function isSkcWorkflowSkill(value: string): value is SkcWorkflowSkill {

package/src/hooks/skill-state.ts

@@ -121,6 +121,12 @@ export interface RecordSkillActivationInput {
 	turnId?: string;
 	nowIso?: string;
 	stateDir?: string;
+	/**
+	 * Semantic fallback, consulted only when no keyword matched. Supplying it turns the
+	 * literal keyword table into a two-stage router; omitting it keeps the historical
+	 * keyword-only behaviour byte for byte.
+	 */
+	resolveSkillSemantically?: (text: string) => Promise<SkcWorkflowSkill | null>;
 }
 
 export interface StopHookInput {
@@ -471,8 +477,18 @@ async function seedSkillActivationState(
 // real /skill dispatch paths resolve sub-skill activation before prompt construction.
 export async function recordSkillActivation(input: RecordSkillActivationInput): Promise<SkillActiveState | null> {
 	const match = detectPrimarySkillKeyword(input.text);
-	if (!match) return null;
-	return await seedSkillActivationState(match.skill, match.keyword, "skc-skill-state-hook", input);
+	if (match) return await seedSkillActivationState(match.skill, match.keyword, "skc-skill-state-hook", input);
+	if (!input.resolveSkillSemantically) return null;
+	// The semantic stage is advisory: any failure leaves routing to the system prompt,
+	// exactly as it behaved before this stage existed.
+	let semantic: SkcWorkflowSkill | null = null;
+	try {
+		semantic = await input.resolveSkillSemantically(input.text);
+	} catch {
+		return null;
+	}
+	if (!semantic) return null;
+	return await seedSkillActivationState(semantic, `semantic:${semantic}`, "skc-skill-decision", input);
 }
 
 export interface EnsureWorkflowSkillActivationInput {

package/src/modes/components/provider-onboarding-selector.ts

@@ -4,7 +4,12 @@ import { matchesSelectCancel } from "../../modes/utils/keybinding-matchers";
 import { formatModelOnboardingGuidance } from "../../setup/model-onboarding-guidance";
 import { DynamicBorder } from "./dynamic-border";
 
-export type ProviderOnboardingAction = "custom-provider-wizard" | "oauth-login" | "import-credentials" | "api-guide";
+export type ProviderOnboardingAction =
+	| "custom-provider-wizard"
+	| "oauth-login"
+	| "import-credentials"
+	| "api-guide"
+	| "typesafe-key";
 
 interface ProviderOnboardingOption {
 	label: string;
@@ -28,6 +33,13 @@ const PROVIDER_ONBOARDING_OPTIONS: ProviderOnboardingOption[] = [
 		description: "Show the /provider add and skc setup provider commands.",
 		action: "api-guide",
 	},
+	{
+		// Not a chat model, so it never shows in the model picker — but this list is where
+		// users come to add a key, and a CLI-only path means nobody turns it on.
+		label: "Add TypeSafe key (typed decisions)",
+		description: "Route workflow decisions through the hosted System One model. Off entirely without a key.",
+		action: "typesafe-key",
+	},
 	{
 		label: "Import existing credentials",
 		description: "Detect and import Claude Code / Codex CLI logins already on this machine.",

package/src/modes/components/typesafe-key-prompt.ts

@@ -0,0 +1,108 @@
+/**
+ * Key entry for TypeSafe, reachable from the same place models are added.
+ *
+ * TypeSafe is not a chat model, so it never appears in the model picker — but the place
+ * users look when they want to "add a model with a key" is this onboarding list, and
+ * making them find a CLI subcommand instead would mean most users never enable it.
+ *
+ * The key is taken through {@link SecretInput} and consumed once: it is never rendered,
+ * never placed in a flag, and never written anywhere but the credential store.
+ */
+import { Container, type Input, matchesKey, SecretInput, Spacer, Text, TruncatedText } from "@sayknow-cli/tui";
+import { theme } from "../theme/theme";
+import { matchesSelectCancel } from "../utils/keybinding-matchers";
+import { DynamicBorder } from "./dynamic-border";
+
+export interface TypeSafeKeyPromptResult {
+	apiKey: string;
+}
+
+export class TypeSafeKeyPromptComponent extends Container {
+	#content: Container;
+	#input: SecretInput | null = null;
+	#onSubmit: (result: TypeSafeKeyPromptResult) => void;
+	#onCancel: () => void;
+	#onRender: () => void;
+	#busy = false;
+	#error: string | null = null;
+
+	constructor(
+		onSubmit: (result: TypeSafeKeyPromptResult) => void,
+		onCancel: () => void,
+		onRender: () => void = () => {},
+	) {
+		super();
+		this.#onSubmit = onSubmit;
+		this.#onCancel = onCancel;
+		this.#onRender = onRender;
+		this.#content = new Container();
+		this.addChild(new DynamicBorder());
+		this.addChild(new Spacer(1));
+		this.addChild(new TruncatedText(theme.bold("TypeSafe (typed decisions)")));
+		this.addChild(
+			new TruncatedText(
+				theme.fg(
+					"muted",
+					"  Routes workflow decisions through the hosted System One model instead of your chat model.",
+				),
+				0,
+				0,
+			),
+		);
+		this.addChild(
+			new TruncatedText(theme.fg("muted", "  Without a key this stays off and nothing else changes."), 0, 0),
+		);
+		this.addChild(new Spacer(1));
+		this.addChild(this.#content);
+		this.addChild(new Spacer(1));
+		this.addChild(new DynamicBorder());
+		this.#render();
+	}
+
+	/** Shown while the key is being checked against the live API. */
+	setBusy(busy: boolean): void {
+		this.#busy = busy;
+		this.#render();
+	}
+
+	/** Keeps the prompt open so a rejected key can be corrected without restarting. */
+	setError(message: string): void {
+		this.#busy = false;
+		this.#error = message;
+		this.#render();
+	}
+
+	#render(): void {
+		this.#content.clear();
+		if (this.#busy) {
+			this.#input = null;
+			this.#content.addChild(new Text(theme.fg("muted", "Verifying key against TypeSafe…"), 0, 0));
+			this.#onRender();
+			return;
+		}
+		if (this.#error) {
+			this.#content.addChild(new Text(theme.fg("error", this.#error), 0, 0));
+			this.#content.addChild(new Spacer(1));
+		}
+		this.#content.addChild(new Text("Paste your TypeSafe API key:", 0, 0));
+		this.#content.addChild(new Spacer(1));
+		const input = new SecretInput();
+		input.onSubmit = secret => {
+			const apiKey = secret.consume().trim();
+			if (!apiKey) return;
+			this.#error = null;
+			this.#onSubmit({ apiKey });
+		};
+		this.#input = input;
+		this.#content.addChild(input);
+		this.#onRender();
+	}
+
+	handleInput(keyData: string): void {
+		if (matchesSelectCancel(keyData) || matchesKey(keyData, "escape")) {
+			this.#onCancel();
+			return;
+		}
+		(this.#input as Input | SecretInput | null)?.handleInput(keyData);
+	}
+}