@sayknow-cli/coding-agent 0.5.21 → 0.5.23

package/src/modes/controllers/selector-controller.ts

@@ -150,6 +150,7 @@ import { ToolExecutionComponent } from "../components/tool-execution";
 import type { StatusLineSettings } from "../components/tool-status-header";
 import { TranscriptViewerOverlay, transcriptViewerEntries } from "../components/transcript-viewer-overlay";
 import { TreeSelectorComponent } from "../components/tree-selector";
+import { TypeSafeKeyPromptComponent } from "../components/typesafe-key-prompt";
 import { UserMessageSelectorComponent } from "../components/user-message-selector";
 import type { JobsObserver } from "../jobs-observer";
 import type { SessionObserverRegistry } from "../session-observer-registry";
@@ -879,6 +880,8 @@ export class SelectorController {
 						void this.showOAuthSelector("login");
 					} else if (action === "import-credentials") {
 						void this.#handleCredentialImport();
+					} else if (action === "typesafe-key") {
+						this.showTypeSafeKeyPrompt();
 					} else {
 						this.ctx.showStatus(formatProviderOnboardingCommandGuide());
 					}
@@ -892,6 +895,47 @@ export class SelectorController {
 		});
 	}
 
+	/**
+	 * Take a TypeSafe key and verify it before storing.
+	 *
+	 * Verification is not optional here. The decision service fails open by design, so an
+	 * unverified bad key produces no error anywhere: decisions silently keep coming from
+	 * the user's own model while the UI claims TypeSafe is on. Better to keep the prompt
+	 * open and say the key was rejected.
+	 */
+	showTypeSafeKeyPrompt(): void {
+		this.showSelector(done => {
+			let prompt: TypeSafeKeyPromptComponent | undefined;
+			prompt = new TypeSafeKeyPromptComponent(
+				({ apiKey }) => {
+					prompt?.setBusy(true);
+					void (async () => {
+						try {
+							const { formatTypeSafeKeyResult, setTypeSafeKey } = await import("../../setup/decision-provider");
+							const result = await setTypeSafeKey({ apiKey });
+							if (result.error) {
+								prompt?.setError(result.error);
+								this.ctx.ui.requestRender();
+								return;
+							}
+							done();
+							this.ctx.showStatus(formatTypeSafeKeyResult(result));
+						} catch (error) {
+							prompt?.setError(error instanceof Error ? error.message : String(error));
+							this.ctx.ui.requestRender();
+						}
+					})();
+				},
+				() => {
+					done();
+					this.ctx.ui.requestRender();
+				},
+				() => this.ctx.ui.requestRender(),
+			);
+			return { component: prompt, focus: prompt };
+		});
+	}
+
 	async #handleCredentialImport(): Promise<void> {
 		this.ctx.showStatus("Scanning for existing Claude Code / Codex CLI credentials…");
 		const preview = await runExternalCredentialAutoImport({

package/src/modes/interactive-mode.ts

@@ -2133,6 +2133,10 @@ export class InteractiveMode implements InteractiveModeContext {
 		this.#selectorController.showEffortSelector();
 	}
 
+	showTypeSafeKeyPrompt(): void {
+		this.#selectorController.showTypeSafeKeyPrompt();
+	}
+
 	showProviderOnboarding(): void {
 		this.#selectorController.showProviderOnboarding();
 	}

package/src/modes/types.ts

@@ -321,6 +321,8 @@ export interface InteractiveModeContext {
 	showModelSelector(options?: { temporaryOnly?: boolean }): void;
 	showEffortSelector(): void;
 	showProviderOnboarding(): void;
+	/** Open the TypeSafe key prompt (typed decisions; not a chat model). */
+	showTypeSafeKeyPrompt(): void;
 	showPluginSelector(mode?: "install" | "uninstall"): void;
 	showUserMessageSelector(): void;
 	showTreeSelector(): void;

package/src/prompts/agents/architect.md

@@ -1,7 +1,7 @@
 ---
 name: architect
 description: Read-only architecture and code-review agent with severity-rated findings and status verdicts
-tools: read, search, find, lsp, ast_grep, web_search, bash, report_finding, irc
+tools: read, search, find, lsp, ast_grep, web_search, bash, report_finding, skill, irc
 thinking-level: high
 blocking: true
 forkContext: allowed

package/src/prompts/agents/critic.md

@@ -1,7 +1,7 @@
 ---
 name: critic
 description: Read-only plan critic that approves only actionable, verifiable execution plans
-tools: read, search, find, lsp, ast_grep, web_search, bash, irc
+tools: read, search, find, lsp, ast_grep, web_search, bash, skill, irc
 thinking-level: high
 bashAllowedPrefixes:
   - skc ralplan --write

package/src/prompts/agents/planner.md

@@ -1,7 +1,7 @@
 ---
 name: planner
 description: Read-only planning agent for sequencing, acceptance criteria, risks, and handoff shape
-tools: read, search, find, lsp, ast_grep, web_search, bash, irc
+tools: read, search, find, lsp, ast_grep, web_search, bash, skill, irc
 thinking-level: medium
 bashAllowedPrefixes:
   - skc ralplan --write

package/src/sdk/bus/native-runtime-compatibility.ts

@@ -1,3 +1,5 @@
+import { fileURLToPath } from "node:url";
+
 const REQUIRED_WORKFLOW_ARBITRATION_METHODS = ["registerArbitratedAsk", "retireIfUnclaimed", "stopAndWait"] as const;
 
 export class NativeRuntimeCompatibilityError extends Error {
@@ -8,12 +10,20 @@ export class NativeRuntimeCompatibilityError extends Error {
 		readonly runtimeVersion: string,
 		readonly nativeVersion: string,
 		readonly workflowArbitrationAvailable: boolean,
+		readonly nativeModulePath: string | null = null,
 	) {
+		const loadedFrom = nativeModulePath ? ` (loaded from ${nativeModulePath})` : "";
+		const causes = [
+			...(runtimeVersion === nativeVersion
+				? []
+				: [`loaded native version is ${nativeVersion}${loadedFrom}, expected ${runtimeVersion}`]),
+			...(workflowArbitrationAvailable ? [] : [`required workflow arbitration methods are missing${loadedFrom}`]),
+		];
 		super(
 			`Incompatible @sayknow-cli/natives for @sayknow-cli/coding-agent@${runtimeVersion}: ` +
-				`loaded native version is ${nativeVersion}, and required workflow arbitration methods are ` +
-				`${workflowArbitrationAvailable ? "available" : "missing"}. ` +
-				`Reinstall matching @sayknow-cli/coding-agent and @sayknow-cli/natives packages.`,
+				`${causes.join("; ")}. ` +
+				`Reinstall matching @sayknow-cli/coding-agent and @sayknow-cli/natives packages, ` +
+				`and remove any stale nested node_modules copy of @sayknow-cli/natives that shadows it.`,
 		);
 		this.name = "NativeRuntimeCompatibilityError";
 	}
@@ -27,10 +37,26 @@ function hasWorkflowArbitrationMethods(notificationServer: unknown): boolean {
 	);
 }
 
+/**
+ * Where the process actually loaded `@sayknow-cli/natives` from. Diagnostic only:
+ * a nested `node_modules` copy wins resolution over a workspace link, so the path
+ * is the difference between "reinstall something" and a one-line fix.
+ */
+function resolveNativeModulePath(): string | null {
+	try {
+		const resolved = import.meta.resolve?.("@sayknow-cli/natives");
+		if (typeof resolved !== "string") return null;
+		return resolved.startsWith("file:") ? fileURLToPath(resolved) : resolved;
+	} catch {
+		return null;
+	}
+}
+
 export function assertNativeRuntimeCompatibility(input: {
 	runtimeVersion: string;
 	nativeVersion: string;
 	notificationServer: unknown;
+	nativeModulePath?: string | null;
 }): void {
 	const workflowArbitrationAvailable = hasWorkflowArbitrationMethods(input.notificationServer);
 	if (input.runtimeVersion !== input.nativeVersion || !workflowArbitrationAvailable)
@@ -38,5 +64,6 @@ export function assertNativeRuntimeCompatibility(input: {
 			input.runtimeVersion,
 			input.nativeVersion,
 			workflowArbitrationAvailable,
+			input.nativeModulePath ?? resolveNativeModulePath(),
 		);
 }

package/src/session/agent-session.ts

@@ -202,6 +202,8 @@ import { onAppendOnlyModeChanged } from "../config/settings";
 import type { SettingPath } from "../config/settings-schema";
 import { getDefault } from "../config/settings-schema";
 import { RawSseDebugBuffer } from "../debug/raw-sse-buffer";
+import { createDecisionService } from "../decisions";
+import { createSemanticSkillRouter, type SkillRouter } from "../decisions/skill-routing";
 import { loadCapability } from "../discovery";
 import { expandApplyPatchToEntries, normalizeDiff, normalizeToLF, ParseError, previewPatch, stripBom } from "../edit";
 import { MAX_EDIT_FILE_BYTES } from "../edit/read-file";
@@ -260,7 +262,12 @@ import { expandSlashCommand, type FileSlashCommand } from "../extensibility/slas
 import { GoalRuntime } from "../goals/runtime";
 import type { Goal, GoalModeState } from "../goals/state";
 import type { HindsightSessionState } from "../hindsight/state";
-import { buildSkillStopOutput, ensureWorkflowSkillActivationState } from "../hooks/skill-state";
+import {
+	buildSkillStopOutput,
+	detectPrimarySkillKeyword,
+	ensureWorkflowSkillActivationState,
+} from "../hooks/skill-state";
+import { buildUiSkillActivationContext } from "../hooks/ui-skill-keywords";
 import { initializeLocalRoot, type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
 import { shutdownAll as shutdownAllLspClients } from "../lsp/client";
 import { resolveMemoryBackend } from "../memory-backend";
@@ -307,6 +314,7 @@ import {
 } from "../skc-runtime/session-state-sidecar";
 import { requestSkcWorkerIntegrationAttempt } from "../skc-runtime/team-runtime";
 import {
+	type CanonicalSkcWorkflowSkill,
 	isCanonicalSkcWorkflowSkill,
 	readVisibleSkillActiveState,
 	syncSkillActiveState,
@@ -1842,6 +1850,9 @@ export class AgentSession {
 	// Model registry for API key resolution
 	#modelRegistry: ModelRegistry;
 
+	/** Built on first use; the decision service resolves model and credential lazily. */
+	#semanticSkillRouter?: SkillRouter;
+
 	// Tool registry and prompt builder for extensions
 	#toolRegistry: Map<string, AgentTool>;
 	#workflowGateToolSession: ToolSession | undefined;
@@ -7548,6 +7559,78 @@ export class AgentSession {
 	 * @throws Error if streaming and no streamingBehavior specified
 	 * @throws Error if no model selected or no API key available (when not streaming)
 	 */
+	/**
+	 * Semantic workflow routing for prompts the keyword table cannot express.
+	 *
+	 * Runs in this process, not the hook process: the hook only receives paths and
+	 * config, so it has no model registry and no credentials to call anything with.
+	 *
+	 * **The keyword table is not consulted here, and that is deliberate.** An earlier
+	 * version returned early on a keyword hit, on the assumption that the deterministic
+	 * stage had already activated the workflow. That assumption holds only under the
+	 * Codex host, where `skc codex-native-hook` runs on `UserPromptSubmit`. This session
+	 * never fires that hook, so the early return meant a prompt containing an enumerated
+	 * keyword activated *nothing at all* — strictly worse than before the keywords
+	 * existed, because the semantic stage had been handling those phrasings.
+	 *
+	 * Keywords remain advisory in this host, as they always were: the routing rules in
+	 * the system prompt describe them to the model. Only this stage activates, and only
+	 * when it is confident enough to be worth the mutation guard and Stop hook that
+	 * activation switches on.
+	 *
+	 * Deliberately best-effort — a disabled setting, a missing credential, a timeout, a
+	 * nonsense answer or low confidence all resolve to "no activation", which is
+	 * precisely the behaviour before this stage existed.
+	 */
+	async #routeWorkflowSemantically(text: string): Promise<void> {
+		// Stage one: the keyword table. Free, deterministic, and measured at zero false
+		// positives, so it is not gated behind the opt-in setting — gating it was why an
+		// enumerated phrase activated nothing in this host while the Codex hook activated
+		// it fine. Activating here makes the two hosts agree.
+		const keyword = detectPrimarySkillKeyword(text);
+		if (keyword) {
+			await this.#activateWorkflowSkill(keyword.skill);
+			return;
+		}
+
+		// Stage two costs a model call, so it stays opt-in.
+		if (!this.settings.get("decisions.enabled")) return;
+		try {
+			this.#semanticSkillRouter ??= createSemanticSkillRouter(
+				createDecisionService({
+					registry: this.#modelRegistry,
+					settings: this.settings,
+					sessionId: this.sessionManager.getSessionId(),
+					enabled: true,
+				}),
+			);
+			const skill = await this.#semanticSkillRouter(text);
+			if (!skill) return;
+			await this.#activateWorkflowSkill(skill);
+		} catch (error) {
+			logger.debug("agent-session: semantic workflow routing failed", { error: String(error) });
+		}
+	}
+
+	/**
+	 * Seed workflow state and attach the ask tool.
+	 *
+	 * Both routing stages funnel through here, and both are best-effort: a failure to
+	 * write state must never take down the user's turn, so it is logged and swallowed.
+	 */
+	async #activateWorkflowSkill(skill: CanonicalSkcWorkflowSkill): Promise<void> {
+		try {
+			await ensureWorkflowSkillActivationState({
+				cwd: this.sessionManager.getCwd(),
+				skill,
+				sessionId: this.sessionManager.getSessionId(),
+			});
+			this.#attachAskTool();
+		} catch (error) {
+			logger.debug("agent-session: workflow activation failed", { skill, error: String(error) });
+		}
+	}
+
 	async prompt(text: string, options?: PromptOptions): Promise<void> {
 		this.#assertRecoveryHydrationPromoted();
 		const expandPromptTemplates = options?.expandPromptTemplates ?? true;
@@ -7606,6 +7689,20 @@ export class AgentSession {
 		const deepInterviewUserIntentEpoch =
 			claimsGenuineUserIntent && !this.isStreaming ? this.#claimDeepInterviewUserIntent() : undefined;
 
+		// The keyword table in `hooks/skill-keywords.ts` is a list of literal strings, so a
+		// Korean phrasing of "plan this before you touch code" activates nothing. Ask a
+		// cheap model instead, and only for real user turns. Any failure leaves routing to
+		// the system prompt, exactly as before.
+		//
+		// Ordering matters: this runs *after* the deep-interview intent claim above but
+		// before streaming, so a workflow it activates is in place before the ambiguity
+		// detector in `skc-runtime/deep-interview-ambiguity.ts` would otherwise seed one.
+		// Verified end to end: "설계가 위험해 보여 … 승인받을 문서부터 만들자" seeds
+		// deep-interview with the setting off and ralplan with it on. Both are plausible
+		// readings and ralplan is the better one here, but the point is that enabling this
+		// can *change* an activation rather than only add one where there was none.
+		if (claimsGenuineUserIntent && !this.isStreaming) await this.#routeWorkflowSemantically(expandedText);
+
 		// If streaming, queue via steer() or followUp() based on option
 		if (this.isStreaming) {
 			if (!options?.streamingBehavior) {
@@ -7639,6 +7736,7 @@ export class AgentSession {
 			const hasPendingUserDirective = this.#toolChoiceQueue.inspect().includes("user-force");
 			const eagerTodoPrelude =
 				!options?.synthetic && !hasPendingUserDirective ? this.#createEagerTodoPrelude(expandedText) : undefined;
+			const uiSkillPrelude = options?.synthetic ? undefined : this.#createUiSkillPrelude(expandedText);
 
 			const userContent: (TextContent | ImageContent)[] = [{ type: "text", text: expandedText }];
 			if (options?.images) {
@@ -7667,7 +7765,13 @@ export class AgentSession {
 			try {
 				await this.#promptWithMessage(message, expandedText, {
 					...options,
-					prependMessages: eagerTodoPrelude ? [eagerTodoPrelude.message] : undefined,
+					prependMessages:
+						eagerTodoPrelude || uiSkillPrelude
+							? [
+									...(uiSkillPrelude ? [uiSkillPrelude] : []),
+									...(eagerTodoPrelude ? [eagerTodoPrelude.message] : []),
+								]
+							: undefined,
 					admissionLease: admission,
 					resetRetryReplaySafety: true,
 				});
@@ -11914,6 +12018,35 @@ export class AgentSession {
 		});
 	}
 
+	/**
+	 * Deterministic activation for the bundled frontend UI/UX skills.
+	 *
+	 * `hooks/ui-skill-keywords.ts` already knows how to match a prompt against all
+	 * thirteen bundled skills in Korean and English, but the only caller was the Codex
+	 * `UserPromptSubmit` hook — which this host never fires. In an SKC session the skills
+	 * were therefore advertised solely by a sentence in the system prompt, leaving it to
+	 * the model to notice and obey. That is not activation, it is hope.
+	 *
+	 * The matcher is deliberately conservative and measured that way: on sixteen real
+	 * prompts it caught 5 of 8 frontend requests and produced **zero** false positives on
+	 * the 8 backend ones. Missing a match costs nothing — the system-prompt sentence is
+	 * still there — while a wrong match would load a design skill onto a database task.
+	 * That asymmetry is why a reminder is the right shape here and a forced tool call is
+	 * not.
+	 */
+	#createUiSkillPrelude(promptText: string): AgentMessage | undefined {
+		if (this.#planModeState?.enabled) return undefined;
+		const directive = buildUiSkillActivationContext(promptText);
+		if (!directive) return undefined;
+		logger.debug("agent-session: bundled UI skill matched", { promptChars: promptText.length });
+		return {
+			role: "developer",
+			content: [{ type: "text", text: `<system-reminder>\n${directive}\n</system-reminder>` }],
+			attribution: "agent",
+			timestamp: Date.now(),
+		};
+	}
+
 	#createEagerTodoPrelude(promptText: string): { message: AgentMessage; toolChoice?: ToolChoice } | undefined {
 		const eagerTodosEnabled = this.settings.get("todo.eager");
 		const todosEnabled = this.settings.get("todo.enabled");

package/src/setup/decision-provider.ts

@@ -0,0 +1,94 @@
+/**
+ * Store a TypeSafe key so the typed-decision service can use the hosted model.
+ *
+ * TypeSafe is **not** a chat provider: no streaming, no messages, no text output. So it
+ * must not be written into `models.yml` the way `addApiCompatibleProvider` writes
+ * OpenAI-compatible endpoints — that would invent a chat model that cannot answer a
+ * chat request and would show up in the model picker as something users could select.
+ *
+ * Only the credential is stored. The decision backend reads it through the same
+ * `getApiKeyForProvider` path every other provider uses, so adding a key turns the
+ * backend on and removing it turns the backend off, with nothing else to configure.
+ */
+import { AuthStorage } from "@sayknow-cli/ai";
+import { getAgentDbPath } from "@sayknow-cli/utils";
+import { TYPESAFE_PROVIDER } from "../decisions";
+
+const VERIFY_ENDPOINT = "https://api.typesafe.ai/v1/models";
+const VERIFY_TIMEOUT_MS = 10_000;
+
+export interface TypeSafeKeySetupResult {
+	provider: string;
+	verified: boolean;
+	/** Present when verification ran and failed; the key is not stored in that case. */
+	error?: string;
+}
+
+/**
+ * Verify a key against the live API before storing it.
+ *
+ * Storing an unverified key is worse than refusing it: the decision service fails open,
+ * so a bad key produces no error anywhere — it silently falls back to the user's own
+ * model forever, and the user believes TypeSafe is active.
+ */
+export async function verifyTypeSafeKey(apiKey: string, fetchImpl: typeof fetch = fetch): Promise<string | null> {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), VERIFY_TIMEOUT_MS);
+	try {
+		const response = await fetchImpl(VERIFY_ENDPOINT, {
+			headers: { Authorization: `Bearer ${apiKey}` },
+			signal: controller.signal,
+		});
+		if (response.ok) return null;
+		if (response.status === 401 || response.status === 403) return "key rejected by TypeSafe (401/403)";
+		return `TypeSafe returned ${response.status}`;
+	} catch (error) {
+		return `could not reach TypeSafe: ${error instanceof Error ? error.message : String(error)}`;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+export interface SetTypeSafeKeyOptions {
+	apiKey: string;
+	/** Skip the live check. Only for offline setup; the key may be wrong. */
+	skipVerify?: boolean;
+	fetchImpl?: typeof fetch;
+	dbPath?: string;
+}
+
+export async function setTypeSafeKey(options: SetTypeSafeKeyOptions): Promise<TypeSafeKeySetupResult> {
+	const apiKey = options.apiKey.trim();
+	if (!apiKey) throw new Error("TypeSafe API key must not be empty");
+
+	let verified = false;
+	if (!options.skipVerify) {
+		const failure = await verifyTypeSafeKey(apiKey, options.fetchImpl ?? fetch);
+		if (failure) return { provider: TYPESAFE_PROVIDER, verified: false, error: failure };
+		verified = true;
+	}
+
+	const authStorage = await AuthStorage.create(options.dbPath ?? getAgentDbPath());
+	try {
+		await authStorage.set(TYPESAFE_PROVIDER, { type: "api_key", key: apiKey });
+	} finally {
+		authStorage.close();
+	}
+	return { provider: TYPESAFE_PROVIDER, verified };
+}
+
+export async function removeTypeSafeKey(dbPath?: string): Promise<void> {
+	const authStorage = await AuthStorage.create(dbPath ?? getAgentDbPath());
+	try {
+		await authStorage.remove(TYPESAFE_PROVIDER);
+	} finally {
+		authStorage.close();
+	}
+}
+
+export function formatTypeSafeKeyResult(result: TypeSafeKeySetupResult): string {
+	if (result.error) return `✗ TypeSafe key not stored: ${result.error}`;
+	return result.verified
+		? "✓ TypeSafe key verified and stored. Typed decisions will use the hosted model."
+		: "✓ TypeSafe key stored (unverified). Typed decisions will try the hosted model.";
+}

package/src/setup/model-onboarding-guidance.ts

@@ -6,6 +6,11 @@ export const MODEL_ONBOARDING_PROVIDER_PRESET_COMMAND = "/provider add --preset
 
 export const MODEL_ONBOARDING_SETUP_COMMAND = "skc setup provider";
 export const MODEL_ONBOARDING_OAUTH_COMMAND = "/provider login [provider-id] or /login [provider-id]";
+/**
+ * TypeSafe is not a chat model and never appears in the model list, so the only way a
+ * user learns it exists is from the surfaces where they go to add credentials.
+ */
+export const MODEL_ONBOARDING_TYPESAFE_COMMAND = "/provider typesafe";
 
 export function formatModelOnboardingGuidance(): string {
 	return [
@@ -15,12 +20,13 @@ export function formatModelOnboardingGuidance(): string {
 		`Provider presets: ${MODEL_ONBOARDING_PROVIDER_PRESET_COMMAND} (or ${MODEL_ONBOARDING_SETUP_COMMAND} --preset <preset>).`,
 		`API-compatible custom providers: ${MODEL_ONBOARDING_API_PROVIDER_COMMAND}.`,
 		`OAuth/subscription providers: ${MODEL_ONBOARDING_OAUTH_COMMAND}.`,
+		`Typed decisions (not a chat model): ${MODEL_ONBOARDING_TYPESAFE_COMMAND} adds a TypeSafe key.`,
 		"Then run /model to select a configured model or assign it to a target.",
 	].join("\n");
 }
 
 export function formatModelOnboardingInlineHint(): string {
-	return `Add MiniMax/GLM presets with ${MODEL_ONBOARDING_PROVIDER_PRESET_COMMAND}; custom API providers with ${MODEL_ONBOARDING_API_PROVIDER_COMMAND} (or ${MODEL_ONBOARDING_SETUP_COMMAND}); OAuth/subscription with ${MODEL_ONBOARDING_OAUTH_COMMAND}; then run /model for DEFAULT, EXECUTOR, ARCHITECT, PLANNER, and CRITIC.`;
+	return `Add MiniMax/GLM presets with ${MODEL_ONBOARDING_PROVIDER_PRESET_COMMAND}; custom API providers with ${MODEL_ONBOARDING_API_PROVIDER_COMMAND} (or ${MODEL_ONBOARDING_SETUP_COMMAND}); OAuth/subscription with ${MODEL_ONBOARDING_OAUTH_COMMAND}; TypeSafe typed decisions with ${MODEL_ONBOARDING_TYPESAFE_COMMAND}; then run /model for DEFAULT, EXECUTOR, ARCHITECT, PLANNER, and CRITIC.`;
 }
 
 export function formatNoModelOnboardingError(): string {

package/src/slash-commands/builtin-registry.ts

@@ -1288,7 +1288,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 	{
 		name: "provider",
 		description: "Set up API-compatible providers or login providers",
-		inlineHint: "add|login",
+		inlineHint: "add|login|typesafe",
 		allowArgs: true,
 		handle: async (command, runtime) => {
 			const args = command.args.trim();
@@ -1296,6 +1296,15 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 				await runtime.output(providerSetupUsage());
 				return commandConsumed();
 			}
+			if (args === "typesafe") {
+				await runtime.output(
+					"TypeSafe key entry needs an interactive terminal.\n" +
+						"Run it in the TUI (/provider typesafe) or from a shell:\n" +
+						"  TYPESAFE_API_KEY=<key> skc setup typesafe\n" +
+						"  skc setup typesafe --remove",
+				);
+				return commandConsumed();
+			}
 			if (args === "login" || args.startsWith("login ")) {
 				const providerId = args.slice("login".length).trim();
 				const loginCommand = providerId ? `/login ${providerId}` : "/login [provider-id]";
@@ -1361,6 +1370,14 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 				runtime.ctx.editor.setText("");
 				return;
 			}
+			// TypeSafe is not a chat model, so it cannot live in the model list. A direct
+			// subcommand keeps it one step away from `/model`, where users actually look
+			// for "add a key", instead of buried in the onboarding menu.
+			if (args === "typesafe") {
+				runtime.ctx.showTypeSafeKeyPrompt();
+				runtime.ctx.editor.setText("");
+				return;
+			}
 			if (args.startsWith("add ")) {
 				const parsed = parseProviderSetupSlashArgs(args.slice(4));
 				try {