@skillrecordings/cli 0.15.0 → 0.16.1

package/dist/index.js

@@ -1479,9 +1479,9 @@ var require_url_state_machine = __commonJS({
         url.username += percentEncodeChar(decoded[i], isUserinfoPercentEncode);
       }
     };
-    module.exports.setThePassword = function(url, password2) {
+    module.exports.setThePassword = function(url, password3) {
       url.password = "";
-      const decoded = punycode.ucs2.decode(password2);
+      const decoded = punycode.ucs2.decode(password3);
       for (let i = 0; i < decoded.length; ++i) {
         url.password += percentEncodeChar(decoded[i], isUserinfoPercentEncode);
       }
@@ -16736,7 +16736,7 @@ var require_proxy_agent = __commonJS({
         const { proxyTunnel = true } = opts;
         super();
         const url = this.#getUrl(opts);
-        const { href, origin, port, protocol, username, password: password2, hostname: proxyHostname } = url;
+        const { href, origin, port, protocol, username, password: password3, hostname: proxyHostname } = url;
         this[kProxy] = { uri: href, protocol };
         this[kRequestTls] = opts.requestTls;
         this[kProxyTls] = opts.proxyTls;
@@ -16748,8 +16748,8 @@ var require_proxy_agent = __commonJS({
           this[kProxyHeaders]["proxy-authorization"] = `Basic ${opts.auth}`;
         } else if (opts.token) {
           this[kProxyHeaders]["proxy-authorization"] = opts.token;
-        } else if (username && password2) {
-          this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password2)}`).toString("base64")}`;
+        } else if (username && password3) {
+          this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password3)}`).toString("base64")}`;
         }
         const connect = buildConnector({ ...opts.proxyTls });
         this[kConnectEndpoint] = buildConnector({ ...opts.requestTls });
@@ -19843,7 +19843,7 @@ var require_snapshot_recorder = __commonJS({
     "use strict";
     init_esm_shims();
     var { writeFile: writeFile9, readFile: readFile10, mkdir: mkdir2 } = __require("fs/promises");
-    var { dirname: dirname8, resolve: resolve9 } = __require("path");
+    var { dirname: dirname7, resolve: resolve9 } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -20074,7 +20074,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         const resolvedPath = resolve9(path);
-        await mkdir2(dirname8(resolvedPath), { recursive: true });
+        await mkdir2(dirname7(resolvedPath), { recursive: true });
         const data2 = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
           snapshot
@@ -26406,8 +26406,8 @@ var require_fetch = __commonJS({
           let authorizationValue = null;
           if (hasAuthenticationEntry(httpRequest) && (httpRequest.useURLCredentials === void 0 || !includesCredentials(requestCurrentURL(httpRequest)))) {
           } else if (includesCredentials(requestCurrentURL(httpRequest)) && isAuthenticationFetch) {
-            const { username, password: password2 } = requestCurrentURL(httpRequest);
-            authorizationValue = `Basic ${Buffer.from(`${username}:${password2}`).toString("base64")}`;
+            const { username, password: password3 } = requestCurrentURL(httpRequest);
+            authorizationValue = `Basic ${Buffer.from(`${username}:${password3}`).toString("base64")}`;
           }
           if (authorizationValue !== null) {
             httpRequest.headersList.append("Authorization", authorizationValue, false);
@@ -74714,24 +74714,24 @@ init_esm_shims();
 var ABBREVIATED_THRESHOLD = 2;
 var MINIMAL_THRESHOLD = 5;
 var ROOT_DESCRIPTIONS = {
-  full: "Skill Recordings support agent CLI \u2014 triage, investigate, and manage customer conversations.\n\n  Getting Started:\n    1. skill auth setup        Configure 1Password secrets (Front API token, DB, etc.)\n    2. skill auth status        Verify your credentials are working\n    3. skill front inbox        See what needs attention right now\n\n  Common Workflows:\n    Triage inbox          skill front inbox \u2192 skill front triage\n    Investigate ticket    skill front conversation <id> --messages\n    Bulk cleanup          skill front bulk-archive --older-than 30d\n    Generate report       skill front report --inbox support\n    Check deploys         skill deploys\n\n  For AI Agents (Claude Code, MCP):\n    skill mcp              Start JSON-RPC server with 9 Front tools\n    skill plugin sync      Install the Claude Code plugin\n    All commands support --json for structured, HATEOAS-enriched output",
-  abbreviated: "Skill Recordings support agent CLI \u2014 triage and investigate support conversations.\n\n  Start here:\n    skill auth setup        Configure 1Password + secrets\n    skill front inbox       See what needs attention\n    skill front triage      Auto-categorize conversations\n\n  Common:\n    skill front conversation <id> --messages\n    skill front reply <id>\n    skill deploys\n    skill mcp\n",
-  minimal: "Skill Recordings support agent CLI. Try: skill front inbox, skill front triage, skill auth status. Use --help for details."
+  full: "Skill Recordings support agent CLI \u2014 triage, investigate, and manage customer conversations.\n\n  Getting Started:\n    1. skill wizard            Interactive app setup wizard\n    2. skill keys              Manage your personal API keys\n    3. skill front inbox        See what needs attention right now\n\n  Common Workflows:\n    Triage inbox          skill front inbox \u2192 skill front triage\n    Investigate ticket    skill front conversation <id> --messages\n    Bulk cleanup          skill front bulk-archive --older-than 30d\n    Generate report       skill front report --inbox support\n    Check deploys         skill deploys\n\n  For AI Agents (Claude Code, MCP):\n    skill mcp              Start JSON-RPC server with 9 Front tools\n    skill plugin sync      Install the Claude Code plugin\n    All commands support --json for structured, HATEOAS-enriched output",
+  abbreviated: "Skill Recordings support agent CLI \u2014 triage and investigate support conversations.\n\n  Start here:\n    skill wizard            Set up a new product\n    skill keys              Manage API keys\n    skill front inbox       See what needs attention\n    skill front triage      Auto-categorize conversations\n\n  Common:\n    skill front conversation <id> --messages\n    skill front reply <id>\n    skill deploys\n    skill mcp\n",
+  minimal: "Skill Recordings support agent CLI. Try: skill wizard, skill keys, skill front inbox, skill front triage. Use --help for details."
 };
 var FRONT_DESCRIPTIONS = {
-  full: "Front conversations, inboxes, tags, archival, and reporting.\n\n  Prerequisites:\n    FRONT_API_TOKEN must be set. Run: skill auth setup\n\n  Start here:\n    skill front inbox                    See unassigned conversations\n    skill front inbox support             List conversations in a specific inbox\n    skill front triage                    AI-powered categorization of inbox items\n\n  Investigate a conversation:\n    skill front conversation <id> -m      Full conversation with messages\n    skill front message <id>              Single message details + body\n\n  Take action:\n    skill front assign <id>               Assign to a teammate\n    skill front reply <id>                Draft a reply (HITL, never auto-sends)\n    skill front tag <id>                  Add a tag\n    skill front archive <id>              Archive a resolved conversation\n\n  Bulk operations:\n    skill front bulk-archive              Archive old/spam conversations\n    skill front report                    Volume + tag + sender forensics\n\n  All commands accept --json for HATEOAS-enriched output with _links and _actions.",
-  abbreviated: "Front API workflows for inbox triage and conversation actions.\n\n  Common:\n    skill front inbox\n    skill front triage\n    skill front conversation <id> -m\n    skill front reply <id>\n    skill front archive <id>\n\n  Requires FRONT_API_TOKEN (skill auth setup).",
-  minimal: "Front API commands (inbox, triage, assign, reply, archive). Requires FRONT_API_TOKEN."
+  full: "Front conversations, inboxes, tags, archival, and reporting.\n\n  Start here:\n    skill front inbox                    See unassigned conversations\n    skill front inbox support             List conversations in a specific inbox\n    skill front triage                    AI-powered categorization of inbox items\n\n  Investigate a conversation:\n    skill front conversation <id> -m      Full conversation with messages\n    skill front message <id>              Single message details + body\n\n  Take action:\n    skill front assign <id>               Assign to a teammate\n    skill front reply <id>                Draft a reply (HITL, never auto-sends)\n    skill front tag <id>                  Add a tag\n    skill front archive <id>              Archive a resolved conversation\n\n  Bulk operations:\n    skill front bulk-archive              Archive old/spam conversations\n    skill front report                    Volume + tag + sender forensics\n\n  All commands accept --json for HATEOAS-enriched output with _links and _actions.",
+  abbreviated: "Front API workflows for inbox triage and conversation actions.\n\n  Common:\n    skill front inbox\n    skill front triage\n    skill front conversation <id> -m\n    skill front reply <id>\n    skill front archive <id>",
+  minimal: "Front API commands (inbox, triage, assign, reply, archive)."
 };
 var AUTH_DESCRIPTIONS = {
-  full: "Manage CLI authentication and secrets.\n\n  First time? Start here:\n    skill auth setup          Interactive wizard \u2014 connects to 1Password vault,\n                              configures FRONT_API_TOKEN, DATABASE_URL, and more.\n                              Requires: `op` CLI installed (brew install 1password-cli)\n\n  Check your setup:\n    skill auth status          Shows which secrets are configured and which are missing\n    skill auth whoami          Verify your 1Password service account identity\n\n  All Skill Recordings employees have access to the Support vault in 1Password.\n  The setup wizard handles everything \u2014 no manual token pasting needed.",
-  abbreviated: "Manage CLI authentication and 1Password secrets.\n\n  Start:\n    skill auth setup\n    skill auth status\n    skill auth whoami\n\n  Requires the 1Password CLI (`op`).",
-  minimal: "Auth and 1Password setup commands."
+  full: "View CLI authentication status.\n\n  Check your setup:\n    skill auth status          Shows which secrets are loaded\n    skill auth whoami          Verify your 1Password service account identity\n\n  API keys ship with the CLI (encrypted). To override with personal keys:\n    skill keys                  Manage personal API key overrides",
+  abbreviated: "View CLI authentication status.\n\n  Commands:\n    skill auth status\n    skill auth whoami",
+  minimal: "Auth status commands (auth status, auth whoami)."
 };
 var INNGEST_DESCRIPTIONS = {
-  full: "Inngest event and workflow commands.\n\n  Debug pipeline runs:\n    skill inngest runs --status failed --after 1h    Recent failures\n    skill inngest events --after 12h                 Recent events\n    skill inngest investigate <run-id>                Deep-dive a specific run\n\n  Requires: INNGEST_SIGNING_KEY, INNGEST_EVENT_KEY in env",
-  abbreviated: "Inngest events and workflow runs.\n\n  Common:\n    skill inngest runs --status failed --after 1h\n    skill inngest events --after 12h\n    skill inngest investigate <run-id>\n\n  Requires INNGEST_SIGNING_KEY, INNGEST_EVENT_KEY.",
-  minimal: "Inngest events and runs debugging. Requires INNGEST_SIGNING_KEY and INNGEST_EVENT_KEY."
+  full: "Inngest event and workflow commands.\n\n  Debug pipeline runs:\n    skill inngest runs --status failed --after 1h    Recent failures\n    skill inngest events --after 12h                 Recent events\n    skill inngest investigate <run-id>                Deep-dive a specific run",
+  abbreviated: "Inngest events and workflow runs.\n\n  Common:\n    skill inngest runs --status failed --after 1h\n    skill inngest events --after 12h\n    skill inngest investigate <run-id>",
+  minimal: "Inngest events and runs debugging."
 };
 var GROUP_DESCRIPTIONS = {
   root: ROOT_DESCRIPTIONS,
@@ -76954,11 +76954,11 @@ Saved to ${options.output}`);
   }
 }
 async function toEvalite(options) {
-  const { readFileSync: readFileSync12 } = await import("fs");
+  const { readFileSync: readFileSync13 } = await import("fs");
   const { ctx } = options;
   const outputJson = ctx.format === "json";
   const data2 = JSON.parse(
-    readFileSync12(options.input, "utf-8")
+    readFileSync13(options.input, "utf-8")
   );
   const evaliteData = data2.map((d) => ({
     input: d.triggerMessage.body,
@@ -77019,15 +77019,19 @@ init_esm_shims();
 
 // src/commands/config/get.ts
 init_esm_shims();
-import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
 import { Decrypter as Decrypter2 } from "age-encryption";
 
+// src/commands/config/set.ts
+init_esm_shims();
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { password, select as select2 } from "@inquirer/prompts";
+import { Decrypter, Encrypter, identityToRecipient } from "age-encryption";
+
 // src/commands/config/init.ts
 init_esm_shims();
-import { existsSync as existsSync3, mkdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
-import { generateIdentity, identityToRecipient } from "age-encryption";
 function getUserConfigDir2() {
   return join2(homedir2(), ".config", "skill");
 }
@@ -77036,68 +77040,27 @@ function getAgeKeyPath() {
 }
 async function configInitAction(ctx, options = {}) {
   const outputJson = options.json === true || ctx.format === "json";
-  const keyPath = getAgeKeyPath();
-  const configDir = getUserConfigDir2();
-  if (existsSync3(keyPath) && !options.force) {
-    const result = {
-      success: false,
-      error: `Age key already exists at ${keyPath}. Use --force to overwrite.`
-    };
-    if (outputJson) {
-      ctx.output.data(result);
-    } else {
-      ctx.output.error(result.error);
-      ctx.output.data(`
-To view your public key: skill config public-key`);
-    }
-    process.exitCode = EXIT_CODES.usage;
-    return;
-  }
-  try {
-    if (!existsSync3(configDir)) {
-      mkdirSync(configDir, { recursive: true, mode: 448 });
-    }
-    const identity = await generateIdentity();
-    const recipient = await identityToRecipient(identity);
-    writeFileSync3(keyPath, identity, { encoding: "utf8", mode: 384 });
-    const result = {
-      success: true,
-      keyPath,
-      publicKey: recipient
-    };
-    if (outputJson) {
-      ctx.output.data(result);
-    } else {
-      ctx.output.success("Age keypair generated successfully!");
-      ctx.output.data(`
-Private key saved to: ${keyPath}`);
-      ctx.output.data(`Public key (age recipient): ${recipient}`);
-      ctx.output.data(
-        "\n\u26A0\uFE0F  Keep your private key secure. Anyone with access can decrypt your config."
-      );
-      ctx.output.data("\nNext steps:");
-      ctx.output.data("  1. Set config values: skill config set KEY=value");
-      ctx.output.data("  2. View config: skill config list");
-    }
-  } catch (error) {
-    const result = {
-      success: false,
-      error: error instanceof Error ? error.message : "Failed to generate keypair"
-    };
-    if (outputJson) {
-      ctx.output.data(result);
-    } else {
-      ctx.output.error(`Failed to generate keypair: ${result.error}`);
-    }
-    process.exitCode = EXIT_CODES.error;
+  const result = {
+    success: false,
+    error: "DEPRECATED: skill config init is no longer needed.\nThe CLI now uses the 1Password age key for encryption.\nUse `skill keys` to manage your personal API keys."
+  };
+  if (outputJson) {
+    ctx.output.data(result);
+  } else {
+    ctx.output.error("\u26A0\uFE0F  DEPRECATED: skill config init is no longer needed.");
+    ctx.output.data("");
+    ctx.output.data("The CLI now uses the 1Password age key for encryption.");
+    ctx.output.data("Local age keypairs are no longer required.");
+    ctx.output.data("");
+    ctx.output.data("To manage your personal API keys:");
+    ctx.output.data("  skill keys           Interactive setup");
+    ctx.output.data("  skill keys add       Add a personal API key");
+    ctx.output.data("  skill keys status    Show key provenance");
   }
+  process.exitCode = EXIT_CODES.usage;
 }
 
 // src/commands/config/set.ts
-init_esm_shims();
-import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
-import { password, select as select2 } from "@inquirer/prompts";
-import { Decrypter, Encrypter, identityToRecipient as identityToRecipient2 } from "age-encryption";
 function getEncryptedConfigPath() {
   return `${getUserConfigDir2()}/.env.user.encrypted`;
 }
@@ -77110,7 +77073,7 @@ function parseKeyValue(input2) {
   return { key, value };
 }
 async function readExistingConfig(identity, configPath) {
-  if (!existsSync4(configPath)) {
+  if (!existsSync3(configPath)) {
     return {};
   }
   try {
@@ -77137,7 +77100,7 @@ async function readExistingConfig(identity, configPath) {
 async function configSetAction(ctx, keyValue, options = {}) {
   const outputJson = options.json === true || ctx.format === "json";
   const keyPath = getAgeKeyPath();
-  if (!existsSync4(keyPath)) {
+  if (!existsSync3(keyPath)) {
     const result = {
       success: false,
       error: "Age key not found. Run: skill config init"
@@ -77189,7 +77152,7 @@ async function configSetAction(ctx, keyValue, options = {}) {
   }
   try {
     const identity = readFileSync2(keyPath, "utf8").trim();
-    const recipient = await identityToRecipient2(identity);
+    const recipient = await identityToRecipient(identity);
     const configPath = getEncryptedConfigPath();
     const config = await readExistingConfig(identity, configPath);
     config[parsed.key] = parsed.value;
@@ -77197,7 +77160,7 @@ async function configSetAction(ctx, keyValue, options = {}) {
     const encrypter = new Encrypter();
     encrypter.addRecipient(recipient);
     const encrypted = await encrypter.encrypt(envContent + "\n");
-    writeFileSync4(configPath, Buffer.from(encrypted));
+    writeFileSync3(configPath, Buffer.from(encrypted));
     const result = {
       success: true,
       key: parsed.key,
@@ -77224,9 +77187,24 @@ async function configSetAction(ctx, keyValue, options = {}) {
 }
 
 // src/commands/config/get.ts
+async function getAgeKeyFrom1Password2() {
+  if (!process.env.OP_SERVICE_ACCOUNT_TOKEN) {
+    return null;
+  }
+  try {
+    const { OnePasswordProvider: OnePasswordProvider2 } = await import("./secrets-MGVPGMFJ.js");
+    const op = new OnePasswordProvider2();
+    if (!await op.isAvailable()) {
+      return null;
+    }
+    return await op.resolve("op://Support/skill-cli-age-key/private_key");
+  } catch {
+    return null;
+  }
+}
 async function decryptConfig(identity) {
   const configPath = getEncryptedConfigPath();
-  if (!existsSync5(configPath)) {
+  if (!existsSync4(configPath)) {
     return {};
   }
   const encrypted = readFileSync3(configPath);
@@ -77254,11 +77232,11 @@ async function decryptConfig(identity) {
 }
 async function configGetAction(ctx, key, options = {}) {
   const outputJson = options.json === true || ctx.format === "json";
-  const keyPath = getAgeKeyPath();
-  if (!existsSync5(keyPath)) {
+  const identity = await getAgeKeyFrom1Password2();
+  if (!identity) {
     const result = {
       success: false,
-      error: "Age key not found. Run: skill config init"
+      error: "OP_SERVICE_ACCOUNT_TOKEN not set. Required for encrypted config."
     };
     if (outputJson) {
       ctx.output.data(result);
@@ -77269,7 +77247,6 @@ async function configGetAction(ctx, key, options = {}) {
     return;
   }
   try {
-    const identity = readFileSync3(keyPath, "utf8").trim();
     const config = await decryptConfig(identity);
     if (!(key in config)) {
       const result2 = {
@@ -77312,11 +77289,26 @@ async function configGetAction(ctx, key, options = {}) {
 
 // src/commands/config/list.ts
 init_esm_shims();
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
 import { Decrypter as Decrypter3 } from "age-encryption";
+async function getAgeKeyFrom1Password3() {
+  if (!process.env.OP_SERVICE_ACCOUNT_TOKEN) {
+    return null;
+  }
+  try {
+    const { OnePasswordProvider: OnePasswordProvider2 } = await import("./secrets-MGVPGMFJ.js");
+    const op = new OnePasswordProvider2();
+    if (!await op.isAvailable()) {
+      return null;
+    }
+    return await op.resolve("op://Support/skill-cli-age-key/private_key");
+  } catch {
+    return null;
+  }
+}
 async function decryptConfig2(identity) {
   const configPath = getEncryptedConfigPath();
-  if (!existsSync6(configPath)) {
+  if (!existsSync5(configPath)) {
     return {};
   }
   const encrypted = readFileSync4(configPath);
@@ -77344,11 +77336,11 @@ async function decryptConfig2(identity) {
 }
 async function configListAction(ctx, options = {}) {
   const outputJson = options.json === true || ctx.format === "json";
-  const keyPath = getAgeKeyPath();
-  if (!existsSync6(keyPath)) {
+  const identity = await getAgeKeyFrom1Password3();
+  if (!identity) {
     const result = {
       success: false,
-      error: "Age key not found. Run: skill config init"
+      error: "OP_SERVICE_ACCOUNT_TOKEN not set. Required for encrypted config."
     };
     if (outputJson) {
       ctx.output.data(result);
@@ -77359,7 +77351,6 @@ async function configListAction(ctx, options = {}) {
     return;
   }
   try {
-    const identity = readFileSync4(keyPath, "utf8").trim();
     const config = await decryptConfig2(identity);
     const keys = Object.keys(config);
     if (keys.length === 0) {
@@ -77424,7 +77415,7 @@ var buildContext2 = async (command, json) => {
 };
 function registerConfigCommands(program3) {
   const config = program3.command("config").description("Manage user-specific config overrides (encrypted)");
-  config.command("init").description("Generate age keypair for user config encryption").option("--force", "Overwrite existing keypair").option("--json", "Output as JSON").action(async (options, command) => {
+  config.command("init").description("[DEPRECATED] No longer needed - use `skill keys` instead").option("--force", "Overwrite existing keypair").option("--json", "Output as JSON").action(async (options, command) => {
     const ctx = await buildContext2(command, options.json);
     await configInitAction(ctx, options);
   });
@@ -80114,7 +80105,7 @@ init_esm_shims();
 // src/commands/eval-pipeline/run.ts
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5 } from "path";
 import { readFile as readFile6 } from "fs/promises";
 import { glob as glob4 } from "glob";
@@ -80532,7 +80523,7 @@ function getClassifySourceHash() {
       join5(process.cwd(), "../core/src/pipeline/classify.ts")
     ];
     for (const path of possiblePaths) {
-      if (existsSync7(path)) {
+      if (existsSync6(path)) {
         const content = readFileSync5(path, "utf-8");
         return createHash2("md5").update(content).digest("hex");
       }
@@ -80544,7 +80535,7 @@ function getClassifySourceHash() {
 function loadCachedClassify(cacheKey) {
   const cachePath = join5(CACHE_DIR, `${cacheKey}.json`);
   try {
-    if (existsSync7(cachePath)) {
+    if (existsSync6(cachePath)) {
       return JSON.parse(readFileSync5(cachePath, "utf-8"));
     }
   } catch {
@@ -80553,17 +80544,17 @@ function loadCachedClassify(cacheKey) {
 }
 function saveCachedClassify(cacheKey, result) {
   try {
-    if (!existsSync7(CACHE_DIR)) {
-      mkdirSync2(CACHE_DIR, { recursive: true });
+    if (!existsSync6(CACHE_DIR)) {
+      mkdirSync(CACHE_DIR, { recursive: true });
     }
     const cachePath = join5(CACHE_DIR, `${cacheKey}.json`);
-    writeFileSync5(cachePath, JSON.stringify(result));
+    writeFileSync4(cachePath, JSON.stringify(result));
   } catch {
   }
 }
 function clearClassifyCache() {
   try {
-    if (existsSync7(CACHE_DIR)) {
+    if (existsSync6(CACHE_DIR)) {
       rmSync(CACHE_DIR, { recursive: true, force: true });
     }
   } catch {
@@ -81555,7 +81546,7 @@ function registerEvalPipelineCommands(program3) {
 
 // src/commands/eval-prompt.ts
 init_esm_shims();
-import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { generateText as generateText2, stepCountIs as stepCountIs2, tool as tool4 } from "ai";
 import { z as z5 } from "zod";
 var leakPatterns = [
@@ -81742,7 +81733,7 @@ async function runEval2(ctx, options) {
   try {
     let prompt = SUPPORT_AGENT_PROMPT;
     if (promptPath) {
-      if (!existsSync8(promptPath)) {
+      if (!existsSync7(promptPath)) {
         throw new CLIError({
           userMessage: `Prompt file not found: ${promptPath}.`,
           suggestion: "Verify the prompt path and try again."
@@ -81755,7 +81746,7 @@ async function runEval2(ctx, options) {
     } else if (!outputJson) {
       ctx.output.message("Using production prompt");
     }
-    if (!existsSync8(datasetPath)) {
+    if (!existsSync7(datasetPath)) {
       throw new CLIError({
         userMessage: `Dataset not found: ${datasetPath}.`,
         suggestion: "Provide a valid dataset file path."
@@ -81838,7 +81829,7 @@ async function runEval2(ctx, options) {
       });
     }
     if (outputPath) {
-      writeFileSync6(outputPath, JSON.stringify(results, null, 2));
+      writeFileSync5(outputPath, JSON.stringify(results, null, 2));
       if (!outputJson) {
         ctx.output.success(`Saved results to ${outputPath}`);
       }
@@ -81867,7 +81858,7 @@ async function comparePrompts(ctx, options) {
   try {
     const baselinePrompt = baseline ? readFileSync6(baseline, "utf-8") : SUPPORT_AGENT_PROMPT;
     const candidatePrompt = readFileSync6(candidate, "utf-8");
-    if (!existsSync8(datasetPath)) {
+    if (!existsSync7(datasetPath)) {
       throw new CLIError({
         userMessage: `Dataset not found: ${datasetPath}.`,
         suggestion: "Provide a valid dataset file path."
@@ -82015,8 +82006,8 @@ init_esm_shims();
 
 // src/commands/faq/classify.ts
 init_esm_shims();
-import { appendFileSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname3, join as join7, resolve as resolve3 } from "path";
+import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname2, join as join7, resolve as resolve3 } from "path";
 import { generateObject } from "ai";
 import { z as z6 } from "zod";
 var PROJECT_ROOT = resolve3(__dirname, "../../../..");
@@ -82083,7 +82074,7 @@ async function loadConversationsFromParquet(parquetPath) {
 }
 function loadExistingClassifications(outputPath) {
   const classifiedIds = /* @__PURE__ */ new Set();
-  if (!existsSync9(outputPath)) {
+  if (!existsSync8(outputPath)) {
     return classifiedIds;
   }
   const content = readFileSync7(outputPath, "utf-8");
@@ -82201,7 +82192,7 @@ async function faqClassify(ctx, options) {
     ctx.output.data(`   Dry run:        ${options.dryRun ?? false}`);
     ctx.output.data("");
   }
-  if (!existsSync9(parquetPath)) {
+  if (!existsSync8(parquetPath)) {
     handleFaqClassifyError(
       ctx,
       new CLIError({
@@ -82212,7 +82203,7 @@ async function faqClassify(ctx, options) {
     );
     return;
   }
-  if (!existsSync9(taxonomyPath)) {
+  if (!existsSync8(taxonomyPath)) {
     handleFaqClassifyError(
       ctx,
       new CLIError({
@@ -82223,9 +82214,9 @@ async function faqClassify(ctx, options) {
     );
     return;
   }
-  const outputDir = dirname3(outputPath);
-  if (!existsSync9(outputDir)) {
-    mkdirSync3(outputDir, { recursive: true });
+  const outputDir = dirname2(outputPath);
+  if (!existsSync8(outputDir)) {
+    mkdirSync2(outputDir, { recursive: true });
   }
   if (!outputJson) ctx.output.data("\u{1F4DA} Loading taxonomy...");
   const taxonomy = JSON.parse(readFileSync7(taxonomyPath, "utf-8"));
@@ -82393,18 +82384,18 @@ function registerFaqClassifyCommands(program3) {
 
 // src/commands/faq/cluster.ts
 init_esm_shims();
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { join as join9, resolve as resolve4 } from "path";
 
 // ../core/src/faq/production-clusterer.ts
 init_esm_shims();
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
 import { join as join8 } from "path";
 function readPhase0Assignments(phase0Path) {
   const assignmentsPath = join8(phase0Path, "clusters/v1/assignments.json");
-  if (!existsSync10(assignmentsPath)) {
+  if (!existsSync9(assignmentsPath)) {
     const latestPath = join8(phase0Path, "clusters/latest/assignments.json");
-    if (!existsSync10(latestPath)) {
+    if (!existsSync9(latestPath)) {
       throw new Error(`Phase 0 assignments not found at ${assignmentsPath}`);
     }
     const content2 = readFileSync8(latestPath, "utf-8");
@@ -82415,9 +82406,9 @@ function readPhase0Assignments(phase0Path) {
 }
 function readPhase0Labels(phase0Path) {
   const labelsPath = join8(phase0Path, "clusters/v1/labels.json");
-  if (!existsSync10(labelsPath)) {
+  if (!existsSync9(labelsPath)) {
     const latestPath = join8(phase0Path, "clusters/latest/labels.json");
-    if (!existsSync10(latestPath)) {
+    if (!existsSync9(latestPath)) {
       throw new Error(`Phase 0 labels not found at ${labelsPath}`);
     }
     const content2 = readFileSync8(latestPath, "utf-8");
@@ -82430,9 +82421,9 @@ function readPhase0Labels(phase0Path) {
 }
 function readPhase0Metrics(phase0Path) {
   const metricsPath = join8(phase0Path, "clusters/v1/metrics.json");
-  if (!existsSync10(metricsPath)) {
+  if (!existsSync9(metricsPath)) {
     const latestPath = join8(phase0Path, "clusters/latest/metrics.json");
-    if (!existsSync10(latestPath)) {
+    if (!existsSync9(latestPath)) {
       throw new Error(`Phase 0 metrics not found at ${metricsPath}`);
     }
     return JSON.parse(readFileSync8(latestPath, "utf-8"));
@@ -82553,17 +82544,17 @@ async function generateProductionClustering(options) {
 }
 function writeProductionArtifacts(result, outputPath) {
   const versionPath = join8(outputPath, result.version);
-  if (!existsSync10(versionPath)) {
-    mkdirSync4(versionPath, { recursive: true });
+  if (!existsSync9(versionPath)) {
+    mkdirSync3(versionPath, { recursive: true });
   }
   const resultPath = join8(versionPath, "clustering-result.json");
-  writeFileSync7(resultPath, JSON.stringify(result, null, 2));
+  writeFileSync6(resultPath, JSON.stringify(result, null, 2));
   console.log(`\u2705 Written: ${resultPath}`);
   const assignmentsPath = join8(versionPath, "assignments.json");
-  writeFileSync7(assignmentsPath, JSON.stringify(result.assignments, null, 2));
+  writeFileSync6(assignmentsPath, JSON.stringify(result.assignments, null, 2));
   console.log(`\u2705 Written: ${assignmentsPath}`);
   const clustersPath = join8(versionPath, "clusters.json");
-  writeFileSync7(
+  writeFileSync6(
     clustersPath,
     JSON.stringify(
       {
@@ -82589,14 +82580,14 @@ function writeProductionArtifacts(result, outputPath) {
       priorityTier: c.priorityTier
     }))
   };
-  writeFileSync7(summaryPath, JSON.stringify(summary, null, 2));
+  writeFileSync6(summaryPath, JSON.stringify(summary, null, 2));
   console.log(`\u2705 Written: ${summaryPath}`);
   const latestPath = join8(outputPath, "latest");
-  if (existsSync10(latestPath)) {
+  if (existsSync9(latestPath)) {
     const { rmSync: rmSync2 } = __require("fs");
     rmSync2(latestPath, { recursive: true, force: true });
   }
-  mkdirSync4(latestPath, { recursive: true });
+  mkdirSync3(latestPath, { recursive: true });
   for (const file of [
     "clustering-result.json",
     "assignments.json",
@@ -82605,7 +82596,7 @@ function writeProductionArtifacts(result, outputPath) {
   ]) {
     const src = join8(versionPath, file);
     const dst = join8(latestPath, file);
-    writeFileSync7(dst, readFileSync8(src));
+    writeFileSync6(dst, readFileSync8(src));
   }
   console.log(`\u2705 Updated: ${latestPath}`);
 }
@@ -82663,19 +82654,19 @@ function validatePaths(phase0Path) {
   const assignmentsPath = join9(phase0Path, "clusters/v1/assignments.json");
   const labelsPath = join9(phase0Path, "clusters/v1/labels.json");
   const metricsPath = join9(phase0Path, "clusters/v1/metrics.json");
-  if (!existsSync11(assignmentsPath)) {
+  if (!existsSync10(assignmentsPath)) {
     throw new CLIError({
       userMessage: `Phase 0 assignments not found at ${assignmentsPath}.`,
       suggestion: "Run Phase 0 clustering first or specify the correct --phase0-path."
     });
   }
-  if (!existsSync11(labelsPath)) {
+  if (!existsSync10(labelsPath)) {
     throw new CLIError({
       userMessage: `Phase 0 labels not found at ${labelsPath}.`,
       suggestion: "Verify the --phase0-path points to valid artifacts."
     });
   }
-  if (!existsSync11(metricsPath)) {
+  if (!existsSync10(metricsPath)) {
     throw new CLIError({
       userMessage: `Phase 0 metrics not found at ${metricsPath}.`,
       suggestion: "Verify the --phase0-path points to valid artifacts."
@@ -82756,12 +82747,12 @@ function registerFaqClusterCommands(program3) {
 
 // src/commands/faq/extract.ts
 init_esm_shims();
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { join as join11, resolve as resolve5 } from "path";
 
 // ../core/src/faq/extractor.ts
 init_esm_shims();
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
 import { join as join10 } from "path";
 
 // ../core/src/faq/review.ts
@@ -83377,11 +83368,11 @@ async function extractFaqCandidates(options) {
 }
 function writeExtractionArtifacts(result, outputPath) {
   const versionPath = join10(outputPath, result.version);
-  if (!existsSync12(versionPath)) {
-    mkdirSync5(versionPath, { recursive: true });
+  if (!existsSync11(versionPath)) {
+    mkdirSync4(versionPath, { recursive: true });
   }
   const resultPath = join10(versionPath, "extraction-result.json");
-  writeFileSync8(resultPath, JSON.stringify(result, null, 2));
+  writeFileSync7(resultPath, JSON.stringify(result, null, 2));
   console.log(`\u2705 Written: ${resultPath}`);
   const candidatesPath = join10(versionPath, "candidates.json");
   const candidatesData = {
@@ -83401,10 +83392,10 @@ function writeExtractionArtifacts(result, outputPath) {
       sourceConversations: c.sourceConversations.slice(0, 5)
     }))
   };
-  writeFileSync8(candidatesPath, JSON.stringify(candidatesData, null, 2));
+  writeFileSync7(candidatesPath, JSON.stringify(candidatesData, null, 2));
   console.log(`\u2705 Written: ${candidatesPath}`);
   const statsPath = join10(versionPath, "stats.json");
-  writeFileSync8(
+  writeFileSync7(
     statsPath,
     JSON.stringify(
       {
@@ -83418,11 +83409,11 @@ function writeExtractionArtifacts(result, outputPath) {
   );
   console.log(`\u2705 Written: ${statsPath}`);
   const latestPath = join10(outputPath, "latest");
-  if (existsSync12(latestPath)) {
+  if (existsSync11(latestPath)) {
     const { rmSync: rmSync2 } = __require("fs");
     rmSync2(latestPath, { recursive: true, force: true });
   }
-  mkdirSync5(latestPath, { recursive: true });
+  mkdirSync4(latestPath, { recursive: true });
   for (const file of [
     "extraction-result.json",
     "candidates.json",
@@ -83430,8 +83421,8 @@ function writeExtractionArtifacts(result, outputPath) {
   ]) {
     const src = join10(versionPath, file);
     const dst = join10(latestPath, file);
-    if (existsSync12(src)) {
-      writeFileSync8(dst, readFileSync9(src));
+    if (existsSync11(src)) {
+      writeFileSync7(dst, readFileSync9(src));
     }
   }
   console.log(`\u2705 Updated: ${latestPath}`);
@@ -83495,13 +83486,13 @@ var DEFAULT_GOLDEN_PATH = join11(
 var DEFAULT_OUTPUT_PATH3 = join11(PROJECT_ROOT3, "artifacts/phase-1/extraction");
 var DEFAULT_CACHE_PATH = `${process.env.HOME}/skill/data/front-cache.db`;
 function validatePaths2(ctx, clusteringPath, goldenPath, outputJson) {
-  if (!existsSync13(clusteringPath)) {
+  if (!existsSync12(clusteringPath)) {
     throw new CLIError({
       userMessage: `Clustering result not found at ${clusteringPath}.`,
       suggestion: "Run `bun src/index.ts faq cluster` first to generate clustering."
     });
   }
-  if (goldenPath && !existsSync13(goldenPath)) {
+  if (goldenPath && !existsSync12(goldenPath)) {
     if (!outputJson) {
       ctx.output.warn(`Golden responses not found at ${goldenPath}`);
       ctx.output.warn("Golden matching will be disabled.");
@@ -83530,7 +83521,7 @@ async function faqExtract(ctx, options) {
     ctx.output.data("");
   }
   validatePaths2(ctx, clusteringPath, goldenPath, outputJson);
-  if (!existsSync13(cachePath)) {
+  if (!existsSync12(cachePath)) {
     const cliError = new CLIError({
       userMessage: `DuckDB cache not found at ${cachePath}.`,
       suggestion: "Run `bun src/index.ts front-cache sync` first to populate cache."
@@ -83552,7 +83543,7 @@ async function faqExtract(ctx, options) {
     }
     const extractionOptions = {
       clusteringPath,
-      goldenPath: existsSync13(goldenPath) ? goldenPath : void 0,
+      goldenPath: existsSync12(goldenPath) ? goldenPath : void 0,
       source,
       outputPath,
       version,
@@ -83672,7 +83663,7 @@ function registerFaqExtractCommands(program3) {
 
 // src/commands/faq/mine.ts
 init_esm_shims();
-import { writeFileSync as writeFileSync9 } from "fs";
+import { writeFileSync as writeFileSync8 } from "fs";
 
 // ../core/src/faq/index.ts
 init_esm_shims();
@@ -92489,7 +92480,7 @@ async function faqMine(ctx, options) {
         }))
       };
       if (options.export) {
-        writeFileSync9(options.export, JSON.stringify(rawData, null, 2), "utf-8");
+        writeFileSync8(options.export, JSON.stringify(rawData, null, 2), "utf-8");
         if (outputJson) {
           ctx.output.data({
             success: true,
@@ -92563,7 +92554,7 @@ async function faqMine(ctx, options) {
           generatedAt: c.generatedAt.toISOString()
         }))
       };
-      writeFileSync9(
+      writeFileSync8(
         options.export,
         JSON.stringify(exportData, null, 2),
         "utf-8"
@@ -92626,7 +92617,7 @@ function registerFaqMineCommands(program3) {
 // src/commands/faq/review.ts
 init_esm_shims();
 import { spawnSync } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync10, unlinkSync, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync10, unlinkSync, writeFileSync as writeFileSync9 } from "fs";
 import { tmpdir } from "os";
 import { join as join12 } from "path";
 import { confirm as confirm2, select as select3 } from "@inquirer/prompts";
@@ -92704,7 +92695,7 @@ Save and close the editor when done.
 The sections are separated by "## Question" and "## Answer" headers.
 -->
 `;
-  writeFileSync10(tmpFile, content, "utf-8");
+  writeFileSync9(tmpFile, content, "utf-8");
   try {
     const result = spawnSync(editor, [tmpFile], {
       stdio: "inherit",
@@ -92732,7 +92723,7 @@ The sections are separated by "## Question" and "## Answer" headers.
       answer: editedAnswer
     };
   } finally {
-    if (existsSync14(tmpFile)) {
+    if (existsSync13(tmpFile)) {
       unlinkSync(tmpFile);
     }
   }
@@ -94927,7 +94918,7 @@ function registerInboxCommand(front) {
 
 // src/commands/front/pull-conversations.ts
 init_esm_shims();
-import { writeFileSync as writeFileSync11 } from "fs";
+import { writeFileSync as writeFileSync10 } from "fs";
 async function pullConversations(ctx, options) {
   const { inbox, limit: limit2 = 50, output, filter: filter4 } = options;
   const outputJson = options.json === true || ctx.format === "json";
@@ -95060,7 +95051,7 @@ Built ${samples.length} eval samples`);
       ctx.output.data(`  ${cat}: ${count}`);
     }
     if (output) {
-      writeFileSync11(output, JSON.stringify(samples, null, 2));
+      writeFileSync10(output, JSON.stringify(samples, null, 2));
       ctx.output.data(`
 Saved to ${output}`);
     } else if (outputJson) {
@@ -103241,7 +103232,7 @@ var compile3 = wrapCompile(compile2);
 var _compileUnsafe = wrapCompile(compileUnsafe);
 var _compileToken = wrapCompile(compileToken);
 function getSelectorFunc(searchFunc) {
-  return function select6(query, elements, options) {
+  return function select7(query, elements, options) {
     const opts = convertOptionFormats(options);
     if (typeof query !== "function") {
       query = compileUnsafe(query, opts, elements);
@@ -113895,10 +113886,217 @@ function registerKbCommands(program3) {
   });
 }
 
-// src/commands/linear/index.ts
+// src/commands/keys/index.ts
 init_esm_shims();
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
+import { password as password2, select as select5 } from "@inquirer/prompts";
+import { Decrypter as Decrypter4 } from "age-encryption";
+var buildContext4 = async (command, json) => {
+  const opts = typeof command.optsWithGlobals === "function" ? command.optsWithGlobals() : {
+    ...command.parent?.opts(),
+    ...command.opts()
+  };
+  return createContext({
+    format: json ? "json" : opts.format,
+    verbose: opts.verbose,
+    quiet: opts.quiet
+  });
+};
+async function getUserConfiguredKeys() {
+  const keyPath = getAgeKeyPath();
+  const configPath = getEncryptedConfigPath();
+  if (!existsSync14(keyPath) || !existsSync14(configPath)) {
+    return /* @__PURE__ */ new Set();
+  }
+  try {
+    const identity = readFileSync12(keyPath, "utf8").trim();
+    const encrypted = readFileSync12(configPath);
+    const decrypter = new Decrypter4();
+    decrypter.addIdentity(identity);
+    const decrypted = await decrypter.decrypt(encrypted, "text");
+    const keys = /* @__PURE__ */ new Set();
+    for (const line of decrypted.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eqIndex = trimmed.indexOf("=");
+      if (eqIndex > 0) {
+        keys.add(trimmed.substring(0, eqIndex));
+      }
+    }
+    return keys;
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+async function showKeyStatus(ctx) {
+  const userKeys = await getUserConfiguredKeys();
+  const allKeys = Object.keys(SECRET_REFS);
+  ctx.output.data("\n\u{1F4CB} API Key Status");
+  ctx.output.data("\u2500".repeat(60));
+  const personal = [];
+  const shared = [];
+  const notSet = [];
+  for (const key of allKeys) {
+    const provenance = getKeyProvenance(key);
+    const hasUserKey = userKeys.has(key);
+    const hasEnvValue = !!process.env[key];
+    if (hasUserKey) {
+      personal.push(key);
+    } else if (provenance === "shipped" || hasEnvValue) {
+      shared.push(key);
+    } else {
+      notSet.push(key);
+    }
+  }
+  if (personal.length > 0) {
+    ctx.output.data("\n\u{1F510} Your personal keys:");
+    for (const key of personal) {
+      ctx.output.data(`   \u2713 ${key}`);
+    }
+  }
+  if (shared.length > 0) {
+    ctx.output.data("\n\u{1F3E2} Using shared/shipped keys:");
+    for (const key of shared.slice(0, 5)) {
+      ctx.output.data(`   \u2022 ${key}`);
+    }
+    if (shared.length > 5) {
+      ctx.output.data(`   \u2022 ... and ${shared.length - 5} more`);
+    }
+  }
+  if (notSet.length > 0 && notSet.length < 10) {
+    ctx.output.data("\n\u26A0\uFE0F  Not configured:");
+    for (const key of notSet) {
+      ctx.output.data(`   \u25CB ${key}`);
+    }
+  }
+  ctx.output.data("");
+}
+async function interactiveKeySetup(ctx) {
+  const keyPath = getAgeKeyPath();
+  if (!existsSync14(keyPath)) {
+    ctx.output.data("\n\u{1F511} First time setup - creating your encryption key...\n");
+    await configInitAction(ctx, { json: false });
+    ctx.output.data("");
+  }
+  await showKeyStatus(ctx);
+  ctx.output.data("\u2500".repeat(60));
+  ctx.output.data("");
+  try {
+    const action = await select5({
+      message: "What would you like to do?",
+      choices: [
+        { name: "Add/update a personal API key", value: "add" },
+        { name: "View all available keys", value: "list" },
+        { name: "Exit", value: "exit" }
+      ]
+    });
+    if (action === "exit") {
+      return;
+    }
+    if (action === "list") {
+      ctx.output.data("\n\u{1F4CB} Available API keys you can personalize:\n");
+      const keys = Object.keys(SECRET_REFS);
+      for (const key of keys) {
+        ctx.output.data(`   \u2022 ${key}`);
+      }
+      ctx.output.data("\nRun `skill keys add` to set one.");
+      return;
+    }
+    if (action === "add") {
+      const selectedKey = await select5({
+        message: "Which key do you want to set?",
+        choices: Object.keys(SECRET_REFS).map((key) => ({
+          name: key,
+          value: key
+        }))
+      });
+      const value = await password2({
+        message: `Enter your ${selectedKey}:`
+      });
+      if (!value) {
+        ctx.output.data("Cancelled - no value provided.");
+        return;
+      }
+      await configSetAction(ctx, `${selectedKey}=${value}`, { json: false });
+    }
+  } catch (error) {
+    if (error instanceof Error && (error.message.includes("User force closed") || error.message.includes("canceled"))) {
+      ctx.output.data("\nCancelled.");
+      return;
+    }
+    throw error;
+  }
+}
+function registerKeysCommands(program3) {
+  const keys = program3.command("keys").description(
+    "Manage your personal API keys\n\n  Use your own API keys instead of shared defaults.\n  Keys are encrypted and stored in ~/.config/skill/\n\n  Examples:\n    skill keys           Interactive setup\n    skill keys status    Show which keys are personal vs shared\n    skill keys add       Add a personal API key"
+  ).action(async (_options, command) => {
+    const ctx = await buildContext4(command, false);
+    if (!process.stdin.isTTY) {
+      ctx.output.error(
+        "Interactive mode requires a TTY. Use `skill keys add KEY=value` for scripting."
+      );
+      return;
+    }
+    await interactiveKeySetup(ctx);
+  });
+  keys.command("status").description("Show which API keys are personal vs shared").option("--json", "Output as JSON").action(async (options, command) => {
+    const ctx = await buildContext4(command, options.json);
+    if (options.json || ctx.format === "json") {
+      const userKeys = await getUserConfiguredKeys();
+      const allKeys = Object.keys(SECRET_REFS);
+      const status = {};
+      for (const key of allKeys) {
+        const provenance = getKeyProvenance(key);
+        if (userKeys.has(key)) {
+          status[key] = "personal";
+        } else if (provenance === "shipped" || process.env[key]) {
+          status[key] = "shared";
+        } else {
+          status[key] = "not_set";
+        }
+      }
+      ctx.output.data({ keys: status });
+    } else {
+      await showKeyStatus(ctx);
+    }
+  });
+  keys.command("add [key-value]").description(
+    "Add a personal API key\n\n  Interactive: skill keys add\n  Direct:      skill keys add LINEAR_API_KEY=lin_xxx"
+  ).option("--json", "Output as JSON").action(async (keyValue, options, command) => {
+    const ctx = await buildContext4(command, options.json);
+    const keyPath = getAgeKeyPath();
+    if (!existsSync14(keyPath)) {
+      if (process.stdin.isTTY && !options.json) {
+        ctx.output.data(
+          "\u{1F511} First time setup - creating your encryption key...\n"
+        );
+      }
+      await configInitAction(ctx, { json: options.json });
+    }
+    await configSetAction(ctx, keyValue, options);
+  });
+  keys.command("list").description("List your personal API keys (names only, values hidden)").option("--show-values", "Show decrypted values").option("--json", "Output as JSON").action(async (options, command) => {
+    const ctx = await buildContext4(command, options.json);
+    const userKeys = await getUserConfiguredKeys();
+    if (options.json || ctx.format === "json") {
+      ctx.output.data({ personalKeys: Array.from(userKeys) });
+    } else {
+      if (userKeys.size === 0) {
+        ctx.output.data("No personal keys configured.");
+        ctx.output.data("\nRun `skill keys add` to set one.");
+      } else {
+        ctx.output.data("\n\u{1F510} Your personal API keys:\n");
+        for (const key of userKeys) {
+          ctx.output.data(`   \u2022 ${key}`);
+        }
+        ctx.output.data("");
+      }
+    }
+  });
+}
 
-// src/commands/linear/assign.ts
+// src/commands/linear/index.ts
 init_esm_shims();
 
 // src/core/write-gate.ts
@@ -113911,11 +114109,14 @@ function requirePersonalKey(keyName) {
   throw new CLIError({
     userMessage: `Write operations require a personal API key for ${keyName}.`,
     exitCode: EXIT_CODES.auth,
-    suggestion: "Run 'skill config init' to set up your personal keys.",
+    suggestion: "Run 'skill keys add' to set up your personal keys.",
     debugMessage: `Key provenance for ${keyName}: ${provenance ?? "undefined"}`
   });
 }
 
+// src/commands/linear/assign.ts
+init_esm_shims();
+
 // src/commands/linear/client.ts
 init_esm_shims();
 import { LinearClient } from "@linear/sdk";
@@ -113947,8 +114148,8 @@ function hateoasWrap2(opts) {
   return response;
 }
 var WRITE_ACTION_META = {
-  personal_key_hint: "\u26A0\uFE0F Write operations require a personal LINEAR_API_KEY. Run `skill config init` to set up your keys.",
-  setup_command: "skill config init"
+  personal_key_hint: "\u26A0\uFE0F Write operations require a personal LINEAR_API_KEY. Run `skill keys add` to set up your keys.",
+  setup_command: "skill keys add"
 };
 function issueLinks(identifier, teamKey) {
   const links = [
@@ -114809,7 +115010,7 @@ async function getIssue(ctx, id) {
     ctx.output.data(`     \u2022 Close:    skill linear close ${issue.identifier}`);
     ctx.output.data("");
     ctx.output.data("   \u26A0\uFE0F  Write operations require a personal LINEAR_API_KEY.");
-    ctx.output.data("       Run `skill config init` to set up your keys.");
+    ctx.output.data("       Run `skill keys add` to set up your keys.");
     ctx.output.data("");
   } catch (error) {
     const cliError = error instanceof CLIError ? error : new CLIError({
@@ -116117,7 +116318,9 @@ Quick start:
   skill linear create "Title"        Create issue
   skill linear search "query"        Search issues
 
-All commands support --json for machine-readable output.`
+All commands support --json for machine-readable output.
+
+\u26A0\uFE0F  Write operations require personal LINEAR_API_KEY (run 'skill keys add').`
   );
   linear.command("issues").description(
     `List issues with optional filters
@@ -116147,6 +116350,7 @@ Examples:
   skill linear my --state "In Progress"  Only in-progress
   skill linear my --limit 5           Just top 5`
   ).option("--limit <number>", "Maximum results (default: 20)", "20").option("--state <name>", "Filter by state name").option("--json", "Output as JSON with HATEOAS links").action(async (options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await listMyIssues(ctx, {
       limit: parseInt(options.limit || "20", 10),
@@ -116191,6 +116395,7 @@ Priority: 0=Urgent, 1=High, 2=Medium, 3=Low, 4=None`
     (v, p) => [...p, v],
     []
   ).option("--project <name>", "Project name").option("--estimate <points>", "Estimate in points").option("--due-date <YYYY-MM-DD>", "Due date").option("--json", "Output as JSON with HATEOAS links").action(async (title, options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await createIssue(ctx, title, {
       description: options.description,
@@ -116211,6 +116416,7 @@ Examples:
   skill linear update ENG-123 --priority 1 --estimate 3
   skill linear update ENG-123 --due-date 2024-03-15`
   ).argument("<id>", "Issue identifier").option("--title <text>", "New title").option("--description <text>", "New description").option("--priority <0-4>", "New priority").option("--estimate <points>", "New estimate").option("--due-date <YYYY-MM-DD>", "New due date").option("--project <name>", "Move to project").option("--json", "Output as JSON with HATEOAS links").action(async (id, options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await updateIssue(ctx, id, {
       title: options.title,
@@ -116229,6 +116435,7 @@ Examples:
   skill linear assign ENG-123 --to me
   skill linear assign ENG-123 --unassign`
   ).argument("<id>", "Issue identifier").option("--to <email>", 'Assign to user email (or "me")').option("--unassign", "Remove assignee").option("--json", "Output as JSON with HATEOAS links").action(async (id, options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await assignIssue(ctx, id, {
       to: options.to,
@@ -116244,6 +116451,7 @@ Examples:
 
 Use 'skill linear states <team>' to see available states.`
   ).argument("<id>", "Issue identifier").requiredOption("--state <name>", "Target state name").option("--json", "Output as JSON with HATEOAS links").action(async (id, options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await changeState(ctx, id, { state: options.state });
   });
@@ -116254,6 +116462,7 @@ Examples:
   skill linear close ENG-123              Close as done
   skill linear close ENG-123 --canceled   Cancel the issue`
   ).argument("<id>", "Issue identifier").option("--canceled", "Close as canceled instead of done").option("--json", "Output as JSON with HATEOAS links").action(async (id, options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await closeIssue(ctx, id, { canceled: options.canceled });
   });
@@ -116277,6 +116486,7 @@ Use 'skill linear labels <team>' to see available labels.`
     (v, p) => [...p, v],
     []
   ).option("--json", "Output as JSON with HATEOAS links").action(async (id, options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await modifyLabels(ctx, id, {
       add: options.add,
@@ -116292,6 +116502,7 @@ Examples:
   skill linear link ENG-123 --related ENG-456
   skill linear link ENG-123 --duplicate ENG-456`
   ).argument("<id>", "Source issue identifier").option("--blocks <id>", "This issue blocks <id>").option("--blocked-by <id>", "This issue is blocked by <id>").option("--related <id>", "Related to <id>").option("--duplicate <id>", "Duplicate of <id>").option("--json", "Output as JSON with HATEOAS links").action(async (id, options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await linkIssues(ctx, id, {
       blocks: options.blocks,
@@ -116307,6 +116518,7 @@ Examples:
   skill linear comment ENG-123 --body "Great work!"
   skill linear comment ENG-123 --body "## Update\\n- Item 1\\n- Item 2"`
   ).argument("<id>", "Issue identifier").requiredOption("--body <text>", "Comment text (supports markdown)").option("--json", "Output as JSON with HATEOAS links").action(async (id, options, command) => {
+    requirePersonalKey("LINEAR_API_KEY");
     const ctx = await contextFromCommand2(command, options);
     await addComment(ctx, id, { body: options.body });
   });
@@ -116738,7 +116950,7 @@ async function deleteMemory(ctx, id, options) {
 }
 
 // src/commands/memory/index.ts
-var buildContext4 = async (command, json) => {
+var buildContext5 = async (command, json) => {
   const opts = typeof command.optsWithGlobals === "function" ? command.optsWithGlobals() : {
     ...command.parent?.opts(),
     ...command.opts()
@@ -116752,42 +116964,42 @@ var buildContext4 = async (command, json) => {
 function registerMemoryCommands(program3) {
   const memory = program3.command("memory").description("Manage semantic memory for agent learning");
   memory.command("store").description("Store a new memory").argument("<content>", "Memory content to store").option("--tags <tags>", "Comma-separated tags").option("--collection <collection>", "Collection name (default: learnings)").option("--app <app>", "App slug to associate with memory").option("--json", "Output as JSON").action(async (content, options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await store(ctx, content, options);
   });
   memory.command("find").description("Search memories by semantic similarity").argument("<query>", "Search query text").option("--limit <number>", "Max results (1-100, default: 10)").option("--collection <collection>", "Collection name (default: learnings)").option("--app <app>", "Filter by app slug").option(
     "--min-confidence <confidence>",
     "Minimum confidence threshold (0-1, default: 0.5)"
   ).option("--json", "Output as JSON").action(async (query, options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await find5(ctx, query, options);
   });
   memory.command("get").description("Get a specific memory by ID").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await get2(ctx, id, options);
   });
   memory.command("validate").description("Validate a memory (resets decay clock)").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await validate2(ctx, id, options);
   });
   memory.command("upvote").description("Upvote a memory").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--reason <reason>", "Optional reason for upvote").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await upvote(ctx, id, options);
   });
   memory.command("downvote").description("Downvote a memory").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--reason <reason>", "Optional reason for downvote").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await downvote(ctx, id, options);
   });
   memory.command("delete").description("Delete a memory").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await deleteMemory(ctx, id, options);
   });
   memory.command("stats").description("Display memory statistics").option("--collection <collection>", "Filter by collection").option("--app <app>", "Filter by app slug").option("--json", "Output as JSON").action(async (options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await stats3(ctx, options);
   });
   memory.command("stale").description("List stale memories needing validation").option("--collection <collection>", "Filter by collection").option("--threshold <threshold>", "Confidence threshold (default: 0.25)").option("--json", "Output as JSON").action(async (options, command) => {
-    const ctx = await buildContext4(command, options.json);
+    const ctx = await buildContext5(command, options.json);
     await stale(ctx, options);
   });
 }
@@ -117369,7 +117581,7 @@ async function buildValidateDatasetFromProduction(productionResultsPath, outputP
 }
 
 // src/commands/pipeline.ts
-var buildContext5 = async (command, json) => {
+var buildContext6 = async (command, json) => {
   const opts = typeof command.optsWithGlobals === "function" ? command.optsWithGlobals() : {
     ...command.parent?.opts(),
     ...command.opts()
@@ -117440,7 +117652,7 @@ function registerPipelineCommands(program3) {
     "Model for LLM classification",
     "anthropic/claude-haiku-4-5"
   ).action(async (opts, command) => {
-    const ctx = await buildContext5(command, opts.json);
+    const ctx = await buildContext6(command, opts.json);
     try {
       await runClassifyEval2({
         ...opts,
@@ -117451,7 +117663,7 @@ function registerPipelineCommands(program3) {
     }
   });
   pipeline.command("build-classify-dataset").description("Build classify eval dataset from production data").requiredOption("--production <file>", "Production dataset JSON").requiredOption("--output <file>", "Output scenarios JSON").action(async (opts, command) => {
-    const ctx = await buildContext5(command);
+    const ctx = await buildContext6(command);
     try {
       await buildClassifyDataset(opts.production, opts.output);
       ctx.output.success(`Dataset written to ${opts.output}`);
@@ -117463,7 +117675,7 @@ function registerPipelineCommands(program3) {
     "--dataset <file>",
     "Path to scenarios JSON (uses built-in if not provided)"
   ).option("--output <file>", "Save results to JSON").option("--verbose", "Show individual failures").option("--json", "JSON output").action(async (opts, command) => {
-    const ctx = await buildContext5(command, opts.json);
+    const ctx = await buildContext6(command, opts.json);
     try {
       await runValidateEval2({
         ...opts,
@@ -117474,7 +117686,7 @@ function registerPipelineCommands(program3) {
     }
   });
   pipeline.command("build-validate-dataset").description("Build validate eval dataset from production failures").requiredOption("--production <file>", "Production baseline results JSON").requiredOption("--output <file>", "Output scenarios JSON").action(async (opts, command) => {
-    const ctx = await buildContext5(command);
+    const ctx = await buildContext6(command);
     try {
       await buildValidateDatasetFromProduction(opts.production, opts.output);
       ctx.output.success(`Dataset written to ${opts.output}`);
@@ -117487,7 +117699,7 @@ function registerPipelineCommands(program3) {
     "Model for LLM steps",
     "anthropic/claude-haiku-4-5"
   ).action(async (opts, command) => {
-    const ctx = await buildContext5(command, opts.json);
+    const ctx = await buildContext6(command, opts.json);
     try {
       await runE2EEval2({ ...opts, json: opts.json ?? ctx.format === "json" });
     } catch (error) {
@@ -117495,7 +117707,7 @@ function registerPipelineCommands(program3) {
     }
   });
   pipeline.command("run").description("Run pipeline on a single message").requiredOption("--subject <text>", "Message subject").requiredOption("--body <text>", "Message body").option("--app <id>", "App ID", "total-typescript").option("--dry-run", "Don't actually send", true).option("--json", "JSON output").action(async (opts, command) => {
-    const ctx = await buildContext5(command, opts.json);
+    const ctx = await buildContext6(command, opts.json);
     await runPipelineCommand(ctx, opts);
   });
 }
@@ -117503,10 +117715,10 @@ function registerPipelineCommands(program3) {
 // src/commands/plugin-sync.ts
 init_esm_shims();
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join13, resolve as resolve6 } from "path";
+import { dirname as dirname3, join as join13, resolve as resolve6 } from "path";
 import { fileURLToPath } from "url";
 var PLUGIN_SOURCE_DIR = resolve6(
-  dirname4(fileURLToPath(import.meta.url)),
+  dirname3(fileURLToPath(import.meta.url)),
   "../../plugin"
 );
 var PLUGIN_MANIFEST_RELATIVE = join13(".claude-plugin", "plugin.json");
@@ -117612,7 +117824,7 @@ var registerPluginSyncCommand = (program3) => {
 
 // src/commands/responses.ts
 init_esm_shims();
-import { writeFileSync as writeFileSync12 } from "fs";
+import { writeFileSync as writeFileSync11 } from "fs";
 function formatDate3(date) {
   return date.toLocaleString("en-US", {
     month: "short",
@@ -118145,7 +118357,7 @@ async function exportResponses(ctx, options) {
     }
     const outputJson = JSON.stringify(exportData, null, 2);
     if (options.output) {
-      writeFileSync12(options.output, outputJson, "utf-8");
+      writeFileSync11(options.output, outputJson, "utf-8");
       if (!outputJsonFormat) {
         ctx.output.success(
           `Exported ${exportData.length} responses to ${options.output}`
@@ -118794,7 +119006,7 @@ init_esm_shims();
 import { spawn } from "child_process";
 import { writeFile as writeFile7 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname5, join as join14 } from "path";
+import { dirname as dirname4, join as join14 } from "path";
 var CONFIG_DIR_NAME = "skill-cli";
 var AUTO_UPDATE_STATE_FILE = "auto-update.json";
 var DEFAULT_PACKAGE = "@skillrecordings/cli";
@@ -118824,7 +119036,7 @@ var AutoUpdateStore = class {
   }
   async save(state) {
     try {
-      await ensureDir(dirname5(this.filePath));
+      await ensureDir(dirname4(this.filePath));
       await writeFile7(this.filePath, JSON.stringify(state, null, 2), "utf-8");
     } catch {
     }
@@ -119030,7 +119242,7 @@ var DEFAULT_HINT_RULES = [
   {
     id: "onboarding.auth",
     audience: "onboarding",
-    message: "Set up credentials with `skill auth setup` (requires 1Password).",
+    message: "Set up your own API keys with `skill keys`.",
     showWhen: (state) => state.totalRuns >= 1 && !hasMilestone(state, "auth_configured"),
     retireWhen: (state) => hasMilestone(state, "auth_configured")
   },
@@ -119062,6 +119274,13 @@ var DEFAULT_HINT_RULES = [
     showWhen: (state) => state.totalRuns >= 3 && !hasCommandPrefix(state, "axiom."),
     retireWhen: (state) => hasCommandPrefix(state, "axiom.")
   },
+  {
+    id: "discovery.keys",
+    audience: "discovery",
+    message: "Override shared credentials with your own: `skill keys add`",
+    showWhen: (state) => state.totalRuns >= 3 && !hasCommand(state, "keys") && !hasMilestone(state, "auth_configured"),
+    retireWhen: (state) => hasCommand(state, "keys") || hasCommand(state, "keys.add") || hasMilestone(state, "auth_configured")
+  },
   {
     id: "context.front.triage",
     audience: "contextual",
@@ -119132,10 +119351,10 @@ var writeHints = (hints, stderr) => {
 init_esm_shims();
 import { lstat, readlink, symlink } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname6, join as join15, resolve as resolve7 } from "path";
+import { dirname as dirname5, join as join15, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var SKILL_SOURCE_DIR = resolve7(
-  dirname6(fileURLToPath2(import.meta.url)),
+  dirname5(fileURLToPath2(import.meta.url)),
   "../../../../.claude/skills/skill-cli"
 );
 var SKILL_TARGET_DIR = join15(homedir5(), ".claude", "skills", "skill-cli");
@@ -119149,7 +119368,7 @@ async function autoLinkSkill() {
     } catch (e) {
       if (e.code === "ENOENT") {
         const { mkdir: mkdir2 } = await import("fs/promises");
-        await mkdir2(dirname6(target), { recursive: true });
+        await mkdir2(dirname5(target), { recursive: true });
         await symlink(source, target, "dir");
         return {
           status: "linked",
@@ -119162,7 +119381,7 @@ async function autoLinkSkill() {
     }
     if (stats4.isSymbolicLink()) {
       const linkTarget = await readlink(target);
-      const resolvedLinkTarget = resolve7(dirname6(target), linkTarget);
+      const resolvedLinkTarget = resolve7(dirname5(target), linkTarget);
       if (resolvedLinkTarget === source || linkTarget === source) {
         return {
           status: "exists",
@@ -119242,7 +119461,7 @@ async function sendTelemetryEvent(event) {
 init_esm_shims();
 import { writeFile as writeFile8 } from "fs/promises";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname7, join as join16 } from "path";
+import { dirname as dirname6, join as join16 } from "path";
 var CONFIG_DIR_NAME2 = "skill-cli";
 var USAGE_FILE_NAME = "usage.json";
 function resolveConfigDir2(configDir) {
@@ -119312,7 +119531,7 @@ var UsageTracker = class {
   }
   async saveState(state) {
     try {
-      await ensureDir(dirname7(this.filePath));
+      await ensureDir(dirname6(this.filePath));
       await writeFile8(this.filePath, JSON.stringify(state, null, 2), "utf-8");
     } catch {
     }
@@ -119868,8 +120087,8 @@ if (!envLoaded && !process.env.DATABASE_URL) {
   process.env.SKIP_ENV_VALIDATION = "1";
 }
 var runtimeTarget = `bun-${process.platform}-${process.arch}`;
-var buildVersion = "0.15.0".length > 0 ? "0.15.0" : "0.0.0-dev";
-var buildCommit = "73ba4fa".length > 0 ? "73ba4fa" : "dev";
+var buildVersion = "0.16.1".length > 0 ? "0.16.1" : "0.0.0-dev";
+var buildCommit = "7f0ef62".length > 0 ? "7f0ef62" : "dev";
 var buildTarget = "node".length > 0 ? "node" : runtimeTarget;
 var isDevBuild = buildVersion.includes("dev") || buildCommit === "dev";
 var versionLabel = `skill v${buildVersion} (${buildCommit}) ${buildTarget}`;
@@ -120088,6 +120307,7 @@ registerDeployCommands(program2);
 registerKbCommands(program2);
 registerAuthCommands(program2, usageState);
 registerConfigCommands(program2);
+registerKeysCommands(program2);
 registerPluginSyncCommand(program2);
 program2.command("mcp").description(
   "Start MCP server for AI coding agent integration.\n  Exposes 9 Front tools over JSON-RPC stdio for Claude Code, Cursor, etc.\n  Tools: inbox, conversation, message, assign, reply, tag, archive, search, report\n  Usage: skill mcp  (then connect your AI editor to stdin/stdout)"