@tuned-tensor/cli 0.13.0-beta.1 → 0.13.1-beta.0

package/dist/index.js

@@ -2,19 +2,16 @@
 import {
   TRAINING_MODELS,
   assertLocalRunInputReady,
-  createLocalStore,
-  defaultLocalHome,
   loadLocalRunInput,
   loadLocalRunnerConfig,
-  runLocalPipeline,
-  runReportSchema
-} from "./chunk-2VJ3VVZF.js";
+  runLocalPipeline
+} from "./chunk-YJYCGSHJ.js";
 
 // src/cli.ts
 import { spawn as spawn2 } from "child_process";
 import { constants as osConstants2 } from "os";
 import { Command } from "commander";
-import chalk7 from "chalk";
+import chalk6 from "chalk";
 
 // src/local-agent-client.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -576,18 +573,134 @@ async function rejectPreparedAction(action, persist) {
 }
 
 // src/agent-model.ts
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, join as join3 } from "path";
+
+// src/config.ts
 import {
-  getAgentDir,
-  ModelRuntime
-} from "@earendil-works/pi-coding-agent";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join as join2 } from "path";
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+var AGENT_THINKING_LEVELS = [
+  "off",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+];
+var CONFIG_DIR_NAME = "tuned-tensor";
+var CONFIG_FILE_NAME = "config.json";
+function getConfigDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg || join2(homedir(), ".config");
+  return join2(base, CONFIG_DIR_NAME);
+}
+function getAgentConfigDir() {
+  return join2(getConfigDir(), "agent");
+}
+function getConfigPath() {
+  return join2(getConfigDir(), CONFIG_FILE_NAME);
+}
+function readConfig() {
+  const path = getConfigPath();
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+var configRevision = 0;
+function getConfigRevision() {
+  return configRevision;
+}
+function writeConfig(config) {
+  const dir = getConfigDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  const path = getConfigPath();
+  writeFileSync(path, JSON.stringify(config, null, 2) + "\n", {
+    mode: 384
+  });
+  chmodSync(path, 384);
+  configRevision += 1;
+}
+function updateConfig(partial) {
+  const current = readConfig();
+  writeConfig({ ...current, ...partial });
+}
+function getApiKey(opts) {
+  return opts?.apiKey || process.env.TUNED_TENSOR_API_KEY || readConfig().api_key;
+}
+function getAgentSelection(env = process.env) {
+  const stored = readConfig().agent;
+  const provider = env.TUNED_TENSOR_AGENT_PROVIDER || stored?.provider;
+  const model = env.TUNED_TENSOR_AGENT_MODEL || stored?.model;
+  const rawThinking = env.TUNED_TENSOR_AGENT_THINKING || stored?.thinking || "medium";
+  if (!AGENT_THINKING_LEVELS.includes(rawThinking)) {
+    throw new Error(
+      "Agent thinking must be off, minimal, low, medium, high, xhigh, or max."
+    );
+  }
+  if (!provider && !model) return void 0;
+  if (!provider || !model) {
+    throw new Error(
+      "Both an agent provider and model are required. Run `tt agent configure --provider <provider> --model <model>`."
+    );
+  }
+  return { provider, model, thinking: rawThinking };
+}
+
+// src/agent-model.ts
+function missingProviderAuthMessage(provider) {
+  return `Provider "${provider}" is not authenticated. Open the tt shell and run /login ${provider} to save a key, then try again.`;
+}
+function unknownAgentProviderMessage(provider) {
+  return `Unknown provider "${provider}". Use /login <id> or /model <id>.`;
+}
+var MIN_REDACTED_SECRET_LENGTH = 8;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function pushSecret(secrets, value) {
+  if (typeof value !== "string") return;
+  const secret = value.trim();
+  if (secret.length < MIN_REDACTED_SECRET_LENGTH) return;
+  if (!secrets.includes(secret)) secrets.push(secret);
+}
+function readStoredProviderSecrets(authPath = getAgentAuthPath()) {
+  if (!existsSync2(authPath)) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(authPath, "utf-8"));
+  } catch {
+    return [];
+  }
+  if (!isRecord(parsed)) return [];
+  const secrets = [];
+  for (const credential of Object.values(parsed)) {
+    if (!isRecord(credential)) continue;
+    if (credential.type === "api_key") {
+      pushSecret(secrets, credential.key);
+    } else if (credential.type === "oauth") {
+      pushSecret(secrets, credential.access);
+      pushSecret(secrets, credential.refresh);
+    }
+  }
+  return secrets;
+}
 function resolveAgentModel(runtime, selection) {
   const resolved = resolveAgentModelDefinition(runtime, selection);
   if (!runtime.hasConfiguredAuth(selection.provider)) {
-    throw new Error(
-      `Authenticate provider "${selection.provider}" first, then retry. Provider secrets are never accepted by tt flags.`
-    );
+    throw new Error(missingProviderAuthMessage(selection.provider));
   }
   return resolved;
 }
@@ -613,25 +726,46 @@ function resolveAgentModelDefinition(runtime, selection) {
   }
   return { model, thinking: selection.thinking };
 }
+function getAgentAuthPath() {
+  return join3(getAgentConfigDir(), "auth.json");
+}
+function getAgentModelsPath() {
+  return join3(getAgentConfigDir(), "models.json");
+}
 async function createPiModelRuntime() {
-  const agentDir = getAgentDir();
-  const modelsPath = join2(agentDir, "models.json");
+  const agentDir = getAgentConfigDir();
+  ensurePrivateDir(agentDir);
+  const modelsPath = getAgentModelsPath();
+  const authPath = getAgentAuthPath();
   ensureOpenRouterAppHeaders(modelsPath);
-  return await ModelRuntime.create({
-    authPath: join2(agentDir, "auth.json"),
+  const runtime = await ModelRuntime.create({
+    authPath,
     modelsPath,
     allowModelNetwork: false
   });
+  if (existsSync2(authPath)) chmodSync2(authPath, 384);
+  return runtime;
 }
 var OPENROUTER_APP_HEADERS = {
   "HTTP-Referer": "https://tunedtensor.com",
+  "X-OpenRouter-Title": "Tuned Tensor",
+  "X-OpenRouter-Categories": "cli-agent",
   "X-Title": "Tuned Tensor"
 };
+function ensurePrivateDir(dir) {
+  if (!existsSync2(dir)) mkdirSync2(dir, { recursive: true, mode: 448 });
+  chmodSync2(dir, 448);
+}
+function writePrivateJson(path, value) {
+  ensurePrivateDir(dirname(path));
+  writeFileSync2(path, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
+  chmodSync2(path, 384);
+}
 function ensureOpenRouterAppHeaders(modelsPath) {
   let config = {};
-  if (existsSync(modelsPath)) {
+  if (existsSync2(modelsPath)) {
     try {
-      const parsed = JSON.parse(readFileSync(modelsPath, "utf-8"));
+      const parsed = JSON.parse(readFileSync2(modelsPath, "utf-8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         config = parsed;
       }
@@ -645,10 +779,15 @@ function ensureOpenRouterAppHeaders(modelsPath) {
   const providers = asRecord(config.providers) ?? (config.providers = empty());
   const openrouter = asRecord(providers.openrouter) ?? (providers.openrouter = empty());
   const headers = asRecord(openrouter.headers) ?? (openrouter.headers = empty());
+  const attributionNames = new Set(
+    Object.keys(OPENROUTER_APP_HEADERS).map((name) => name.toLowerCase())
+  );
+  for (const name of Object.keys(headers)) {
+    if (attributionNames.has(name.toLowerCase())) delete headers[name];
+  }
   Object.assign(headers, OPENROUTER_APP_HEADERS);
   if (JSON.stringify(config) === before) return;
-  mkdirSync(dirname(modelsPath), { recursive: true });
-  writeFileSync(modelsPath, JSON.stringify(config, null, 2) + "\n");
+  writePrivateJson(modelsPath, config);
 }
 
 // src/agent-tools.ts
@@ -1338,7 +1477,7 @@ import {
   writeFile as writeFile2
 } from "fs/promises";
 import { randomUUID as randomUUID3 } from "crypto";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var DEFAULT_MAX_THREAD_BYTES = 1e6;
 var DEFAULT_MAX_MESSAGES = 200;
@@ -1348,7 +1487,7 @@ var DEFAULT_MAX_CLAIMS = 1e3;
 function assertThreadId(id) {
   if (!UUID.test(id)) throw new Error("Invalid local agent thread ID.");
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function scrub(value, secrets) {
@@ -1359,7 +1498,7 @@ function scrub(value, secrets) {
     );
   }
   if (Array.isArray(value)) return value.map((entry) => scrub(entry, secrets));
-  if (isRecord(value)) {
+  if (isRecord2(value)) {
     return Object.fromEntries(
       Object.entries(value).map(([key, entry]) => [key, scrub(entry, secrets)])
     );
@@ -1369,9 +1508,10 @@ function scrub(value, secrets) {
 var LocalAgentStore = class {
   constructor(rootDir, options = {}) {
     this.rootDir = rootDir;
-    this.threadsDir = join3(rootDir, "threads");
-    this.claimsDir = join3(rootDir, "action-claims");
+    this.threadsDir = join4(rootDir, "threads");
+    this.claimsDir = join4(rootDir, "action-claims");
     this.secrets = options.secretValues?.filter(Boolean) ?? [];
+    this.secretValueProvider = options.secretValueProvider;
     this.maxThreadBytes = options.maxThreadBytes ?? DEFAULT_MAX_THREAD_BYTES;
     this.maxMessages = options.maxMessages ?? DEFAULT_MAX_MESSAGES;
     this.maxActions = options.maxActions ?? DEFAULT_MAX_ACTIONS;
@@ -1381,13 +1521,20 @@ var LocalAgentStore = class {
   threadsDir;
   claimsDir;
   secrets;
+  secretValueProvider;
   maxThreadBytes;
   maxMessages;
   maxActions;
   maxThreads;
   maxClaims;
   redact(value) {
-    return scrub(value, this.secrets);
+    let extra = [];
+    try {
+      extra = this.secretValueProvider?.() ?? [];
+    } catch {
+      extra = [];
+    }
+    return scrub(value, [...this.secrets, ...extra]);
   }
   async ensureDirectories() {
     await mkdir2(this.rootDir, { recursive: true, mode: 448 });
@@ -1399,7 +1546,7 @@ var LocalAgentStore = class {
   }
   path(id) {
     assertThreadId(id);
-    return join3(this.threadsDir, `${id}.json`);
+    return join4(this.threadsDir, `${id}.json`);
   }
   serializeWithinQuota(state) {
     const active = state.actions.filter(
@@ -1424,11 +1571,11 @@ var LocalAgentStore = class {
     return serialized;
   }
   async pruneDirectory(directory, suffix, maximum, preserve) {
-    const entries = await Promise.all((await readdir(directory)).filter((name) => suffix.test(name) && name !== preserve).map(async (name) => ({ name, modified: (await stat(join3(directory, name))).mtimeMs })));
+    const entries = await Promise.all((await readdir(directory)).filter((name) => suffix.test(name) && name !== preserve).map(async (name) => ({ name, modified: (await stat(join4(directory, name))).mtimeMs })));
     entries.sort((a, b) => a.modified - b.modified);
     const keepOther = Math.max(0, maximum - (preserve ? 1 : 0));
     for (const entry of entries.slice(0, Math.max(0, entries.length - keepOther))) {
-      await unlink(join3(directory, entry.name));
+      await unlink(join4(directory, entry.name));
     }
   }
   async pruneThreads(preserve) {
@@ -1448,19 +1595,19 @@ var LocalAgentStore = class {
     }
     const candidates = await Promise.all(names.filter((name) => !protectedNames.has(name)).map(async (name) => ({
       name,
-      modified: (await stat(join3(this.threadsDir, name))).mtimeMs
+      modified: (await stat(join4(this.threadsDir, name))).mtimeMs
     })));
     candidates.sort((a, b) => a.modified - b.modified);
     const keep = Math.max(0, this.maxThreads - protectedNames.size);
     for (const entry of candidates.slice(0, Math.max(0, candidates.length - keep))) {
-      await unlink(join3(this.threadsDir, entry.name));
+      await unlink(join4(this.threadsDir, entry.name));
     }
   }
   async save(state) {
     assertThreadId(state.thread.id);
     await this.ensureDirectories();
     const destination = this.path(state.thread.id);
-    const temporary = join3(
+    const temporary = join4(
       this.threadsDir,
       `.${state.thread.id}.${randomUUID3()}.tmp`
     );
@@ -1480,7 +1627,7 @@ var LocalAgentStore = class {
   async claimAction(actionId) {
     assertThreadId(actionId);
     await this.ensureDirectories();
-    const path = join3(this.claimsDir, `${actionId}.claim`);
+    const path = join4(this.claimsDir, `${actionId}.claim`);
     try {
       await writeFile2(path, `${(/* @__PURE__ */ new Date()).toISOString()}
 `, {
@@ -1508,7 +1655,7 @@ var LocalAgentStore = class {
       throw new Error("Invalid local agent thread file.");
     }
     const parsed = JSON.parse(await readFile(path, "utf8"));
-    if (!isRecord(parsed) || !isRecord(parsed.thread) || parsed.thread.id !== id || !Array.isArray(parsed.messages) || !Array.isArray(parsed.actions)) {
+    if (!isRecord2(parsed) || !isRecord2(parsed.thread) || parsed.thread.id !== id || !Array.isArray(parsed.messages) || !Array.isArray(parsed.actions)) {
       throw new Error("Local agent thread file is malformed.");
     }
     return parsed;
@@ -1531,92 +1678,6 @@ var LocalAgentStore = class {
   }
 };
 
-// src/config.ts
-import {
-  chmodSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir } from "os";
-import { join as join4 } from "path";
-var AGENT_THINKING_LEVELS = [
-  "off",
-  "minimal",
-  "low",
-  "medium",
-  "high",
-  "xhigh",
-  "max"
-];
-var CONFIG_DIR_NAME = "tuned-tensor";
-var CONFIG_FILE_NAME = "config.json";
-function getConfigDir() {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  const base = xdg || join4(homedir(), ".config");
-  return join4(base, CONFIG_DIR_NAME);
-}
-function getConfigPath() {
-  return join4(getConfigDir(), CONFIG_FILE_NAME);
-}
-function readConfig() {
-  const path = getConfigPath();
-  if (!existsSync2(path)) return {};
-  try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-var configRevision = 0;
-function getConfigRevision() {
-  return configRevision;
-}
-function writeConfig(config) {
-  const dir = getConfigDir();
-  if (!existsSync2(dir)) mkdirSync2(dir, { recursive: true, mode: 448 });
-  chmodSync(dir, 448);
-  const path = getConfigPath();
-  writeFileSync2(path, JSON.stringify(config, null, 2) + "\n", {
-    mode: 384
-  });
-  chmodSync(path, 384);
-  configRevision += 1;
-}
-function updateConfig(partial) {
-  const current = readConfig();
-  writeConfig({ ...current, ...partial });
-}
-var DEFAULT_BASE_URL = "https://tunedtensor.com";
-function getBaseUrl(opts) {
-  return opts?.baseUrl || process.env.TUNED_TENSOR_URL || readConfig().base_url || DEFAULT_BASE_URL;
-}
-function getApiKey(opts) {
-  return opts?.apiKey || process.env.TUNED_TENSOR_API_KEY || readConfig().api_key;
-}
-function getAgentSelection(env = process.env) {
-  const stored = readConfig().agent;
-  const provider = env.TUNED_TENSOR_AGENT_PROVIDER || stored?.provider;
-  const model = env.TUNED_TENSOR_AGENT_MODEL || stored?.model;
-  const rawThinking = env.TUNED_TENSOR_AGENT_THINKING || stored?.thinking || "medium";
-  if (!AGENT_THINKING_LEVELS.includes(rawThinking)) {
-    throw new Error(
-      "Agent thinking must be off, minimal, low, medium, high, xhigh, or max."
-    );
-  }
-  if (!provider && !model) return void 0;
-  if (!provider || !model) {
-    throw new Error(
-      "Both an agent provider and model are required. Run `tt agent configure --provider <provider> --model <model>`."
-    );
-  }
-  return { provider, model, thinking: rawThinking };
-}
-
-// src/cli.ts
-import { join as join8 } from "path";
-
 // src/agent.ts
 import chalk3 from "chalk";
 import { stripVTControlCharacters as stripVTControlCharacters3 } from "util";
@@ -1626,7 +1687,7 @@ import chalk from "chalk";
 import { stat as stat3 } from "fs/promises";
 import { homedir as homedir3 } from "os";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
-import { createInterface } from "readline";
+import { createInterface as createInterface2 } from "readline";
 import { stripVTControlCharacters } from "util";
 
 // src/command-catalog.ts
@@ -1636,6 +1697,11 @@ var COMMAND_CATALOG = [
   { path: "validate", description: "Validate a local fine-tuning project.", group: "Workflow", modes: LOCAL },
   { path: "doctor", description: "Check the local host and run prerequisites.", group: "Workflow", modes: LOCAL },
   { path: "run", description: "Run the local fine-tuning and evaluation workflow.", group: "Workflow", modes: LOCAL },
+  { path: "pipeline init", description: "Write a canonical v1 pipeline recipe.", group: "Workflow", modes: LOCAL },
+  { path: "pipeline validate", description: "Validate a pipeline without executing it.", group: "Workflow", modes: LOCAL },
+  { path: "pipeline plan", description: "Resolve pipeline steps and required artifacts.", group: "Workflow", modes: LOCAL },
+  { path: "pipeline run", description: "Run or dry-run a local pipeline.", group: "Workflow", modes: LOCAL },
+  { path: "shell", description: "Open the conversational terminal.", group: "Workflow", modes: LOCAL },
   { path: "runs list", description: "List local runs.", group: "Inspect", modes: LOCAL },
   { path: "runs get", description: "Show a local run.", group: "Inspect", modes: LOCAL },
   { path: "runs report", description: "Show a local run report.", group: "Inspect", modes: LOCAL },
@@ -1652,16 +1718,17 @@ var COMMAND_CATALOG = [
   { path: "models rollback", description: "Roll back the active local model.", group: "Serving", modes: LOCAL },
   { path: "serve", description: "Serve a local adapter, active model, or base model.", group: "Serving", modes: LOCAL },
   { path: "info", description: "Show local runtime package information.", group: "Inspect", modes: LOCAL },
-  { path: "auth login", description: "Store a Tuned Tensor API key.", group: "Account", modes: LOCAL },
-  { path: "auth logout", description: "Remove the stored Tuned Tensor API key.", group: "Account", modes: LOCAL },
-  { path: "auth status", description: "Show Tuned Tensor authentication status.", group: "Account", modes: LOCAL },
-  { path: "publish", description: "Publish local run evidence to the dashboard.", group: "Account", modes: LOCAL }
+  { path: "status", description: "Show local project context.", group: "Inspect", modes: LOCAL },
+  { path: "agent models", description: "List provider models for the laptop-local TT agent.", group: "Inspect", modes: LOCAL },
+  { path: "agent configure", description: "Select the laptop-local TT agent model.", group: "Inspect", modes: LOCAL },
+  { path: "agent status", description: "Show the laptop-local TT agent selection.", group: "Inspect", modes: LOCAL }
 ];
 var SLASH_COMMANDS = [
   { path: "/help", description: "Show commands; add a word to filter." },
   { path: "/status", description: "Show lightweight workflow status." },
   { path: "/context", description: "Show the current project context." },
-  { path: "/model", description: "Show or change the TT agent model." },
+  { path: "/model", description: "Show or change the TT agent provider and model." },
+  { path: "/login", description: "Save a provider API key; asks which provider if omitted." },
   { path: "/cd", description: "Change the shell's working directory." },
   { path: "/clear", description: "Clear the terminal." },
   { path: "/exit", description: "Exit the TT shell." }
@@ -1903,6 +1970,24 @@ function formatShellStatus(context) {
 }
 
 // src/agent-control.ts
+import { chmodSync as chmodSync3, existsSync as existsSync3 } from "fs";
+var FEATURED_AGENT_PROVIDERS = [
+  "openai",
+  "openrouter"
+];
+var RECOMMENDED_AGENT_MODELS = [
+  { provider: "openai", ids: ["gpt-5.6-sol"] },
+  {
+    provider: "openrouter",
+    ids: ["deepseek/deepseek-v4-flash-0731", "deepseek/deepseek-v4-flash"]
+  }
+];
+var FEATURED_PROVIDER_INDEX = new Map(
+  FEATURED_AGENT_PROVIDERS.map((id, index) => [id, index])
+);
+function isFeaturedProvider(id) {
+  return FEATURED_PROVIDER_INDEX.has(id);
+}
 function modelKey(model) {
   return `${model.provider}/${model.id}`;
 }
@@ -1919,9 +2004,28 @@ function modelRelevance(model, query) {
   if (name.includes(q)) return 4;
   return void 0;
 }
+function listAgentProviders(runtime, options = {}) {
+  return runtime.getProviders().filter((provider) => !options.featuredOnly || isFeaturedProvider(provider.id)).map((provider) => ({
+    id: provider.id,
+    name: provider.name ?? provider.id,
+    authenticated: runtime.hasConfiguredAuth(provider.id)
+  })).sort((left, right) => {
+    const leftRank = FEATURED_PROVIDER_INDEX.get(left.id);
+    const rightRank = FEATURED_PROVIDER_INDEX.get(right.id);
+    if (leftRank !== void 0 || rightRank !== void 0) {
+      return (leftRank ?? Number.MAX_SAFE_INTEGER) - (rightRank ?? Number.MAX_SAFE_INTEGER) || left.id.localeCompare(right.id);
+    }
+    return left.id.localeCompare(right.id);
+  });
+}
+function findAgentProvider(runtime, id) {
+  const needle = id.trim().toLowerCase();
+  if (!needle) return void 0;
+  return listAgentProviders(runtime).find((provider) => provider.id.toLowerCase() === needle);
+}
 function listAgentModels(runtime, options = {}) {
   let models = runtime.getModels(options.provider).filter(
-    (model) => options.includeUnauthenticated || runtime.hasConfiguredAuth(model.provider)
+    (model) => (options.includeUnauthenticated || runtime.hasConfiguredAuth(model.provider)) && (!options.featuredOnly || isFeaturedProvider(model.provider))
   ).map((model) => ({
     provider: model.provider,
     id: model.id,
@@ -1948,6 +2052,19 @@ function listAgentModels(runtime, options = {}) {
   }
   return models;
 }
+function recommendAgentModels(runtime, options = {}) {
+  const models = listAgentModels(runtime, {
+    includeUnauthenticated: options.includeUnauthenticated ?? true
+  });
+  const picks = [];
+  for (const recommendation of RECOMMENDED_AGENT_MODELS) {
+    const match = recommendation.ids.map((id) => models.find(
+      (model) => model.provider === recommendation.provider && model.id === id
+    )).find((model) => model !== void 0);
+    if (match) picks.push(match);
+  }
+  return picks;
+}
 function describeAgentModel(runtime, env) {
   const selection = getAgentSelection(env);
   if (!selection) return void 0;
@@ -1963,6 +2080,23 @@ function describeAgentModel(runtime, env) {
     supportsThinking: resolved.model.reasoning !== false
   };
 }
+async function loginAgentProvider(runtime, provider, apiKey) {
+  const choice = findAgentProvider(runtime, provider);
+  if (!choice) {
+    throw new Error(unknownAgentProviderMessage(provider));
+  }
+  const key = apiKey.trim();
+  if (!key) {
+    throw new Error("API key cannot be empty.");
+  }
+  if (typeof runtime.setRuntimeApiKey !== "function") {
+    throw new Error("This session cannot store provider credentials.");
+  }
+  await runtime.setRuntimeApiKey(choice.id, key);
+  const authPath = getAgentAuthPath();
+  if (existsSync3(authPath)) chmodSync3(authPath, 384);
+  return { provider: choice.id };
+}
 function setAgentModel(runtime, env, provider, model, options = {}) {
   const current = getAgentSelection(env);
   const requestedThinking = options.thinking ?? current?.thinking ?? "medium";
@@ -1999,6 +2133,65 @@ function setAgentModel(runtime, env, provider, model, options = {}) {
   return { selection, adjustedThinking: effectiveThinking !== requestedThinking };
 }
 
+// src/secret-prompt.ts
+import { createInterface } from "readline/promises";
+import { stdin, stdout } from "process";
+import { Writable } from "stream";
+async function promptVisibleInput(message, input = stdin, output = stdout) {
+  return await promptInput(message, false, input, output);
+}
+async function promptHiddenInput(message, input = stdin, output = stdout) {
+  return await promptInput(message, true, input, output);
+}
+async function withDetachedKeypress(input, run) {
+  const listeners = [...input.listeners("keypress")];
+  input.removeAllListeners("keypress");
+  try {
+    return await run();
+  } finally {
+    input.removeAllListeners("keypress");
+    for (const listener of listeners) {
+      input.on("keypress", listener);
+    }
+  }
+}
+async function promptInput(message, hidden, input, output) {
+  if (input.isTTY !== true || output.isTTY !== true) {
+    throw new Error("Provider login needs an interactive tt session.");
+  }
+  return await withDetachedKeypress(input, async () => {
+    if (!hidden) {
+      const rl2 = createInterface({ input, output, terminal: true });
+      try {
+        return await rl2.question(message);
+      } finally {
+        rl2.close();
+      }
+    }
+    let muted = false;
+    const maskedOutput = new Writable({
+      write(chunk, _encoding, callback) {
+        if (!muted) output.write(chunk);
+        callback();
+      }
+    });
+    const rl = createInterface({
+      input,
+      output: maskedOutput,
+      terminal: true
+    });
+    try {
+      const pending = rl.question(message);
+      muted = true;
+      return await pending;
+    } finally {
+      muted = false;
+      output.write("\n");
+      rl.close();
+    }
+  });
+}
+
 // src/shell.ts
 var AGENT_SLASH_COMMANDS = /* @__PURE__ */ new Set([
   "new",
@@ -2157,6 +2350,7 @@ var SLASH_NAMES = /* @__PURE__ */ new Set([
   "status",
   "context",
   "model",
+  "login",
   "clear",
   "cd",
   "exit"
@@ -2326,6 +2520,9 @@ function agentModelLabel(context) {
 }
 function renderShellBanner(snapshot) {
   const heading = snapshot.version ? `${accent.bold("tt")} ${chalk.dim(`v${snapshot.version}`)}` : accent.bold("tt");
+  const configured = Boolean(
+    snapshot.context.agent?.provider && snapshot.context.agent?.model
+  );
   const lines = [
     heading,
     chalk.dim(
@@ -2333,7 +2530,9 @@ function renderShellBanner(snapshot) {
     ),
     chalk.dim("ctrl+c stop/clear \xB7 ctrl+d exit \xB7 /help commands \xB7 tab complete"),
     "",
-    chalk.dim("Ask TT anything. Known commands run directly.")
+    chalk.dim(
+      configured ? "Ask TT anything. Known commands run directly." : "Use /model to choose a provider and model. Workflow commands work now."
+    )
   ];
   return `${lines.join("\n")}
 
@@ -2442,45 +2641,74 @@ var TunedTensorShellSession = class _TunedTensorShellSession {
     const lines = styleDetailLines([
       detailLine("Agent model", label),
       detailLine("Change", "/model <provider>/<model>"),
-      detailLine("Search", "/model <query>")
+      detailLine("List", "/model <provider>"),
+      detailLine("Search", "/model <query>"),
+      detailLine("Login", "/login <provider>")
     ]);
-    const all = listAgentModels(runtime);
-    if (all.length === 0) {
-      lines.push("", chalk.dim("  no authenticated models \u2014 run `tt agent models --all` for the full catalog"));
+    const catalog = { includeUnauthenticated: true };
+    const featuredCatalog = { ...catalog, featuredOnly: true };
+    const provider = query ? findAgentProvider(runtime, query) : void 0;
+    if (provider) {
+      const matches = listAgentModels(runtime, { ...catalog, provider: provider.id });
+      lines.push("", chalk.bold(`Models from ${provider.id}`));
+      this.appendAgentModelChoices(lines, matches, summary, 20, "/model <query> to search");
+      if (matches.length === 0) {
+        lines.push(chalk.dim("  no models"));
+      }
       return lines;
     }
     if (query) {
-      const matches = listAgentModels(runtime, { query });
+      const matches = listAgentModels(runtime, { ...catalog, query });
       lines.push("", chalk.bold(`Models matching ${JSON.stringify(query)}`));
+      this.appendAgentModelChoices(lines, matches, summary, 10, "refine the query");
       if (matches.length === 0) {
         lines.push(chalk.dim("  no matches"));
-      } else {
-        const shown2 = matches.slice(0, 10);
-        for (const model of shown2) {
-          lines.push(this.formatAgentModelChoice(model, summary));
-        }
-        if (matches.length > shown2.length) {
-          lines.push(chalk.dim(`  \u2026 ${matches.length - shown2.length} more \u2014 refine the query`));
-        }
       }
       return lines;
     }
-    const preferred = summary ? all.filter((model) => model.provider === summary.provider) : [];
-    const rest = summary ? all.filter((model) => model.provider !== summary.provider) : all;
-    const shown = [...preferred, ...rest].slice(0, 8);
-    lines.push("", chalk.bold(summary ? "Suggestions" : "Available models"));
+    const providers = listAgentProviders(runtime, { featuredOnly: true });
+    lines.push("", chalk.bold("Providers"));
+    if (providers.length === 0) {
+      lines.push(chalk.dim("  no providers in the catalog"));
+    } else {
+      for (const choice of providers) {
+        lines.push(this.formatAgentProviderChoice(choice));
+      }
+      lines.push(chalk.dim("  Other providers: /login <id> or /model <id>"));
+      if (providers.some((choice) => !choice.authenticated)) {
+        lines.push(chalk.dim("  Use /login <provider> to save a key."));
+      }
+    }
+    const suggestions = recommendAgentModels(runtime, featuredCatalog);
+    lines.push("", chalk.bold("Suggestions"));
+    this.appendAgentModelChoices(lines, suggestions, summary);
+    if (suggestions.length === 0) {
+      lines.push(chalk.dim("  no models in the catalog"));
+    } else {
+      lines.push(chalk.dim("  Use /model <provider> to list models, /model <query> to search"));
+    }
+    return lines;
+  }
+  appendAgentModelChoices(lines, models, summary, limit, moreHint) {
+    const shown = limit ? models.slice(0, limit) : models;
     for (const model of shown) {
       lines.push(this.formatAgentModelChoice(model, summary));
     }
-    if (all.length > shown.length) {
-      lines.push(chalk.dim(`  \u2026 ${all.length - shown.length} more \u2014 /model <query> to search`));
+    if (limit && models.length > shown.length) {
+      const hint = moreHint ? ` \u2014 ${moreHint}` : "";
+      lines.push(chalk.dim(`  \u2026 ${models.length - shown.length} more${hint}`));
     }
-    return lines;
+  }
+  formatAgentProviderChoice(provider) {
+    const displayName = provider.name !== provider.id ? `  ${provider.name}` : "";
+    const auth = provider.authenticated ? "" : chalk.dim("  auth required");
+    return `  ${accent(provider.id)}${displayName}${auth}`;
   }
   formatAgentModelChoice(model, summary) {
     const active = summary?.provider === model.provider && summary?.model === model.id;
     const displayName = model.name !== model.id ? `  ${model.name}` : "";
-    return `  ${accent(`${model.provider}/${model.id}`)}${displayName}${active ? chalk.dim(" (active)") : ""}`;
+    const auth = model.authenticated ? "" : chalk.dim("  auth required");
+    return `  ${accent(`${model.provider}/${model.id}`)}${displayName}${active ? chalk.dim(" (active)") : ""}${auth}`;
   }
   async handleSlash(command) {
     switch (command.name) {
@@ -2508,7 +2736,7 @@ var TunedTensorShellSession = class _TunedTensorShellSession {
           return "continue";
         }
         if (command.args.length !== 1) {
-          throw new ShellParseError("Usage: /model [<query> | <provider>/<model>]");
+          throw new ShellParseError("Usage: /model [<query> | <provider> | <provider>/<model>]");
         }
         const target = command.args[0];
         const slash = target.indexOf("/");
@@ -2529,6 +2757,48 @@ var TunedTensorShellSession = class _TunedTensorShellSession {
         const note = result2.adjustedThinking ? " \u2014 thinking set to off for this model" : "";
         this.io.write(
           `${successMark()} Agent model: ${result2.selection.provider}/${result2.selection.model} (thinking ${result2.selection.thinking})${note}.
+`
+        );
+        return "continue";
+      }
+      case "login": {
+        const runtime = await this.requireAgentModelRuntime();
+        if (command.args.length > 1) {
+          throw new ShellParseError("Usage: /login [<provider>]");
+        }
+        let providerId = command.args[0]?.trim();
+        if (!providerId) {
+          const providers = listAgentProviders(runtime, { featuredOnly: true });
+          if (providers.length === 0) {
+            throw new ShellParseError("No providers in the catalog.");
+          }
+          this.writeLines([
+            "",
+            chalk.bold("Providers"),
+            ...providers.map((choice) => this.formatAgentProviderChoice(choice)),
+            chalk.dim("  Other providers: /login <id>")
+          ]);
+          if (!this.io.promptLine) {
+            throw new ShellParseError("Usage: /login <provider>");
+          }
+          providerId = (await this.io.promptLine("Provider: ")).trim();
+          if (!providerId) {
+            throw new ShellParseError("Usage: /login <provider>");
+          }
+        }
+        const provider = findAgentProvider(runtime, providerId);
+        if (!provider) {
+          throw new ShellParseError(unknownAgentProviderMessage(providerId));
+        }
+        if (!this.io.promptSecret) {
+          throw new ShellParseError("Provider login needs an interactive tt session.");
+        }
+        const label = provider.name !== provider.id ? provider.name : provider.id;
+        const apiKey = await this.io.promptSecret(`${label} API key: `);
+        const result2 = await loginAgentProvider(runtime, provider.id, apiKey);
+        await this.refreshContext();
+        this.io.write(
+          `${successMark()} Saved ${result2.provider} credentials. Chat and /model can use this provider now.
 `
         );
         return "continue";
@@ -2655,17 +2925,37 @@ async function startInteractiveShell(options) {
   }
   let readline;
   const terminalInput = input;
-  const foregroundRunner = (request2) => withForegroundSignalHandoff(
+  const withPrompt = async (message, prompt) => {
+    readline?.pause();
+    const restoreRawMode = terminalInput.isRaw === true && typeof terminalInput.setRawMode === "function";
+    if (restoreRawMode) terminalInput.setRawMode(false);
+    try {
+      return await prompt(message, input, output);
+    } finally {
+      if (restoreRawMode) terminalInput.setRawMode(true);
+      readline?.resume();
+    }
+  };
+  const io = {
+    ...streamIO(output, error),
+    async promptLine(message) {
+      return await withPrompt(message, promptVisibleInput);
+    },
+    async promptSecret(message) {
+      return await withPrompt(message, promptHiddenInput);
+    }
+  };
+  const foregroundRunner = (request) => withForegroundSignalHandoff(
     {
       input: terminalInput,
       pauseReadline: () => readline?.pause(),
       resumeReadline: () => readline?.resume()
     },
-    () => options.runner(request2)
+    () => options.runner(request)
   );
   const session = await createShellSession({
     runner: foregroundRunner,
-    io: streamIO(output, error),
+    io,
     agent: options.agent,
     cwd: options.cwd,
     env: options.env,
@@ -2673,7 +2963,7 @@ async function startInteractiveShell(options) {
     agentModelRuntime: options.agentModelRuntime
   });
   const completer = createCommandCompleter(() => session.snapshot().mode);
-  readline = createInterface({
+  readline = createInterface2({
     input,
     output,
     terminal: true,
@@ -2846,7 +3136,7 @@ var StreamingTerminalMarkdown = class {
 var accent3 = chalk3.hex("#8B5CF6");
 var successMark2 = () => chalk3.green("\u2713");
 var errorMark2 = () => chalk3.red("\u2717");
-function isRecord2(value) {
+function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function stringValue(value) {
@@ -2887,7 +3177,7 @@ function formatThread(thread, activeId) {
   return `${active} ${chalk3.dim(thread.id.slice(0, 8))}  ${sanitizeTerminalText2(thread.title)}  ${chalk3.dim(dateLabel)}`;
 }
 function actionFromPayload(payload) {
-  const value = isRecord2(payload.action) ? payload.action : isRecord2(payload.approval) ? payload.approval : payload;
+  const value = isRecord3(payload.action) ? payload.action : isRecord3(payload.approval) ? payload.approval : payload;
   const id = stringValue(value.id);
   const title = stringValue(value.title);
   if (!id || !title) return null;
@@ -2975,10 +3265,10 @@ ${chalk3.yellow.bold("Approval required")}  ${chalk3.dim(action.id.slice(0, 8))}
 `);
     if (action.summary) this.options.io.write(`${sanitizeTerminalText2(action.summary)}
 `);
-    const request2 = [action.method, action.path].filter(Boolean).join(" ");
+    const request = [action.method, action.path].filter(Boolean).join(" ");
     const technical = {
       operation: action.operation,
-      ...request2 ? { request: request2 } : {},
+      ...request ? { request } : {},
       arguments: action.arguments ?? null,
       preview: action.preview ?? null
     };
@@ -3020,7 +3310,7 @@ ${chalk3.yellow.bold("Approval required")}  ${chalk3.dim(action.id.slice(0, 8))}
     if (event.type === "tool_call") {
       this.flushResponse();
       this.endOpenLine();
-      const name = stringValue(payload.name) ?? stringValue(isRecord2(payload.tool_call) ? payload.tool_call.name : null) ?? "tool";
+      const name = stringValue(payload.name) ?? stringValue(isRecord3(payload.tool_call) ? payload.tool_call.name : null) ?? "tool";
       this.options.io.write(chalk3.dim(`  \u25CB ${name}
 `));
       return;
@@ -3278,7 +3568,7 @@ ${chalk3.yellow.bold("Approval required")}  ${chalk3.dim(action.id.slice(0, 8))}
 import { constants as osConstants } from "os";
 import { randomUUID as randomUUID4 } from "crypto";
 import { spawn } from "child_process";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { fileURLToPath } from "url";
 import {
   readFile as readFile3,
@@ -3361,59 +3651,6 @@ var ApiError = class extends Error {
     this.name = "ApiError";
   }
 };
-function resolveKey(opts) {
-  const key = getApiKey(opts);
-  if (!key) {
-    throw new ApiError(
-      401,
-      "NO_API_KEY",
-      "No API key found. Run `tt auth login` or set TUNED_TENSOR_API_KEY."
-    );
-  }
-  return key;
-}
-function buildUrl(path, query, opts) {
-  const base = getBaseUrl(opts);
-  const url = new URL(`/api/v1${path}`, base);
-  if (query) {
-    for (const [k, v] of Object.entries(query)) {
-      if (v !== void 0) url.searchParams.set(k, String(v));
-    }
-  }
-  return url.toString();
-}
-async function request(method, path, options = {}) {
-  const key = resolveKey(options.opts);
-  const url = buildUrl(path, options.query, options.opts);
-  const headers = {
-    ...options.headers,
-    Authorization: `Bearer ${key}`
-  };
-  let bodyPayload;
-  if (options.body) {
-    headers["Content-Type"] = "application/json";
-    bodyPayload = JSON.stringify(options.body);
-  }
-  const res = await fetch(url, { method, headers, body: bodyPayload });
-  if (!res.ok) {
-    let errBody;
-    try {
-      errBody = await res.json();
-    } catch {
-      throw new ApiError(res.status, "UNKNOWN", res.statusText);
-    }
-    throw new ApiError(
-      res.status,
-      errBody.error?.code || "UNKNOWN",
-      errBody.error?.message || res.statusText
-    );
-  }
-  if (res.status === 204) return { data: null };
-  return await res.json();
-}
-function post(path, body, opts, headers) {
-  return request("POST", path, { body, opts, headers });
-}
 
 // src/output.ts
 var labelStyle = chalk4.bold.hex("#A78BFA");
@@ -3509,7 +3746,7 @@ function shortId(id) {
 }
 
 // src/local-output.ts
-function isRecord3(value) {
+function isRecord4(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function text(value) {
@@ -3523,14 +3760,16 @@ function number(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function record3(value) {
-  return isRecord3(value) ? value : void 0;
+  return isRecord4(value) ? value : void 0;
 }
 function rows(value) {
-  return Array.isArray(value) ? value.filter(isRecord3) : [];
+  return Array.isArray(value) ? value.filter(isRecord4) : [];
 }
 function displayId(value) {
   const id = text(value);
-  return id ? shortId(id) : "\u2014";
+  if (!id) return "\u2014";
+  if (id.startsWith("local-")) return `local-${shortId(id.slice("local-".length))}`;
+  return shortId(id);
 }
 function displayNumber(value, digits = 4) {
   const parsed = number(value);
@@ -3814,19 +4053,19 @@ function renderServePlan(value) {
 function renderKnownJson(args2, value) {
   const command = args2[0];
   const subcommand = args2[1];
-  if (command === "doctor" && isRecord3(value)) {
+  if (command === "doctor" && isRecord4(value)) {
     renderDoctor(value);
     return true;
   }
-  if (command === "init" && isRecord3(value)) {
+  if (command === "init" && isRecord4(value)) {
     renderInit(value);
     return true;
   }
-  if (command === "validate" && isRecord3(value)) {
+  if (command === "validate" && isRecord4(value)) {
     renderValidate(value);
     return true;
   }
-  if (command === "run" && isRecord3(value)) {
+  if (command === "run" && isRecord4(value)) {
     renderRun(value);
     return true;
   }
@@ -3839,15 +4078,15 @@ function renderKnownJson(args2, value) {
       renderRunEvents(value);
       return true;
     }
-    if (subcommand === "get" && isRecord3(value)) {
+    if (subcommand === "get" && isRecord4(value)) {
       renderRunRecord(value);
       return true;
     }
-    if (subcommand === "report" && isRecord3(value)) {
+    if (subcommand === "report" && isRecord4(value)) {
       renderRunReport(value);
       return true;
     }
-    if (subcommand === "compare" && isRecord3(value)) {
+    if (subcommand === "compare" && isRecord4(value)) {
       renderRunComparison(value);
       return true;
     }
@@ -3857,25 +4096,25 @@ function renderKnownJson(args2, value) {
       renderModelsList(value);
       return true;
     }
-    if ((subcommand === "get" || subcommand === "verify") && isRecord3(value)) {
+    if ((subcommand === "get" || subcommand === "verify") && isRecord4(value)) {
       if (subcommand === "verify") printSuccess("Local model artifact is valid");
       renderModelRecord(value);
       return true;
     }
-    if ((subcommand === "prefetch" || subcommand === "verify-base") && isRecord3(value)) {
+    if ((subcommand === "prefetch" || subcommand === "verify-base") && isRecord4(value)) {
       renderModelPrefetch(value);
       return true;
     }
-    if (["active", "activate", "rollback"].includes(subcommand ?? "") && isRecord3(value)) {
+    if (["active", "activate", "rollback"].includes(subcommand ?? "") && isRecord4(value)) {
       renderActiveModel(value);
       return true;
     }
-    if (subcommand === "serve" && isRecord3(value)) {
+    if (subcommand === "serve" && isRecord4(value)) {
       renderServePlan(value);
       return true;
     }
   }
-  if (command === "serve" && isRecord3(value)) {
+  if (command === "serve" && isRecord4(value)) {
     renderServePlan(value);
     return true;
   }
@@ -4149,7 +4388,7 @@ async function projectSpecArguments(originalArgs, cwd) {
 }
 function resolveLocalCliEntrypoint() {
   const entrypoint = fileURLToPath(new URL("./local-runtime.js", import.meta.url));
-  if (!existsSync3(entrypoint)) {
+  if (!existsSync4(entrypoint)) {
     throw new Error(
       "The bundled local runtime is missing. Rebuild or reinstall @tuned-tensor/cli."
     );
@@ -4478,294 +4717,9 @@ function registerAgentCommands(parent, options) {
   });
 }
 
-// src/commands/auth.ts
-import { createInterface as createInterface2 } from "readline/promises";
-import { stdin, stdout } from "process";
-import { Writable } from "stream";
-import chalk6 from "chalk";
-async function promptForApiKey(input = stdin, output = stdout) {
-  if (input.isTTY !== true || output.isTTY !== true) {
-    throw new Error(
-      "An API key is required in non-interactive mode. Pass it to `tt auth login <key>` or set TUNED_TENSOR_API_KEY."
-    );
-  }
-  let muted = false;
-  const maskedOutput = new Writable({
-    write(chunk, _encoding, callback) {
-      if (!muted) output.write(chunk);
-      callback();
-    }
-  });
-  const rl = createInterface2({
-    input,
-    output: maskedOutput,
-    terminal: true
-  });
-  try {
-    const pending = rl.question("Enter your API key (tt_...): ");
-    muted = true;
-    return await pending;
-  } finally {
-    muted = false;
-    output.write("\n");
-    rl.close();
-  }
-}
-function registerAuthCommands(parent) {
-  const auth = parent.command("auth").description("Manage authentication");
-  auth.command("login").description("Store an API key for authentication").argument("[key]", "API key (tt_...). If omitted, you will be prompted.").action(async (key) => {
-    let apiKey = key;
-    if (!apiKey) {
-      if (isJsonMode()) {
-        throw new Error(
-          "An API key argument is required in JSON mode. Use `tt --json auth login <key>`."
-        );
-      }
-      const settingsUrl = `${DEFAULT_BASE_URL}/dashboard/settings`;
-      console.log();
-      console.log(
-        `  To get your API key, go to ${chalk6.bold("Settings \u2192 API Keys")} in the Tuned Tensor dashboard:`
-      );
-      console.log(`  ${chalk6.hex("#A78BFA").underline(settingsUrl)}`);
-      console.log();
-      apiKey = await promptForApiKey();
-    }
-    apiKey = apiKey.trim();
-    if (!apiKey.startsWith("tt_") || apiKey.length !== 51) {
-      throw new Error(
-        "Invalid API key format. Keys start with tt_ and are 51 characters long."
-      );
-    }
-    updateConfig({ api_key: apiKey });
-    if (isJsonMode()) {
-      printJson({
-        authenticated: true,
-        key_prefix: `${apiKey.slice(0, 8)}...`,
-        base_url: getBaseUrl(parent.opts())
-      });
-      return;
-    }
-    printSuccess(
-      `API key stored (${apiKey.slice(0, 8)}...). You're ready to go.`
-    );
-  });
-  auth.command("logout").description("Remove stored credentials").action(() => {
-    const current = readConfig();
-    const { api_key: _removed, ...rest } = current;
-    writeConfig(rest);
-    if (isJsonMode()) {
-      printJson({ authenticated: false });
-      return;
-    }
-    printSuccess("Credentials removed.");
-  });
-  auth.command("status").description("Show current authentication status").action(() => {
-    const opts = parent.opts();
-    const apiKey = getApiKey(opts);
-    const baseUrl = getBaseUrl(opts);
-    if (isJsonMode()) {
-      printJson({
-        authenticated: !!apiKey,
-        key_prefix: apiKey ? apiKey.slice(0, 8) + "..." : null,
-        base_url: baseUrl
-      });
-      return;
-    }
-    if (apiKey) {
-      printDetail([
-        ["Authenticated", "Yes"],
-        ["API Key", apiKey.slice(0, 8) + "..."],
-        ["Base URL", baseUrl]
-      ]);
-    } else {
-      printWarning(
-        "Not authenticated. Run `tt auth login` to store an API key."
-      );
-      printDetail([["Base URL", baseUrl]]);
-    }
-  });
-}
-
-// src/commands/publish.ts
-import { createInterface as createInterface3 } from "readline/promises";
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { isAbsolute as isAbsolute4, join as join7, resolve as resolve4 } from "path";
-import { stdin as defaultStdin, stdout as defaultStdout } from "process";
-var MAX_PUBLISH_BYTES = 2 * 1024 * 1024;
-function expandPath2(value, baseDirectory, homeDirectory) {
-  if (value === "~") return homeDirectory;
-  if (value.startsWith("~/")) return resolve4(homeDirectory, value.slice(2));
-  return isAbsolute4(value) ? resolve4(value) : resolve4(baseDirectory, value);
-}
-function resolvePublishStoreRoot(options) {
-  const cwd = options?.cwd ?? process.cwd();
-  const env = options?.env ?? process.env;
-  const homeDirectory = options?.homeDirectory ?? (env.HOME ? resolve4(env.HOME) : homedir4());
-  const localConfigPath = join7(cwd, "local-runner.json");
-  if (existsSync4(localConfigPath)) {
-    try {
-      const raw = JSON.parse(readFileSync4(localConfigPath, "utf-8"));
-      if (typeof raw.storeRoot === "string" && raw.storeRoot.trim()) {
-        return expandPath2(raw.storeRoot, cwd, homeDirectory);
-      }
-    } catch {
-    }
-  }
-  if (env.TT_LOCAL_HOME && env.TT_LOCAL_HOME.trim()) {
-    return expandPath2(env.TT_LOCAL_HOME, cwd, homeDirectory);
-  }
-  return defaultLocalHome();
-}
-async function confirmPublish(question, input = defaultStdin, output = defaultStdout) {
-  if (input.isTTY !== true || output.isTTY !== true) {
-    throw new Error(
-      "Publishing requires confirmation in interactive mode. Re-run with --yes."
-    );
-  }
-  const rl = createInterface3({ input, output, terminal: true });
-  try {
-    const answer = (await rl.question(question)).trim().toLowerCase();
-    return answer === "y" || answer === "yes";
-  } finally {
-    rl.close();
-  }
-}
-function pickPublishableRun(runs, runId) {
-  if (runId) {
-    const exact = runs.find((run) => run.id === runId);
-    const prefixMatches = exact ? [exact] : runs.filter((run) => run.id.startsWith(runId));
-    if (prefixMatches.length === 0) {
-      throw new Error(`Run not found: ${runId}`);
-    }
-    if (prefixMatches.length > 1) {
-      throw new Error(
-        `Ambiguous run id prefix ${JSON.stringify(runId)}; matches ${prefixMatches.map((run) => shortId(run.id)).join(", ")}. Pass a longer prefix or the full id.`
-      );
-    }
-    const match = prefixMatches[0];
-    if (match.status !== "completed" && match.status !== "failed") {
-      throw new Error(
-        `Run ${shortId(match.id)} is still ${match.status}; only completed or failed runs can be published.`
-      );
-    }
-    return match;
-  }
-  const candidates = runs.filter((run) => run.status === "completed" || run.status === "failed").sort((a, b) => b.updated_at.localeCompare(a.updated_at));
-  const latest = candidates[0];
-  if (!latest) {
-    throw new Error(
-      "No completed or failed local runs found. Run `tt run` first, then publish."
-    );
-  }
-  return latest;
-}
-function assertPublishPayloadSize(payload) {
-  const bytes = Buffer.byteLength(JSON.stringify(payload), "utf8");
-  if (bytes > MAX_PUBLISH_BYTES) {
-    throw new Error(
-      `Publish payload is ${bytes} bytes; maximum is ${MAX_PUBLISH_BYTES} bytes. Reduce eval examples or publish a smaller run.`
-    );
-  }
-}
-function registerPublishCommand(parent) {
-  parent.command("publish").description("Publish local run evidence to the Tuned Tensor dashboard").argument("[runId]", "Local run id or prefix (defaults to latest completed/failed run)").option("-k, --api-key <key>", "API key (tt_...)").option("-u, --base-url <url>", "API base URL").option("-y, --yes", "Skip confirmation prompt").option("--dry-run", "Show what would be published without uploading").action(async (runId, cmdOpts) => {
-    const opts = {
-      apiKey: cmdOpts.apiKey,
-      baseUrl: cmdOpts.baseUrl
-    };
-    if (!cmdOpts.dryRun && !getApiKey(opts)) {
-      throw new Error(
-        "No API key found. Run `tt auth login` or set TUNED_TENSOR_API_KEY."
-      );
-    }
-    const storeRoot = resolvePublishStoreRoot();
-    const store = createLocalStore(storeRoot);
-    const runs = await store.listRuns();
-    const run = pickPublishableRun(runs, runId);
-    const rawReport = await store.getRunReport(run.id);
-    const report = runReportSchema.parse(rawReport);
-    const specRecord = await store.getSpec(run.behavior_spec_id);
-    const exampleCount = report.candidate.results.length || report.baseline.results.length;
-    const payload = {
-      spec: {
-        id: specRecord.id,
-        ...specRecord.spec
-      },
-      report
-    };
-    assertPublishPayloadSize(payload);
-    if (isJsonMode() && cmdOpts.dryRun) {
-      printJson({
-        dry_run: true,
-        store_root: storeRoot,
-        run_id: run.id,
-        spec_id: specRecord.id,
-        spec_name: specRecord.spec.name,
-        run_number: run.run_number,
-        status: run.status,
-        example_count: exampleCount,
-        payload
-      });
-      return;
-    }
-    if (!isJsonMode()) {
-      printDetail([
-        ["Spec", specRecord.spec.name],
-        ["Run", `${shortId(run.id)} (#${run.run_number})`],
-        ["Status", run.status],
-        ["Examples", String(exampleCount)],
-        ["Store", storeRoot]
-      ]);
-      printWarning(
-        "Prompts and model outputs from the run report will be uploaded to your Tuned Tensor account."
-      );
-    }
-    if (cmdOpts.dryRun) {
-      if (isJsonMode()) {
-        printJson({
-          dry_run: true,
-          run_id: run.id,
-          spec_id: specRecord.id,
-          example_count: exampleCount
-        });
-        return;
-      }
-      printSuccess("Dry run only \u2014 nothing was uploaded.");
-      return;
-    }
-    if (!cmdOpts.yes && !isJsonMode()) {
-      const ok = await confirmPublish("Publish this run evidence? [y/N] ");
-      if (!ok) {
-        printWarning("Publish cancelled.");
-        return;
-      }
-    }
-    if (!cmdOpts.yes && isJsonMode()) {
-      throw new Error(
-        "JSON mode requires --yes to publish without an interactive prompt."
-      );
-    }
-    const { data: data3 } = await post("/publish/runs", payload, opts);
-    const baseUrl = getBaseUrl(opts).replace(/\/$/, "");
-    const dashboardUrl = `${baseUrl}/dashboard/runs/${data3.id}`;
-    if (isJsonMode()) {
-      printJson({ ...data3, dashboard_url: dashboardUrl });
-      return;
-    }
-    printSuccess(
-      `Published run #${data3.run_number} (${shortId(data3.id)}) for ${specRecord.spec.name}`
-    );
-    printDetail([
-      ["Dashboard", dashboardUrl],
-      ["Spec ID", shortId(data3.spec_id)]
-    ]);
-  });
-}
-
 // src/commands/pipeline.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve5 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
 var DEFAULT_PIPELINE_FILE = "tunedtensor.pipeline.json";
 function parseList(value) {
   if (!value) return void 0;
@@ -4774,10 +4728,10 @@ function parseList(value) {
   return ids;
 }
 function loadPipeline(path) {
-  const resolved = resolve5(path);
+  const resolved = resolve4(path);
   if (!existsSync5(resolved)) throw new Error(`Pipeline file not found: ${path}. Run \`tt pipeline init\` to create one.`);
   try {
-    return JSON.parse(readFileSync5(resolved, "utf8"));
+    return JSON.parse(readFileSync4(resolved, "utf8"));
   } catch (error) {
     throw new Error(`Pipeline file must be JSON: ${error.message}`);
   }
@@ -4793,7 +4747,7 @@ function outputPlan(plan) {
 function registerPipelineCommands(parent) {
   const pipeline = parent.command("pipeline").description("Create, validate, inspect, and safely dry-run ordered pipeline recipes");
   pipeline.command("init").description("Write a canonical v1 pipeline recipe").option("-f, --file <path>", "Output file", DEFAULT_PIPELINE_FILE).action((options) => {
-    const path = resolve5(options.file);
+    const path = resolve4(options.file);
     if (existsSync5(path)) throw new Error(`Pipeline file already exists: ${options.file}.`);
     const recipe = canonicalPipeline("local");
     writeFileSync3(path, `${JSON.stringify(recipe, null, 2)}
@@ -4823,9 +4777,9 @@ function registerPipelineCommands(parent) {
     if (remote) {
       throw new Error(`Step "${remote.id}" targets cloud execution. This CLI is local-only; rewrite that step to local or use --dry-run.`);
     }
-    const input = await loadLocalRunInput(resolve5(options.spec));
+    const input = await loadLocalRunInput(resolve4(options.spec));
     assertLocalRunInputReady(input.request);
-    const config = await loadLocalRunnerConfig(options.config ? resolve5(options.config) : void 0);
+    const config = await loadLocalRunnerConfig(options.config ? resolve4(options.config) : void 0);
     const localPipeline = {
       version: 1,
       ...plan.name ? { name: plan.name } : {},
@@ -4888,7 +4842,7 @@ async function checkForCliUpdate(currentVersion, options = {}) {
   const controller = new AbortController();
   const timeoutMs = options.timeoutMs ?? 750;
   let timeout;
-  const request2 = (async () => {
+  const request = (async () => {
     try {
       const response = await (options.fetchImpl ?? fetch)(PACKAGE_LATEST_URL, {
         headers: { accept: "application/json" },
@@ -4907,14 +4861,14 @@ async function checkForCliUpdate(currentVersion, options = {}) {
       return null;
     }
   })();
-  const deadline = new Promise((resolve6) => {
+  const deadline = new Promise((resolve5) => {
     timeout = setTimeout(() => {
       controller.abort();
-      resolve6(null);
+      resolve5(null);
     }, timeoutMs);
   });
   try {
-    return await Promise.race([request2, deadline]);
+    return await Promise.race([request, deadline]);
   } finally {
     if (timeout) clearTimeout(timeout);
   }
@@ -4949,7 +4903,7 @@ async function createDefaultAgentClient(runtime, env, workspaceRoot, getModelRun
   const selection = getAgentSelection(env);
   if (!selection) {
     throw new Error(
-      "The laptop-local agent is not configured. Run `tt agent models --all`, then `tt agent configure --provider <provider> --model <model>`."
+      "The laptop-local agent is not configured. Use /model to choose a provider and model, then try again."
     );
   }
   const modelRuntime = await getModelRuntime();
@@ -4958,8 +4912,9 @@ async function createDefaultAgentClient(runtime, env, workspaceRoot, getModelRun
   const secret = getApiKey({ apiKey: env.TUNED_TENSOR_API_KEY });
   const providerSecrets = Object.entries(env).filter(([name, value]) => value && /(?:API_KEY|TOKEN|SECRET)$/i.test(name)).map(([, value]) => value).filter((value) => value.length >= 8 && value !== secret);
   return createLocalAgentClient({
-    store: runtime.agentStore ?? new LocalAgentStore(join8(getConfigDir(), "agent"), {
-      secretValues: [...secret ? [secret] : [], ...providerSecrets]
+    store: runtime.agentStore ?? new LocalAgentStore(getAgentConfigDir(), {
+      secretValues: [...secret ? [secret] : [], ...providerSecrets],
+      secretValueProvider: readStoredProviderSecrets
     }),
     workspaceRoot,
     selection,
@@ -5007,7 +4962,7 @@ async function runSelfCommand(args2, options = {}) {
   if (!entrypoint) {
     throw new Error("Cannot locate the tt CLI entrypoint.");
   }
-  return await new Promise((resolve6, reject) => {
+  return await new Promise((resolve5, reject) => {
     const child = spawn2(process.execPath, [entrypoint, ...args2], {
       cwd: options.cwd,
       env: options.env ?? process.env,
@@ -5043,7 +4998,7 @@ async function runSelfCommand(args2, options = {}) {
     child.once("close", (exitCode, signal) => {
       cleanup();
       const signalNumber = signal ? osConstants2.signals[signal] : void 0;
-      resolve6({
+      resolve5({
         exitCode: exitCode ?? (typeof signalNumber === "number" ? 128 + signalNumber : 1),
         signal
       });
@@ -5064,10 +5019,10 @@ function createProgram(version, runtime = {}) {
   const launchShell = runtime.startShell ?? startInteractiveShell;
   const cwd = runtime.cwd ?? process.cwd();
   const getModelRuntime = createModelRuntimeGetter(runtime);
-  const shellRunner = async (request2) => {
+  const shellRunner = async (request) => {
     const root = program.opts();
-    return await invokeSelf(request2.args, {
-      cwd: request2.cwd,
+    return await invokeSelf(request.args, {
+      cwd: request.cwd,
       env: childEnvironment2(root, env),
       entrypoint: runtime.argv?.[1]
     });
@@ -5104,7 +5059,7 @@ function createProgram(version, runtime = {}) {
     if (root.json) setJsonMode(true);
     if (root.color === false) {
       process.env.FORCE_COLOR = "0";
-      chalk7.level = 0;
+      chalk6.level = 0;
     }
   });
   registerLocalCommands(program, {
@@ -5115,8 +5070,6 @@ function createProgram(version, runtime = {}) {
     stdout: runtime.stdout ?? process.stdout,
     stderr: runtime.stderr ?? process.stderr
   });
-  registerAuthCommands(program);
-  registerPublishCommand(program);
   registerPipelineCommands(program);
   registerAgentCommands(program, {
     env,
@@ -5135,12 +5088,12 @@ function createProgram(version, runtime = {}) {
 `);
       return;
     }
-    output.write(`${chalk7.bold.hex("#8B5CF6")("Tuned Tensor status")}
+    output.write(`${chalk6.bold.hex("#8B5CF6")("Tuned Tensor status")}
 `);
     output.write(`${formatShellStatus(context).join("\n")}
 
 `);
-    output.write(`${chalk7.bold("Context")}
+    output.write(`${chalk6.bold("Context")}
 `);
     output.write(`${formatShellContext(context).join("\n")}
 `);
@@ -5149,19 +5102,11 @@ function createProgram(version, runtime = {}) {
   program.addHelpText(
     "after",
     `
-Commands:
-  tt                     Open the conversational terminal (TTY only)
-  tt status              Inspect local project context
-  tt doctor              Check the host and run prerequisites
-  tt run                 Fine-tune and evaluate on your GPU
-  tt auth                Store a dashboard API key
-  tt publish             Upload local run evidence to the dashboard
-
 Examples:
+  tt                     Open the conversational terminal (TTY only)
   tt doctor tunedtensor.json
   tt run tunedtensor.json --dry-run
   tt runs list
-  tt publish --yes
 `
   );
   return program;
@@ -5217,10 +5162,10 @@ async function runCli(version, runtime = {}) {
       error
     });
     await (runtime.startShell ?? startInteractiveShell)({
-      runner: async (request2) => await invokeSelf(
-        request2.args,
+      runner: async (request) => await invokeSelf(
+        request.args,
         {
-          cwd: request2.cwd,
+          cwd: request.cwd,
           env,
           entrypoint: argv[1]
         }
@@ -5241,7 +5186,7 @@ async function runCli(version, runtime = {}) {
 }
 
 // src/index.ts
-runCli("0.13.0-beta.1").catch((err) => {
+runCli("0.13.1-beta.0").catch((err) => {
   reportError(err);
   process.exit(1);
 });