@tuned-tensor/cli 0.13.0 → 0.13.1-beta.1

package/dist/index.js

@@ -573,18 +573,157 @@ async function rejectPreparedAction(action, persist) {
 }
 
 // src/agent-model.ts
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, join as join3 } from "path";
+
+// src/config.ts
 import {
-  getAgentDir,
-  ModelRuntime
-} from "@earendil-works/pi-coding-agent";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join as join2 } from "path";
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+var AGENT_THINKING_LEVELS = [
+  "off",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+];
+var CONFIG_DIR_NAME = "tuned-tensor";
+var CONFIG_FILE_NAME = "config.json";
+function getConfigDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg || join2(homedir(), ".config");
+  return join2(base, CONFIG_DIR_NAME);
+}
+function getAgentConfigDir() {
+  return join2(getConfigDir(), "agent");
+}
+function getConfigPath() {
+  return join2(getConfigDir(), CONFIG_FILE_NAME);
+}
+function readConfig() {
+  const path = getConfigPath();
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+var configRevision = 0;
+function getConfigRevision() {
+  return configRevision;
+}
+function writeConfig(config) {
+  const dir = getConfigDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  const path = getConfigPath();
+  writeFileSync(path, JSON.stringify(config, null, 2) + "\n", {
+    mode: 384
+  });
+  chmodSync(path, 384);
+  configRevision += 1;
+}
+function updateConfig(partial) {
+  const current = readConfig();
+  writeConfig({ ...current, ...partial });
+}
+function getApiKey(opts) {
+  return opts?.apiKey || process.env.TUNED_TENSOR_API_KEY || readConfig().api_key;
+}
+function getAgentSelection(env = process.env) {
+  const stored = readConfig().agent;
+  const provider = env.TUNED_TENSOR_AGENT_PROVIDER || stored?.provider;
+  const model = env.TUNED_TENSOR_AGENT_MODEL || stored?.model;
+  const rawThinking = env.TUNED_TENSOR_AGENT_THINKING || stored?.thinking || "medium";
+  if (!AGENT_THINKING_LEVELS.includes(rawThinking)) {
+    throw new Error(
+      "Agent thinking must be off, minimal, low, medium, high, xhigh, or max."
+    );
+  }
+  if (!provider && !model) return void 0;
+  if (!provider || !model) {
+    throw new Error(
+      "Both an agent provider and model are required. Run `tt agent configure --provider <provider> --model <model>`."
+    );
+  }
+  return { provider, model, thinking: rawThinking };
+}
+
+// src/agent-model.ts
+function missingProviderAuthMessage() {
+  return "No API key is saved for the selected model. Run /login, or /model to pick a different one.";
+}
+function unknownAgentProviderMessage(provider) {
+  return `Unknown provider "${provider}". Use /login <id> or /model <id>.`;
+}
+var MIN_REDACTED_SECRET_LENGTH = 8;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function pushSecret(secrets, value) {
+  if (typeof value !== "string") return;
+  const secret = value.trim();
+  if (secret.length < MIN_REDACTED_SECRET_LENGTH) return;
+  if (!secrets.includes(secret)) secrets.push(secret);
+}
+function persistProviderApiKey(provider, apiKey, authPath = getAgentAuthPath()) {
+  const key = apiKey.trim();
+  if (!key) {
+    throw new Error("API key cannot be empty.");
+  }
+  let stored = {};
+  if (existsSync2(authPath)) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync2(authPath, "utf-8"));
+    } catch (error) {
+      throw new Error(
+        `Failed to read ${authPath}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    if (!isRecord(parsed)) {
+      throw new Error(`Invalid auth.json: expected an object at ${authPath}`);
+    }
+    stored = parsed;
+  }
+  stored[provider] = { type: "api_key", key };
+  writePrivateJson(authPath, stored);
+}
+function readStoredProviderSecrets(authPath = getAgentAuthPath()) {
+  if (!existsSync2(authPath)) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(authPath, "utf-8"));
+  } catch {
+    return [];
+  }
+  if (!isRecord(parsed)) return [];
+  const secrets = [];
+  for (const credential of Object.values(parsed)) {
+    if (!isRecord(credential)) continue;
+    if (credential.type === "api_key") {
+      pushSecret(secrets, credential.key);
+    } else if (credential.type === "oauth") {
+      pushSecret(secrets, credential.access);
+      pushSecret(secrets, credential.refresh);
+    }
+  }
+  return secrets;
+}
 function resolveAgentModel(runtime, selection) {
   const resolved = resolveAgentModelDefinition(runtime, selection);
   if (!runtime.hasConfiguredAuth(selection.provider)) {
-    throw new Error(
-      `Authenticate provider "${selection.provider}" first, then retry. Provider secrets are never accepted by tt flags.`
-    );
+    throw new Error(missingProviderAuthMessage());
   }
   return resolved;
 }
@@ -610,25 +749,46 @@ function resolveAgentModelDefinition(runtime, selection) {
   }
   return { model, thinking: selection.thinking };
 }
+function getAgentAuthPath() {
+  return join3(getAgentConfigDir(), "auth.json");
+}
+function getAgentModelsPath() {
+  return join3(getAgentConfigDir(), "models.json");
+}
 async function createPiModelRuntime() {
-  const agentDir = getAgentDir();
-  const modelsPath = join2(agentDir, "models.json");
+  const agentDir = getAgentConfigDir();
+  ensurePrivateDir(agentDir);
+  const modelsPath = getAgentModelsPath();
+  const authPath = getAgentAuthPath();
   ensureOpenRouterAppHeaders(modelsPath);
-  return await ModelRuntime.create({
-    authPath: join2(agentDir, "auth.json"),
+  const runtime = await ModelRuntime.create({
+    authPath,
     modelsPath,
     allowModelNetwork: false
   });
+  if (existsSync2(authPath)) chmodSync2(authPath, 384);
+  return runtime;
 }
 var OPENROUTER_APP_HEADERS = {
   "HTTP-Referer": "https://tunedtensor.com",
+  "X-OpenRouter-Title": "Tuned Tensor",
+  "X-OpenRouter-Categories": "cli-agent",
   "X-Title": "Tuned Tensor"
 };
+function ensurePrivateDir(dir) {
+  if (!existsSync2(dir)) mkdirSync2(dir, { recursive: true, mode: 448 });
+  chmodSync2(dir, 448);
+}
+function writePrivateJson(path, value) {
+  ensurePrivateDir(dirname(path));
+  writeFileSync2(path, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
+  chmodSync2(path, 384);
+}
 function ensureOpenRouterAppHeaders(modelsPath) {
   let config = {};
-  if (existsSync(modelsPath)) {
+  if (existsSync2(modelsPath)) {
     try {
-      const parsed = JSON.parse(readFileSync(modelsPath, "utf-8"));
+      const parsed = JSON.parse(readFileSync2(modelsPath, "utf-8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         config = parsed;
       }
@@ -642,10 +802,15 @@ function ensureOpenRouterAppHeaders(modelsPath) {
   const providers = asRecord(config.providers) ?? (config.providers = empty());
   const openrouter = asRecord(providers.openrouter) ?? (providers.openrouter = empty());
   const headers = asRecord(openrouter.headers) ?? (openrouter.headers = empty());
+  const attributionNames = new Set(
+    Object.keys(OPENROUTER_APP_HEADERS).map((name) => name.toLowerCase())
+  );
+  for (const name of Object.keys(headers)) {
+    if (attributionNames.has(name.toLowerCase())) delete headers[name];
+  }
   Object.assign(headers, OPENROUTER_APP_HEADERS);
   if (JSON.stringify(config) === before) return;
-  mkdirSync(dirname(modelsPath), { recursive: true });
-  writeFileSync(modelsPath, JSON.stringify(config, null, 2) + "\n");
+  writePrivateJson(modelsPath, config);
 }
 
 // src/agent-tools.ts
@@ -1335,7 +1500,7 @@ import {
   writeFile as writeFile2
 } from "fs/promises";
 import { randomUUID as randomUUID3 } from "crypto";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var DEFAULT_MAX_THREAD_BYTES = 1e6;
 var DEFAULT_MAX_MESSAGES = 200;
@@ -1345,7 +1510,7 @@ var DEFAULT_MAX_CLAIMS = 1e3;
 function assertThreadId(id) {
   if (!UUID.test(id)) throw new Error("Invalid local agent thread ID.");
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function scrub(value, secrets) {
@@ -1356,7 +1521,7 @@ function scrub(value, secrets) {
     );
   }
   if (Array.isArray(value)) return value.map((entry) => scrub(entry, secrets));
-  if (isRecord(value)) {
+  if (isRecord2(value)) {
     return Object.fromEntries(
       Object.entries(value).map(([key, entry]) => [key, scrub(entry, secrets)])
     );
@@ -1366,9 +1531,10 @@ function scrub(value, secrets) {
 var LocalAgentStore = class {
   constructor(rootDir, options = {}) {
     this.rootDir = rootDir;
-    this.threadsDir = join3(rootDir, "threads");
-    this.claimsDir = join3(rootDir, "action-claims");
+    this.threadsDir = join4(rootDir, "threads");
+    this.claimsDir = join4(rootDir, "action-claims");
     this.secrets = options.secretValues?.filter(Boolean) ?? [];
+    this.secretValueProvider = options.secretValueProvider;
     this.maxThreadBytes = options.maxThreadBytes ?? DEFAULT_MAX_THREAD_BYTES;
     this.maxMessages = options.maxMessages ?? DEFAULT_MAX_MESSAGES;
     this.maxActions = options.maxActions ?? DEFAULT_MAX_ACTIONS;
@@ -1378,13 +1544,20 @@ var LocalAgentStore = class {
   threadsDir;
   claimsDir;
   secrets;
+  secretValueProvider;
   maxThreadBytes;
   maxMessages;
   maxActions;
   maxThreads;
   maxClaims;
   redact(value) {
-    return scrub(value, this.secrets);
+    let extra = [];
+    try {
+      extra = this.secretValueProvider?.() ?? [];
+    } catch {
+      extra = [];
+    }
+    return scrub(value, [...this.secrets, ...extra]);
   }
   async ensureDirectories() {
     await mkdir2(this.rootDir, { recursive: true, mode: 448 });
@@ -1396,7 +1569,7 @@ var LocalAgentStore = class {
   }
   path(id) {
     assertThreadId(id);
-    return join3(this.threadsDir, `${id}.json`);
+    return join4(this.threadsDir, `${id}.json`);
   }
   serializeWithinQuota(state) {
     const active = state.actions.filter(
@@ -1421,11 +1594,11 @@ var LocalAgentStore = class {
     return serialized;
   }
   async pruneDirectory(directory, suffix, maximum, preserve) {
-    const entries = await Promise.all((await readdir(directory)).filter((name) => suffix.test(name) && name !== preserve).map(async (name) => ({ name, modified: (await stat(join3(directory, name))).mtimeMs })));
+    const entries = await Promise.all((await readdir(directory)).filter((name) => suffix.test(name) && name !== preserve).map(async (name) => ({ name, modified: (await stat(join4(directory, name))).mtimeMs })));
     entries.sort((a, b) => a.modified - b.modified);
     const keepOther = Math.max(0, maximum - (preserve ? 1 : 0));
     for (const entry of entries.slice(0, Math.max(0, entries.length - keepOther))) {
-      await unlink(join3(directory, entry.name));
+      await unlink(join4(directory, entry.name));
     }
   }
   async pruneThreads(preserve) {
@@ -1445,19 +1618,19 @@ var LocalAgentStore = class {
     }
     const candidates = await Promise.all(names.filter((name) => !protectedNames.has(name)).map(async (name) => ({
       name,
-      modified: (await stat(join3(this.threadsDir, name))).mtimeMs
+      modified: (await stat(join4(this.threadsDir, name))).mtimeMs
     })));
     candidates.sort((a, b) => a.modified - b.modified);
     const keep = Math.max(0, this.maxThreads - protectedNames.size);
     for (const entry of candidates.slice(0, Math.max(0, candidates.length - keep))) {
-      await unlink(join3(this.threadsDir, entry.name));
+      await unlink(join4(this.threadsDir, entry.name));
     }
   }
   async save(state) {
     assertThreadId(state.thread.id);
     await this.ensureDirectories();
     const destination = this.path(state.thread.id);
-    const temporary = join3(
+    const temporary = join4(
       this.threadsDir,
       `.${state.thread.id}.${randomUUID3()}.tmp`
     );
@@ -1477,7 +1650,7 @@ var LocalAgentStore = class {
   async claimAction(actionId) {
     assertThreadId(actionId);
     await this.ensureDirectories();
-    const path = join3(this.claimsDir, `${actionId}.claim`);
+    const path = join4(this.claimsDir, `${actionId}.claim`);
     try {
       await writeFile2(path, `${(/* @__PURE__ */ new Date()).toISOString()}
 `, {
@@ -1505,7 +1678,7 @@ var LocalAgentStore = class {
       throw new Error("Invalid local agent thread file.");
     }
     const parsed = JSON.parse(await readFile(path, "utf8"));
-    if (!isRecord(parsed) || !isRecord(parsed.thread) || parsed.thread.id !== id || !Array.isArray(parsed.messages) || !Array.isArray(parsed.actions)) {
+    if (!isRecord2(parsed) || !isRecord2(parsed.thread) || parsed.thread.id !== id || !Array.isArray(parsed.messages) || !Array.isArray(parsed.actions)) {
       throw new Error("Local agent thread file is malformed.");
     }
     return parsed;
@@ -1528,88 +1701,6 @@ var LocalAgentStore = class {
   }
 };
 
-// src/config.ts
-import {
-  chmodSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { homedir } from "os";
-import { join as join4 } from "path";
-var AGENT_THINKING_LEVELS = [
-  "off",
-  "minimal",
-  "low",
-  "medium",
-  "high",
-  "xhigh",
-  "max"
-];
-var CONFIG_DIR_NAME = "tuned-tensor";
-var CONFIG_FILE_NAME = "config.json";
-function getConfigDir() {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  const base = xdg || join4(homedir(), ".config");
-  return join4(base, CONFIG_DIR_NAME);
-}
-function getConfigPath() {
-  return join4(getConfigDir(), CONFIG_FILE_NAME);
-}
-function readConfig() {
-  const path = getConfigPath();
-  if (!existsSync2(path)) return {};
-  try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-var configRevision = 0;
-function getConfigRevision() {
-  return configRevision;
-}
-function writeConfig(config) {
-  const dir = getConfigDir();
-  if (!existsSync2(dir)) mkdirSync2(dir, { recursive: true, mode: 448 });
-  chmodSync(dir, 448);
-  const path = getConfigPath();
-  writeFileSync2(path, JSON.stringify(config, null, 2) + "\n", {
-    mode: 384
-  });
-  chmodSync(path, 384);
-  configRevision += 1;
-}
-function updateConfig(partial) {
-  const current = readConfig();
-  writeConfig({ ...current, ...partial });
-}
-function getApiKey(opts) {
-  return opts?.apiKey || process.env.TUNED_TENSOR_API_KEY || readConfig().api_key;
-}
-function getAgentSelection(env = process.env) {
-  const stored = readConfig().agent;
-  const provider = env.TUNED_TENSOR_AGENT_PROVIDER || stored?.provider;
-  const model = env.TUNED_TENSOR_AGENT_MODEL || stored?.model;
-  const rawThinking = env.TUNED_TENSOR_AGENT_THINKING || stored?.thinking || "medium";
-  if (!AGENT_THINKING_LEVELS.includes(rawThinking)) {
-    throw new Error(
-      "Agent thinking must be off, minimal, low, medium, high, xhigh, or max."
-    );
-  }
-  if (!provider && !model) return void 0;
-  if (!provider || !model) {
-    throw new Error(
-      "Both an agent provider and model are required. Run `tt agent configure --provider <provider> --model <model>`."
-    );
-  }
-  return { provider, model, thinking: rawThinking };
-}
-
-// src/cli.ts
-import { join as join7 } from "path";
-
 // src/agent.ts
 import chalk3 from "chalk";
 import { stripVTControlCharacters as stripVTControlCharacters3 } from "util";
@@ -1619,7 +1710,7 @@ import chalk from "chalk";
 import { stat as stat3 } from "fs/promises";
 import { homedir as homedir3 } from "os";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
-import { createInterface } from "readline";
+import { createInterface as createInterface2 } from "readline";
 import { stripVTControlCharacters } from "util";
 
 // src/command-catalog.ts
@@ -1659,7 +1750,8 @@ var SLASH_COMMANDS = [
   { path: "/help", description: "Show commands; add a word to filter." },
   { path: "/status", description: "Show lightweight workflow status." },
   { path: "/context", description: "Show the current project context." },
-  { path: "/model", description: "Show or change the TT agent model." },
+  { path: "/model", description: "Show or change the TT agent provider and model." },
+  { path: "/login", description: "Save a provider API key; asks which provider if omitted." },
   { path: "/cd", description: "Change the shell's working directory." },
   { path: "/clear", description: "Clear the terminal." },
   { path: "/exit", description: "Exit the TT shell." }
@@ -1901,6 +1993,23 @@ function formatShellStatus(context) {
 }
 
 // src/agent-control.ts
+var FEATURED_AGENT_PROVIDERS = [
+  "openai",
+  "openrouter"
+];
+var RECOMMENDED_AGENT_MODELS = [
+  { provider: "openai", ids: ["gpt-5.6-sol"] },
+  {
+    provider: "openrouter",
+    ids: ["deepseek/deepseek-v4-flash-0731", "deepseek/deepseek-v4-flash"]
+  }
+];
+var FEATURED_PROVIDER_INDEX = new Map(
+  FEATURED_AGENT_PROVIDERS.map((id, index) => [id, index])
+);
+function isFeaturedProvider(id) {
+  return FEATURED_PROVIDER_INDEX.has(id);
+}
 function modelKey(model) {
   return `${model.provider}/${model.id}`;
 }
@@ -1917,9 +2026,28 @@ function modelRelevance(model, query) {
   if (name.includes(q)) return 4;
   return void 0;
 }
+function listAgentProviders(runtime, options = {}) {
+  return runtime.getProviders().filter((provider) => !options.featuredOnly || isFeaturedProvider(provider.id)).map((provider) => ({
+    id: provider.id,
+    name: provider.name ?? provider.id,
+    authenticated: runtime.hasConfiguredAuth(provider.id)
+  })).sort((left, right) => {
+    const leftRank = FEATURED_PROVIDER_INDEX.get(left.id);
+    const rightRank = FEATURED_PROVIDER_INDEX.get(right.id);
+    if (leftRank !== void 0 || rightRank !== void 0) {
+      return (leftRank ?? Number.MAX_SAFE_INTEGER) - (rightRank ?? Number.MAX_SAFE_INTEGER) || left.id.localeCompare(right.id);
+    }
+    return left.id.localeCompare(right.id);
+  });
+}
+function findAgentProvider(runtime, id) {
+  const needle = id.trim().toLowerCase();
+  if (!needle) return void 0;
+  return listAgentProviders(runtime).find((provider) => provider.id.toLowerCase() === needle);
+}
 function listAgentModels(runtime, options = {}) {
   let models = runtime.getModels(options.provider).filter(
-    (model) => options.includeUnauthenticated || runtime.hasConfiguredAuth(model.provider)
+    (model) => (options.includeUnauthenticated || runtime.hasConfiguredAuth(model.provider)) && (!options.featuredOnly || isFeaturedProvider(model.provider))
   ).map((model) => ({
     provider: model.provider,
     id: model.id,
@@ -1946,6 +2074,19 @@ function listAgentModels(runtime, options = {}) {
   }
   return models;
 }
+function recommendAgentModels(runtime, options = {}) {
+  const models = listAgentModels(runtime, {
+    includeUnauthenticated: options.includeUnauthenticated ?? true
+  });
+  const picks = [];
+  for (const recommendation of RECOMMENDED_AGENT_MODELS) {
+    const match = recommendation.ids.map((id) => models.find(
+      (model) => model.provider === recommendation.provider && model.id === id
+    )).find((model) => model !== void 0);
+    if (match) picks.push(match);
+  }
+  return picks;
+}
 function describeAgentModel(runtime, env) {
   const selection = getAgentSelection(env);
   if (!selection) return void 0;
@@ -1961,6 +2102,21 @@ function describeAgentModel(runtime, env) {
     supportsThinking: resolved.model.reasoning !== false
   };
 }
+async function loginAgentProvider(runtime, provider, apiKey) {
+  const choice = findAgentProvider(runtime, provider);
+  if (!choice) {
+    throw new Error(unknownAgentProviderMessage(provider));
+  }
+  const key = apiKey.trim();
+  if (!key) {
+    throw new Error("API key cannot be empty.");
+  }
+  persistProviderApiKey(choice.id, key);
+  if (typeof runtime.setRuntimeApiKey === "function") {
+    await runtime.setRuntimeApiKey(choice.id, key);
+  }
+  return { provider: choice.id };
+}
 function setAgentModel(runtime, env, provider, model, options = {}) {
   const current = getAgentSelection(env);
   const requestedThinking = options.thinking ?? current?.thinking ?? "medium";
@@ -1997,6 +2153,65 @@ function setAgentModel(runtime, env, provider, model, options = {}) {
   return { selection, adjustedThinking: effectiveThinking !== requestedThinking };
 }
 
+// src/secret-prompt.ts
+import { createInterface } from "readline/promises";
+import { stdin, stdout } from "process";
+import { Writable } from "stream";
+async function promptVisibleInput(message, input = stdin, output = stdout) {
+  return await promptInput(message, false, input, output);
+}
+async function promptHiddenInput(message, input = stdin, output = stdout) {
+  return await promptInput(message, true, input, output);
+}
+async function withDetachedKeypress(input, run) {
+  const listeners = [...input.listeners("keypress")];
+  input.removeAllListeners("keypress");
+  try {
+    return await run();
+  } finally {
+    input.removeAllListeners("keypress");
+    for (const listener of listeners) {
+      input.on("keypress", listener);
+    }
+  }
+}
+async function promptInput(message, hidden, input, output) {
+  if (input.isTTY !== true || output.isTTY !== true) {
+    throw new Error("Provider login needs an interactive tt session.");
+  }
+  return await withDetachedKeypress(input, async () => {
+    if (!hidden) {
+      const rl2 = createInterface({ input, output, terminal: true });
+      try {
+        return await rl2.question(message);
+      } finally {
+        rl2.close();
+      }
+    }
+    let muted = false;
+    const maskedOutput = new Writable({
+      write(chunk, _encoding, callback) {
+        if (!muted) output.write(chunk);
+        callback();
+      }
+    });
+    const rl = createInterface({
+      input,
+      output: maskedOutput,
+      terminal: true
+    });
+    try {
+      const pending = rl.question(message);
+      muted = true;
+      return await pending;
+    } finally {
+      muted = false;
+      output.write("\n");
+      rl.close();
+    }
+  });
+}
+
 // src/shell.ts
 var AGENT_SLASH_COMMANDS = /* @__PURE__ */ new Set([
   "new",
@@ -2155,6 +2370,7 @@ var SLASH_NAMES = /* @__PURE__ */ new Set([
   "status",
   "context",
   "model",
+  "login",
   "clear",
   "cd",
   "exit"
@@ -2324,6 +2540,9 @@ function agentModelLabel(context) {
 }
 function renderShellBanner(snapshot) {
   const heading = snapshot.version ? `${accent.bold("tt")} ${chalk.dim(`v${snapshot.version}`)}` : accent.bold("tt");
+  const configured = Boolean(
+    snapshot.context.agent?.provider && snapshot.context.agent?.model
+  );
   const lines = [
     heading,
     chalk.dim(
@@ -2331,7 +2550,9 @@ function renderShellBanner(snapshot) {
     ),
     chalk.dim("ctrl+c stop/clear \xB7 ctrl+d exit \xB7 /help commands \xB7 tab complete"),
     "",
-    chalk.dim("Ask TT anything. Known commands run directly.")
+    chalk.dim(
+      configured ? "Ask TT anything. Known commands run directly." : "Use /model to choose a provider and model. Workflow commands work now."
+    )
   ];
   return `${lines.join("\n")}
 
@@ -2440,45 +2661,74 @@ var TunedTensorShellSession = class _TunedTensorShellSession {
     const lines = styleDetailLines([
       detailLine("Agent model", label),
       detailLine("Change", "/model <provider>/<model>"),
-      detailLine("Search", "/model <query>")
+      detailLine("List", "/model <provider>"),
+      detailLine("Search", "/model <query>"),
+      detailLine("Login", "/login <provider>")
     ]);
-    const all = listAgentModels(runtime);
-    if (all.length === 0) {
-      lines.push("", chalk.dim("  no authenticated models \u2014 run `tt agent models --all` for the full catalog"));
+    const catalog = { includeUnauthenticated: true };
+    const featuredCatalog = { ...catalog, featuredOnly: true };
+    const provider = query ? findAgentProvider(runtime, query) : void 0;
+    if (provider) {
+      const matches = listAgentModels(runtime, { ...catalog, provider: provider.id });
+      lines.push("", chalk.bold(`Models from ${provider.id}`));
+      this.appendAgentModelChoices(lines, matches, summary, 20, "/model <query> to search");
+      if (matches.length === 0) {
+        lines.push(chalk.dim("  no models"));
+      }
       return lines;
     }
     if (query) {
-      const matches = listAgentModels(runtime, { query });
+      const matches = listAgentModels(runtime, { ...catalog, query });
       lines.push("", chalk.bold(`Models matching ${JSON.stringify(query)}`));
+      this.appendAgentModelChoices(lines, matches, summary, 10, "refine the query");
       if (matches.length === 0) {
         lines.push(chalk.dim("  no matches"));
-      } else {
-        const shown2 = matches.slice(0, 10);
-        for (const model of shown2) {
-          lines.push(this.formatAgentModelChoice(model, summary));
-        }
-        if (matches.length > shown2.length) {
-          lines.push(chalk.dim(`  \u2026 ${matches.length - shown2.length} more \u2014 refine the query`));
-        }
       }
       return lines;
     }
-    const preferred = summary ? all.filter((model) => model.provider === summary.provider) : [];
-    const rest = summary ? all.filter((model) => model.provider !== summary.provider) : all;
-    const shown = [...preferred, ...rest].slice(0, 8);
-    lines.push("", chalk.bold(summary ? "Suggestions" : "Available models"));
+    const providers = listAgentProviders(runtime, { featuredOnly: true });
+    lines.push("", chalk.bold("Providers"));
+    if (providers.length === 0) {
+      lines.push(chalk.dim("  no providers in the catalog"));
+    } else {
+      for (const choice of providers) {
+        lines.push(this.formatAgentProviderChoice(choice));
+      }
+      lines.push(chalk.dim("  Other providers: /login <id> or /model <id>"));
+      if (providers.some((choice) => !choice.authenticated)) {
+        lines.push(chalk.dim("  Use /login <provider> to save a key."));
+      }
+    }
+    const suggestions = recommendAgentModels(runtime, featuredCatalog);
+    lines.push("", chalk.bold("Suggestions"));
+    this.appendAgentModelChoices(lines, suggestions, summary);
+    if (suggestions.length === 0) {
+      lines.push(chalk.dim("  no models in the catalog"));
+    } else {
+      lines.push(chalk.dim("  Use /model <provider> to list models, /model <query> to search"));
+    }
+    return lines;
+  }
+  appendAgentModelChoices(lines, models, summary, limit, moreHint) {
+    const shown = limit ? models.slice(0, limit) : models;
     for (const model of shown) {
       lines.push(this.formatAgentModelChoice(model, summary));
     }
-    if (all.length > shown.length) {
-      lines.push(chalk.dim(`  \u2026 ${all.length - shown.length} more \u2014 /model <query> to search`));
+    if (limit && models.length > shown.length) {
+      const hint = moreHint ? ` \u2014 ${moreHint}` : "";
+      lines.push(chalk.dim(`  \u2026 ${models.length - shown.length} more${hint}`));
     }
-    return lines;
+  }
+  formatAgentProviderChoice(provider) {
+    const displayName = provider.name !== provider.id ? `  ${provider.name}` : "";
+    const auth = provider.authenticated ? "" : chalk.dim("  auth required");
+    return `  ${accent(provider.id)}${displayName}${auth}`;
   }
   formatAgentModelChoice(model, summary) {
     const active = summary?.provider === model.provider && summary?.model === model.id;
     const displayName = model.name !== model.id ? `  ${model.name}` : "";
-    return `  ${accent(`${model.provider}/${model.id}`)}${displayName}${active ? chalk.dim(" (active)") : ""}`;
+    const auth = model.authenticated ? "" : chalk.dim("  auth required");
+    return `  ${accent(`${model.provider}/${model.id}`)}${displayName}${active ? chalk.dim(" (active)") : ""}${auth}`;
   }
   async handleSlash(command) {
     switch (command.name) {
@@ -2506,7 +2756,7 @@ var TunedTensorShellSession = class _TunedTensorShellSession {
           return "continue";
         }
         if (command.args.length !== 1) {
-          throw new ShellParseError("Usage: /model [<query> | <provider>/<model>]");
+          throw new ShellParseError("Usage: /model [<query> | <provider> | <provider>/<model>]");
         }
         const target = command.args[0];
         const slash = target.indexOf("/");
@@ -2527,6 +2777,48 @@ var TunedTensorShellSession = class _TunedTensorShellSession {
         const note = result2.adjustedThinking ? " \u2014 thinking set to off for this model" : "";
         this.io.write(
           `${successMark()} Agent model: ${result2.selection.provider}/${result2.selection.model} (thinking ${result2.selection.thinking})${note}.
+`
+        );
+        return "continue";
+      }
+      case "login": {
+        const runtime = await this.requireAgentModelRuntime();
+        if (command.args.length > 1) {
+          throw new ShellParseError("Usage: /login [<provider>]");
+        }
+        let providerId = command.args[0]?.trim();
+        if (!providerId) {
+          const providers = listAgentProviders(runtime, { featuredOnly: true });
+          if (providers.length === 0) {
+            throw new ShellParseError("No providers in the catalog.");
+          }
+          this.writeLines([
+            "",
+            chalk.bold("Providers"),
+            ...providers.map((choice) => this.formatAgentProviderChoice(choice)),
+            chalk.dim("  Other providers: /login <id>")
+          ]);
+          if (!this.io.promptLine) {
+            throw new ShellParseError("Usage: /login <provider>");
+          }
+          providerId = (await this.io.promptLine("Provider: ")).trim();
+          if (!providerId) {
+            throw new ShellParseError("Usage: /login <provider>");
+          }
+        }
+        const provider = findAgentProvider(runtime, providerId);
+        if (!provider) {
+          throw new ShellParseError(unknownAgentProviderMessage(providerId));
+        }
+        if (!this.io.promptSecret) {
+          throw new ShellParseError("Provider login needs an interactive tt session.");
+        }
+        const label = provider.name !== provider.id ? provider.name : provider.id;
+        const apiKey = await this.io.promptSecret(`${label} API key: `);
+        const result2 = await loginAgentProvider(runtime, provider.id, apiKey);
+        await this.refreshContext();
+        this.io.write(
+          `${successMark()} Saved ${result2.provider} credentials. Chat and /model can use this provider now.
 `
         );
         return "continue";
@@ -2653,6 +2945,26 @@ async function startInteractiveShell(options) {
   }
   let readline;
   const terminalInput = input;
+  const withPrompt = async (message, prompt) => {
+    readline?.pause();
+    const restoreRawMode = terminalInput.isRaw === true && typeof terminalInput.setRawMode === "function";
+    if (restoreRawMode) terminalInput.setRawMode(false);
+    try {
+      return await prompt(message, input, output);
+    } finally {
+      if (restoreRawMode) terminalInput.setRawMode(true);
+      readline?.resume();
+    }
+  };
+  const io = {
+    ...streamIO(output, error),
+    async promptLine(message) {
+      return await withPrompt(message, promptVisibleInput);
+    },
+    async promptSecret(message) {
+      return await withPrompt(message, promptHiddenInput);
+    }
+  };
   const foregroundRunner = (request) => withForegroundSignalHandoff(
     {
       input: terminalInput,
@@ -2663,7 +2975,7 @@ async function startInteractiveShell(options) {
   );
   const session = await createShellSession({
     runner: foregroundRunner,
-    io: streamIO(output, error),
+    io,
     agent: options.agent,
     cwd: options.cwd,
     env: options.env,
@@ -2671,7 +2983,7 @@ async function startInteractiveShell(options) {
     agentModelRuntime: options.agentModelRuntime
   });
   const completer = createCommandCompleter(() => session.snapshot().mode);
-  readline = createInterface({
+  readline = createInterface2({
     input,
     output,
     terminal: true,
@@ -2844,7 +3156,7 @@ var StreamingTerminalMarkdown = class {
 var accent3 = chalk3.hex("#8B5CF6");
 var successMark2 = () => chalk3.green("\u2713");
 var errorMark2 = () => chalk3.red("\u2717");
-function isRecord2(value) {
+function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function stringValue(value) {
@@ -2885,7 +3197,7 @@ function formatThread(thread, activeId) {
   return `${active} ${chalk3.dim(thread.id.slice(0, 8))}  ${sanitizeTerminalText2(thread.title)}  ${chalk3.dim(dateLabel)}`;
 }
 function actionFromPayload(payload) {
-  const value = isRecord2(payload.action) ? payload.action : isRecord2(payload.approval) ? payload.approval : payload;
+  const value = isRecord3(payload.action) ? payload.action : isRecord3(payload.approval) ? payload.approval : payload;
   const id = stringValue(value.id);
   const title = stringValue(value.title);
   if (!id || !title) return null;
@@ -3018,7 +3330,7 @@ ${chalk3.yellow.bold("Approval required")}  ${chalk3.dim(action.id.slice(0, 8))}
     if (event.type === "tool_call") {
       this.flushResponse();
       this.endOpenLine();
-      const name = stringValue(payload.name) ?? stringValue(isRecord2(payload.tool_call) ? payload.tool_call.name : null) ?? "tool";
+      const name = stringValue(payload.name) ?? stringValue(isRecord3(payload.tool_call) ? payload.tool_call.name : null) ?? "tool";
       this.options.io.write(chalk3.dim(`  \u25CB ${name}
 `));
       return;
@@ -3454,7 +3766,7 @@ function shortId(id) {
 }
 
 // src/local-output.ts
-function isRecord3(value) {
+function isRecord4(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function text(value) {
@@ -3468,10 +3780,10 @@ function number(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function record3(value) {
-  return isRecord3(value) ? value : void 0;
+  return isRecord4(value) ? value : void 0;
 }
 function rows(value) {
-  return Array.isArray(value) ? value.filter(isRecord3) : [];
+  return Array.isArray(value) ? value.filter(isRecord4) : [];
 }
 function displayId(value) {
   const id = text(value);
@@ -3761,19 +4073,19 @@ function renderServePlan(value) {
 function renderKnownJson(args2, value) {
   const command = args2[0];
   const subcommand = args2[1];
-  if (command === "doctor" && isRecord3(value)) {
+  if (command === "doctor" && isRecord4(value)) {
     renderDoctor(value);
     return true;
   }
-  if (command === "init" && isRecord3(value)) {
+  if (command === "init" && isRecord4(value)) {
     renderInit(value);
     return true;
   }
-  if (command === "validate" && isRecord3(value)) {
+  if (command === "validate" && isRecord4(value)) {
     renderValidate(value);
     return true;
   }
-  if (command === "run" && isRecord3(value)) {
+  if (command === "run" && isRecord4(value)) {
     renderRun(value);
     return true;
   }
@@ -3786,15 +4098,15 @@ function renderKnownJson(args2, value) {
       renderRunEvents(value);
       return true;
     }
-    if (subcommand === "get" && isRecord3(value)) {
+    if (subcommand === "get" && isRecord4(value)) {
       renderRunRecord(value);
       return true;
     }
-    if (subcommand === "report" && isRecord3(value)) {
+    if (subcommand === "report" && isRecord4(value)) {
       renderRunReport(value);
       return true;
     }
-    if (subcommand === "compare" && isRecord3(value)) {
+    if (subcommand === "compare" && isRecord4(value)) {
       renderRunComparison(value);
       return true;
     }
@@ -3804,25 +4116,25 @@ function renderKnownJson(args2, value) {
       renderModelsList(value);
       return true;
     }
-    if ((subcommand === "get" || subcommand === "verify") && isRecord3(value)) {
+    if ((subcommand === "get" || subcommand === "verify") && isRecord4(value)) {
       if (subcommand === "verify") printSuccess("Local model artifact is valid");
       renderModelRecord(value);
       return true;
     }
-    if ((subcommand === "prefetch" || subcommand === "verify-base") && isRecord3(value)) {
+    if ((subcommand === "prefetch" || subcommand === "verify-base") && isRecord4(value)) {
       renderModelPrefetch(value);
       return true;
     }
-    if (["active", "activate", "rollback"].includes(subcommand ?? "") && isRecord3(value)) {
+    if (["active", "activate", "rollback"].includes(subcommand ?? "") && isRecord4(value)) {
       renderActiveModel(value);
       return true;
     }
-    if (subcommand === "serve" && isRecord3(value)) {
+    if (subcommand === "serve" && isRecord4(value)) {
       renderServePlan(value);
       return true;
     }
   }
-  if (command === "serve" && isRecord3(value)) {
+  if (command === "serve" && isRecord4(value)) {
     renderServePlan(value);
     return true;
   }
@@ -4107,10 +4419,10 @@ function localCommandStreamsStdout(args2) {
   const serves = args2[0] === "serve" || args2[0] === "models" && args2[1] === "serve";
   return serves && !args2.includes("--print-command") && !args2.includes("--help") && !args2.includes("-h");
 }
-function parseJsonOutput(stdout) {
-  if (!stdout.trim()) return { hasJson: false, json: void 0 };
+function parseJsonOutput(stdout2) {
+  if (!stdout2.trim()) return { hasJson: false, json: void 0 };
   try {
-    return { hasJson: true, json: JSON.parse(stdout) };
+    return { hasJson: true, json: JSON.parse(stdout2) };
   } catch {
     return { hasJson: false, json: void 0 };
   }
@@ -4156,7 +4468,7 @@ async function spawnLocalCli(args2) {
     }
   );
   if (pipeInput && args2.stdin && child.stdin) args2.stdin.pipe(child.stdin);
-  let stdout = "";
+  let stdout2 = "";
   let stderr = "";
   child.stdout?.setEncoding("utf8");
   child.stderr?.setEncoding("utf8");
@@ -4166,7 +4478,7 @@ async function spawnLocalCli(args2) {
       args2.pathReplacements
     );
     if (args2.streamingStdout) writeStream(output, normalized);
-    else stdout += normalized;
+    else stdout2 += normalized;
   });
   child.stderr?.on("data", (chunk) => {
     const normalized = normalizeProjectedPaths(
@@ -4211,7 +4523,7 @@ async function spawnLocalCli(args2) {
       resolveChild({
         exitCode: spawnError ? 1 : code2 ?? signalExitCode(signal),
         signal,
-        stdout,
+        stdout: stdout2,
         stderr,
         ...spawnError ? { errorMessage: spawnError.message } : {}
       });
@@ -4611,7 +4923,7 @@ async function createDefaultAgentClient(runtime, env, workspaceRoot, getModelRun
   const selection = getAgentSelection(env);
   if (!selection) {
     throw new Error(
-      "The laptop-local agent is not configured. Run `tt agent models --all`, then `tt agent configure --provider <provider> --model <model>`."
+      "The laptop-local agent is not configured. Use /model to choose a provider and model, then try again."
     );
   }
   const modelRuntime = await getModelRuntime();
@@ -4620,8 +4932,9 @@ async function createDefaultAgentClient(runtime, env, workspaceRoot, getModelRun
   const secret = getApiKey({ apiKey: env.TUNED_TENSOR_API_KEY });
   const providerSecrets = Object.entries(env).filter(([name, value]) => value && /(?:API_KEY|TOKEN|SECRET)$/i.test(name)).map(([, value]) => value).filter((value) => value.length >= 8 && value !== secret);
   return createLocalAgentClient({
-    store: runtime.agentStore ?? new LocalAgentStore(join7(getConfigDir(), "agent"), {
-      secretValues: [...secret ? [secret] : [], ...providerSecrets]
+    store: runtime.agentStore ?? new LocalAgentStore(getAgentConfigDir(), {
+      secretValues: [...secret ? [secret] : [], ...providerSecrets],
+      secretValueProvider: readStoredProviderSecrets
     }),
     workspaceRoot,
     selection,
@@ -4893,7 +5206,7 @@ async function runCli(version, runtime = {}) {
 }
 
 // src/index.ts
-runCli("0.13.0").catch((err) => {
+runCli("0.13.1-beta.1").catch((err) => {
   reportError(err);
   process.exit(1);
 });