@vibeframe/cli 0.27.0

package/src/commands/sanitize.ts

@@ -0,0 +1,60 @@
+/**
+ * @module sanitize
+ * @description Sanitize AI/LLM responses to prevent prompt injection and terminal exploits.
+ */
+
+/**
+ * Strip suspicious prompt injection patterns from LLM text output.
+ * Catches common injection attempts like "Ignore previous instructions",
+ * fake system prompts, and markdown-disguised commands.
+ */
+export function sanitizeLLMResponse(text: string): string {
+  if (!text || typeof text !== "string") return text;
+
+  let sanitized = text;
+
+  // Strip ANSI escape sequences that could manipulate terminal
+  // eslint-disable-next-line no-control-regex
+  sanitized = sanitized.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+
+  // Strip other control characters (except newline, tab, carriage return)
+  // eslint-disable-next-line no-control-regex
+  sanitized = sanitized.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g, "");
+
+  return sanitized;
+}
+
+/**
+ * Sanitize a file path returned by an AI model.
+ * Prevents path traversal and null byte injection.
+ */
+export function sanitizeFilePath(path: string): string {
+  if (!path || typeof path !== "string") return path;
+
+  // Remove null bytes
+  let sanitized = path.replace(/\0/g, "");
+
+  // Remove control characters
+  // eslint-disable-next-line no-control-regex
+  sanitized = sanitized.replace(/[\x00-\x1f\x7f-\x9f]/g, "");
+
+  return sanitized;
+}
+
+/**
+ * Sanitize structured data from AI responses (e.g., JSON parsed results).
+ * Recursively sanitizes all string values.
+ */
+export function sanitizeAIResult<T>(data: T): T {
+  if (data === null || data === undefined) return data;
+  if (typeof data === "string") return sanitizeLLMResponse(data) as T;
+  if (Array.isArray(data)) return data.map(sanitizeAIResult) as T;
+  if (typeof data === "object") {
+    const result: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(data as Record<string, unknown>)) {
+      result[key] = sanitizeAIResult(value);
+    }
+    return result as T;
+  }
+  return data;
+}

package/src/commands/schema.ts

@@ -0,0 +1,130 @@
+/**
+ * @module schema
+ * @description Schema introspection command. Outputs JSON Schema for any CLI command,
+ * enabling agent introspection without static docs.
+ *
+ * Usage: vibe schema generate.image
+ *        vibe schema edit.silence-cut
+ */
+
+import { Command } from "commander";
+
+export const schemaCommand = new Command("schema")
+  .description("Show JSON schema for a CLI command")
+  .argument("<command>", "Command path (e.g., generate.image, edit.silence-cut)")
+  .action((commandPath: string) => {
+    // Access the parent program to find commands
+    const program = schemaCommand.parent;
+    if (!program) {
+      console.error("Schema command must be registered on a program");
+      process.exit(1);
+    }
+
+    const parts = commandPath.split(".");
+    if (parts.length !== 2) {
+      console.error(
+        `Invalid command path: ${commandPath}. Use format: group.action (e.g., generate.image)`
+      );
+      process.exit(1);
+    }
+
+    const [groupName, actionName] = parts;
+
+    // Find the group command
+    const groupCmd = program.commands.find(
+      (c: Command) => c.name() === groupName
+    );
+    if (!groupCmd) {
+      console.error(`Unknown group: ${groupName}`);
+      console.error(
+        `Available groups: ${program.commands.map((c: Command) => c.name()).join(", ")}`
+      );
+      process.exit(1);
+    }
+
+    // Find the action command
+    const actionCmd = (groupCmd as Command).commands.find(
+      (c: Command) => c.name() === actionName
+    );
+    if (!actionCmd) {
+      console.error(`Unknown action: ${actionName} in group ${groupName}`);
+      console.error(
+        `Available actions: ${(groupCmd as Command).commands
+          .map((c: Command) => c.name())
+          .join(", ")}`
+      );
+      process.exit(1);
+    }
+
+    // Build JSON schema from Commander options and arguments
+    const toolName = `${groupName}_${actionName.replace(/-/g, "_")}`;
+    const schema = buildSchema(actionCmd as Command, toolName);
+    console.log(JSON.stringify(schema, null, 2));
+  });
+
+function buildSchema(
+  cmd: Command,
+  toolName: string
+): Record<string, unknown> {
+  const properties: Record<string, unknown> = {};
+  const required: string[] = [];
+
+  // Extract arguments
+  for (const arg of cmd.registeredArguments || []) {
+    const name = arg.name();
+    properties[name] = {
+      type: "string",
+      description: arg.description,
+    };
+    if (arg.required) {
+      required.push(name);
+    }
+  }
+
+  // Extract options
+  for (const opt of cmd.options) {
+    const name = camelCase(
+      opt.long?.replace(/^--/, "") || opt.short?.replace(/^-/, "") || ""
+    );
+    if (!name || name === "help") continue;
+
+    const prop: Record<string, unknown> = {
+      description: opt.description,
+    };
+
+    // Detect type from default value or flags
+    if (
+      opt.flags.includes("<number>") ||
+      opt.flags.includes("<seconds>") ||
+      opt.flags.includes("<sec>") ||
+      opt.flags.includes("<dB>") ||
+      opt.flags.includes("<pixels>")
+    ) {
+      prop.type = "number";
+    } else if (opt.flags.includes("<") && opt.flags.includes(">")) {
+      prop.type = "string";
+    } else {
+      prop.type = "boolean";
+    }
+
+    if (opt.defaultValue !== undefined) {
+      prop.default = opt.defaultValue;
+    }
+
+    properties[name] = prop;
+  }
+
+  return {
+    name: toolName,
+    description: cmd.description(),
+    parameters: {
+      type: "object",
+      properties,
+      required: required.length > 0 ? required : undefined,
+    },
+  };
+}
+
+function camelCase(str: string): string {
+  return str.replace(/-([a-z])/g, (_, c: string) => c.toUpperCase());
+}

package/src/commands/setup.ts

@@ -0,0 +1,509 @@
+/**
+ * Setup command - Interactive configuration wizard
+ */
+
+import { Command } from "commander";
+import chalk from "chalk";
+import { resolve, dirname } from "node:path";
+import { access, readFile, mkdir, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { parse as parseDotenv } from "dotenv";
+import {
+  loadConfig,
+  saveConfig,
+  createDefaultConfig,
+  CONFIG_PATH,
+  type LLMProvider,
+  PROVIDER_NAMES,
+} from "../config/index.js";
+import {
+  promptHidden,
+  promptSelect,
+  promptConfirm,
+  closeTTYStream,
+  hasTTY,
+} from "../utils/tty.js";
+import { loadEnv } from "../utils/api-key.js";
+
+export const setupCommand = new Command("setup")
+  .description("Configure VibeFrame (LLM provider, API keys)")
+  .option("--reset", "Reset configuration to defaults")
+  .option("--full", "Run full setup with all optional providers")
+  .option("--show", "Show current configuration (for debugging)")
+  .option("--claude-code", "Set up Claude Code integration (.claude/rules/) in current directory")
+  .action(async (options) => {
+    if (options.claudeCode) {
+      await setupClaudeCode();
+      return;
+    }
+
+    if (options.show) {
+      await showConfig();
+      return;
+    }
+
+    if (options.reset) {
+      const config = createDefaultConfig();
+      await saveConfig(config);
+      console.log(chalk.green("✓ Configuration reset to defaults"));
+      console.log(chalk.dim(`  Saved to: ${CONFIG_PATH}`));
+      return;
+    }
+
+    // Check if TTY is available
+    if (!hasTTY()) {
+      console.error(chalk.red("Error: Interactive setup requires a terminal."));
+      console.log(chalk.dim("Run 'vibe setup' directly from your terminal."));
+      process.exit(1);
+    }
+
+    try {
+      await runSetupWizard(options.full);
+      closeTTYStream();
+      // Explicitly exit to ensure clean termination when run from install script
+      // The TTY stream can keep the event loop alive otherwise
+      process.exit(0);
+    } catch (err) {
+      closeTTYStream();
+      throw err;
+    }
+  });
+
+/**
+ * Run the interactive setup wizard
+ */
+async function runSetupWizard(fullSetup = false): Promise<void> {
+  console.log();
+  console.log(chalk.bold.magenta("VibeFrame Setup"));
+  console.log(chalk.dim("─".repeat(40)));
+  console.log();
+
+  // Load existing config or create default
+  let config = await loadConfig();
+  if (!config) {
+    config = createDefaultConfig();
+  }
+
+  // Step 1: Select LLM Provider
+  console.log(chalk.bold("1. Choose your AI provider"));
+  console.log(chalk.dim("   This provider handles natural language commands."));
+  console.log();
+
+  const providers: LLMProvider[] = ["claude", "openai", "gemini", "xai", "ollama"];
+  const providerDescriptions: Record<LLMProvider, string> = {
+    claude: "Best understanding, most capable",
+    openai: "GPT-5-mini, reliable and fast",
+    gemini: "Google AI, good for general use",
+    xai: "Grok 4.1, optimized for tool calling",
+    ollama: "Free, local, no API key needed",
+  };
+  const providerLabels = providers.map((p) => {
+    const rec = p === "claude" ? chalk.dim(" (recommended)") : "";
+    const desc = chalk.dim(` - ${providerDescriptions[p]}`);
+    return `${PROVIDER_NAMES[p]}${rec}${desc}`;
+  });
+
+  const currentIndex = providers.indexOf(config.llm.provider);
+  const providerIndex = await promptSelect(
+    chalk.cyan("   Select [1-5]: "),
+    providerLabels,
+    currentIndex >= 0 ? currentIndex : 0
+  );
+  config.llm.provider = providers[providerIndex];
+  console.log();
+
+  // Step 2: API Key for selected provider
+  const selectedProvider = config.llm.provider;
+
+  // Show Ollama-specific guidance
+  if (selectedProvider === "ollama") {
+    console.log(chalk.bold("2. Ollama Setup"));
+    console.log();
+    console.log(chalk.dim("   Ollama runs locally and requires no API key."));
+    console.log(chalk.dim("   Make sure Ollama is running before using VibeFrame:"));
+    console.log();
+    console.log(chalk.cyan("   ollama serve") + chalk.dim("          # Start server"));
+    console.log(chalk.cyan("   ollama pull llama3.2") + chalk.dim("  # Download model (first time)"));
+    console.log();
+    console.log(chalk.dim("   Server should be running at http://localhost:11434"));
+    console.log();
+  }
+
+  if (selectedProvider !== "ollama") {
+    const providerKey =
+      selectedProvider === "gemini"
+        ? "google"
+        : selectedProvider === "claude"
+        ? "anthropic"
+        : selectedProvider;
+
+    console.log(chalk.bold(`2. ${PROVIDER_NAMES[selectedProvider]} API Key`));
+    console.log(
+      chalk.dim(`   You can also set ${getEnvVarName(selectedProvider)} environment variable.`)
+    );
+    console.log();
+
+    const existingKey = config.providers[providerKey as keyof typeof config.providers];
+    if (existingKey) {
+      console.log(chalk.dim(`   Current: ${maskApiKey(existingKey)}`));
+      const change = await promptConfirm(chalk.cyan("   Update?"), false);
+      if (change) {
+        const newKey = await promptHidden(chalk.cyan("   Enter API key: "));
+        if (newKey.trim()) {
+          config.providers[providerKey as keyof typeof config.providers] = newKey.trim();
+          console.log(chalk.green("   ✓ Updated"));
+        }
+      }
+    } else {
+      const newKey = await promptHidden(chalk.cyan("   Enter API key: "));
+      if (newKey.trim()) {
+        config.providers[providerKey as keyof typeof config.providers] = newKey.trim();
+        console.log(chalk.green("   ✓ Saved"));
+      } else {
+        console.log(chalk.yellow("   ⚠ Skipped (required for AI features)"));
+      }
+    }
+    console.log();
+  }
+
+  // Step 3: Optional providers (only in full setup mode)
+  if (fullSetup) {
+    console.log(chalk.bold("3. Additional Providers (optional)"));
+    console.log(chalk.dim("   Natural language, video generation, TTS, images, etc."));
+    console.log();
+
+    // Build list of optional providers, excluding the one already configured as primary LLM
+    const allOptionalProviders = [
+      { key: "openai", name: "OpenAI", desc: "NL Commands, DALL-E, Whisper" },
+      { key: "anthropic", name: "Anthropic", desc: "Claude, NL Commands" },
+      { key: "google", name: "Google", desc: "Gemini" },
+      { key: "xai", name: "xAI", desc: "Grok, NL Commands" },
+      { key: "elevenlabs", name: "ElevenLabs", desc: "TTS & Voice" },
+      { key: "runway", name: "Runway", desc: "Video Gen" },
+      { key: "kling", name: "Kling", desc: "Video Gen" },
+      { key: "imgbb", name: "ImgBB", desc: "Image Hosting (for Kling)" },
+      { key: "replicate", name: "Replicate", desc: "Various" },
+    ];
+
+    // Get the key of the primary LLM provider to skip it
+    const primaryProviderKey =
+      selectedProvider === "gemini"
+        ? "google"
+        : selectedProvider === "claude"
+        ? "anthropic"
+        : selectedProvider;
+
+    // Filter out the primary provider
+    const optionalProviders = allOptionalProviders.filter(
+      (p) => p.key !== primaryProviderKey
+    );
+
+    for (const provider of optionalProviders) {
+      const existing = config.providers[provider.key as keyof typeof config.providers];
+      const status = existing ? chalk.green("✓") : chalk.dim("○");
+
+      const configure = await promptConfirm(
+        chalk.cyan(`   ${status} ${provider.name} ${chalk.dim(`(${provider.desc})`)}?`),
+        false
+      );
+
+      if (configure) {
+        const key = await promptHidden(chalk.cyan(`      API key: `));
+        if (key.trim()) {
+          config.providers[provider.key as keyof typeof config.providers] = key.trim();
+          console.log(chalk.green("      ✓ Saved"));
+        }
+      }
+    }
+    console.log();
+
+    // Step 4: Default aspect ratio
+    console.log(chalk.bold("4. Default Aspect Ratio"));
+    console.log();
+
+    const ratios = ["16:9", "9:16", "1:1", "4:5"] as const;
+    const ratioLabels = [
+      "16:9 (YouTube, landscape)",
+      "9:16 (TikTok, Reels, Shorts)",
+      "1:1 (Instagram, square)",
+      "4:5 (Instagram portrait)",
+    ];
+
+    const currentRatioIndex = ratios.indexOf(config.defaults.aspectRatio);
+    const ratioIndex = await promptSelect(
+      chalk.cyan("   Select [1-4]: "),
+      ratioLabels,
+      currentRatioIndex >= 0 ? currentRatioIndex : 0
+    );
+    config.defaults.aspectRatio = ratios[ratioIndex];
+    console.log();
+  }
+
+  // Save configuration
+  await saveConfig(config);
+
+  // Done
+  console.log(chalk.dim("─".repeat(40)));
+  console.log(chalk.green.bold("✓ Setup complete!"));
+  console.log();
+  console.log(chalk.dim(`Config: ${CONFIG_PATH}`));
+  console.log();
+
+  // Suggest a "try it" command based on configured providers
+  const { hasApiKey } = await import("../utils/api-key.js");
+  if (hasApiKey("GOOGLE_API_KEY")) {
+    console.log(`  Try: ${chalk.cyan('vibe generate image "a sunset over mountains" -o test.png')}`);
+  } else if (hasApiKey("ELEVENLABS_API_KEY")) {
+    console.log(`  Try: ${chalk.cyan('vibe generate speech "Hello world" -o hello.mp3')}`);
+  } else if (hasApiKey("OPENAI_API_KEY")) {
+    console.log(`  Try: ${chalk.cyan('vibe generate image "a cute robot" -p openai -o test.png')}`);
+  } else {
+    console.log(`  Try: ${chalk.cyan("vibe")} to start the interactive Agent`);
+  }
+  console.log();
+  console.log(chalk.dim(`  vibe doctor         Check what's ready`));
+  console.log(chalk.dim(`  vibe setup --show   Verify configuration`));
+  console.log(chalk.dim(`  vibe setup --full   Configure more providers`));
+  console.log();
+}
+
+/**
+ * Set up Claude Code integration in current directory
+ */
+async function setupClaudeCode(): Promise<void> {
+  const targetDir = resolve(process.cwd(), ".claude", "rules");
+  const targetFile = resolve(targetDir, "cli-reference.md");
+
+  // Check if already exists
+  let isUpdate = false;
+  try {
+    await access(targetFile);
+    isUpdate = true;
+  } catch {
+    // doesn't exist yet, fresh install
+  }
+
+  // Read the bundled CLI reference from the package
+  // In built dist: packages/cli/dist/commands/setup.js
+  // Source reference: .claude/rules/cli-reference.md (relative to repo root)
+  // We'll embed it directly since the file ships with the npm package
+
+  const cliReference = await getCliReference();
+
+  await mkdir(targetDir, { recursive: true });
+  await writeFile(targetFile, cliReference, "utf-8");
+
+  console.log();
+  console.log(chalk.green(`✓ Claude Code integration ${isUpdate ? "updated" : "set up"}!`));
+  console.log();
+  console.log(chalk.dim(`  ${isUpdate ? "Updated" : "Created"}: ${targetFile}`));
+  console.log();
+  console.log("  Claude Code now knows all VibeFrame commands.");
+  console.log("  It will use " + chalk.cyan("vibe") + " commands directly without running --help.");
+  console.log();
+}
+
+/**
+ * Get CLI reference content (embedded)
+ */
+async function getCliReference(): Promise<string> {
+  // Try to read from the repo's .claude/rules/ first (dev mode)
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = dirname(__filename);
+
+  // Walk up to find the repo root or package root
+  const possiblePaths = [
+    // Dev mode: repo root
+    resolve(__dirname, "..", "..", "..", "..", ".claude", "rules", "cli-reference.md"),
+    // Built CLI (dist/commands/setup.js): packages/cli/.claude/rules/cli-reference.md
+    resolve(__dirname, "..", "..", ".claude", "rules", "cli-reference.md"),
+    // Installed via curl (~/.vibeframe/): .claude/rules/cli-reference.md
+    resolve(__dirname, "..", "..", "..", "..", ".claude", "rules", "cli-reference.md"),
+  ];
+
+  for (const p of possiblePaths) {
+    try {
+      return await readFile(p, "utf-8");
+    } catch {
+      // try next
+    }
+  }
+
+  // Fallback: generate a minimal reference
+  return generateMinimalReference();
+}
+
+/**
+ * Generate minimal CLI reference if bundled file not found
+ */
+function generateMinimalReference(): string {
+  return `# VibeFrame CLI Reference
+
+> Use these commands directly — no need to run \`--help\` first.
+
+## Quick Reference
+
+\`\`\`bash
+# Image
+vibe ai image "<prompt>" -o out.png
+vibe ai gemini-edit <image> "<instruction>" -o out.png
+
+# Video
+vibe ai video "<prompt>" -o out.mp4 -d 5
+vibe ai kling "<prompt>" -o out.mp4 -d 5
+
+# Audio
+vibe ai tts "<text>" -o out.mp3
+vibe ai transcribe <audio> -o out.srt
+
+# Editing
+vibe ai silence-cut <video> -o out.mp4
+vibe ai caption <video> -o out.mp4 -s bold
+vibe ai noise-reduce <input> -o out.mp4
+vibe ai fade <video> -o out.mp4 --fade-in 1 --fade-out 1
+vibe ai grade <video> -o out.mp4 -p cinematic-warm
+vibe ai jump-cut <video> -o out.mp4
+
+# Analysis
+vibe ai analyze <source> "<prompt>"
+vibe ai gemini-video <video> "<prompt>"
+
+# Pipeline
+vibe ai script-to-video "<script>" -o output-dir/ -g runway
+vibe ai highlights <video> -d 60
+vibe ai auto-shorts <video> -o shorts/ -n 3
+
+# Project
+vibe project create <name> -o project.vibe.json
+vibe timeline add-source <project> <media>
+vibe timeline add-clip <project> <source-id>
+vibe export <project> -o output.mp4 -y
+\`\`\`
+
+Run \`vibe ai --help\` for full command list with all options.
+`;
+}
+
+/**
+ * Mask API key for display
+ */
+function maskApiKey(key: string): string {
+  if (key.length <= 8) return "****";
+  return `${key.slice(0, 4)}${"*".repeat(8)}${key.slice(-4)}`;
+}
+
+/**
+ * Get environment variable name for a provider
+ */
+function getEnvVarName(provider: LLMProvider): string {
+  const envVars: Record<LLMProvider, string> = {
+    claude: "ANTHROPIC_API_KEY",
+    openai: "OPENAI_API_KEY",
+    gemini: "GOOGLE_API_KEY",
+    xai: "XAI_API_KEY",
+    ollama: "",
+  };
+  return envVars[provider];
+}
+
+/**
+ * Show current configuration for debugging
+ */
+async function showConfig(): Promise<void> {
+  // Load CWD .env before showing config
+  loadEnv();
+
+  const cwdEnvPath = resolve(process.cwd(), ".env");
+  let hasCwdEnv = false;
+  try {
+    await access(cwdEnvPath);
+    hasCwdEnv = true;
+  } catch {
+    // no .env in CWD
+  }
+
+  console.log();
+  console.log(chalk.bold.magenta("VibeFrame Configuration"));
+  console.log(chalk.dim("─".repeat(40)));
+  console.log();
+  console.log(chalk.dim(`Config file: ${CONFIG_PATH}`));
+  if (hasCwdEnv) {
+    console.log(chalk.dim(`Project .env: ${cwdEnvPath}`));
+  }
+  console.log();
+
+  const config = await loadConfig();
+
+  // Parse .env file directly to know which keys are in it
+  let dotenvKeys: Record<string, string> = {};
+  if (hasCwdEnv) {
+    try {
+      const envContent = await readFile(cwdEnvPath, "utf-8");
+      dotenvKeys = parseDotenv(Buffer.from(envContent));
+    } catch {
+      // ignore parse errors
+    }
+  }
+
+  if (!config && !hasCwdEnv) {
+    console.log(chalk.yellow("No configuration found."));
+    console.log(chalk.dim("Run 'vibe setup' or create .env in your project directory."));
+    return;
+  }
+
+  // Show LLM provider
+  if (config) {
+    console.log(chalk.bold("LLM Provider:"));
+    console.log(`  ${PROVIDER_NAMES[config.llm.provider]}`);
+    console.log();
+  }
+
+  // Show API keys (masked) with accurate source detection
+  console.log(chalk.bold("API Keys:"));
+  const providerKeys = [
+    { key: "anthropic", name: "Anthropic", env: "ANTHROPIC_API_KEY" },
+    { key: "openai", name: "OpenAI", env: "OPENAI_API_KEY" },
+    { key: "google", name: "Google", env: "GOOGLE_API_KEY" },
+    { key: "xai", name: "xAI", env: "XAI_API_KEY" },
+    { key: "elevenlabs", name: "ElevenLabs", env: "ELEVENLABS_API_KEY" },
+    { key: "runway", name: "Runway", env: "RUNWAY_API_SECRET" },
+    { key: "kling", name: "Kling", env: "KLING_API_KEY" },
+    { key: "imgbb", name: "ImgBB", env: "IMGBB_API_KEY" },
+    { key: "replicate", name: "Replicate", env: "REPLICATE_API_TOKEN" },
+  ];
+
+  for (const p of providerKeys) {
+    const configValue = config?.providers[p.key as keyof typeof config.providers];
+    const dotenvValue = dotenvKeys[p.env];
+
+    if (configValue || dotenvValue) {
+      // Show effective value (config wins) and all sources
+      const sources: string[] = [];
+      if (configValue) sources.push("config");
+      if (dotenvValue) sources.push(".env");
+      const value = configValue || dotenvValue;
+      const status = chalk.green("✓");
+      console.log(`  ${status} ${p.name.padEnd(12)} ${maskApiKey(value)} (${sources.join(" + ")})`);
+    } else {
+      const status = chalk.dim("○");
+      console.log(`  ${status} ${p.name.padEnd(12)} ${chalk.dim("not set")}`);
+    }
+  }
+  console.log();
+
+  // Show defaults
+  if (config) {
+    console.log(chalk.bold("Defaults:"));
+    console.log(`  Aspect Ratio: ${config.defaults.aspectRatio}`);
+    console.log(`  Export Quality: ${config.defaults.exportQuality}`);
+    console.log();
+  }
+
+  // Show resolution order
+  console.log(chalk.bold("Resolution order:"));
+  console.log(chalk.dim("  1. --api-key CLI option"));
+  console.log(chalk.dim(`  2. ${CONFIG_PATH}`));
+  console.log(chalk.dim("  3. .env in current directory"));
+  console.log(chalk.dim("  4. Shell environment variables"));
+  console.log();
+}