@zergai/ztc 0.5.0-beta.1 → 0.6.0-beta.1

package/dist/agent/commands/connect.js

@@ -0,0 +1,150 @@
+import { runAuthAction } from './auth.js';
+import { canAskForCredential, promptForDirectCredential } from './direct_credential_prompt.js';
+import { canonicalProvider, canonicalRoute, DIRECT_PROVIDER_CHOICES, describeDirectProvider, isLocalSubscription, modelRouteStatus, } from './provider_choices.js';
+import { currentRouteReady, formatDirectProviders, selectProviderModel } from './provider_selection.js';
+import { LOCAL_API_KEYS_LABEL, ZERGAI_LOGIN_BENEFITS, ZERGAI_LOGIN_LABEL, } from '../../onboarding/zergai_login.js';
+const ROUTE_OPTIONS = [
+    {
+        value: 'zergrouter',
+        label: ZERGAI_LOGIN_LABEL,
+        description: 'Opens your browser to log in.',
+        details: [...ZERGAI_LOGIN_BENEFITS],
+    },
+    {
+        value: 'direct',
+        label: LOCAL_API_KEYS_LABEL,
+        description: 'Paste a provider API key, or use a local Claude Code, Codex or Kimi Code login.',
+    },
+];
+const CONNECT_LATER = 'Run /connect any time to log in with ZergAI or use your local API keys.';
+const NOTHING_CONNECTED = 'No model is connected. Run /connect to log in with ZergAI or use your local API keys.';
+async function connectProvider(provider, ready, ctx, flow) {
+    if (ready) {
+        await selectProviderModel([provider], ctx);
+        flow?.finish();
+        return;
+    }
+    const asked = promptForDirectCredential(provider, ctx, async () => {
+        await selectProviderModel([provider], ctx, { credentialPrompted: true });
+        flow?.finish();
+    }, { onCancel: flow?.back });
+    if (!asked)
+        ctx.addMessage({ role: 'system', content: `${provider} is not connected yet. Run /connect direct in an interactive session to add a key or sign in.` });
+    // A key prompt and a custom endpoint's form finish or step back on their
+    // own. A local login's sign-in help is the end of this flow.
+    const id = canonicalProvider(provider) ?? provider;
+    if (!asked || isLocalSubscription(id))
+        flow?.finish();
+}
+async function connectRoute(route, ctx, noBrowser, flow) {
+    // Saved before the route runs: choosing local keys counts even when the
+    // provider list is then cancelled, and it keeps the launch prompt away.
+    const previous = ctx.config.get().onboarding;
+    ctx.config.set('onboarding', { ...previous, connectChoice: route });
+    await ctx.config.save();
+    switch (route) {
+        case 'zergrouter': {
+            const outcome = await runAuthAction(noBrowser ? ['login', '--no-browser'] : ['login'], ctx);
+            // Stopping the browser wait at launch (Escape, /auth cancel) goes back to
+            // the launch choice, where ZergAI is no longer chosen.
+            if (flow && !outcome.ok && outcome.ended === 'cancelled') {
+                ctx.config.set('onboarding', previous);
+                await ctx.config.save();
+                return flow.back();
+            }
+            flow?.finish();
+            return;
+        }
+        case 'direct': {
+            // Headless pickers answer by themselves; list the providers instead of picking one.
+            if (!canAskForCredential(ctx)) {
+                ctx.addMessage({ role: 'system', content: formatDirectProviders(modelRouteStatus(ctx.config).directProviders) });
+                flow?.finish();
+                return;
+            }
+            const ready = new Set(modelRouteStatus(ctx.config).directProviders);
+            // Configured providers lead; sort is stable, so choice order holds within each group.
+            const options = [...DIRECT_PROVIDER_CHOICES]
+                .sort((a, b) => Number(ready.has(b.id)) - Number(ready.has(a.id)))
+                .map(choice => ({ value: choice.id, label: choice.label, description: describeDirectProvider(choice.id, ready.has(choice.id)) }));
+            const showProviders = () => ctx.select.showSelect({ title: LOCAL_API_KEYS_LABEL,
+                question: 'Which provider should ZTC call?', type: 'select', options, silentCancel: true, compact: true }, async (value) => {
+                if (typeof value === 'string' && options.some(option => option.value === value)) {
+                    // Leaving a key choice comes back here.
+                    return connectProvider(value, ready.has(value), ctx, flow && { back: showProviders, finish: flow.finish });
+                }
+                if (!flow) {
+                    ctx.addMessage({ role: 'system', content: 'Run /connect direct any time to choose a provider.' });
+                    return;
+                }
+                // Back at the launch choice, local keys are no longer chosen.
+                ctx.config.set('onboarding', previous);
+                await ctx.config.save();
+                return flow.back();
+            });
+            showProviders();
+            return;
+        }
+    }
+}
+export const connectCommand = {
+    name: 'connect',
+    description: 'Connect a model: log in with ZergAI or use your local API keys',
+    usage: '[zergrouter|direct] [--no-browser]',
+    agentRunnable: false,
+    category: 'config',
+    handler: (args, ctx) => {
+        const noBrowser = args.includes('--no-browser');
+        const rest = args.filter(arg => arg !== '--no-browser');
+        const route = rest[0] === undefined ? undefined : canonicalRoute(rest[0]);
+        if (rest.length > 1 || (rest[0] !== undefined && !route)) {
+            ctx.addMessage({ role: 'system', content: 'Usage: /connect [zergrouter|direct] [--no-browser]' });
+            return;
+        }
+        if (route)
+            return connectRoute(route, ctx, noBrowser);
+        showConnectPrompt(ctx, { noBrowser });
+    },
+};
+/**
+ * After a ZergAI logout that leaves no model reachable, ask how to connect
+ * again, as launch does; mid-session the choice can be closed. Without a
+ * person to ask, say so and point to /connect.
+ */
+export function offerConnectAfterLogout(ctx) {
+    if (currentRouteReady(ctx))
+        return;
+    if (canAskForCredential(ctx))
+        showConnectPrompt(ctx);
+    else
+        ctx.addMessage({ role: 'system', content: NOTHING_CONNECTED });
+}
+/**
+ * Ask how to reach a model. `launch` is the prompt ZTC opens by itself at
+ * launch, and it must end in a choice: typing and Escape do not close it,
+ * Escape further on steps back towards it, and choosing ZergAI starts the
+ * login at once.
+ */
+export function showConnectPrompt(ctx, { launch = false, noBrowser = false, onFinished } = {}) {
+    const expired = ctx.config.getRouterSessionStatus?.() === 'expired';
+    let finished = false;
+    const finish = () => {
+        if (finished)
+            return;
+        finished = true;
+        onFinished?.();
+    };
+    const flow = launch
+        ? { back: () => showConnectPrompt(ctx, { launch, noBrowser, onFinished: finish }), finish }
+        : undefined;
+    ctx.select.showSelect({
+        title: 'Connect a model', type: 'select',
+        question: `${expired ? 'Your ZergAI session expired. ' : ''}How should ZTC reach a model?`,
+        options: ROUTE_OPTIONS, defaultValue: 'zergrouter', silentCancel: true, compact: true, ...(launch ? { required: true } : {}),
+    }, value => {
+        if (value === 'zergrouter' || value === 'direct')
+            return connectRoute(value, ctx, noBrowser, flow);
+        ctx.addMessage({ role: 'system', content: CONNECT_LATER });
+        flow?.finish();
+    });
+}

package/dist/agent/commands/credential_redaction.d.ts

@@ -0,0 +1,12 @@
+/** What a redacted secret argument reads as. */
+export declare const REDACTED_SECRET = "\u2022\u2022\u2022\u2022";
+/**
+ * The text to record for a submitted line: input history, the mirror and the
+ * session journal. A key typed into `/config key [provider] <key>` or
+ * `/voice key <provider> <key>` becomes `••••`; the command still runs with
+ * the real key. Any other command line, a mistyped one included, keeps no
+ * word that plainly is a key (a known key prefix at a key's length). Every
+ * other line, messages and `/config key [provider] --remove` included, is
+ * returned as typed.
+ */
+export declare function redactCredentialCommand(text: string): string;

package/dist/agent/commands/credential_redaction.js

@@ -0,0 +1,46 @@
+import { canonicalProvider } from './provider_choices.js';
+import { hasApiKeyPrefix } from '../../config/provider_api_key_env.js';
+/** What a redacted secret argument reads as. */
+export const REDACTED_SECRET = '••••';
+/** The providers `/voice key <provider> <key>` takes. */
+const VOICE_PROVIDERS = new Set(['openai', 'elevenlabs']);
+/** `/config` words that only pick a write scope before the subcommand. */
+const CONFIG_SCOPE_WORDS = new Set(['local', 'session', 'global']);
+/**
+ * The text to record for a submitted line: input history, the mirror and the
+ * session journal. A key typed into `/config key [provider] <key>` or
+ * `/voice key <provider> <key>` becomes `••••`; the command still runs with
+ * the real key. Any other command line, a mistyped one included, keeps no
+ * word that plainly is a key (a known key prefix at a key's length). Every
+ * other line, messages and `/config key [provider] --remove` included, is
+ * returned as typed.
+ */
+export function redactCredentialCommand(text) {
+    const [command, ...args] = text.trim().split(/\s+/);
+    // Commands dispatch case-insensitively, so /CONFIG KEY must redact too.
+    const name = command.toLowerCase();
+    const words = args.map(arg => arg.toLowerCase());
+    const scopes = words.findIndex(word => !CONFIG_SCOPE_WORDS.has(word));
+    if (name === '/config' && scopes >= 0 && words[scopes] === 'key') {
+        const values = args.slice(scopes + 1);
+        // Mirrors parseConfigKeyArgs: a leading provider name is kept, anything else is the key.
+        const kept = values.length > 0 && canonicalProvider(values[0]) ? 1 : 0;
+        // `--remove` removes the key; it is not one.
+        if (values.slice(kept).join(' ') === '--remove')
+            return text;
+        return values.length > kept ? [command, ...args.slice(0, scopes + 1 + kept), REDACTED_SECRET].join(' ') : text;
+    }
+    if (name === '/voice' && words[0] === 'key' && args.length > 2) {
+        return [command, args[0], args[1], REDACTED_SECRET].join(' ');
+    }
+    // /voice key <key> left out its provider: the one value is the key.
+    if (name === '/voice' && words[0] === 'key' && args.length === 2 && !VOICE_PROVIDERS.has(words[1])) {
+        return [command, args[0], REDACTED_SECRET].join(' ');
+    }
+    // Any other command line, a mistyped /confg key … included, keeps no word
+    // that is plainly a key.
+    if (name.startsWith('/') && args.some(hasApiKeyPrefix)) {
+        return [command, ...args.map(arg => (hasApiKeyPrefix(arg) ? REDACTED_SECRET : arg))].join(' ');
+    }
+    return text;
+}

package/dist/agent/commands/credential_status.d.ts

@@ -0,0 +1,72 @@
+import type { ConfigController } from './types.js';
+import { type RouterSessionStatus } from '../../router_auth.js';
+import type { ApiKeySource } from '../../config/provider_api_key_env.js';
+/** How a selection reaches a model. */
+export type RouteKind = 'router' | 'api-key' | 'local-login' | 'endpoint' | 'platform' | 'none';
+/** How the current selection reaches a model, and whether it can now. */
+export interface ActiveRoute {
+    kind: RouteKind;
+    route: string;
+    ready: boolean;
+    /** Why the route could not be resolved, when it could not. */
+    error?: string;
+    /** The error is a missing or expired ZergAI login. */
+    signIn?: boolean;
+}
+export declare function describeActiveRoute(config: ConfigController): ActiveRoute;
+/**
+ * /status's readiness: Yes, or what blocks a model and the one step that
+ * fixes it, naming a provider that is ready on this machine when there is one.
+ */
+export declare function readinessLine(config: ConfigController, route?: ActiveRoute): string;
+/**
+ * The route and model in one line, as the settings panel's Connection page
+ * leads with it: "Connected via ZergAI · modal/deepseek-v4.1-flash".
+ */
+export declare function describeConnection(config: ConfigController, route?: ActiveRoute): string;
+/**
+ * What the agent runs on, as /status and /config show list it: provider,
+ * model and route, then the credential lines.
+ */
+export declare function connectionStatusLines(config: ConfigController, route?: ActiveRoute): string[];
+/**
+ * The credential lines /status and /config show share: the ZergAI login (for
+ * Zerg Router), each local provider key with where it comes from, and local
+ * logins. Keys show their last four characters only; variables are named,
+ * never read out.
+ */
+export declare function credentialStatusLines(config: ConfigController): string[];
+/** A key row's value: where the key comes from, never the key. */
+export declare function describeKeyRow(config: ConfigController, provider: string): string;
+/** One provider key as the mirror's Connection section lists it: its source, masked. */
+export interface ConnectionKey {
+    provider: string;
+    label: string;
+    source: ApiKeySource['kind'];
+    detail: string;
+}
+/** The custom endpoint as the mirror's Connection section shows it: its URL and model, and its key's source, masked. */
+export interface ConnectionEndpoint {
+    baseUrl?: string;
+    model?: string;
+    source: ApiKeySource['kind'];
+    detail: string;
+}
+/**
+ * What the mirror's settings page shows on Connection, as /keys shows it in
+ * the terminal: the route, the ZergAI login (or a login waiting for
+ * approval), where each provider key comes from, and the custom endpoint.
+ * Keys are masked to their last four characters; variables are named, never
+ * read out.
+ */
+export interface ConnectionSnapshot {
+    connection: string;
+    ready: boolean;
+    zergai: {
+        status: RouterSessionStatus | 'pending';
+        origin?: string;
+    };
+    keys: ConnectionKey[];
+    endpoint: ConnectionEndpoint;
+}
+export declare function connectionSnapshot(config: ConfigController, pendingLogin?: string): ConnectionSnapshot;

package/dist/agent/commands/credential_status.js

@@ -0,0 +1,181 @@
+import { API_KEY_PROVIDER_CHOICES, DIRECT_PROVIDER_CHOICES, isLocalSubscription, isRouterOnlyProvider, modelRouteStatus, } from './provider_choices.js';
+import { isBuildableResolvedConfig } from './config.js';
+import { maskApiKey } from '../../config.js';
+import { RouterConfigurationError } from '../../router_auth.js';
+/** The route as /status and /config show name it. */
+const ROUTE_NAMES = {
+    router: 'Zerg Router',
+    'api-key': 'local API key',
+    'local-login': 'local login',
+    endpoint: 'custom endpoint',
+    platform: 'legacy ZergAI token',
+    none: 'none (missing credentials)',
+};
+/** The route as the settings panel's one-line connection status leads with it. */
+const CONNECTION_PREFIXES = {
+    router: 'Connected via ZergAI',
+    'api-key': 'Local API key',
+    'local-login': 'Local login',
+    endpoint: 'Custom endpoint',
+    platform: 'Legacy ZergAI token',
+};
+/** A routing mode in words, as /status and /config show put it beside the route. */
+const ROUTING_MODE_NAMES = {
+    auto: 'auto',
+    direct: 'local keys only',
+    zrouter: 'Zerg Router only',
+};
+export function describeActiveRoute(config) {
+    const provider = config.getProvider();
+    try {
+        const llm = config.resolveLLMBackendConfig();
+        const ready = isBuildableResolvedConfig(llm);
+        // A custom endpoint may carry a key, but the endpoint is what it connects to.
+        const kind = isLocalSubscription(provider) ? 'local-login'
+            : llm.useProxy ? 'router'
+                : provider === 'openai_compatible' && llm.compatBaseUrl ? 'endpoint'
+                    : llm.apiKey ? 'api-key'
+                        : ready ? 'platform' : 'none';
+        return { kind, route: ROUTE_NAMES[kind], ready };
+    }
+    catch (error) {
+        return { kind: 'none', route: ROUTE_NAMES.none, ready: false, error: error instanceof Error ? error.message : String(error),
+            signIn: error instanceof RouterConfigurationError && error.needsSignIn };
+    }
+}
+function routingMode(config) {
+    return config.getAuthMode?.() || config.get().authMode || 'auto';
+}
+/**
+ * /status's readiness: Yes, or what blocks a model and the one step that
+ * fixes it, naming a provider that is ready on this machine when there is one.
+ */
+export function readinessLine(config, route = describeActiveRoute(config)) {
+    if (route.ready)
+        return 'Yes';
+    const provider = config.getProvider();
+    const session = config.getRouterSessionStatus?.() ?? 'signed_out';
+    const mode = routingMode(config);
+    const needsRouter = session !== 'signed_in' && (mode === 'zrouter' || isRouterOnlyProvider(provider));
+    const reason = needsRouter
+        ? `${mode === 'zrouter' ? 'routing is Zerg Router only' : `${provider} runs through Zerg Router`} and ${session === 'expired' ? 'your ZergAI session expired' : 'you are not logged in with ZergAI'}`
+        : isLocalSubscription(provider) ? `${provider} is not signed in on this machine`
+            : provider === 'openai_compatible' ? 'the custom endpoint is not set up'
+                : `${provider} has no API key here`;
+    // When routing is the block, the selected provider's own key counts too.
+    const ready = modelRouteStatus(config).directProviders.filter(id => needsRouter || id !== provider);
+    const next = ready.length > 0
+        ? `Ready on this machine: ${ready.join(', ')}. Switch with /model direct ${ready[0]}, or ${needsRouter ? 'log in with /auth login' : 'add a key in /keys'}.`
+        : needsRouter ? 'Log in with /auth login, or add an API key in /keys.' : 'Add a key in /keys, or log in with ZergAI (/auth login).';
+    return `No - ${reason}. ${next}`;
+}
+/**
+ * The route and model in one line, as the settings panel's Connection page
+ * leads with it: "Connected via ZergAI · modal/deepseek-v4.1-flash".
+ */
+export function describeConnection(config, route = describeActiveRoute(config)) {
+    if (!route.ready || route.kind === 'none')
+        return 'No model connected';
+    const provider = config.getProvider();
+    const model = config.getModel?.() || config.get().model;
+    // Router model ids already carry their provider (modal/deepseek-…).
+    return `${CONNECTION_PREFIXES[route.kind]} · ${model.startsWith(`${provider}/`) ? model : `${provider}/${model}`}`;
+}
+/**
+ * What the agent runs on, as /status and /config show list it: provider,
+ * model and route, then the credential lines.
+ */
+export function connectionStatusLines(config, route = describeActiveRoute(config)) {
+    return [
+        `  Provider: ${config.getProvider()}`,
+        `  Model: ${config.getModel?.() || config.get().model}`,
+        `  Routing: ${route.route} · ${ROUTING_MODE_NAMES[routingMode(config)] ?? routingMode(config)}`,
+        ...credentialStatusLines(config),
+    ];
+}
+/**
+ * The credential lines /status and /config show share: the ZergAI login (for
+ * Zerg Router), each local provider key with where it comes from, and local
+ * logins. Keys show their last four characters only; variables are named,
+ * never read out.
+ */
+export function credentialStatusLines(config) {
+    const proxy = config.get().zergProxyUrl;
+    const session = config.getRouterSessionStatus?.() ?? 'signed_out';
+    const router = proxy ? ` (Zerg Router at ${proxy})` : '';
+    const login = session === 'signed_in' ? `signed in${router}`
+        : `${session === 'expired' ? 'session expired' : 'not signed in'}${router} · /auth login`;
+    const keys = [];
+    const logins = [];
+    for (const { id } of DIRECT_PROVIDER_CHOICES) {
+        const source = config.getApiKeySource(id);
+        switch (source.kind) {
+            case 'saved':
+                keys.push([id, `${config.getMaskedApiKey(id)} · saved`]);
+                break;
+            case 'env-ref': {
+                if (source.set) {
+                    keys.push([id, `${config.getMaskedApiKey(id)} · from $${source.name}`]);
+                    break;
+                }
+                // The variable is not set yet; say which key stands in until it is.
+                const until = `until $${source.name} is set`;
+                keys.push([id, source.fallback?.kind === 'saved' ? `${config.getMaskedApiKey(id)} · saved, ${until}`
+                        : source.fallback ? `${config.getMaskedApiKey(id)} · from $${source.fallback.name}, ${until}`
+                            : `$${source.name} is not set`]);
+                break;
+            }
+            case 'env-default':
+                keys.push([id, `${config.getMaskedApiKey(id)} · from $${source.name}`]);
+                break;
+            case 'login':
+                logins.push(id);
+                break;
+            case 'none': break;
+        }
+    }
+    const width = Math.max(0, ...keys.map(([id]) => id.length));
+    return [
+        `  ZergAI login: ${login}`,
+        keys.length > 0 ? '  API keys:' : '  API keys: none · /keys',
+        ...keys.map(([id, detail]) => `    ${id.padEnd(width)}  ${detail}`),
+        ...(logins.length > 0 ? [`  Local logins: ${logins.join(', ')}`] : []),
+        ...(config.isAuthenticated?.() ? ['  Legacy ZergAI token: present (older platform login; /auth login is the current ZergAI login)'] : []),
+    ];
+}
+/** A key row's value: where the key comes from, never the key. */
+export function describeKeyRow(config, provider) {
+    const source = config.getApiKeySource(provider);
+    switch (source.kind) {
+        case 'saved': return `${maskApiKey(config.getApiKey(provider) ?? '').replace(/^••••(?=.)/, '•••• ')} saved`;
+        case 'env-ref': {
+            if (source.set)
+                return `$${source.name}`;
+            const inUse = source.fallback?.kind === 'saved' ? 'saved key' : source.fallback ? `$${source.fallback.name}` : undefined;
+            return `$${source.name} (not set)${inUse ? ` · ${inUse} in use` : ''}`;
+        }
+        case 'env-default': return `$${source.name} (env)`;
+        case 'login': return 'Local login ready';
+        case 'none': return 'not set';
+    }
+}
+export function connectionSnapshot(config, pendingLogin) {
+    const route = describeActiveRoute(config);
+    const origin = pendingLogin ?? config.get().zergProxyUrl;
+    const compat = config.getOpenAICompatibleSettings?.() ?? config.get().openaiCompatible ?? {};
+    const baseUrl = compat.baseUrl || config.get().openaiCompatibleBaseUrl;
+    return {
+        connection: describeConnection(config, route),
+        ready: route.ready,
+        zergai: { status: pendingLogin ? 'pending' : config.getRouterSessionStatus?.() ?? 'signed_out', ...(origin ? { origin } : {}) },
+        keys: API_KEY_PROVIDER_CHOICES.map(choice => ({
+            provider: choice.id, label: choice.label, source: config.getApiKeySource(choice.id).kind, detail: describeKeyRow(config, choice.id),
+        })),
+        endpoint: {
+            ...(baseUrl ? { baseUrl } : {}),
+            ...(compat.defaultModel ? { model: compat.defaultModel } : {}),
+            source: config.getApiKeySource('openai_compatible').kind,
+            detail: describeKeyRow(config, 'openai_compatible'),
+        },
+    };
+}

package/dist/agent/commands/direct_credential_prompt.d.ts

@@ -0,0 +1,71 @@
+import type { CommandContext } from './types.js';
+import type { ResolvedLLMConfig } from '../../config/resolved.js';
+import { type ApiKeySource } from '../../config/provider_api_key_env.js';
+type Callback = () => void | Promise<void>;
+/**
+ * A change the person made to one provider's key, summed up in one line.
+ * 'env-pending' names a variable that is not set yet: the provider keeps
+ * whatever key it had until then.
+ */
+export interface KeyChange {
+    kind: 'saved' | 'env' | 'env-pending' | 'removed';
+    summary: string;
+}
+export interface DirectCredentialPromptOptions {
+    /** Runs when the person leaves without a usable credential. */
+    onCancel?: Callback;
+    /** Runs just before the first widget opens, e.g. to close the settings panel. */
+    beforeAsk?: () => void;
+}
+/**
+ * Whether a person can answer a secret prompt here. Agent-run commands and
+ * widgets that answer by themselves (headless) cannot.
+ */
+export declare function canAskForCredential(ctx: CommandContext): boolean;
+export declare function providerLabel(provider: string): string;
+/**
+ * What else decides which key `provider` uses, so a key just saved is never
+ * silently ignored. Names variables, never their values.
+ */
+export declare function savedKeyNotes(provider: string, stored: string, ctx: CommandContext): string[];
+/**
+ * Ask for a direct provider's missing credential: paste an API key, name the
+ * environment variable that holds it, or cancel. The one owner of this
+ * interaction for every selection command, /connect direct and the composer.
+ * Local logins get sign-in help and a custom endpoint gets its setup form.
+ * Nothing is saved until the person confirms a key or a variable, so Cancel
+ * or Escape at any step leaves the config as it was.
+ *
+ * Returns false without asking when nobody can answer (an agent-run command or
+ * headless widgets) or the provider takes no key, so the caller prints its own
+ * message. `onReady` runs once the provider has a usable key.
+ */
+export declare function promptForDirectCredential(provider: string, ctx: CommandContext, onReady: Callback, options?: DirectCredentialPromptOptions): boolean;
+/**
+ * The prompt for a resolved route that cannot build. Only a direct route whose
+ * provider takes a key qualifies; a Router route needs a login instead.
+ */
+export declare function promptForMissingDirectKey(resolved: ResolvedLLMConfig, ctx: CommandContext, onReady: Callback, options?: DirectCredentialPromptOptions): boolean;
+/**
+ * A provider's key choices, as its key row in /config and `/config key
+ * <provider>` offer them: paste a key, name an environment variable, stop
+ * reading a variable or remove the saved key, or cancel. `onDone` runs once,
+ * with the change made or undefined when nothing changed. False, without
+ * asking, when nobody can answer here or the provider takes no API key.
+ */
+export declare function manageApiKey(provider: string, ctx: CommandContext, onDone: (change?: KeyChange) => void | Promise<void>, options?: Pick<DirectCredentialPromptOptions, 'beforeAsk'>): boolean;
+/**
+ * `/config key <provider> NAME`: read the key from the variable NAME, as the
+ * variable choice would. False, without asking, when nobody can answer here.
+ */
+export declare function useApiKeyVariable(provider: string, name: string, ctx: CommandContext, onDone: (change?: KeyChange) => void | Promise<void>): Promise<boolean>;
+/** A key ZTC can remove: one it saved, or a variable named for it. */
+export declare function hasRemovableKey(source: ApiKeySource): boolean;
+/**
+ * `/config key <provider> --remove`: stop reading the variable named for the
+ * key, or forget the saved key, as the key row's remove choice does, without
+ * a question. A custom endpoint's key goes everywhere at once (see removeKey).
+ * Says so when there is nothing to remove; agents cannot use it.
+ */
+export declare function removeApiKey(provider: string, ctx: CommandContext, onDone: (change?: KeyChange) => void | Promise<void>): Promise<void>;
+export {};